Pith. sign in

REVIEW 5 major objections 8 minor 292 references

Context attribution methods give unreliable scores when the model already knows the answer from its weights, and cannot tell in-context evidence from memorized knowledge.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-30 11:54 UTC pith:R2T245MA

load-bearing objection Solid diagnostic kit showing removal-based context attribution breaks under IW overlap; SSP’s near-chance result is partly baked into R_bench, but CAC/BCS still carry the main claim. the 5 major comments →

arxiv 2607.23804 v1 pith:R2T245MA submitted 2026-07-26 cs.CL cs.AI

How Context Attribution Handles What the Model Already Knows

Quoc-Huy Trinh , Lin Zhu , Sebastian Szyller This is my paper
classification cs.CL cs.AI
keywords context attributionin-weight knowledgein-context learningsource separationLLM evaluationWMDP-Cyber++leave-one-outShapley values
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Context attribution tools are meant to show which parts of a prompt actually drive an LLM's answer. This paper shows that when the same facts already live in the model's weights, those tools systematically mis-score the evidence: a truly supporting passage can look unimportant simply because removing it does not change the output. The authors build a controlled test—four new metrics plus a cybersecurity benchmark with known in-weight versus in-context labels—and run four leading methods through it. Rankings shift after the model is taught the material, task-level necessity and sufficiency stay only moderate, and attempts to read source labels off the scores stay near chance. The practical upshot is that today's attribution numbers are hard to trust whenever retrieval and training data overlap, which is the common case in real deployments.

Core claim

Across four representative context-attribution methods, contributive scores become unfaithful under in-weight overlap: after controlled knowledge exposure, ranking consistency falls (CAC typically 0.34–0.56), top-k segments are only moderately necessary and sufficient on a base model (BCS), and adapted source-separation precision stays near random (~0.5). Contributive scores alone therefore cannot disentangle in-context learning from in-weight knowledge.

What carries the argument

An evaluation protocol built on four metrics—BCS (task-level sufficiency and necessity of top-k on a base model), CAC (rank consistency between base and fine-tuned models via RBO), APS (their harmonic mean), and SSP (precision of IW/ICL labels read from scores)—together with WMDP-Cyber++, a benchmark whose context segments carry ground-truth provenance by construction.

Load-bearing premise

That teaching the model the material with LoRA fine-tuning is a fair stand-in for the knowledge that would already sit in its weights from real pretraining, and that simple score thresholds can fairly test whether those methods can separate sources.

What would settle it

Re-run the same four methods on a model whose pretraining corpus is fully known and public, with true overlap segments taken from that corpus rather than from LoRA, and check whether CAC rises substantially above ~0.5 and SSP rises well above chance; if both stay low, the claim holds under real in-weight knowledge.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Low attribution scores cannot be read as ‘irrelevant’ when the same knowledge may already be in the weights.
  • Likelihood-based checks (log-prob drop, LDS) can rank methods highly even when task-level attribution under overlap fails.
  • Systems that discard low-scoring evidence or reward citations from attribution scores risk throwing away or mis-crediting supporting documents.
  • Future attribution methods need primitives that quantify both contextual contribution and parametric coverage, not removal alone.
  • WMDP-Cyber++ and the BCS/CAC/APS/SSP suite give a concrete testbed for any new method that claims source-aware attribution.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Retrieval-augmented generation pipelines that treat attribution scores as trust or citation signals will systematically under-weight documents that duplicate training data.
  • The same failure mode likely affects any removal- or ablation-based explanation method, not only the four tested here.
  • A useful next method would emit two scores per segment—contextual marginal effect and parametric coverage—rather than one scalar.
  • If pretraining data provenance ever becomes auditable, the protocol could be re-run without fine-tuning proxies and would become a stronger acceptance test for attribution tools.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. The paper studies how context-attribution methods (ContextCite, TokenShapley, AttriBoT, TracLLM) behave when the knowledge carried by a context segment is also present in the model's weights. The authors control in-weight (IW) knowledge by LoRA fine-tuning three open models (LLaMA3-8B, Qwen3-8B, Qwen3-32B) on the WMDP cyber-retain corpus, build a provenance-labeled benchmark (WMDP-Cyber++, 1,987 questions with 3 IW + 3 ICL segments each), and propose four metrics: BCS (task-level top-k utility × removal impact on the base model), CAC (RBO ranking consistency between base and fine-tuned models), APS (harmonic mean of the two), and SSP (source-separation precision under a "disentanglement interface" that threshold contributive scores into IW/ICL labels). Headline findings: attribution rankings shift after knowledge exposure (CAC 0.34–0.56), task-level attribution quality is moderate and trades off against consistency, and all methods sit at chance (~0.5) on SSP, from which the authors conclude that contributive scores cannot disentangle IW from ICL sources.

