Information Leakage of Sentence Embeddings via Generative Embedding Inversion Attacks

Antonios Tragoudaras; Emmanouil Georgios Lionis; Marina Orozco Gonz\'alez; Panagiotis Eustratiadis; Theofanis Aslanidis

REVIEW 4 major objections 6 minor 1 cited by

Information Leakage of Sentence Embeddings via Generative Embedding Inversion Attacks

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that masked sentence embeddings leak sensitive information from the embedding model's training data, and that the leakage is tied to the embedding itself.

desk verdict Solid GEIA reproduction plus a clever leakage probe, but the training-data-leak claim is not yet supported; worth refereeing with a demand to temper it. read the letter →

arxiv 2504.16609 v1 pith:5ZWGVKYC submitted 2025-04-23 cs.IR

Antonios Tragoudaras , Theofanis Aslanidis , Emmanouil Georgios Lionis , Marina Orozco González , Panagiotis Eustratiadis This is my paper · ORCID

classification cs.IR

keywords sentenceembeddingsembeddinginversionattacktrainingdataleakageprivacylargelanguagemodelsadversarialretrievalreproducibilitynamedentityrecovery

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is a reproducibility study plus an extension of the Generative Embedding Inversion Attack (GEIA), which trains a GPT-2 decoder to reconstruct sentences from frozen sentence embeddings. The authors reproduce GEIA across five victim models and largely confirm its original claims, with GEIA's own metrics landing within 1–2% of the reported values. Their new contribution is a training-data leakage test: using LLM reasoners to mask named entities in sentences from AltLex, they show that a masked sentence's embedding makes the attacker assign higher log-likelihood to the original masked entity than to a plausible alternative, by 25–34% when averaging over masked tokens. When the embedding is withheld, the gap disappears, which they take as evidence that the leakage comes from the victim embedding, not the attacker's memory. If correct, this means sentence embeddings can reveal facts the embedding model memorized during pre-training, even when the input sentence no longer contains those facts.

What carries the argument

The central object is the GEIA attacker: a randomly initialized GPT-2 medium decoder, trained from scratch on PersonaChat, with a projection module that aligns the victim sentence embedding to the decoder's embedding space. The extension's mechanism is a likelihood-difference test: for each AltLex sentence, two LLM reasoners (GLM-4 and Llama-3.1) produce a masked version and a similar alternative; the masked sentence embedding f(x) is concatenated to each candidate, and the attacker's log-likelihood for the masked tokens is compared. A control condition withholds f(x), isolating leakage from the parametric knowledge of the attacker itself.

What would settle it

Run the same masked-token log-likelihood comparison on a corpus verifiably absent from the victim models' training data, or audit AltLex's overlap with each victim's pre-training corpus. If the original-over-similar gap persists for absent sentences, the effect is contextual inference rather than training-data leakage; if AltLex was never in the training data, the paper's central interpretation collapses.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central finding is that masked sentence embeddings do carry significant sensitive information regarding the training set, posing a considerable threat for embedding models. Concretely, for sentences sampled from AltLex, an LLM masks named entities; the victim model embeds the masked sentence; and the GEIA attacker computes generation log-likelihoods for the original sentence versus a similar alternative. Averaging only over the masked tokens, the original tokens are 25–34% more likely than the alternative when the embedding is provided, whereas without the embedding the difference is near zero or slightly negative. This pattern holds for SRoBERTa and SimCSE-BERT victims with both GLM-4 and Llama-3.1 reasoners, and the paper reports t-tests with p-values close to zero. The authors conclude that attackers are able to identify exact sensitive information that the embedding model saw during training.

Load-bearing premise

The conclusion that the recovered entities are training-data leakage assumes AltLex actually appears in the pre-training corpus of every victim model; the paper asserts this without a membership audit, and if that membership is wrong the same likelihood gap could be contextual inference from the unmasked parts of the sentence.

