Pith. sign in

REVIEW 4 major objections 5 minor 36 references

Task-related public data lets differentially private in-context learning match non-private performance at strong privacy levels.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review

2026-08-04 17:22 UTC pith:JGSH7LQ7

load-bearing objection Useful private-ICL idea, but the public-data benefit needs a proper ablation and the privacy accounting needs tightening. the 4 major comments →

arxiv 2509.10932 v1 pith:JGSH7LQ7 submitted 2025-09-13 cs.AI cs.CL

Public Data Assisted Differentially Private In-Context Learning

Seongho Joo , Hyukhun Koh , Kyomin Jung This is my paper
classification cs.AI cs.CL
keywords differentially private in-context learningpublic datasemantic clusteringpost-processingmembership inference attacklarge language modelsDP aggregationRényi differential privacy
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that the utility loss from differential privacy in in-context learning can be largely recovered by using task-related public data—without weakening the formal privacy guarantee. It proposes a pipeline that privately aggregates multiple LLM responses in a semantic embedding space, then uses public examples to select the best answer among the top candidates. In experiments on medical question answering and dialogue summarization, this approach at a strong privacy budget (epsilon=1) comes close to the non-private 4-shot baseline, and it clearly beats private-only aggregation. This matters because it offers a practical path to privacy-preserving few-shot prompting on sensitive data.

Core claim

The central claim is that a private ICL algorithm can preserve high utility by combining three steps: generating an ensemble of responses from both private and public demonstrations, privately clustering their embeddings with a differentially private mechanism, and then using only public data to choose a final answer from the top-k cluster representatives. Because the selection stage consumes no private data, the whole algorithm inherits the DP guarantee through post-processing. Empirically, on the QA task the top-k model reaches BLEU 22.21 and an LLM-judge score of 2.82 at epsilon=1, versus 23.43 BLEU for the non-private 4-shot baseline, and it outperforms keyword-aggregation baselines at e

What carries the argument

Semantic group aggregation with private clustering (the DPM algorithm): LLM responses are embedded into a low-dimensional space, and a differentially private clustering routine estimates cluster centers and member counts using exponential and Gaussian mechanisms, with subsampling amplification and RDP-based accounting. Public examples closest to each privatized center serve as class representatives, and a public one-shot prompt guides the final selection among the top-k candidates. This mechanism converts high-dimensional text output into small private aggregates and lets public data steer selection without touching private information.

Load-bearing premise

The load-bearing premise is that the size of the dataset and the size of the interval are public and therefore can be removed from the privacy budget; if those quantities are actually sensitive, the claimed epsilon is an undercount and the guarantee weakens.

What would settle it

Compute the mutual information between the noised dataset size output by Algorithm 2 and the true dataset size; if an adversary can infer n from the mechanism's output with better accuracy than the claimed epsilon allows, the privacy analysis is broken. A direct empirical check is to run the full pipeline with a single point whose presence flips a cluster center's ranking and see whether the public-data selection reveals that membership.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Privacy-preserving in-context learning can be deployed on sensitive text domains without fine-tuning and without a catastrophic drop in answer quality at strong privacy levels.
  • Out-of-distribution public data still helps, so a perfectly matched public corpus is not required; even noisy public data improves utility under tight privacy budgets.
  • Membership inference attacks are blunted: the private models keep AUROC around or below 0.6 in both balanced and unbalanced attack settings.
  • The framework is model-agnostic and black-box: it works with API-based LLMs as well as open-source models, and no model parameters are modified.
  • When public data is scarce, a small privacy budget can be spent to synthesize additional public demonstrations, recovering most of the utility gain.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If dataset size and interval size are genuinely sensitive, the paper's epsilon undercounts the true privacy loss, because those quantities are removed from the accounting even though the algorithm still perturbs them; a testable extension is to include them in the DP budget and measure the utility change.
  • The selection step introduces a potential new attack surface: a maliciously curated public dataset could bias the top-k selection toward a particular answer; adversarial-public-data robustness is an open question.
  • The method's core idea should transfer to other high-dimensional output tasks (code completion, translation) as long as a semantic embedding space is available; the expected gain over keyword aggregation should grow with output length and diversity.
  • The reported results suggest that the utility benefit of public data grows as the privacy budget tightens, so a quantitative study of the utility gap between in-distribution and out-of-distribution public data as a function of epsilon and domain shift would sharpen deployment guidance.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a differentially private in-context learning (ICL) framework called SGA that uses public data to mitigate utility loss. The method samples private and public demonstrations, collects LLM responses for an ensemble, embeds them, privately clusters the combined set using DPM, selects the public responses closest to the top-k cluster centers, and finally prompts the LLM with those public candidates and a public one-shot example. The authors claim the full pipeline is (ε,δ)-DP by post-processing of DPM, with RDP-based accounting for the exponential and Gaussian mechanisms. Experiments on ChatDoctor QA and SAMSum summarization at ε=1,3,8 report that SGA outperforms keyword-space aggregation (KSA) and approaches the non-private 4-shot baseline; membership-inference attacks achieve AUROC around 0.6, suggesting empirical privacy. The paper also presents noisy-public-data and public-data-augmentation studies.