Significance. The phenomenon the paper targets is real and practically important: removal-based attribution is blind to knowledge redundancy, and low contributive scores are genuinely ambiguous between "irrelevant" and "redundant with weights" — a problem for citation-reward mechanisms (e.g., SelfCite) and RAG evidence verification. The paper ships several concrete assets: a provenance-labeled benchmark with documented construction prompts, a controlled-exposure design with verified knowledge acquisition (no-context accuracy 42–54% → 77–97%), a task-level evaluation (BCS) that usefully complements likelihood-based Drop@k/LDS, and robustness checks over RBO persistence. The empirical core — score-mass shifting toward zero after fine-tuning (Figure 3) and rankings changing across knowledge states (Table 1) — is well supported across four methods and three model sizes. However, the most quotable claim (SSP ≈ 0.5 ⟹ "methods cannot disentangle") is substantially entangled with the evaluation's own construction, as detailed in the major comments; if reframed as "contributive scores carry no provenance signal under redundancy," the contribution stands but is more modest.

major comments (5)
  1. [§Proposed evaluation protocol, Eqs. (9)–(10); Figure 2] The near-chance SSP result is close to baked into the evaluation design. R_bench (Eq. 9) retains only questions the fine-tuned model answers correctly with NO context; by construction, then, no context segment — IW- or ICL-labeled — is counterfactually necessary for the response on this subset, so removal/Shapley/surrogate scores for every segment should be near zero (Figure 3 confirms the mass shift toward zero). The disentanglement interface labels low-score segments IW, so on R_bench the interface plausibly collapses to 'predict all IW'; with balanced provenance labels this yields SSP = 0.5 exactly, regardless of any discriminative signal in the scores. The paper never reports the predicted-label distribution, per-class precision, or a confusion matrix, so the reader cannot distinguish 'scores are noise' from 'the interface degenerated on a subset where the decision is undefined.' At
  2. [§Problem statement, criterion C1; §Discussion (contributive vs. corroborative)] There is an internal tension between the paper's adopted definition and its faithfulness criteria. The paper explicitly adopts the contributive (counterfactual) notion of attribution, yet C1 requires a high score for a segment 'whether it is explicitly included ICL or implicitly IW' — i.e., a high score even when the segment's knowledge is fully redundant with the weights and its counterfactual contribution is genuinely zero. Under the contributive definition, a method that lowers the score of a redundant segment is behaving correctly, and CAC's premise ('a segment that contributes still contributes whether or not the knowledge is IW, so its attribution should not change') is false by construction. The interesting and defensible claim is that contributive scores are knowledge-state-dependent and therefore uninterpretable as evidence of textual support; the claim that methods are 'unfaith
  3. [§WMDP-Cyber++ dataset (construction); Eq. (10)] SSP ground truth is corpus provenance (D_train vs. D_forget), not verified usage. An ICL-labeled segment retrieved from D_forget that the model never relies on is still labeled ICL, and a method that correctly infers 'the answer came from the weights, not this segment' is scored wrong. The labels are thus corroborative in the paper's own taxonomy, while the methods and the interface are contributive — a category mismatch that independently pushes SSP toward chance on R_bench (where usage of any segment is nil by selection). A usage-verified variant is feasible within the authors' setup: e.g., test whether supplying only the ICL segments changes the fine-tuned model's answer, or whether only the IW segments suffice, and restrict provenance labels to segments passing such a dependence check. Without this, SSP measures agreement with retrieval provenance, not source separation.
  4. [§Evaluation / Table 1; Figure 2] No uncertainty quantification is provided for any of the four metrics. BCS is computed from aggregate accuracies (Eqs. 3–5), yielding a single point per method/model/k with no resampling-based interval; CAC and SSP are per-sample averages and could easily carry confidence intervals, but none are reported. The text draws comparative conclusions from differences of 0.02–0.05 (e.g., TokenShapley vs. TracLLM APS 0.47 vs. 0.45 on Qwen3-8B at k=3) that are unlikely to survive bootstrap variability over 1,987 questions, and the Drop@k/LDS comparisons in Table 2 have the same issue. Bootstrap CIs over questions (clustered appropriately) should accompany Tables 1–2 and Figure 2.
  5. [§Discussion (Finetuning as a proxy); appendix fine-tuning details] The external validity of the central claim rests on LoRA fine-tuning (r=16, 3 epochs) on the WMDP cyber-retain corpus being a faithful proxy for pretraining-era IW knowledge. Two observations weaken this: (i) base models already answer 42–54% of questions correctly with no context (4-choice MC; chance 25%), so a substantial fraction of 'IW' content is pre-existing and heterogeneous; (ii) the fine-tuned Qwen3-8B reaches 96.8% no-context accuracy, consistent with shallow answer-key memorization rather than integrated knowledge, and shallow knowledge may interact with removal-based attribution differently than pretraining knowledge (e.g., higher no-context log-probability inflates p_empty and the IW proxy in Eqs. 13–14). The authors acknowledge this as future work, but since every headline number is conditioned on this one fine-tuning recipe, at least one robustness run (different rank/epoc
minor comments (8)
  1. [Eq. (6)] BCS is a geometric mean of Util and RmI, both of which can be negative (e.g., rm-topk accuracy exceeding full-ctx accuracy by noise) or exceed 1; the paper does not state whether values are clipped or how undefined cases are handled.
  2. [§Proposed evaluation protocol (SSP)] Dangling cross-reference: 'we describe the detailed process in Section .' — the section number is missing.
  3. [§Evaluation (Metrics)] RBO with persistence ρ=0.5 over only k=6 segments is extremely top-heavy (effective depth ≈ 2); the choice deserves justification beyond the appendix robustness check, and the RBO reference (Webber et al., 2010) is not cited.
  4. [Figure 3] Axes are unlabeled and units differ across panels (some scores appear to be log-probability differences, others normalized); as the key evidence for the score-shift claim, the figure needs labeled axes and a caption stating the x- and y-variables.
  5. [§WMDP-Cyber++ (Step 3)] GPT-4o smoothing with transitional phrases could leak provenance signal (e.g., systematically different connective styles around D_train vs. D_forget segments); a check that a text-only classifier cannot recover provenance from the smoothed context above chance would strengthen the 'ordering carries no provenance signal' claim.
  6. [§Evaluation (TracLLM); appendix] The ensemble weight w_loo = 2.0 is introduced without justification or sensitivity analysis.
  7. [Throughout] Typographical issues: 'suprooting' (Introduction), inconsistent capitalization 'Attribot'/'AttriBoT' (Tables 2–3), 'cannot do the disentanglement' (abstract), 'Further details are provided followed by each method in the appendix' (§Evaluation), and hyphenation artifacts in the abstract ('con- tributive').
  8. [Figure 2] The y-axis spans only 0.40–0.55; the truncation visually amplifies small differences — consider starting at 0 or noting the chance line explicitly.