Editorial extensions

If this is right

An adversary with access to sentence embeddings can recover named entities that are absent from the input text but present in the victim model's training data.
Masking sensitive entities at inference time does not by itself protect against embedding inversion, because the embedding still encodes the masked entity.
The leakage signal is attributable to the embedding itself: without f(x), original and alternative tokens are equally likely, so the attacker's memory is not the source.
The effect replicates across two victim model families and two LLM reasoners, suggesting a general vulnerability rather than a quirk of one model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

One extension the authors do not pursue is a top-1 recovery rate: enumerate candidate entity fillings for a masked slot, rank them by the attacker's log-likelihood, and measure how often the true entity is the most likely; that would turn the likelihood gap into a concrete extraction rate.
A natural control the paper does not run is the same comparison on sentences from a corpus verifiably absent from pre-training data; that control would separate memorization from the contextual reasoning power of the attacker.
Because the gap appears only for masked tokens and only when f(x) is supplied, the method could be developed into an auditing tool that tests which entities an embedding model has memorized, by masking candidates and observing which fillings receive high likelihood.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Good reproduction of GEIA, and a useful new probe for embedding leakage — but the headline training-data claim is ahead of the evidence. The four GEIA reproduction claims mostly hold up: reported metrics are close to the original, code is released, and the authors are transparent about where their baselines diverge. That alone makes this a worthwhile paper for the reproducibility track.

The new experiment is a clever extension: mask sensitive entities, embed the masked sentence, then ask the trained GEIA attacker to score the original tokens against a plausible alternative, with and without the embedding. The without-embedding control is the right instinct, and the t-test results indicate the embedding does bias generation toward the original masked tokens.

The problem is what that bias means. Section 4.1 asserts AltLex 'formed part of the training set' for SRoBERTa, SimCSE, ST5, and MPNet, with no citation, overlap analysis, or audit. Those models were trained on different corpora (Wikipedia+BookCorpus, C4, etc.), and AltLex is a processed Wikipedia-derived resource, not a guaranteed pretraining ingredient. Without verified membership, the +25–33% masked-token likelihood gap can be explained just as well by the victim model's contextual inference: the unmasked context ('was a commander of the during the campaign') is enough to make Rommel likely. That is knowledge stored in the parameters, not evidence of direct exposure to that specific AltLex sentence. The paper's own framing — 'exact sensitive information that the embedding model saw during training' — is stronger than the experiment supports.

The fix is not hard: re-frame the contribution as embedding-conditioned entity inference, or add controls that separate memorization from general knowledge — for example, use masked entities that the context does not disambiguate, or compare against a verified membership set with known duplicate/near-duplicate sentences. The reproduction half of the paper stands regardless.

This paper deserves a serious referee. The reproducibility results are solid, and the leakage question is important even if this first pass over-claims. Send it to review, but the authors should be pushed to temper the training-data claim or provide the missing audit.

Referee Report

4 major / 6 minor

Summary. This paper is a reproducibility study of the GEIA (Generative Embedding Inversion Attack) framework for sentence embeddings, combined with a new research question: whether sentence embeddings leak information from the embedding model's training data. The authors replicate GEIA's original experiments on PersonaChat and QNLI with four victim sentence-embedding models (SRoBERTa, SimCSE-BERT, SimCSE-RoBERTa, ST5, MPNet) and confirm the original paper's four claims, with small discrepancies attributed to stochasticity and implementation details. For the new analysis, they sample sentences from AltLex, use an LLM reasoner (GLM-4 or Llama-3.1) to create masked versions (sensitive entities replaced with placeholders) and alternative versions (entities replaced with plausible substitutes), embed the masked sentences with the victim model, and feed the embedding concatenated with either the original or alternative text to the GEIA attacker. They compare the attacker's log-likelihoods for the original versus alternative tokens, both with and without access to the sentence embedding.

