Pith. sign in

REVIEW 5 major objections 6 minor 31 references

AgentStealth: Reinforcing Large Language Model for Anonymizing User-generated Text

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that an 8-billion-parameter model fine-tuned to attack its own outputs anonymizes user text better than large cloud-based anonymizers.

desk verdict A sensible pipeline for on-device anonymization, but the headline +12.3% privacy gain is measured against an unnamed attacker that is probably the same model the pipeline was built around. read the letter →

arxiv 2506.22508 v1 pith:5QYX5WO6 submitted 2025-06-26 cs.CL cs.AI

Chenyang Shao , Tianxing Li , Chenhao Pu , Fengli Xu , Yong Li This is my paper · ORCID
classification cs.CLcs.AI
keywords textanonymizationauthorprofilingsmalllanguagemodelsedgedeploymentreinforcementlearningGRPOin-contextcontrastiveprivacy-utilitytrade-off
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a small, locally deployable language model can anonymize user-generated text more effectively than large cloud-based anonymizers by learning against its own ability to infer personal attributes. AgentStealth does this in three stages: an adversarial anonymization workflow that distills contrastive success-failure lessons into a reusable insight memory, supervised fine-tuning that trains the same model both to anonymize and to attack, and reinforcement learning whose reward is the failure of the model's own trained attacker. On two synthetic datasets, the trained 8-billion-parameter model reports anonymization effectiveness of 63.7% versus 56.7% for the strongest baseline, a 12.3% gain, while improving the utility score by 6.8%. If true, this would let privacy-preserving rewriting run directly on phones or edge devices without sending user text to cloud servers.

What carries the argument

The load-bearing mechanism is a self-referential training loop: the model's own supervised-fine-tuned attribute attacker is frozen and reused as the critic that scores anonymizations during reinforcement learning, so the anonymizer is optimized against exactly the inference skills it has learned. Two supporting mechanisms make that loop work: In-context Contrastive Learning, which maintains a rolling memory of generalized insights mined from pairs of failed and successful anonymization attempts, and Adaptive Utility-Aware Control, which injects a warning into the anonymization prompt when BLEU/ROUGE-based utility drops by more than a threshold, steering aggressive rewriting back toward preserving meaning. The reward is $R=\lambda_{RL}R_{anonymity}+(1-\lambda_{RL})R_{utility}$, where $R_{anonymity}$ is 1 when the internal attacker fails to recover the true attribute.

What would settle it

Run the anonymized test outputs through an attribute-inference attacker that took no part in training, such as a separately fine-tuned classifier or a different large language model with its own prompts, and compare how often it recovers the true attributes. If the remaining attack accuracy climbs back toward the un-anonymized baseline, the reported 12.3% anonymization advantage does not transfer to unseen attackers.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that the long-standing trade-off between hiding sensitive attributes and preserving the meaning of a text can be shifted by closing the loop between anonymizer and attacker inside one model. The trained agent, called AgentStealth, is an 8-billion-parameter instruction-tuned model whose training data is produced by an adversarial workflow: a large teacher anonymizes comments, an attacker tries to recover eight attributes (age, gender, location, occupation, education, relationship status, income, birthplace), and the system distills why some rewrites succeeded and others failed into a memory of general insights. Joint supervised fine-tuning then teaches the small model both roles, and a GRPO (group-relative policy optimization) reinforcement-learning stage uses the model's own attack output as the reward signal for anonymization, optionally balanced with utility. The paper reports that this pipeline reaches 63.7% anonymity (the fraction of attributes the attacker fails to recover) and a utility score of 0.79, beating the adversarial-anonymization baseline by 12.3% and 6.8% respectively, and that the fine-tuned small model's attack accuracy is comparable to the larger teacher's.

Load-bearing premise

The headline privacy numbers assume that the particular AI model used to attack the anonymized texts is representative of all real-world attackers, so a different attacker model could undo much of the measured gain.