Circularity Check

1 steps flagged

Primarily evaluative paper with no closed derivation; only mild by-construction pressure in the SSP/R_bench setup, not a load-bearing circular proof.

specific steps
  1. other [In-context/in-weight source separation precision; Eqs. 9–10; Adapting methods for source separation]
    "Rbench={i:pθft(Xi)=Ai∧pθbase(Xi)≠Ai} ... SSP measures the proportion of context segments whose predicted source matches their controlled source label ... a relevant segment whose removal barely affects the response is presumed covered by IW knowledge."

    On R_bench the fine-tuned model already recovers the answer with no context, so by the methods’ removal/perturbation definitions every segment’s contributive score is expected to be near zero/noise. The disentanglement interface then maps low scores to IW. With balanced IW/ICL provenance labels, SSP is pushed toward ~0.5 largely by this joint construction rather than by a strong independent test of source discrimination. This is mild evaluation circularity (result partly baked into the probe), not a derived theorem equal to its inputs; BCS/CAC/APS are unaffected.

full rationale

This paper does not claim a first-principles derivation or a fitted-parameter prediction. Its core contribution is an evaluation protocol (BCS, CAC, APS, SSP), a provenance-labeled benchmark (WMDP-Cyber++), and empirical measurements of four existing attribution methods under controlled IW overlap. Metrics are defined from task accuracy, rank overlap, and labeled source precision, not from the methods’ own training objectives. The authors explicitly note that Drop@k/LDS favor LOO-style scorers by construction and introduce APS as a complementary check—so that known alignment is disclosed, not hidden. Self-citations are ordinary method citations (ContextCite, TracLLM, etc.), not uniqueness theorems by the same authors used to forbid alternatives. The only mild circularity-adjacent issue is that R_bench selects items the fine-tuned model already answers with no context, so removal/Shapley scores are expected to collapse toward noise and the score-threshold disentanglement interface then tends toward chance SSP; that makes the headline SSP≈0.5 partly unsurprising given the probe, but it is a metric-validity concern rather than a derivation that reduces a claimed theorem to its inputs. BCS/CAC/APS comparisons and score-distribution shifts across mechanisms retain independent empirical content. No self-definitional equation chain, no fitted-input-called-prediction, and no load-bearing self-citation uniqueness claim. Score 2 reflects that single mild construction pressure, not a circular paper.

Axiom & Free-Parameter Ledger

6 free parameters · 6 axioms · 5 invented entities

The central negative claim rests on standard LLM/ICL modeling, the identification of removal-based attribution with “contribution,” LoRA fine-tuning as a stand-in for parametric knowledge, retrieval+LLM re-ranking as ground-truth provenance, and author-defined score-to-source interfaces. No new physical entities; free choices are metric hyperparameters and adaptation thresholds.