Significance. If the new claim were established, this paper would extend embedding inversion attacks from input reconstruction to training-data extraction, which would be a meaningful privacy contribution. The reproduction component is useful and appears mostly faithful to the original GEIA results, with transparent reporting of discrepancies. However, the central novel claim is not yet supported: the assertion that AltLex belongs to the pre-training corpora of all victim models is unverified, and the experimental design does not rule out that the observed likelihood differences arise from contextual inference or world knowledge encoded in the victim's parameters rather than from memorization of specific training examples. The paper is therefore a solid reproducibility study with an interesting but currently unproven extension.

major comments (4)

[Section 4.1] The statement that 'Altlex also formed part of the training set for the sentence embedding models used' is asserted without citation, dataset audit, or overlap analysis. The victim models were pre-trained on heterogeneous corpora (e.g., RoBERTa/SimCSE on Wikipedia and BookCorpus, ST5 on C4, MPNet on BookCorpus/Wikipedia), and no evidence shows that the specific AltLex sentences sampled for the experiments actually appear in those corpora. This assumption is load-bearing for the Section 5.2 conclusion that the attacker recovers 'exact sensitive information that the embedding model saw during training.' Without verification, the observed likelihood differences could reflect general knowledge (e.g., that Rommel was a German commander in WWII) rather than training-data memorization. The authors should provide an overlap analysis (e.g., exact or near-duplicate sentence matching against the pre-training data) or include a control set of sentences known to be absent from the training corpora.
[Section 5.2, Table 6] The without-f(x) control is insufficient to support the training-data-leakage claim. This control shows that the attacker's parametric memory alone does not produce the difference, but it does not rule out information already stored in the victim model's parameters. The masked sentences retain rich context (e.g., 'Rommel was a commander of the <ORGANIZATION> during the <LOCATION> campaign... seeing much of <PERSON>'), so the victim embedding may encode strong contextual priors over entities that are plausible in that context, which is not equivalent to memorizing specific training examples. To isolate memorization, the authors should include a condition where the masked entity is unlikely to appear in the victim's pre-training data, or compare against a set of alternatives matched for contextual plausibility.
[Section 5.2] The analysis appears to select the masked-token subset in a post-hoc manner: the whole-sentence aggregation is reported as not indicating leakage-specific differences (the difference persists without f(x)), and only then the masked-token subset is examined, where the pattern is observed. No correction for multiple comparisons is applied, and only p-values are reported. The paper should provide the number of samples, effect sizes, and confidence intervals for each cell in Table 6, and clarify whether the masked-token analysis was planned a priori or is exploratory.
[Section 3.2] The operational definition of training-data leakage is circular in practice: a higher likelihood for the original masked tokens is taken as evidence of training-data leakage, but this pattern could also arise from contextual inference or from the victim embedding encoding common-sense factual knowledge that is not tied to any specific training example. The paper should formulate a sharper null hypothesis (e.g., that the embedding provides no more information about the masked entity than a well-calibrated language model with access to the same context) and test it with appropriate controls, such as comparing embeddings of sentences that are paraphrases but not verbatim training examples.

minor comments (6)

[Section 4.1] Table 2 reports that 10% of AltLex is used (9,851 sentences) but does not describe the sampling procedure; please specify how this subsample was drawn and whether it is representative of the full dataset.
[Section 4.3] The phrase 'make its an excellent candidate' contains a typo; it should be 'make it an excellent candidate.'
[Section 6.2] The statement 'the projection was not parametrized' is ambiguous; it likely means that the original authors did not provide a parameterized projection module, but the sentence is unclear. Please clarify the intended meaning.
[Table 6] The caption does not explain the sign convention of the 'Distr. Comparison Original vs Similar' column. It should state explicitly that positive values indicate higher likelihood for the original tokens, and specify the units (percentage points).
[Section 3.2 and Figure 2] The procedure for 'pre-appending' the sentence embedding to the original and alternative sentences is not described precisely in the text. Figure 2 is too coarse; a precise description of the concatenation mechanism (e.g., how the embedding is projected and inserted into the decoder's token sequence) is needed for reproducibility.
[Abstract and Section 5.2] The abstract and the conclusion state that the method reveals 'data that sentence embedding models have been pre-trained on,' but the evidence presented does not yet establish a connection to pre-training data specifically. This phrasing overstates the current results and should be tempered until the training-data overlap is verified.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the leakage experiment is a differential likelihood test with external controls, though the training-set membership premise is unsupported.