Significance. If the privacy accounting is complete and the attribution to public data is supported, the paper would be a useful contribution: it offers a black-box, inference-time alternative to differentially private fine-tuning, with a plausible mechanism for preserving utility via public data, and it introduces a semantic-clustering approach to handle high-dimensional LLM outputs. The empirical results at ε=1 are encouraging, and the MIA evaluation is a relevant empirical check. However, the present version contains a load-bearing privacy-accounting gap and does not isolate the effect of public data for the headline method, so the claimed contributions are not yet fully established.

major comments (4)
  1. [§5.2, Table 1a] The central claim, stated in the Abstract and §5.2, is that incorporating task-related public data 'significantly improves the utility of private ICL.' The only direct with/without-public comparison is KSA vs. KSA w/o public, which differ in aggregation mechanism from the headline SGA method. SGA is never run without public data. Consequently, the large gap between SGA top-k (e.g., BLEU 22.21 at ε=1) and KSA w/o public (BLEU 15.65) conflates the effect of public data with the effect of semantic clustering and private cluster-center-based aggregation. The SGA top-k vs. SGA top-1 comparison both use public data and only tests candidate selection. To support the paper's main attribution, the authors should provide an SGA variant that removes public data from the pipeline (or at least from clustering and final selection) under the same privacy budget, or explicitly discuss why such a variant
  2. [§4.2 and Appendix A.1–A.2] The privacy analysis accounts only for the exponential mechanism (DPM split) and the Gaussian mechanism (DPAvg). However, Algorithm 2 (Appendix A.1) also injects Laplace noise into the dataset size (line 7) and into cluster-size counts (lines 20–21), and uses an interval-size estimation with budget ε_int. These mechanisms are not included in the RDP composition described in Appendix A.2. The assumption that 'the size of the dataset and the size of the interval are public' does not remove the need to account for these mechanisms if they are still executed and their outputs influence the release: if they are truly public, the noise is unnecessary and can be removed; if they are retained for stability or because some quantities are not actually public, then the claimed ε is an undercount. The manuscript needs a formal statement of the modified DPM's DP guarantee, including all mechanisms us
  3. [Table 1a vs. Appendix B.1] There is a numerical inconsistency for the same SGA top-k method on the ChatDoctor QA task. Table 1a reports BLEU 22.21±0.32 at ε=1 and 23.67±0.09 at ε=8, while Table 3 in Appendix B.1 reports BLEU 23.98 at ε=1 and 25.41 at ε=8 for k=3, which appears to be the default k for ChatDoctor according to Table 6 (assuming the table columns correspond to split levels=4, k=3). The differences exceed the reported standard deviations and are not explained. The authors should clarify whether Table 3 uses a different test set, different number of test queries, different subsampling, or a different privacy configuration, and reconcile the numbers.
  4. [§5.1 and Appendix G] The subsampling rate p is never reported, although Theorem 1 (privacy amplification via subsampling) is used to claim the privacy guarantee. The experiments mention 4-shot/100-ensemble and private dataset size 2,600, but no explicit p is given in the main text or in the hyperparameter tables. Without p, the claimed ε cannot be verified or reproduced. The authors should report the actual subsampling rate(s) used for each experiment, including the MIA experiment (2-shot/10-ensemble, effective 20 shots).
minor comments (5)
  1. [Step 2, §4.1 and References] The text says 'we adopt private clustering from Li et al. (2024)', but the referenced DPM algorithm is by Liebenow et al. (2024), and 'Li et al. (2024)' is not in the reference list with that title. Please correct the citation.
  2. [Table 1, caption] The table has two columns both labeled 'ε=∞', one for 'Agg' and one for '4-shot'. The caption uses 'ε=∞' twice, which is confusing. Distinguish them (e.g., 'ε=∞ (Agg)' and 'ε=∞ (4-shot)').
  3. [§5.1 and Table 1] The notation 'ε=0' for the public-only 4-shot baseline is non-standard; in DP, ε=0 usually means perfect privacy, not a non-private baseline. Please rename to 'public-only (ε not applicable)' or clearly define this notation.
  4. [Appendix G, Table 6] The hyperparameter table is difficult to parse: the columns for split levels and k are not clearly separated (e.g., 'ChatDoctor 43 [...]'). Add explicit column separators and explain that k=3 is the default for SGA. Also, the main text never states the value of k used in Table 1.
  5. [Appendix H, H.3] The KSA prompt template includes a '<Public Demonstration Example>', but the description of 'KSA w/o public' in §5.1 says it uses only private data. Clarify whether the 'w/o public' variant removes the public example from the prompt or only from the aggregation step, and describe the actual prompt used for KSA w/o public.