Editorial extensions

If this is right

  • An 8-billion-parameter model trained this way can anonymize posts on-device, eliminating cloud upload and its transmission risks.
  • The same model's dual-role training makes the reinforcement-learning stage self-contained, since no separate external attacker or reward model is needed at training time.
  • The framework also improves inference-only use of a large model, with the workflow alone gaining 1.1% anonymity and 6.2% utility over the adversarial-anonymization baseline.
  • At a fixed anonymity level of 50%, the method keeps about 8.6% more utility than the baseline, and at a fixed utility of 0.85 it gains about 16.9% more anonymity.
  • The fine-tuned small model reaches attack accuracy around 65%, matching the larger teacher, indicating that it has learned strong attribute inference rather than merely copying rewritten text.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: because both training data and the attack signal come from the same model family, the reported gain may overstate transfer to attackers built from a different model family; an independent attacker benchmark would reveal the gap.
  • Editorial: the anonymity metric counts only whether the top-1 attribute guess is wrong, so a real-world attacker that uses top-k guesses or confidence scores could still leak attributes even at 63.7% reported anonymity.
  • Editorial: the contrastive insight memory is frozen after training, but in a deployed edge setting the model could keep updating it with local successes and failures, making the method a lifelong learner if privacy-safe accumulation is designed.
  • Editorial: the synthetic training data covers only eight coarse attributes, while real user text contains richer identity cues such as dialect, topic interests, and social ties, so a more granular attribute taxonomy and human-written data would be a natural next stress test.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes AgentStealth, a three-stage framework for training a locally deployable small language model (Llama-3.1-8B-Instruct) to anonymize user-generated text. Stage 1 builds an adversarial anonymization workflow using DeepSeek-V3, enriched with in-context contrastive learning from success/failure pairs and adaptive utility-aware prompting; Stage 2 uses the collected anonymization and attack dialogues for joint supervised fine-tuning; Stage 3 applies GRPO reinforcement learning with a reward that combines the model's own SFT-trained attacker's failure rate with a utility term. On a 200-sample synthetic test set, the paper reports that AgentStealth outperforms the Adversarial Anonymization (AA) baseline by 12.3% in Anonymity and 6.8% in Score Utility, and concludes that an 8B on-device model can achieve a competitive privacy-utility trade-off without cloud reliance.

Significance. If the reported results are robust, the contribution is significant: an on-device anonymization model with a privacy-utility trade-off competitive with cloud-based LLMs would address a real deployment bottleneck, and the three-stage self-reinforcing pipeline (contrastive insight memory, joint SFT, RL with self-adversarial rewards) is a plausible and interesting recipe. The open-source release and the use of only synthetic data are also strengths. However, the evaluation as written does not yet establish the central claim: the attacker used for the headline Anonymity metric is never identified, the only trained attacker is the model's own SFT attacker, the test split is non-random and small with no error bars, and the appendix containing the SFT ablation is corrupted. These issues make the +12.3% anonymity gain an estimate whose generality across adversaries is unmeasured, so the headline result should be treated as promising but not yet supported.

