Pith. sign in

REVIEW 3 major objections 5 minor 8 cited by

Rethinking Data Protection in the (Generative) Artificial Intelligence Era

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Data protection in the generative-AI era should be organized as a four-level hierarchy—non-usability, privacy preservation, traceability, and deletability—that trades control against utility.

desk verdict A useful four-goal taxonomy for AI data protection, but the claimed utility/control hierarchy is not supported by the paper's own definitions and should be softened before publication. read the letter →

arxiv 2507.03034 v4 pith:MM34KEOB submitted 2025-07-03 cs.LG cs.AIcs.CRcs.CVcs.CY

Yiming Li , Shuo Shao , Yu He , Junfeng Guo , Tianwei Zhang , Zhan Qin , Pin-Yu Chen , Michael Backes
show 3 more authors
Philip Torr Dacheng Tao Kui Ren
This is my paper
classification cs.LGcs.AIcs.CRcs.CVcs.CY
keywords dataprotectiongenerativeAInon-usabilityprivacypreservationtraceabilitydeletabilitymachineunlearninggovernance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that 'data protection' in the generative-AI era is no longer about guarding static files; data flows through every stage of the AI lifecycle, from training sets to prompts to model outputs, and each artifact can be copied and leaked independently. To make sense of this, it proposes a four-level hierarchical taxonomy: data non-usability, privacy preservation, traceability, and deletability. Each level is defined by a different trade-off between how much control the owner keeps and how much utility the data can still deliver, from fully blocking use to allowing full use with a right to later removal. The paper maps existing techniques and regulations onto the four levels, revealing that most legal frameworks cover the first three levels while deletability remains the weakest in both technical and regulatory terms. A sympathetic reader would care because the taxonomy gives researchers, developers, and regulators a common language to say precisely which protection goal they mean, rather than treating all AI data protection as a single undifferentiated obligation.

What carries the argument

The central object is the four-level hierarchical taxonomy itself: data non-usability, privacy preservation, traceability, and deletability. The hierarchy is the mechanism: it places every data-protection technique and every legal instrument on a gradient from maximal control with zero utility to minimal control with full utility, and it extends the scope of protected data beyond raw samples to trained model weights, system prompts, external knowledge bases, user inputs, and AI-generated content. The paper uses this ladder as an analytical lens to compare techniques—encryption and unlearnable examples at level 1; differential privacy and federated learning at level 2; watermarks and membership inference at level 3; retraining and machine unlearning at level 4—and to score regulations by which levels they actually enforce.

What would settle it

A concrete test: take a fixed dataset and model, measure utility (for example test accuracy or downstream task performance) under a representative technique from each level—unlearnable examples, differential privacy, watermarking, and machine unlearning—and measure protection strength (for example attack success rate or verification rate). If the levels do not produce a monotone ordering in both dimensions—if a traceability watermark degrades utility more than a privacy-preserving mechanism, or a privacy mechanism offers weaker protection than a traceability one—then the single-gradient hierarchy is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that the many disparate data-protection problems raised by modern AI—artists blocking style mimicry, hospitals keeping patient records private, companies tracing leaked datasets, users erasing their influence from models—are not separate issues but positions on a single spectrum of control versus utility. It proposes a four-level hierarchy: level 1 non-usability (data cannot be used for training or inference at all), level 2 privacy preservation (data may be used while sensitive attributes are shielded), level 3 traceability (data is used almost fully but carries mechanisms to track origin and modification), and level 4 deletability (data is fully used up front on the condition that its influence can later be removed from the model). The paper claims each successive level relaxes protection slightly and increases utility, and it uses this ladder to organize representative technical approaches and to map existing regulations, revealing that most laws cover non-usability, privacy, and traceability but deletability remains technically and legally underdeveloped.

Load-bearing premise

The taxonomy assumes that non-usability, privacy preservation, traceability, and deletability can be ranked on a single scale of control-versus-utility, with each level strictly less restrictive than the last.