Circularity Check

0 steps flagged

No significant circularity; the DP guarantee is assembled from an externally cited clustering mechanism (DPM) plus post-processing, and the utility claims are empirical comparisons.

full rationale

The paper's derivation chain is compositional rather than circular: it assumes DPM (Liebenow et al., 2024) is (ε,δ)-DP, runs it on the union of private and public responses, and then applies post-processing (selecting closest public representatives and prompting the LLM only with public data) under Definition 2. The privacy result is inherited from an external mechanism and the post-processing step does not use additional private data, so the conclusion does not reduce to the input by construction. The utility claims are empirical measurements in Table 1, not quantities derived from fitted parameters; the choice of candidate number k is an ablation/hyperparameter selection (Appendix B.1, Table 6), not a fitted constant that is later renamed as a prediction. The public-data benefit is also supported by a same-mechanism ablation within the paper (KSA vs. KSA w/o public), so the headline claim is not entirely confounded with the change of aggregation mechanism, although an SGA-without-public variant is missing. The main concerns are non-circular: Appendix A.1 assumes dataset size and interval size are public while Algorithm 2 still perturbs dataset size with Laplace noise, which may under-count the privacy budget if those quantities are not truly public; and the lack of an SGA private-only ablation is an evidence gap. These are soundness/evidence issues, not self-referential derivations. The paper contains no load-bearing self-citations and does not import any uniqueness theorem from its own authors; its cited DP theorems and DPM are external, machine-checkable or standard results. Therefore the circularity score is 0.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

The central claim rests on the DPM clustering algorithm's DP guarantee (taken from Liebenow et al. 2024), on the post-processing property, and on a modified privacy accounting that treats dataset size as public. The main free parameters are the candidate number k, selected on the test benchmark, and the DPM split/budget hyperparameters. No new theoretical entities are introduced.

free parameters (3)
  • k (number of candidates) = 6 for ChatDoctor, 10 for SAMsum (Appendix G, selected via ablation in Appendix B.1)
    The number of candidate representatives passed to the final LLM is chosen based on BLEU performance on the benchmark test set, so it is tuned to the evaluation data.
  • subsampling rate p
    The fraction of private and public data sampled for each ensemble is not explicitly stated in the text; it affects privacy amplification and utility but is hand-chosen.
  • DPM split levels and budget allocation (epsilon_exp, epsilon_gm) = e.g., ChatDoctor: 4 split levels, k=6, eps_exp/eps_gm as in Table 6
    The DPM hyperparameters are set per dataset and affect the clustering output; they are chosen by the authors, potentially tuned for the task.
axioms (5)
  • domain assumption DPM clustering algorithm satisfies (epsilon, delta)-DP under the RDP accounting used in Appendix A.2
    The paper relies on the correctness of DPM (Liebenow et al., 2024) and the RDP accounting libraries; no proof is reproduced. The authors also modify DPM by treating dataset size and interval as public, which changes the guarantee.
  • domain assumption The output of the final LLM selection step is a post-processing function of the DP outputs and public data only
    Section 4.2 uses the post-processing property; this holds only if the final prompt does not depend on private data except through the privatized cluster centers.
  • domain assumption The text embedding model and the public datasets are available and do not themselves leak private information
    The embeddings are computed from LLM responses that derive from private prompts, so the DP guarantee must cover the embedding mapping; this is standard but unstated.
  • standard math Theorem 1 (privacy amplification by subsampling) applies to uniform sampling without replacement as implemented
    The paper cites Balle et al. (2018) for amplification but does not verify that the exact subsampling procedure in the implementation satisfies the conditions.
  • ad hoc to paper The size of the dataset and the size of the interval are public information and can be excluded from the privacy budget
    This assumption is introduced in Appendix A.1 specifically to simplify the privacy analysis and is not a standard part of the original DPM guarantee; if false, the claimed epsilon understates privacy loss.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Public Data Assisted Differentially Private In-Context Learning." pith.science (2026). https://pith.science/paper/JGSH7LQ7