free parameters (6)
  • RBO persistence ρ = 0.5 (main); 0.8 (ablation)
    Controls top-heaviness of CAC; main results use ρ=0.5 (appendix also ρ=0.8). Ranking-consistency magnitudes depend on this choice even if method order is stable.
  • top-k for BCS (k∈{1,2,3}) = 1, 2, 3
    Defines which attributed segments are tested for sufficiency/necessity; reported per k rather than fitted, but conclusions about method quality depend on k.
  • IW/ICL segment counts and retrieval depth = kiw=kicl=3, kcand=10
    kiw=kicl=3, kcand=10, 500-token chunks with 50-token overlap; balance and difficulty of SSP/BCS depend on these construction choices.
  • Disentanglement thresholds (no-context baseline contrast; uniform mass 1/k) = ICL if sICL share ≥ 0.5 or ρi ≥ 1/k
    Maps scalar attribution scores to IW/ICL labels for SSP; not part of the original methods. Near-chance SSP could partly reflect threshold design.
  • LoRA fine-tuning hyperparameters = r=16, α=64, lr=0.0001, 3 epochs
    r=16, α=64, AdamW lr=1e-4, 3 epochs, architecture-specific target modules; determines how completely Dtrain becomes IW knowledge.
  • TracLLM ensemble weight w_loo = 2.0
    Method hyperparameter in the TracLLM scoring ensemble used during evaluation.
axioms (6)
  • domain assumption Autoregressive LLMs generate Y ~ pθ(Y | C ⊕ X); context attribution assigns scalar importance si = Attr(ci, Y, C, X).
    Standard setup in Background; shared by all evaluated methods.
  • ad hoc to paper A context unit is necessary/sufficient for attribution quality if removing it or using only it changes task-level correctness of the answer, not merely token likelihood.
    Problem statement reframes attribution quality away from likelihood-only metrics toward task accuracy; this is the paper’s evaluative stance (C1).
  • domain assumption Leave-one-out, random-ablation surrogates, and Shapley-style marginal contributions on text are valid primitives for measuring context contribution.
    Assumed by ContextCite, AttriBoT, TracLLM, TokenShapley; the paper critiques their blindness to IW knowledge but still uses them as the object of study.
  • ad hoc to paper LoRA fine-tuning on cyber-retain injects controllable in-weight knowledge comparable in kind to pretraining memorization for the purpose of this evaluation.
    Discussion section “Finetuning as a proxy for in-weight knowledge”; justified by no-context accuracy gains but not proven equivalent to pretraining IW.
  • ad hoc to paper Passages retrieved from Dtrain / Dforget and re-ranked by GPT-4o, then smoothed while preserving markers, yield correct IW vs ICL provenance labels.
    WMDP-Cyber++ construction (Algorithm 1 and Stages 1–3); ground truth for SSP and controlled overlap.
  • standard math Rank-biased overlap and the geometric/harmonic means defining BCS and APS are appropriate summaries of ranking stability and sufficiency–necessity.
    Metric definitions in Proposed evaluation protocol; standard aggregation choices.
invented entities (5)
  • BCS (base-model context attribution score) no independent evidence
    purpose: Measure top-k sufficiency and necessity via task accuracy on a base model without Dtrain knowledge.
    New metric combining Util and RmI as geometric mean; defined only for this protocol.
  • CAC (cross-model context attribution consistency) no independent evidence
    purpose: Measure whether attribution rankings remain stable between base and fine-tuned models via RBO.
    New consistency metric tied to controlled IW exposure.
  • APS (attribution preservation score) no independent evidence
    purpose: Single scalar harmonic mean of BCS and CAC requiring both faithfulness and stability.
    Composite metric introduced to prevent high consistency with wrong rankings.
  • SSP (source separation precision) and disentanglement interface I no independent evidence
    purpose: Score whether attribution outputs can be mapped to IW vs ICL labels on Rbench.
    New diagnostic plus author-defined adapters from scalar scores to source labels.
  • WMDP-Cyber++ benchmark no independent evidence
    purpose: Provide mixed-context multiple-choice items with ground-truth IW/ICL segment provenance.
    New dataset constructed from WMDP cyber retain/forget corpora; labels exist by construction inside this pipeline.

pith-pipeline@v1.2.0-grok45-kimik3 · 22369 in / 4445 out tokens · 82805 ms · 2026-07-30T11:54:29.996926+00:00 · methodology

0 comments
read the original abstract

Context attribution methods for large language models (LLMs) identify which input context contributes to the model response. Recent works show the initial success in attributing the con- tributive score of the contexts. However, we observe that when the context overlaps with the training data, these methods can- not disentangle in-context from in-weight (IW) contributions, producing unreliable scores. Based on this observation, in this work, we introduce: 1) an evaluation protocol that relies on four new metrics (base-model context attribution score (BCS), cross-model context attribution consistency (CAC), attribution preservation score (APS), source separation pre- cision (SSP)) and 2) a benchmark dataset (WMDP-Cyber++) with ground-truth provenance labels to systematically assess attribution under IW overlap. In our experiments across four well-known context attribution methods, we demonstrate that they provide unfaithful attribution when the knowledge from the context also exists in the weights. Finally, we adapt these methods for source separation (IW vs. in-context learning (ICL)) and show that they cannot do the disentanglement based on the contributive score

Figures

Figures reproduced from arXiv: 2607.23804 by Lin Zhu, Quoc-Huy Trinh, Sebastian Szyller.

Figure 1
Figure 1. Figure 1: Current context attribution methods cannot distin [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: SSP on WMDP-Cyber++ dataset across different [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Contributive score distribution shift of different attribution methods on two LLaMA3-8B, Qwen3-8B, and Qwen3-32B. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 5
Figure 5. Figure 5: CAC vs. BCS for four attribution methods across three target models. BCS measures task-level attribution quality at k=1, while CAC measures ranking consistency between the base and finetuned models using RBO with ρ=0.5 and ρ=0.8. The dashed line denotes y=x. The relative comparison between attribution methods re￾mains largely stable across the two values of ρ. Although the absolute CAC values change as dee… view at source ↗
Figure 4
Figure 4. Figure 4: ROC curves for classifying context segments as ICL [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 6
Figure 6. Figure 6: Ranking of attribution methods under Drop@ [PITH_FULL_IMAGE:figures/full_fig_p011_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

292 extracted references · 32 canonical work pages · 11 internal anchors

  1. [1]

    and Agrawal, Ameeta , editor =

    Tao, Yufei and Hiatt, Adam and Haake, Erik and Jetter, Antonie J. and Agrawal, Ameeta , editor =. When. Proceedings of the 2024. 2024 , pages =. doi:10.18653/v1/2024.emnlp-main.234 , abstract =

    work page doi:10.18653/v1/2024.emnlp-main.234 2024

  2. [2]

    Understanding

    Zhao, Jun and Yang, Yongzhuo and Hu, Xiang and Tong, Jingqi and Lu, Yi and Wu, Wei and Gui, Tao and Zhang, Qi and Huang, Xuanjing , month = oct, year =. Understanding

  3. [3]