full rationale

The paper's derivation chain is not circular. The GEIA reproduction is checked against the original paper's published metrics and against independently re-run baselines, so the reproducibility claims do not rely on the present authors' own prior results. The new training-data-leakage experiment uses an external differential test: the same attacker scores the likelihood of original versus alternative masked tokens, both with and without the victim embedding f(x), and the attacker is trained on PersonaChat, not on AltLex or on the victim models' training data. This control isolates the embedding's contribution, so the observed +25 to +33 percent likelihood shift is an empirical result rather than an identity. The paper does assert without audit that AltLex was part of the victims' pre-training corpora in Section 4.1, and that premise is load-bearing for calling the recovered entities 'training data' rather than contextual inference; however, an unsupported factual premise is a correctness risk, not a circular derivation, and no equation or fitted parameter reduces the conclusion to its inputs. There is also no load-bearing self-citation chain: the cited GEIA work is external prior work, and the attacker architecture is reproduced with publicly available code rather than imported as an unverified assumption.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central leakage claim rests on three unverified domain assumptions: that AltLex is in the victim pretraining data, that the masked-vs-original likelihood contrast isolates training-data leakage, and that masked sentences carry no identifying context. No new entities are introduced. The main quantitative choices are the AltLex subset and the post-hoc masked-token aggregation, both of which affect the headline result.

free parameters (2)

AltLex subsample = 9,851 sentences (10%)
A random 10% subset of AltLex is used for all leakage tests, but the paper gives no seed or index; the chosen subset is never shown to be representative of the dataset or of the victim models' training data.
Masked-token likelihood subset = lower half of Table 6
The headline leakage result is computed only over 'perturbed/masked tokens' after whole-sentence aggregation failed to show a leakage-specific difference; this manual subset selection is post hoc and affects the central claim.

assumptions (3)

domain assumption AltLex is part of the pre-training data of all victim sentence embedding models (SRoBERTa, SimCSE variants, ST5, MPNet).
Stated in Section 4.1 but no dataset card, citation, or overlap analysis is provided; the victim models have heterogeneous pre-training corpora.
domain assumption Higher log-likelihood of original vs. alternative masked tokens, conditioned on the masked sentence embedding, indicates leakage from the victim's training data.
This interpretive link is the basis of Section 5.2 but does not distinguish training-data memorization from general world knowledge or contextual inference in the embedding model.
domain assumption Masking named entities with placeholders removes all sensitive information from the text, so any recovery must come from the embedding or model rather than the text.
Masked sentences still contain rich context such as dates, relationships, and location descriptions that can identify entities even without prior knowledge of the exact entity.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Information Leakage of Sentence Embeddings via Generative Embedding Inversion Attacks." pith.science (2026). https://pith.science/paper/5ZWGVKYC

@misc{pith2026250416609,
  author       = {Pith},
  title        = {Pith review of: Information Leakage of Sentence Embeddings via Generative Embedding Inversion Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5ZWGVKYC}},
  note         = {Machine review of arXiv:2504.16609}
}

read the original abstract

Text data are often encoded as dense vectors, known as embeddings, which capture semantic, syntactic, contextual, and domain-specific information. These embeddings, widely adopted in various applications, inherently contain rich information that may be susceptible to leakage under certain attacks. The GEIA framework highlights vulnerabilities in sentence embeddings, demonstrating that they can reveal the original sentences they represent. In this study, we reproduce GEIA's findings across various neural sentence embedding models. Additionally, we contribute new analysis to examine whether these models leak sensitive information from their training datasets. We propose a simple yet effective method without any modification to the attacker's architecture proposed in GEIA. The key idea is to examine differences between log-likelihood for masked and original variants of data that sentence embedding models have been pre-trained on, calculated on the embedding space of the attacker. Our findings indicate that following our approach, an adversary party can recover meaningful sensitive information related to the pre-training knowledge of the popular models used for creating sentence embeddings, seriously undermining their security. Our code is available on: https://github.com/taslanidis/GEIA

Figures

Figures reproduced from arXiv: 2504.16609 by the authors.