major comments (5)
  1. [§5.2, Table 1; §4.3, Eq. (10)] The Anonymity metric in Table 1 is undefined with respect to the evaluator. Section 5.2 defines Anonymity as 'the proportion of attributes where the top-1 predicted entity in the fifth stage anonymized outputs diverges from ground truth' but never states which model produces the prediction. The only attacker used in supervision is the model's own SFT attacker in Eq. (10), and the workflow that generates training data uses DeepSeek-V3 (Sections 4.1 and 5.1), which is also the named judge for Readability and Meaning in Section 5.2. If Table 1's Anonymity is computed with DeepSeek-V3, the +12.3% improvement over AA is partially a fitted value against the same model family that generated the training signal rather than a transferable privacy estimate. Please name the attacker model for every reported Anonymity value and add an evaluation with at least one held-out adversary not used in data generation or reward (e.g., GPT-4o, Claude, or Llama-3.1-70B).
  2. [§5.1] The test split takes the first 100 samples from each dataset (200 total). This is a non-random, order-dependent split and may not represent the data distribution; combined with the absence of error bars or significance tests in Tables 1 and 2, the headline differences (12.3% anonymity, 6.8% utility) have no quantified uncertainty. Use a random stratified split (or multiple seeds) and report bootstrap confidence intervals or paired significance tests for the main comparisons.
  3. [Appendix A.4, Figure 7] The promised 'Comprehensive evaluation of SFT' does not contain the actual results: Figure 7 is rendered as a sequence of encoded tokens (/uni00000027/...), and the text asserts 'SFT can significantly improve anonymization performance by 19.2%' without readable supporting data. Since Section 5.3 explicitly refers readers to this appendix for the SFT ablation, the evidence base for the SFT contribution is currently missing. Provide a proper table or figure with the SFT anonymization and utility numbers.
  4. [§5.3, Table 1] The abstract and Section 1 claim a 6.8% utility improvement 'over baseline methods,' but the 6.8% figure is relative only to AA (0.74 to 0.79). Standard Prompt achieves ScoreUtility 0.92, which is 14% higher than AgentStealth's 0.79; the paper never discusses this gap. The utility claim should be restricted to the AA comparison, and the paper should discuss the utility loss relative to non-adversarial prompting.
  5. [§5.4] The sentence 'our workflow demonstrates statistically significant superiority' is unsupported; no test statistic, p-value, or confidence interval is provided. With a 200-sample test set and no reported variance, the reader cannot verify the statistical significance of small differences such as the 1.1% anonymity gain (66.4% vs 65.7%). Please specify the statistical test used and report the corresponding dispersion measures.
minor comments (6)
  1. [A.5] The heading 'Details of GRPO Algrothm' contains a typo; it should read 'Algorithm'.
  2. [§4.3, Eq. (9)] Equation (9) says Rutility is 'as defined previously (Equation 2),' but U is defined in Section 4.1.2, not in Equation (2). Please correct the cross-reference.
  3. [§5.2, A.6] The attack prompt in Appendix A.6 asks the model for top-3 guesses, while Anonymity uses 'top-1 predicted entity'; clarify how the top-1 prediction is extracted from the output format and whether the other guesses are considered.
  4. [§5.2] The Progress metric ('proportion of attributes that exhibit enhanced privacy preservation compared to their original unprotected forms') is not formally defined; specify how 'enhanced' is determined and how it is computed.
  5. [§5.6, Figure 4] The human evaluation lacks details on the number of participants, the number of texts judged, and whether the reported 45.0%/54.0% values are pairwise win rates; without this information the human result is not interpretable.
  6. [References] Reference [12] lists 'Hanna Yukhymenko and [Additional Authors]' and is incomplete; please provide the full author list.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the training/evaluation loop is attacker-dependent but not equivalent by construction

full rationale

The paper's derivations are self-contained: SFT and RL objectives (Eqs. 8-11) optimize anonymization and attack objectives on synthetic data, and the final evaluation is on held-out test texts with standard attack-failure and utility metrics. The largest potential concern is that the Anonymity metric in Section 5.2 never names the attacker, while DeepSeek-V3 is used both to construct the workflow data and to score readability/meaning; if DeepSeek-V3 (or the SFT-trained attacker derived from it) also computes Table 1's Anonymity, the measured privacy gain is attacker-specific and may overstate transfer to unseen adversaries. This is a reporting and generalization gap, not a definitional circularity: the reported number is still an empirical attack-failure rate on held-out inputs, and the relative comparison against AA and Azure is fair for that attacker. Utility, readability/meaning, and human-evaluation results are independent of the adversary. Self-citations (e.g., [14,15,25]) are background only; the load-bearing adversarial-anonymization setup is attributed to Staab et al. [4,9]. The paper's own stated limitation (A.8.1) is dataset scarcity, which is orthogonal to circularity. No equation reduces to its own input, and no fitted parameter is renamed as a prediction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on dataset representativeness, a fixed adversary assumption, and several hand-set hyperparameters; the paper reports only some values. No new physical or conceptual entities are proposed; the insight memory, contrastive learning, and adaptive prompts are algorithmic components, not independent postulates.