    Kim, Minsung and Kim, Dong-Kyum and Kwon, Jea and Yang, Nakyeong and Jung, Kyomin and Cha, Meeyoung , editor =. How. Proceedings of the 64th. 2026 , pages =. doi:10.18653/v1/2026.acl-long.1064 , abstract =

    work page doi:10.18653/v1/2026.acl-long.1064 2026

  4. [4]

    Teaching language models to support answers with verified quotes , url =

    Menick, Jacob and Trebacz, Maja and Mikulik, Vladimir and Aslanides, John and Song, Francis and Chadwick, Martin and Glaese, Mia and Young, Susannah and Campbell-Gillingham, Lucy and Irving, Geoffrey and McAleese, Nat , month = mar, year =. Teaching language models to support answers with verified quotes , url =. doi:10.48550/arXiv.2203.11147 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2203.11147

  5. [5]

    doi:10.48550/arXiv.2112.09332 , abstract =

    Nakano, Reiichiro and Hilton, Jacob and Balaji, Suchir and Wu, Jeff and Ouyang, Long and Kim, Christina and Hesse, Christopher and Jain, Shantanu and Kosaraju, Vineet and Saunders, William and Jiang, Xu and Cobbe, Karl and Eloundou, Tyna and Krueger, Gretchen and Button, Kevin and Knight, Matthew and Chess, Benjamin and Schulman, John , month = jun, year ...

    Pith/arXiv arXiv doi:10.48550/arxiv.2112.09332

  6. [6]

    OpenAI and Hurst, Aaron and Lerer, Adam and Goucher, Adam P. and. 2024 , note =. doi:10.48550/arXiv.2410.21276 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2410.21276 2024

  7. [7]

    Zhang, Yanzhao and Li, Mingxin and Long, Dingkun and Zhang, Xin and Lin, Huan and Yang, Baosong and. Qwen3. 2025 , note =. doi:10.48550/arXiv.2506.05176 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2506.05176 2025

  8. [8]

    Yang, An and Li, Anfeng and Yang, Baosong and Zhang, Beichen and Hui, Binyuan and. Qwen3. 2025 , note =. doi:10.48550/arXiv.2505.09388 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2505.09388 2025

  9. [9]

    Yang, An and Yang, Baosong and Hui, Binyuan and Zheng, Bo and Yu, Bowen and. Qwen2. 2024 , note =. doi:10.48550/arXiv.2407.10671 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2407.10671 2024

  10. [10]

    Llama 2:

    Touvron, Hugo and Martin, Louis and Stone, Kevin and Albert, Peter and Almahairi, Amjad and. Llama 2:. 2023 , note =. doi:10.48550/arXiv.2307.09288 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2307.09288 2023

  11. [11]

    2023 , note =

    Touvron, Hugo and Lavril, Thibaut and lzacard, Gautier and Martinet, Xavier and. 2023 , note =. doi:10.48550/arXiv.2302.13971 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2302.13971 2023

  12. [12]

    Grattafiori, Aaron and Dubey, Abhimanyu and Jauhri, Abhinav and Goyal, Anirudh and others , month = nov, year =. The. doi:10.48550/arXiv.2407.21783 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2407.21783

  13. [13]

    Guo, Zhixiang and Liang, Siyuan and Balogh, Andras and Lunberry, Noah and Tu, Rong-Cheng and Jelasity, Mark and Tao, Dacheng , month = feb, year =. When. doi:10.48550/arXiv.2602.18739 , abstract =

    doi:10.48550/arxiv.2602.18739

  14. [14]

    Unifying

    Worledge, Theodora and Shen, Judy Hanwen and Meister, Nicole and Winston, Caleb and Guestrin, Carlos , month = nov, year =. Unifying. doi:10.48550/arXiv.2311.12233 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2311.12233

  15. [15]

    Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy

    Saxena, Aman and Schuchardt, Jan and Scholten, Yan and Günnemann, Stephan , month = may, year =. Provable. doi:10.48550/arXiv.2605.21780 , abstract =

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2605.21780

  16. [16]

    , editor =

    Chuang, Yung-Sung and Qiu, Linlu and Hsieh, Cheng-Yu and Krishna, Ranjay and Kim, Yoon and Glass, James R. , editor =. Lookback. Proceedings of the 2024. 2024 , pages =. doi:10.18653/v1/2024.emnlp-main.84 , abstract =

    doi:10.18653/v1/2024.emnlp-main.84 2024

  17. [17]

    Transactions of the Association for Computational Linguistics , author =

    Natural. Transactions of the Association for Computational Linguistics , author =. 2019 , pages =. doi:10.1162/tacl_a_00276 , abstract =

    doi:10.1162/tacl_a_00276 2019

  18. [18]

    doi:10.48550/ARXIV.1611.09268 , abstract =

    Bajaj, Payal and Campos, Daniel and Craswell, Nick and Deng, Li and Gao, Jianfeng and Liu, Xiaodong and Majumder, Rangan and McNamara, Andrew and Mitra, Bhaskar and Nguyen, Tri and Rosenberg, Mir and Song, Xia and Stoica, Alina and Tiwary, Saurabh and Wang, Tong , year =. doi:10.48550/ARXIV.1611.09268 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.1611.09268

  19. [19]

    Decoupled

    Loshchilov, Ilya and Hutter, Frank , month = jan, year =. Decoupled. doi:10.48550/arXiv.1711.05101 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.1711.05101