**Figure 2.** Pipeline overview of the method for assessing train [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

SoK: Semantic Privacy in Large Language Models
cs.CR 2025-06 conditional novelty 4.0 of 10

A systematization of knowledge arguing that LLM privacy threats extend beyond data leakage to semantically inferred attributes, and that current defenses only partially address them.

Reference graph

Works this paper leans on

40 extracted references · 8 canonical work pages · cited by 1 Pith paper

[1]

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Floren- cia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

arXiv 2023
[2]

Anthropic. 2024. The Claude 3 Model Family: Opus, Sonnet, Haiku. https: //www-cdn.anthropic.com/de8ba9b01c9ab7cbabf5c33b80b7bbc618857627/ Model_Card_Claude_3.pdf

2024
[3]

Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19) . 267–284

2019
[4]

Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374 (2021)

arXiv 2021
[5]

Junyoung Chung, Caglar Gulcehre, KyungHyun Cho, and Yoshua Bengio. 2014. Empirical evaluation of gated recurrent neural networks on sequence modeling. arXiv preprint arXiv:1412.3555 (2014)

arXiv 2014
[6]

Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. 2021. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168 (2021)

arXiv 2021
[7]

Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Jailbreaker: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715 (2023)

arXiv 2023
[8]

Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024)

arXiv 2024

Show all 40 references

[9]

Tianyu Gao, Xingcheng Yao, and Danqi Chen. 2021. Simcse: Simple contrastive learning of sentence embeddings. arXiv preprint arXiv:2104.08821 (2021)

2021 arXiv
[10]

Team GLM, Aohan Zeng, Bin Xu, Bowen Wang, Chenhui Zhang, Da Yin, Dan Zhang, Diego Rojas, Guanyu Feng, Hanlin Zhao, et al. 2024. Chatglm: A fam- ily of large language models from glm-130b to glm-4 all tools. arXiv preprint arXiv:2406.12793 (2024)

2024 arXiv
[11]

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Int...

2023
[12]

Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. 2024. Cold- attack: Jailbreaking llms with stealthiness and controllability. arXiv preprint arXiv:2402.08679 (2024)

2024 arXiv
[13]

Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2020. Measuring massive multitask language under- standing. arXiv preprint arXiv:2009.03300 (2020)

2020 arXiv
[14]

Christopher Hidey and Kathleen McKeown. 2016. Identifying causal relations using parallel Wikipedia articles. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . 1424–1433

2016
[15]

Pegah Jandaghi, XiangHai Sheng, Xinyi Bai, Jay Pujara, and Hakim Sidahmed
[16]

Nikhil Kandpal, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. 2023. Backdoor attacks for in-context learning with language models. arXiv preprint arXiv:2307.14692 (2023)

2023 arXiv
[17]

Diederik P Kingma. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)

2014 arXiv
[18]

Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660 (2020)

2020 arXiv
[19]

Haoran Li, Yulin Chen, Jinglong Luo, Jiecong Wang, Hao Peng, Yan Kang, Xiaojin Zhang, Qi Hu, Chunkit Chan, Zenglin Xu, et al. 2023. Privacy in large language models: Attacks, defenses and future directions. arXiv preprint arXiv:2310.10383 (2023)

2023 arXiv
[20]

Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song. 2023. Multi-step jailbreaking privacy attacks on chatgpt. arXiv preprint arXiv:2304.05197 (2023)

2023 arXiv
[21]

Haoran Li, Mingshi Xu, and Yangqiu Song. 2023. Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentence. arXiv:2305.03010 [cs.CL] https://arxiv.org/abs/2305.03010

2023 arXiv
[22]

Zekun Li, Baolin Peng, Pengcheng He, and Xifeng Yan. 2024. Evaluating the instruction-following robustness of large language models to prompt injection. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 557–568

2024
[23]