@misc{pith2026250910932,
  author       = {Pith},
  title        = {Pith review of: Public Data Assisted Differentially Private In-Context Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JGSH7LQ7}},
  note         = {Machine review of arXiv:2509.10932}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

In-context learning (ICL) in Large Language Models (LLMs) has shown remarkable performance across various tasks without requiring fine-tuning. However, recent studies have highlighted the risk of private data leakage through the prompt in ICL, especially when LLMs are exposed to malicious attacks. While differential privacy (DP) provides strong privacy guarantees, it often significantly reduces the utility of in-context learning (ICL). To address this challenge, we incorporate task-related public data into the ICL framework while maintaining the DP guarantee. Based on this approach, we propose a private in-context learning algorithm that effectively balances privacy protection and model utility. Through experiments, we demonstrate that our approach significantly improves the utility of private ICL with the assistance of public data. Additionally, we show that our method is robust against membership inference attacks, demonstrating empirical privacy protection.

Figures

Figures reproduced from arXiv: 2509.10932 by Hyukhun Koh, Kyomin Jung, Seongho Joo.

Figure 1
Figure 1. Figure 1: An illustration of a membership inference at￾tack, where a malicious attacker infers whether a target example is included in the prompt composed of private examples retrieved from the database. By leveraging the tuned prompt, the attacker can determine the presence of the target example within the in-context examples. private clinical record data may try inference attack targeting LLM. The LLM with an ICL … view at source ↗
Figure 2
Figure 2. Figure 2: Overview of public data-assisted differentially private in-context learning. In Step 1, the public and private data are partitioned and used to create demonstration examples. In Step 2, the generated responses of the LLMs are embedded into a semantic space and then clustered privately. Finally, in Step 3, the top-k candidates closest to the centroids are selected, and the LLM chooses the final answer from … view at source ↗
Figure 3
Figure 3. Figure 3: Results for SGA model with OOD public dataset OOD public refers to private ICL with out-of￾distribution public data and ID public to private ICL with in-distribution public data. ios. 5.4 Membership Inference Attack For the empirical evaluation of privacy protection, we adopt a widely used membership inference at￾tack (MIA) against the ICL framework (Shokri et al., 2016). The attacker’s goal is to determin… view at source ↗
Figure 4
Figure 4. Figure 4: AUROC results for repeat attacks. "Balanced" [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: ROUGE-L score with augmented public dataset referred as "AUG public" in the summarization task [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Average running time of SGA and KSA. SGA [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: ROUGE-L scores across different privacy bud [PITH_FULL_IMAGE:figures/full_fig_p009_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

36 extracted references · 18 linked inside Pith

  1. [1]

    2016. https://gdpr-info.eu/art-32-gdpr/ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) . https://gdpr-info.eu/art-32-gdpr/. Article 32 – Security of processing

    2016

  2. [2]

    Goodfellow, H

    Mart \'i n Abadi, Andy Chu, Ian J. Goodfellow, H. B. McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. https://api.semanticscholar.org/CorpusID:207241585 Deep learning with differential privacy . Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

    2016

  3. [3]

    Federico Albanese, Daniel Alfredo Ciolek, and Nicolas D'Ippolito. 2023. https://api.semanticscholar.org/CorpusID:265295019 Text sanitization beyond specific domains: Zero-shot redaction & substitution with large language models . ArXiv, abs/2311.10785

    Pith/arXiv arXiv 2023

  4. [4]

    Borja Balle, Gilles Barthe, and Marco Gaboardi. 2018. https://api.semanticscholar.org/CorpusID:49576075 Privacy amplification by subsampling: Tight analyses via couplings and divergences . ArXiv, abs/1807.01647

    Pith/arXiv arXiv 2018

  5. [5]

    Borja Balle, Gilles Barthe, Marco Gaboardi, Justin Hsu, and Tetsuya Sato. 2019. https://api.semanticscholar.org/CorpusID:165163686 Hypothesis testing interpretations and renyi differential privacy . In International Conference on Artificial Intelligence and Statistics

    2019

  6. [6]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in Neural Information Processing Systems, 33:1877--1901

    2020

  7. [7]