  20. [20]

    and Choi, Eunsol and Collins, Michael and Garrette, Dan and Kwiatkowski, Tom and Nikolaev, Vitaly and Palomaki, Jennimaria , editor =

    Clark, Jonathan H. and Choi, Eunsol and Collins, Michael and Garrette, Dan and Kwiatkowski, Tom and Nikolaev, Vitaly and Palomaki, Jennimaria , editor =. Transactions of the Association for Computational Linguistics , publisher =. 2020 , pages =. doi:10.1162/tacl_a_00317 , abstract =

    doi:10.1162/tacl_a_00317 2020

  21. [21]

    and Manning, Christopher D

    See, Abigail and Liu, Peter J. and Manning, Christopher D. , month = apr, year =. Get. doi:10.48550/arXiv.1704.04368 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.1704.04368

  22. [22]

    , editor =

    Yang, Zhilin and Qi, Peng and Zhang, Saizheng and Bengio, Yoshua and Cohen, William and Salakhutdinov, Ruslan and Manning, Christopher D. , editor =. Proceedings of the 2018. 2018 , pages =. doi:10.18653/v1/D18-1259 , abstract =

    doi:10.18653/v1/d18-1259 2018

  23. [23]

    Liu, Fengyuan and Kandpal, Nikhil and Raffel, Colin , month = oct, year =

  24. [24]

    Probing for Knowledge Attribution in Large Language Models

    Brink, Ivo and Boer, Alexander and Ulmer, Dennis , month = feb, year =. Probing for. doi:10.48550/arXiv.2602.22787 , abstract =

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2602.22787

  25. [25]

    ACM Comput

    When. ACM Comput. Surv. , author =. 2021 , pages =. doi:10.1145/3436755 , abstract =

    doi:10.1145/3436755 2021

  26. [26]

    ACM Comput

    Fairness in. ACM Comput. Surv. , author =. 2024 , pages =. doi:10.1145/3616865 , abstract =

    doi:10.1145/3616865 2024

  27. [27]

    Parasites in the toolchain: a large-scale analysis of attacks on the

    Zhao, Shuli and Hou, Qinsheng and Zhan, Zihan and Wang, Yanhao and Xie, Yuchong and Guo, Yu and Chen, Libo and Li, Shenghong and Xue, Zhi , year =. Parasites in the toolchain: a large-scale analysis of attacks on the

  28. [28]

    Machine Learning , author =

    Training data influence analysis and estimation: a survey , volume =. Machine Learning , author =. 2024 , pages =. doi:10.1007/s10994-023-06495-7 , abstract =

    doi:10.1007/s10994-023-06495-7 2024

  29. [29]

    The fourteenth international conference on learning representations , publisher =

    Laban, Philippe and Hayashi, Hiroaki and Zhou, Yingbo and Neville, Jennifer , year =. The fourteenth international conference on learning representations , publisher =

  30. [30]

    Data poisoning against differentially-private learners: attacks and defenses , isbn =

    Ma, Yuzhe and Zhu, Xiaojin and Hsu, Justin , month = aug, year =. Data poisoning against differentially-private learners: attacks and defenses , isbn =. Proceedings of the 28th

  31. [31]

    Wang, Yanting and Zou, Wei and Geng, Runpeng and Jia, Jinyuan , year =

  32. [32]

    Learning to

    Cohen-Wang, Benjamin and Chuang, Yung-Sung and Madry, Aleksander , month = apr, year =. Learning to. doi:10.48550/arXiv.2504.13752 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2504.13752

  33. [33]

    DarkSAM: Fooling Segment Anything Model to Segment Nothing

    Zhou, Ziqi and Song, Yufei and Li, Minghui and Hu, Shengshan and Wang, Xianlong and Zhang, Leo Yu and Yao, Dezhong and Jin, Hai , month = sep, year =. doi:10.48550/arXiv.2409.17874 , abstract =

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2409.17874

  34. [34]

    Detecting

    Tramer, Florian , month = jun, year =. Detecting. Proceedings of the 39th

  35. [35]

    Proceedings of the AAAI Conference on Artificial Intelligence , author =

    Certified but. Proceedings of the AAAI Conference on Artificial Intelligence , author =. 2026 , pages =. doi:10.1609/aaai.v40i12.37924 , abstract =

    work page doi:10.1609/aaai.v40i12.37924 2026

  36. [36]

    Context versus

    Du, Kevin and Snæbjarnarson, Vésteinn and Stoehr, Niklas and White, Jennifer and Schein, Aaron and Cotterell, Ryan , editor =. Context versus. Proceedings of the 62nd. 2024 , pages =. doi:10.18653/v1/2024.acl-long.714 , abstract =

    doi:10.18653/v1/2024.acl-long.714 2024

  37. [37]

    Attributing

    Li, Ruizhe and Chen, Chen and Hu, Yuchen and Gao, Yanjun and Wang, Xi and Yilmaz, Emine , month = feb, year =. Attributing. doi:10.48550/arXiv.2505.16415 , abstract =

    doi:10.48550/arxiv.2505.16415

  38. [38]

    Differential

    Xu, Ruichen and Chen, Kexin , month = mar, year =. Differential. doi:10.48550/arXiv.2603.04881 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2603.04881

  39. [39]

    and Jagielski, Matthew and Kairouz, Peter and Koyejo, Sanmi and Liang, Percy and Papernot, Nicolas , month = jun, year =