free parameters (5)
  • lambda_RL = 0.5
    Trade-off weight in reward Eq. (9); set by default with no sensitivity analysis, directly shapes the optimization target.
  • lambda = not reported
    Privacy-utility weight in objective Eq. (2); introduced to define the task but no experimental value is given.
  • tau_U = not reported
    Utility degradation threshold in adaptive prompting Eq. (7); triggers corrective prompts, hand-set without stated value.
  • M_max = not reported
    Cap on insight memory size in Eq. (6); controls how much contrastive knowledge is retained, value unspecified.
  • N (adversarial rounds) = 5 (implied)
    Number of anonymization-attack interaction rounds; metrics use 'fifth stage' outputs, so N=5 is used to produce the main results.
assumptions (5)
  • domain assumption Synthetic datasets (SynthPAI Reddit and Staab et al. Q&A) are representative of real user-generated content for author-profiling attacks and anonymization.
    Section 5.1 states both datasets are synthetic with properties comparable to real content; the paper relies on this to make claims about practical privacy protection.
  • domain assumption DeepSeek-V3 acts as a strong, representative adversary; anonymization that fools it will fool other attackers.
    The workflow uses DeepSeek-V3 as the attacker, and evaluation does not include an independent attacker; Section 5.2 and Section 4.3.
  • domain assumption A model's own fine-tuned attacker provides meaningful reward signals that improve anonymization against external adversaries.
    Section 4.3: the RL stage uses M'_attack as the reward source; the paper assumes self-play improves robustness rather than merely overfitting to the internal attacker.
  • domain assumption Utility metrics (BLEU, ROUGE, LLM readability/meaning scores) capture the qualities users care about in anonymized text.
    Section 5.2 defines Score Utility from these components; no user-study validation connects them to actual communicative intent.
  • standard math GRPO (Eq. 11) is a valid optimization procedure with stated properties.
    Section 4.3 and Appendix A.5 adopt GRPO from DeepSeekMath without proof; treated as background.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AgentStealth: Reinforcing Large Language Model for Anonymizing User-generated Text." pith.science (2026). https://pith.science/paper/5QYX5WO6

@misc{pith2026250622508,
  author       = {Pith},
  title        = {Pith review of: AgentStealth: Reinforcing Large Language Model for Anonymizing User-generated Text},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5QYX5WO6}},
  note         = {Machine review of arXiv:2506.22508}
}
read the original abstract

In today's digital world, casual user-generated content often contains subtle cues that may inadvertently expose sensitive personal attributes. Such risks underscore the growing importance of effective text anonymization to safeguard individual privacy. However, existing methods either rely on rigid replacements that damage utility or cloud-based LLMs that are costly and pose privacy risks. To address these issues, we explore the use of locally deployed smaller-scale language models (SLMs) for anonymization. Yet training effective SLMs remains challenging due to limited high-quality supervision. To address the challenge, we propose AgentStealth, a self-reinforcing LLM anonymization framework.First, we introduce an adversarial anonymization workflow enhanced by In-context Contrastive Learning and Adaptive Utility-Aware Control. Second, we perform supervised adaptation of SLMs using high-quality data collected from the workflow, which includes both anonymization and attack signals. Finally, we apply online reinforcement learning where the model leverages its internal adversarial feedback to iteratively improve anonymization performance. Experiments on two datasets show that our method outperforms baselines in both anonymization effectiveness (+12.3%) and utility (+6.8%). Our lightweight design supports direct deployment on edge devices, avoiding cloud reliance and communication-based privacy risks. Our code is open-source at https://github.com/tsinghua-fib-lab/AgentStealth.

Figures

Figures reproduced from arXiv: 2506.22508 by the authors.

Figure 1
Figure 1. A Set of Success and Failure Examples Illustrating LLM-based Method [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Illustration of AgentStealth Framework. Learning, which systematically extracts knowledge from historical outcomes to enhance future anonymization performance. During the data construction phase, we have already divided the dataset into batches and apply the full adversarial anonymization and attack pipeline. Let the protection status of a text t with sensitive attribute a, anonymized as t˜, be defined as: S(t, a,t˜… view at source ↗
Figure 3
Figure 3. RL Reward Curve (SFT vs. Non-SFT) 45.0% 54.0% Azure AA AgentStealth [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Privacy-Utility Trade-off DeepSeek Llama Llama+SFT Llama+SFT+RL Llama+RL 40.0% 45.0% 50.0% 55.0% 60.0% 65.0% 70.0% AttackAcc 64% 50% 63% 65% 56% Attack Accuracy Comparison [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 7
Figure 7. Figure 7: Effectiveness of SFT. To evaluate the effectiveness of the second-stage SFT, we conducted a comparative analysis between the original Llama3.1-8b-instruct model before SFT and the model after SFT. The evaluation was carried out from two dimensions: anonymity and utilit…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 23 canonical work pages

  1. [1]

    General data protection regulation (gdpr) – legal text

    European Union. General data protection regulation (gdpr) – legal text. https://gdpr-info. eu/, 2016. Accessed: 2025-05-15

    work page 2016

  2. [2]