    Mark Bun and Thomas Steinke. 2016. https://api.semanticscholar.org/CorpusID:486774 Concentrated differential privacy: Simplifications, extensions, and lower bounds . ArXiv, abs/1605.02065

    Pith/arXiv arXiv 2016

  8. [8]

    Yulong Chen, Yang Liu, Liang Chen, and Yue Zhang. 2021. https://doi.org/10.18653/v1/2021.findings-acl.449 D ialog S um: A real-life scenario dialogue summarization dataset . In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 5062--5074, Online. Association for Computational Linguistics

    doi:10.18653/v1/2021.findings-acl.449 2021

  9. [9]

    Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Zhiyong Wu, Baobao Chang, Xu Sun, Jingjing Xu, and Zhifang Sui. 2022. https://api.semanticscholar.org/CorpusID:255372865 A survey on in-context learning

    2022

  10. [10]

    Haonan Duan, Adam Dziedzic, Nicolas Papernot, and Franziska Boenisch. 2023. https://api.semanticscholar.org/CorpusID:258887717 Flocks of stochastic parrots: Differentially private prompt learning for large language models . ArXiv, abs/2305.15594

    Pith/arXiv arXiv 2023

  11. [11]

    Cynthia Dwork. 2006. https://api.semanticscholar.org/CorpusID:2565493 Differential privacy . In International Colloquium on Automata, Languages and Programming

    2006

  12. [12]

    James Flemings, Meisam Razaviyayn, and Murali Annavaram. 2024. https://api.semanticscholar.org/CorpusID:268681735 Differentially private next-token prediction of large language models . ArXiv, abs/2403.15638

    Pith/arXiv arXiv 2024

  13. [13]

    Ginart, Laurens van der Maaten, James Y

    Antonio A. Ginart, Laurens van der Maaten, James Y. Zou, and Chuan Guo. 2022. https://api.semanticscholar.org/CorpusID:245668784 Submix: Practical private prediction for large-scale language models . ArXiv, abs/2201.00971

    Pith/arXiv arXiv 2022

  14. [14]

    Bogdan Gliwa, Iwona Mochol, Maciej Biesek, and Aleksander Wawer. 2019. https://doi.org/10.18653/v1/D19-5409 SAMS um corpus: A human-annotated dialogue dataset for abstractive summarization . In Proceedings of the 2nd Workshop on New Frontiers in Summarization, pages 70--79, Hong Kong, China. Association for Computational Linguistics

    doi:10.18653/v1/d19-5409 2019

  15. [15]

    Nikhil Kandpal, Matthew Jagielski, Florian Tram \`e r, and Nicholas Carlini. 2023. https://api.semanticscholar.org/CorpusID:260203047 Backdoor attacks for in-context learning with language models . ArXiv, abs/2307.14692

    Pith/arXiv arXiv 2023

  16. [16]

    Aly Kassem, Omar Mahmoud, and Sherif Saad. 2023. https://doi.org/10.18653/v1/2023.emnlp-main.265 Preserving privacy through dememorization: An unlearning technique for mitigating memorization risks in language models . In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 4360--4379, Singapore. Association for Co...

    doi:10.18653/v1/2023.emnlp-main.265 2023

  17. [17]

    Haoran Li, Yulin Chen, Jinglong Luo, Yan Kang, Xiaojin Zhang, Qi Hu, Chunkit Chan, and Yangqiu Song. 2023 a . https://api.semanticscholar.org/CorpusID:264145758 Privacy in large language models: Attacks, defenses and future directions . ArXiv, abs/2310.10383

    Pith/arXiv arXiv 2023

  18. [18]

    Xi Li, Yusen Zhang, Renze Lou, Chen Wu, and Jiaqi Wang. 2024. https://api.semanticscholar.org/CorpusID:270371399 Chain-of-scrutiny: Detecting backdoor attacks for large language models . ArXiv, abs/2406.05948

    arXiv 2024

  19. [19]

    Hashimoto

    Xuechen Li, Florian Tram \`e r, Percy Liang, and Tatsunori B. Hashimoto. 2021. https://api.semanticscholar.org/CorpusID:238634219 Large language models can be strong differentially private learners . ArXiv, abs/2110.05679

    Pith/arXiv arXiv 2021

  20. [20]

    Yunxiang Li, Zihan Li, Kai Zhang, Ruilong Dan, Steve Jiang, and You Zhang. 2023 b . Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (llama) using medical domain knowledge. Cureus, 15(6)

    2023

  21. [21]