    Liu, Ken and Choquette-Choo, Christopher A. and Jagielski, Matthew and Kairouz, Peter and Koyejo, Sanmi and Liang, Percy and Papernot, Nicolas , month = jun, year =. Language

  40. [41]

    Understanding the

    Javanmard, Adel and Mirzasoleiman, Baharan and Mirrokni, Vahab , month = oct, year =. Understanding the

  41. [42]

    Efficient

    Kaya, Mehmet Onurcan and Elliott, Desmond and Papadopoulos, Dim , month = oct, year =. Efficient

  42. [43]

    Muennighoff, Niklas and Yang, Zitong and Shi, Weijia and Li, Xiang Lisa and Fei-Fei, Li and Hajishirzi, Hannaneh and Zettlemoyer, Luke and Liang, Percy and Candes, Emmanuel and Hashimoto, Tatsunori , month = mar, year =. s1:

  43. [44]

    Chen, Peter Baile and Zhang, Yi and Roth, Dan and Madden, Samuel and Andreas, Jacob and Cafarella, Mike , month = oct, year =. Log-

  44. [45]

    arXiv.org , author =

    Whose. arXiv.org , author =

  45. [46]

    arXiv.org , author =

    Can. arXiv.org , author =

  46. [47]

    arXiv.org , author =

    Adversarial. arXiv.org , author =

  47. [48]

    and Kang, Feiyang and Song, Dawn , month = oct, year =

    Jia, Ruoxi and Oala, Luis and Xiong, Wenjie and Ge, Suqin and Wang, Jiachen T. and Kang, Feiyang and Song, Dawn , month = oct, year =. A

  48. [49]

    Hayes, Jamie and Shumailov, Ilia and Choquette-Choo, Christopher A. and Jagielski, Matthew and Kaissis, Georgios and Nasr, Milad and Annamalai, Meenatchi Sundaram Muthu Selva and Mireshghallah, Niloofar and Shilov, Igor and Meeus, Matthieu and Montjoye, Yves-Alexandre de and Lee, Katherine and Boenisch, Franziska and Dziedzic, Adam and Cooper, A. Feder , ...

  49. [50]

    Proceedings on Privacy Enhancing Technologies , author =

    Revealing the. Proceedings on Privacy Enhancing Technologies , author =

  50. [51]

    Monteiro Paes, Lucas and Wei, Dennis and Do, Hyo Jin and Strobelt, Hendrik and Luss, Ronny and Dhurandhar, Amit and Nagireddy, Manish and Natesan Ramamurthy, Karthikeyan and Sattigeri, Prasanna and Geyer, Werner and Ghosh, Soumya , editor =. Multi-. Proceedings of the 63rd. 2025 , pages =. doi:10.18653/v1/2025.acl-long.1553 , abstract =

    doi:10.18653/v1/2025.acl-long.1553 2025

  51. [52]

    Liu, Yepeng and Zhao, Xuandong and Song, Dawn and Bu, Yuheng , month = jul, year =. Dataset

  52. [53]

    Advances in Neural Information Processing Systems , author =

    Navigating the. Advances in Neural Information Processing Systems , author =. 2024 , pages =. doi:10.52202/079017-3032 , language =

    work page doi:10.52202/079017-3032 2024

  53. [54]

    Beurer-Kellner, Luca and Buesser, Beat and Creţu, Ana-Maria and Debenedetti, Edoardo and Dobos, Daniel and Fabian, Daniel and Fischer, Marc and Froelicher, David and Grosse, Kathrin and Naeff, Daniel and Ozoani, Ezinwanne and Paverd, Andrew and Tramèr, Florian and Volhejn, Václav , month = jun, year =. Design. doi:10.48550/arXiv.2506.08837 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2506.08837

  54. [55]

    Proceedings of the AAAI Conference on Artificial Intelligence , author =

    An. Proceedings of the AAAI Conference on Artificial Intelligence , author =. 2026 , pages =. doi:10.1609/aaai.v40i26.39373 , abstract =

    work page doi:10.1609/aaai.v40i26.39373 2026

  55. [56]

    Watermark

    Chang, Hongyan and Hassani, Hamed and Shokri, Reza , editor =. Watermark. Findings of the. 2025 , pages =. doi:10.18653/v1/2025.findings-emnlp.264 , abstract =

    work page doi:10.18653/v1/2025.findings-emnlp.264 2025

  56. [57]

    Bounding-

    Koda, Satoru and Morikawa, Ikuya , editor =. Bounding-. Machine. 2026 , pages =. doi:10.1007/978-3-032-06096-9_17 , abstract =

    work page doi:10.1007/978-3-032-06096-9_17 2026

  57. [58]

    Protecting

    Li, Zongjie and Wang, Chaozheng and Wang, Shuai and Gao, Cuiyun , month = nov, year =. Protecting. Proceedings of the 2023. doi:10.1145/3576915.3623120 , abstract =

    arXiv 2023

  58. [59]

    IACR Communications in Cryptology , author =

    Publicly-. IACR Communications in Cryptology , author =. doi:10.62056/ahmpdkp10 , language =

    doi:10.62056/ahmpdkp10

  59. [60]

    Lun, Li and Feng, Kunyu and Ni, Qinglong and Liang, Ling and Wang, Yuan and Li, Ying and Yu, Dunshan and Cui, Xiaoxin , month = jun, year =. Towards. Proceedings of the