    Chatgpt has been turned into a social media surveillance assistant, 2023

    Thomas Brewster. Chatgpt has been turned into a social media surveillance assistant, 2023

    work page 2023

  3. [3]

    Aligning llms with individual preferences via interaction

    Shujin Wu, Yi R Fung, Cheng Qian, Jeonghwan Kim, Dilek Hakkani-Tur, and Heng Ji. Aligning llms with individual preferences via interaction. In Proceedings of the 31st International Conference on Computational Linguistics, pages 7648–7662, 2025

    work page 2025

  4. [4]

    Beyond memorization: Violating privacy via inference with large language models

    Robin Staab, Mark Vero, Mislav Balunovi ´c, and Martin Vechev. Beyond memorization: Violating privacy via inference with large language models. In International Conference on Learning Representations 2024, 2024

    work page 2024

  5. [5]

    Guide to protecting the confidentiality of personally identifiable information (pii)

    Erika McCallister, Timothy Grance, and Karen Scarfone. Guide to protecting the confidentiality of personally identifiable information (pii). Special Publication 800-122, National Institute of Standards and Technology, Gaithersburg, MD, 2010

    work page 2010

  6. [6]

    Get serious about cybersecurity, 2025

    Presidio. Get serious about cybersecurity, 2025

    work page 2025

  7. [7]

    What is azure ai language - azure ai services, July 2023

    Aahill. What is azure ai language - azure ai services, July 2023. Accessed: 2025-05-12

    work page 2023

  8. [8]

    Incognitext: Privacy-enhancing conditional text anonymization via llm-based private attribute randomization

    Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka, Ricardo Mendes, Xue Jiang, and Xuebing Zhou. Incognitext: Privacy-enhancing conditional text anonymization via llm-based private attribute randomization. In Neurips Safe Generative AI Workshop 2024, 2024

    work page 2024

Show all 31 references
  1. [9]

    Language models are advanced anonymizers

    Robin Staab, Mark Vero, Mislav Balunovic, and Martin Vechev. Language models are advanced anonymizers. In The Thirteenth International Conference on Learning Representations, 2025

    2025

  2. [10]

    Confidential prompting: Protecting user prompts from cloud llm providers, 2025

    In Gim, Caihua Li, and Lin Zhong. Confidential prompting: Protecting user prompts from cloud llm providers, 2025

    2025

  3. [11]

    Expel: Llm agents are experiential learners

    Andrew Zhao, Daniel Huang, Quentin Xu, Matthieu Lin, Yong-Jin Liu, and Gao Huang. Expel: Llm agents are experiential learners. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 19632–19642, 2024

    2024

  4. [12]

    A synthetic dataset for personal attribute inference

    Hanna Yukhymenko and [Additional Authors]. A synthetic dataset for personal attribute inference. In Advances in Neural Information Processing Systems, volume 37, pages 120735– 120779. Curran Associates, Inc., 2024. NeurIPS 2024

    2024

  5. [13]

    A survey on large language model (llm) security and privacy: The good, the bad, and the ugly

    Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing, page 100211, 2024

    2024

  6. [14]

    Division-of-thoughts: Harnessing hybrid language model synergy for efficient on-device agents

    Chenyang Shao, Xinyuan Hu, Yutang Lin, and Fengli Xu. Division-of-thoughts: Harnessing hybrid language model synergy for efficient on-device agents. In Proceedings of the ACM on Web Conference 2025, pages 1822–1833, 2025

    2025

  7. [15]

    Limp: Large language model enhanced intent-aware mobility prediction

    Songwei Li, Jie Feng, Jiawei Chi, Xinyuan Hu, Xiaomeng Zhao, and Fengli Xu. Limp: Large language model enhanced intent-aware mobility prediction. arXiv preprint arXiv:2408.12832, 2024

    2024 arXiv

  8. [16]

    A survey on responsible llms: Inherent risk, malicious use, and mitigation strategy

    Huandong Wang, Wenjie Fu, Yingzhou Tang, Zhilong Chen, Yuxi Huang, Jinghua Piao, Chen Gao, Fengli Xu, Tao Jiang, and Yong Li. A survey on responsible llms: Inherent risk, malicious use, and mitigation strategy. arXiv preprint arXiv:2501.09431, 2025. 10