    Johannes Liebenow, Yara Schütt, Tanya Braun, Marcel Gehrke, Florian Thaeter, and Esfandiar Mohammadi. 2024. https://arxiv.org/abs/2307.02969 Dpm: Clustering sensitive data through separation . Preprint, arXiv:2307.02969

    Pith/arXiv arXiv 2024

  22. [22]

    Jimit Majmudar, Christophe Dupuy, Charith Peris, Sami Smaili, Rahul Gupta, and Richard S. Zemel. 2022. https://api.semanticscholar.org/CorpusID:249151985 Differentially private decoding in large language models . ArXiv, abs/2205.13621

    Pith/arXiv arXiv 2022

  23. [23]

    Sewon Min, Xinxi Lyu, Ari Holtzman, Mikel Artetxe, Mike Lewis, Hannaneh Hajishirzi, and Luke Zettlemoyer. 2022. https://api.semanticscholar.org/CorpusID:247155069 Rethinking the role of demonstrations: What makes in-context learning work? ArXiv, abs/2202.12837

    Pith/arXiv arXiv 2022

  24. [24]

    Milad Nasr, Saeed Mahloujifar, Xinyu Tang, Prateek Mittal, and Amir Houmansadr. 2023. https://api.semanticscholar.org/CorpusID:260927393 Effectively using public data in privacy preserving machine learning . In International Conference on Machine Learning

    2023

  25. [25]

    Anthia Papadopoulou, Yunhao Yu, Pierre Lison, and Lilja vrelid. 2022. https://api.semanticscholar.org/CorpusID:253762084 Neural text sanitization with explicit measures of privacy risk . In AACL

    2022

  26. [26]

    Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and \'U lfar Erlingsson. 2018. https://api.semanticscholar.org/CorpusID:3544583 Scalable private learning with pate . ArXiv, abs/1802.08908

    Pith/arXiv arXiv 2018

  27. [27]

    Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov

    R. Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2016. https://api.semanticscholar.org/CorpusID:10488675 Membership inference attacks against machine learning models . 2017 IEEE Symposium on Security and Privacy (SP), pages 3--18

    2016

  28. [28]

    Inan, Andre Manoel, FatemehSadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim

    Xinyu Tang, Richard Shin, Huseyin A. Inan, Andre Manoel, FatemehSadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim. 2023. https://api.semanticscholar.org/CorpusID:262083977 Privacy-preserving in-context learning with differentially private few-shot generation . ArXiv, abs/2309.11765

    Pith/arXiv arXiv 2023

  29. [29]

    Jun Wang and Zhi-Hua Zhou. 2020. https://api.semanticscholar.org/CorpusID:209454015 Differentially private learning with small public data . In AAAI Conference on Artificial Intelligence

    2020

  30. [30]

    Jason Wei, Yi Tay, Rishi Bommasani, Colin Raffel, Barret Zoph, Sebastian Borgeaud, Dani Yogatama, Maarten Bosma, Denny Zhou, Donald Metzler, Ed Huai hsin Chi, Tatsunori Hashimoto, Oriol Vinyals, Percy Liang, Jeff Dean, and William Fedus. 2022. https://api.semanticscholar.org/CorpusID:249674500 Emergent abilities of large language models . ArXiv, abs/2206.07682

    Pith/arXiv arXiv 2022

  31. [31]

    Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. 2024. https://api.semanticscholar.org/CorpusID:272367776 Membership inference attacks against in-context learning . ArXiv, abs/2409.01380

    Pith/arXiv arXiv 2024

  32. [32]

    Wang, and Prateek Mittal

    Tong Wu, Ashwinee Panda, Jiachen T. Wang, and Prateek Mittal. 2024. https://openreview.net/forum?id=x4OPJ7lHVU Privacy-preserving in-context learning for large language models . In The Twelfth International Conference on Learning Representations

    2024

  33. [33]

    Religa, Jian Yin, and Huishuai Zhang

    Da Yu, Sivakanth Gopi, Janardhan Kulkarni, Zi-Han Lin, Saurabh Naik, Tomasz L. Religa, Jian Yin, and Huishuai Zhang. 2023. https://api.semanticscholar.org/CorpusID:258841179 Selective pre-training for private fine-tuning . ArXiv, abs/2305.13865

    Pith/arXiv arXiv 2023

  34. [34]

    Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. 2021. https://api.semanticscholar.org/CorpusID:238743879 Differentially private fine-tuning of language models . ArXiv, abs/2110.06500

    Pith/arXiv arXiv 2021

  35. [35]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  36. [36]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.