  60. [61]

    Peering into the

    Phukan, Anirudh and Somasundaram, Shwetha and Saxena, Apoorv and Goswami, Koustava and Srinivasan, Balaji Vasan , editor =. Peering into the. Findings of the. 2024 , pages =. doi:10.18653/v1/2024.findings-acl.682 , abstract =

    doi:10.18653/v1/2024.findings-acl.682 2024

  61. [62]

    doi:10.48550/arXiv.2502.09604 , abstract =

    Chuang, Yung-Sung and Cohen-Wang, Benjamin and Shen, Shannon Zejiang and Wu, Zhaofeng and Xu, Hu and Lin, Xi Victoria and Glass, James and Li, Shang-Wen and Yih, Wen-tau , month = jun, year =. doi:10.48550/arXiv.2502.09604 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2502.09604

  62. [63]

    Proceedings of the 1st

    Horovicz, Miriam and Goldshmidt, Roni , editor =. Proceedings of the 1st. 2024 , pages =. doi:10.18653/v1/2024.nlp4science-1.1 , abstract =

    work page doi:10.18653/v1/2024.nlp4science-1.1 2024

  63. [64]

    International

    Agent. International

  64. [65]

    Efficient task-specific data valuation for nearest neighbor algorithms , volume =. Proc. VLDB Endow. , author =. 2019 , pages =. doi:10.14778/3342263.3342637 , abstract =

    arXiv 2019

  65. [66]

    , month = apr, year =

    Jia, Ruoxi and Dao, David and Wang, Boxin and Hubis, Frances Ann and Hynes, Nick and Gürel, Nezihe Merve and Li, Bo and Zhang, Ce and Song, Dawn and Spanos, Costas J. , month = apr, year =. Towards. Proceedings of the

  66. [67]

    Learning multiple layers of features from tiny images , publisher =

    Krizhevsky, Alex and Hinton, Geoffrey and. Learning multiple layers of features from tiny images , publisher =

  67. [68]

    Advances in

    Heusel, Martin and Ramsauer, Hubert and Unterthiner, Thomas and Nessler, Bernhard and Hochreiter, Sepp , year =. Advances in

  68. [69]

    IEEE Signal Processing Magazine , author =

    The. IEEE Signal Processing Magazine , author =. 2012 , pages =. doi:10.1109/MSP.2012.2211477 , abstract =

    arXiv 2012

  69. [70]

    International Journal of Computer Vision , author =

    The. International Journal of Computer Vision , author =. 2020 , pages =. doi:10.1007/s11263-020-01316-z , abstract =

    doi:10.1007/s11263-020-01316-z 2020

  70. [71]

    Horé, Alain and Ziou, Djemel , month = aug, year =. Image. 2010 20th. doi:10.1109/ICPR.2010.579 , abstract =

    doi:10.1109/icpr.2010.579 2010

  71. [72]

    and Ba, Jimmy , month = jan, year =

    Kingma, Diederik P. and Ba, Jimmy , month = jan, year =. Adam:. doi:10.48550/arXiv.1412.6980 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.1412.6980

  72. [73]

    Hanzlik, Lucjan and Zhang, Yang and Grosse, Kathrin and Salem, Ahmed and Augustin, Maximilian and Backes, Michael and Fritz, Mario , year =

  73. [74]

    Refinement

    Chatzikokolakis, Konstantinos and Fernandes, Natasha and Palamidessi, Catuscia , month = dec, year =. Refinement. Journal of Cybersecurity and Privacy , publisher =. doi:10.3390/jcp1010004 , abstract =

    work page doi:10.3390/jcp1010004

  74. [75]

    doi:10.48550/arXiv.2412.05579 , abstract =

    Li, Haitao and Dong, Qian and Chen, Junjie and Su, Huixue and Zhou, Yujia and Ai, Qingyao and Ye, Ziyi and Liu, Yiqun , month = dec, year =. doi:10.48550/arXiv.2412.05579 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2412.05579

  75. [76]

    Generalization

    Liu, Jiaxiang and Oya, Simon and Kerschbaum, Florian , month = oct, year =. Generalization. doi:10.48550/arXiv.2110.05524 , abstract =

    Pith/arXiv arXiv doi:10.48550/arxiv.2110.05524

  76. [78]

    and Szyller, Sebastian , month = jun, year =

    Spoczynski, Marcin and Melara, Marcela S. and Szyller, Sebastian , month = jun, year =. Atlas:. 2025. doi:10.1109/EuroSPW67616.2025.00058 , abstract =

    arXiv 2025

  77. [79]

    Transactions on Machine Learning Research , author =

    On the. Transactions on Machine Learning Research , author =

  78. [80]

    , month = apr, year =

    Atli Tekgul, Buse Gul and Asokan, N. , month = apr, year =. On the. Proceedings of the 2022. doi:10.1145/3510548.3519376 , abstract =

    arXiv 2022

  79. [81]

    Robustness

    Tsipras, Dimitris and Santurkar, Shibani and Engstrom, Logan and Turner, Alexander and Madry, Aleksander , month = sep, year =. Robustness

  80. [82]

    IEEE Transactions on Image Processing , author =

    Image quality assessment: from error visibility to structural similarity , volume =. IEEE Transactions on Image Processing , author =. 2004 , pages =. doi:10.1109/TIP.2003.819861 , abstract =

    arXiv 2004

Showing first 80 references.