Jianmo Ni, Gustavo Hernandez Abrego, Noah Constant, Ji Ma, Keith B Hall, Daniel Cer, and Yinfei Yang. 2021. Sentence-t5: Scalable sentence encoders from pre-trained text-to-text models. arXiv preprint arXiv:2108.08877 (2021)

2021 arXiv
[24]

Xudong Pan, Mi Zhang, Shouling Ji, and Min Yang. 2020. Privacy risks of general- purpose language models. In 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 1314–1331

2020
[25]

Fábio Perez and Ian Ribeiro. 2022. Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.09527 (2022)

2022 arXiv
[26]

Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. 2021. Mind the style of text! adversarial and backdoor attacks based on text style transfer. arXiv preprint arXiv:2110.07139 (2021)

2021 arXiv
[27]

N Reimers. 2019. Sentence-BERT: Sentence Embeddings using Siamese BERT- Networks. arXiv preprint arXiv:1908.10084 (2019)

2019 arXiv
[28]

David Rein, Betty Li Hou, Asa Cooper Stickland, Jackson Petty, Richard Yuanzhe Pang, Julien Dirani, Julian Michael, and Samuel R Bowman. 2023. Gpqa: A graduate-level google-proof q&a benchmark. arXiv preprint arXiv:2311.12022 (2023)

2023 arXiv
[29]

Rico Sennrich. 2015. Neural machine translation of rare words with subword units. arXiv preprint arXiv:1508.07909 (2015)

2015 arXiv
[30]

Congzheng Song and Ananth Raghunathan. 2020. Information leakage in em- bedding models. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security. 377–390

2020
[31]

Kaitao Song, Xu Tan, Tao Qin, Jianfeng Lu, and Tie-Yan Liu. 2020. Mpnet: Masked and permuted pre-training for language understanding. Advances in neural information processing systems 33 (2020), 16857–16867

2020
[32]

Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. 2023. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805 (2023)

2023 arXiv
[33]

Om Dipakbhai Thakkar, Swaroop Ramaswamy, Rajiv Mathews, and Francoise Beaufays. 2021. Understanding unintended memorization in language models under federated learning. In Proceedings of the Third Workshop on Privacy in Natural Language Processing. 1–10

2021
[34]

Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel Bowman. 2018. GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understanding. In Proceedings of the 2018 EMNLP Workshop BlackboxNLP: Analyzing and Interpreting Neural Networks ...

2018 doi
[35]

Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reason- ing in large language models. Advances in neural information processing systems 35 (2022), 24824–24837

2022
[36]

Sean Welleck, Zixin Yao, Yu Gai, Jialin Mao, Zheng Zhang, and Kyunghyun Cho
[37]

Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. 2024. Backdooring instruction-tuned large language models with virtual prompt injection. In Proceedings of the 2024 Conference of the North American Chapter of t...

2024
[38]

Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing (2024), 100211

2024
[2018]

Advances in Neural Information Processing Systems 31 (2018)

Loss functions for multiset prediction. Advances in Neural Information Processing Systems 31 (2018)

2018
[2023]

arXiv:2312.10007 [cs.CL]

Faithful Persona-based Conversational Dataset Generation with Large Language Models. arXiv:2312.10007 [cs.CL]

arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Floren- cia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

arXiv 2023

[2] [2]

Anthropic. 2024. The Claude 3 Model Family: Opus, Sonnet, Haiku. https: //www-cdn.anthropic.com/de8ba9b01c9ab7cbabf5c33b80b7bbc618857627/ Model_Card_Claude_3.pdf

2024

[3] [3]

Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19) . 267–284

2019

[4] [4]

Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374 (2021)

arXiv 2021

[5] [5]

Junyoung Chung, Caglar Gulcehre, KyungHyun Cho, and Yoshua Bengio. 2014. Empirical evaluation of gated recurrent neural networks on sequence modeling. arXiv preprint arXiv:1412.3555 (2014)

arXiv 2014

[6] [6]

Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. 2021. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168 (2021)

arXiv 2021

[7] [7]

Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Jailbreaker: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715 (2023)

arXiv 2023

[8] [8]

Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024)

arXiv 2024