Editorial extensions

If this is right

  • If the taxonomy is right, a developer can specify a protection target precisely—'I need deletability, not non-usability'—and pick techniques and compliance measures accordingly, instead of treating data protection as one undifferentiated obligation.
  • Regulators can audit their instruments level by level; the paper's Table I shows, for instance, that most Chinese regulations cover non-usability, privacy, and traceability but leave deletability weak, and that the United States lacks a comprehensive federal data-protection regime.
  • The taxonomy redefines what counts as protected data in the AI era: not just training datasets but model weights, system prompts, retrieval-augmented knowledge bases, user prompts, and AI-generated content that later becomes training data.
  • The paper's analysis implies that technical feasibility lags legal rights: deletion rights exist in law, but machine unlearning is not yet reliable enough to guarantee that a data point's influence is truly gone.
  • Traceability and non-usability can act as technical substitutes where copyright law is uncertain, for example watermarking AI-generated content or cloaking artists' styles when AI-generated content itself is not copyrightable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the same artifact can sit at different levels for different parties—a dataset could be non-usable to unauthorized trainers, traceable to the public, and deletable to the original contributors—so the hierarchy is best read as a relation between an asset, an actor, and a lifecycle stage.
  • A natural testable extension is to build a benchmark that classifies existing protection techniques by their utility drop: measure, for a fixed model and dataset, how much accuracy is lost under an unlearnable-example defense, differential privacy, watermarking, and machine unlearning, and check whether the paper's predicted ordering of utility actually holds.
  • The taxonomy suggests a cross-disciplinary design pattern: future systems could dynamically switch protection levels depending on jurisdictional requirements, much as the paper suggests with adaptive watermarking and context-aware deletion, which would make compliance a technical parameter rather than a legal afterthought.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This perspective paper argues that data protection in the generative AI era should be organized into a four-level hierarchical taxonomy: data non-usability, privacy-preservation, traceability, and deletability. It motivates the taxonomy by surveying the AI lifecycle—training data, trained models, deployment-integrated data, user inputs, and AI-generated content—and then maps representative techniques (encryption, unlearnable examples, differential privacy, watermarking, membership inference, machine unlearning) onto the four levels. It also analyzes a set of international regulations, classifying each regulation as covering some subset of the four levels, and discusses emerging challenges around AIGC, cross-jurisdictional enforcement, and ethics. The paper's central claim is that this hierarchy captures a utility–control gradient and provides a structured lens for comparing techniques and regulations.

Significance. If the taxonomy is accepted, it could serve as a useful organizing device for a scattered literature spanning unlearnable examples, differential privacy, watermarking, and machine unlearning, and it could give regulators a shared vocabulary. The paper is strongest as a broad survey: it covers a commendable range of techniques and regulations, and the four categories are natural and memorable. It is weaker as a conceptual contribution because the hierarchical ordering—the element that makes the taxonomy more than a checklist—is not derived from the definitions given. The policy mapping in Table I is also presented without a transparent rubric. The paper does not contain machine-checked proofs or falsifiable quantitative predictions, but that is not expected for a perspective piece; its value is in synthesis and framing.

major comments (3)
  1. [Section II.B] The central claim that the four levels form a strict hierarchy ordered by a utility–control trade-off is not supported by the definitions given. Section II.B states that 'each successive level in this hierarchy relaxes the protections on data slightly, trading off some degree of control for greater data utility,' but traceability (Level 3) and deletability (Level 4) are logically orthogonal under the paper's own descriptions: a watermarked dataset can be used in a model with no unlearning mechanism, and an unlearning service can erase influence without any watermarking or audit trail. Similarly, non-usability via encryption and non-usability via unlearnable examples are different in kind, and privacy-preservation is not obviously 'more permissive' than non-usability because privacy-preserving techniques such as differential privacy also mask task-relevant information. Since no operational definition of 'data utility' or 'degree of control' is provided, the claimed gradient is an additional assumption rather than a consequence of the categorization. The taxonomy remains useful as a set of four protection dimensions, but the hierarchy should either be justified with explicit ordering criteria or reframed as a multi-dimensional framework.
  2. [Table I and Section IV] The assignment of protection levels to regulations is asserted without a stated methodology or rubric, and some entries appear inconsistent with the accompanying text. For example, CCPA is marked as covering N (non-usability), but the text describes CCPA as supporting L2 and L4 protections and does not identify any general prohibition on using data for AI training. Conversely, the text states that deletability (L4) is 'nominally protected under Chinese law' with limited enforcement, yet the PIPL row in Table I lists only N, P, T and omits D. Because the paper uses Table I to support the claim of 'regulatory blind spots,' the mapping should be justified with explicit criteria for what counts as coverage at each level, or the table should be replaced with a more cautious qualitative comparison.
  3. [Section III, Level 1] Grouping encryption and authorization under 'non-usability' conflates access control with inherent unusability. Encryption prevents access by unauthorized parties, but the data remains perfectly usable by authorized parties and can be decrypted; unlearnable examples, by contrast, aim to make the data unusable even when the adversary has full access. These are different threat models with different guarantees. The paper should either distinguish these subcases explicitly or explain why they belong to the same level despite their different failure modes.
minor comments (5)
  1. [Section I] The word 'AI-enpowered' should be 'AI-empowered'.
  2. [Section III, Privacy-preservation] The phrase 'such like k-anonymity and L-diversity' should be 'such as k-anonymity and L-diversity'.
  3. [Figure 3] The leftmost subfigure in Figure 3 is labeled 'Level 4: Unlearnability' while the text and Figure 2 use 'Deletability'; these terms are related but not identical and should be aligned.
  4. [Section II.B] The abstract and Section II.B describe the taxonomy as 'hierarchical,' but Figure 2's caption and the surrounding text sometimes describe it as a 'spectrum' or 'gradient'; the terminology should be made consistent if the hierarchy claim is retained.
  5. [Section V.A] The discussion of data protection vs. data safety is useful but overlaps considerably with the introduction; consider condensing to avoid repetition.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the proposed taxonomy is a definitional categorization, and its central claim does not reduce to the paper's cited inputs or self-citations.