    2025 arXiv

  9. [17]

    Propile: probing privacy leakage in large language models

    Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. Propile: probing privacy leakage in large language models. In Proceedings of the 37th Interna- tional Conference on Neural Information Processing Systems, pages 20750–20762, 2023

    2023

  10. [18]

    User inference attacks on large language models

    Nikhil Kandpal, Krishna Pillutla, Alina Oprea, Peter Kairouz, Christopher Choquette-Choo, and Zheng Xu. User inference attacks on large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 18238–18265, 2024

    2024

  11. [19]

    Unveiling privacy risks in llm agent memory

    Bo Wang, Weiyi He, Pengfei He, Shenglai Zeng, Zhen Xiang, Yue Xing, and Jiliang Tang. Unveiling privacy risks in llm agent memory. CoRR, 2025

    2025

  12. [20]

    Cogenesis: A framework collaborating large and small language models for secure context-aware instruction following

    Kaiyan Zhang, Jianyu Wang, Ermo Hua, Biqing Qi, Ning Ding, and Bowen Zhou. Cogenesis: A framework collaborating large and small language models for secure context-aware instruction following. In Proceedings of the 62nd Annual Meeting of the Association for Computational Lingui...

    2024

  13. [21]

    Latticegen: Hiding generated text in a lattice for privacy-aware large language model generation on cloud

    Mengke Zhang, Tianxing He, Tianle Wang, Lu Mi, Niloofar Mireshghallah, Binyi Chen, Hao Wang, and Yulia Tsvetkov. Latticegen: Hiding generated text in a lattice for privacy-aware large language model generation on cloud. In Findings of the Association for Computational Linguist...

    2024

  14. [22]

    Privacyasst: Safeguarding user privacy in tool-using large language model agents

    Xinyu Zhang, Huiyu Xu, Zhongjie Ba, Zhibo Wang, Yuan Hong, Jian Liu, Zhan Qin, and Kui Ren. Privacyasst: Safeguarding user privacy in tool-using large language model agents. IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  15. [23]

    Rangel Pardo et al

    Francisco M. Rangel Pardo et al. Overview of the 6th author profiling task at PAN 2018: Multimodal gender identification in twitter. In CLEF 2018 Working Notes, volume 2125 of CEUR Workshop Proceedings. CEUR-WS.org, 2018. 6th Author Profiling Task at PAN@CLEF 2018

    2018

  16. [24]

    Overview of PAN’16

    Paolo Rosso, Francisco Rangel Pardo, Martin Potthast, Efstathios Stamatatos, Michael Tschug- gnall, and Benno Stein. Overview of PAN’16. In Experimental IR Meets Multilinguality, Multimodality, and Interaction, volume 9822 of Lecture Notes in Computer Science , pages 332–350, ...

    2016

  17. [25]

    Towards large reasoning models: A survey of reinforced reasoning with large language models

    Fengli Xu, Qianyue Hao, Zefang Zong, Jingwei Wang, Yunke Zhang, Jingyi Wang, Xiaochong Lan, Jiahui Gong, Tianjian Ouyang, Fanjin Meng, et al. Towards large reasoning models: A survey of reinforced reasoning with large language models. arXiv preprint arXiv:2501.09686, 2025

    2025 arXiv

  18. [26]

    Deepseekmath: Pushing the limits of mathematical reasoning in open language models

    Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Y Wu, et al. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300, 2024

    2024 arXiv

  19. [27]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948, 2025

    2025 arXiv

  20. [28]

    Bleu: a method for automatic evaluation of machine translation

    Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, pages 311–318, 2002

    2002

  21. [29]

    Rouge: A package for automatic evaluation of summaries

    Chin-Yew Lin. Rouge: A package for automatic evaluation of summaries. InText summarization branches out, pages 74–81, 2004

    2004

  22. [30]

    Deepseek-v3 technical report, 2024

    DeepSeek-AI. Deepseek-v3 technical report, 2024

    2024

  23. [31]

    my husband

    Meta. Introducing llama 3.1: Our most capable models to date, 2024. 11 A Appendix A.1 Case Study on Attack & Protection Insights through Adversarial Training To better understand the mechanisms of our Adversarial Anonymization framework, we examine a representative case study ...

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.