full rationale

This paper is a perspective that proposes a four-level hierarchy for data protection in the generative-AI era: non-usability, privacy-preservation, traceability, and deletability. It makes no quantitative predictions and fits no parameters, so the fitted-input-as-prediction pattern does not apply. The four levels are introduced through prose definitions of protection goals and representative technique classes; the cited works, including several self-citations in Sections III and IV, serve as illustrative examples rather than as the evidence from which the levels are derived. Even if every self-cited watermarking, unlearning, or privacy paper were invalid, the taxonomy's logical structure would remain intact, which shows that the self-citations are not load-bearing. The paper's assertion in Section II.B that 'each successive level in this hierarchy relaxes the protections on data slightly, trading off some degree of control for greater data utility' is an asserted design assumption, not a result derived from the definitions; it may be debatable, and the reader's concern that traceability and deletability could be orthogonal is a legitimate correctness or argumentation critique, but it is not circularity. The paper invokes no uniqueness theorem, smuggles no ansatz via citation, and does not rename a known empirical result as a derivation. No circular step can be exhibited, so the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No free parameters or invented entities are introduced. The paper's central claim is a taxonomy, so the implicit axioms are its scope (four levels), its ordering (one utility/control gradient), and its application to regulations.

assumptions (3)
  • domain assumption The four levels (non-usability, privacy preservation, traceability, deletability) are the relevant and comprehensive protection goals for data in the AI era.
    The paper asserts this scope in Section II.B with examples, but does not derive it or compare it to alternative taxonomies.
  • domain assumption The four levels can be ordered along a single utility/control spectrum.
    Section II.B states 'Each successive level in this hierarchy relaxes the protections on data slightly, trading off some degree of control for greater data utility.' This monotonic ordering is assumed, not proven.
  • domain assumption Existing regulations can be accurately classified by which of the four levels they cover.
    Table I maps regulations to levels without a transparent legal analysis, so the classification is an assumption that drives the regulatory gap analysis.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rethinking Data Protection in the (Generative) Artificial Intelligence Era." pith.science (2026). https://pith.science/paper/MM34KEOB

@misc{pith2026250703034,
  author       = {Pith},
  title        = {Pith review of: Rethinking Data Protection in the (Generative) Artificial Intelligence Era},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MM34KEOB}},
  note         = {Machine review of arXiv:2507.03034}
}
read the original abstract

The (generative) artificial intelligence (AI) era has profoundly reshaped the meaning and value of data. No longer confined to static content, data now permeates every stage of the AI lifecycle from the training samples that shape model parameters to the prompts and outputs that drive real-world model deployment. This shift renders traditional notions of data protection insufficient, while the boundaries of what needs safeguarding remain poorly defined. Failing to safeguard data in AI systems can inflict societal and individual, underscoring the urgent need to clearly delineate the scope of and rigorously enforce data protection. In this perspective, we propose a four-level taxonomy, including non-usability, privacy preservation, traceability, and deletability, that captures the diverse protection needs arising in modern (generative) AI models and systems. Our framework offers a structured understanding of the trade-offs between data utility and control, spanning the entire AI pipeline, including training datasets, model weights, system prompts, and AI-generated content. We analyze representative technical approaches at each level and reveal regulatory blind spots that leave critical assets exposed. By offering a structured lens to align future AI technologies and governance with trustworthy data practices, we underscore the urgency of rethinking data protection for modern AI techniques and provide timely guidance for developers, researchers, and regulators alike.

Figures

Figures reproduced from arXiv: 2507.03034 by the authors.

Figure 1
Figure 1. Data flow across the life-cycle of a (generative) AI model. The schematic traces how different forms of data emerge and circulate from the moment raw samples are collected to the point at which a deployed model generates new content. (i) Data Collection and Curation: Samples, such as images, texts, and audio clips are gathered and annotated; once aggregated, they form the training dataset that drives model learning … view at source ↗
Figure 2
Figure 2. Hierarchical taxonomy of data protection in the (generative) AI era. This taxonomy comprises four distinct protection [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Design principles of techniques for each level. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 8 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarking

    cs.CR 2025-11 conditional novelty 7.0 of 10

    SWAP embeds a copyright watermark into CLIP soft prompts by enforcing a secret ordering of out-of-distribution class scores, enabling black-box ownership verification.

  2. External Data Extraction Attacks against Retrieval-Augmented Large Language Models

    cs.CR 2025-10 conditional novelty 7.0 of 10

    SECRET, an adaptive RAG extraction attack that fuses LLM-optimized jailbreak prompts with cluster-guided queries, extracts large portions of private databases from commercial and open LLMs, including ~35% of a sampled...

  3. Delving into the Temporal Challenges of Unified Video Protection Against Image-to-Video and Fine-Tuning-based Customization

    cs.CV 2026-07 conditional novelty 6.0 of 10

    TC-UAP learns a shared multi-frame adversarial perturbation that protects videos of the same identity from both fine-tuning-based and reference-based video customization, remaining effective on unseen clips and under ...

  4. Sliced Transport Plans

    math.OC 2025-08 unverdicted novelty 6.0 of 10

    A new sliced-Wasserstein-based discrepancy with provable semi-metric properties and a constrained Kantorovich relation, plus a generic-measure generalization of Expected Sliced plans.

  5. The Man Behind the Sound: Demystifying Audio Private Attribute Profiling via Multimodal Large Language Model Agents

    cs.CR 2025-07 unverdicted novelty 6.0 of 10

    A multi-agent audio-language model framework can automatically profile private attributes, such as age, health, and income, directly from general audio recordings.

  6. 4KAgent: Agentic Any Image to 4K Super-Resolution

    cs.CV 2025-07 reject novelty 6.0 of 10

    An agentic pipeline that plans and executes image restoration from a toolbox of pretrained models to upscale arbitrary images to 4K, reporting state-of-the-art results on many benchmarks.

  7. Positive Style Accumulation: A Style Screening and Continuous Utilization Framework for Federated DG-ReID

    cs.CV 2025-07 conditional novelty 5.0 of 10

    SSCU improves federated domain-generalizable person re-identification by screening styles with round-over-round Rank-1 gains and continuously training on the memorized positive styles.

  8. Memory Enhanced Fractional-Order Dung Beetle Optimization for Photovoltaic Parameter Identification

    cs.NE 2025-08 reject novelty 3.0 of 10

    The claimed MFO-DBO algorithm and its CEC2017/PV results are absent from the manuscript, which instead contains an unrelated prompt-stealing attack paper.

Reference graph

Works this paper leans on

141 extracted references · 71 canonical work pages · cited by 8 Pith papers

  1. [1]

    Deep learning,

    Y . LeCun, Y . Bengio, and G. Hinton, “Deep learning,”Nature, vol. 521, no. 7553, pp. 436–444, 2015

    2015

  2. [2]

    Multitask joint strategies of self-supervised representation learning on biomedical networks for drug discovery,

    X. Wang, Y . Cheng, Y . Yang, Y . Yu, F. Li, and S. Peng, “Multitask joint strategies of self-supervised representation learning on biomedical networks for drug discovery,” Nature Machine Intelligence, vol. 5, no. 4, pp. 445–456, 2023

    2023

  3. [3]

    Large language models in medicine,

    A. J. Thirunavukarasu, D. S. J. Ting, K. Elangovan, L. Gutierrez, T. F. Tan, and D. S. W. Ting, “Large language models in medicine,” Nature Medicine, vol. 29, no. 8, pp. 1930–1940, 2023

    1930

  4. [4]

    Chen and S

    P.-Y . Chen and S. Liu, Introduction to Foundation Models . Springer Nature, 2025

    2025

  5. [5]

    A survey of controllable text generation using transformer-based pre-trained language models,

    H. Zhang, H. Song, S. Li, M. Zhou, and D. Song, “A survey of controllable text generation using transformer-based pre-trained language models,” ACM Computing Surveys , vol. 56, no. 3, pp. 1– 37, 2023

    2023

  6. [6]

    Diffusion models in vision: A survey,

    F.-A. Croitoru, V . Hondru, R. T. Ionescu, and M. Shah, “Diffusion models in vision: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 45, no. 9, pp. 10 850–10 869, 2023

    2023

  7. [7]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    arXiv 2023

  8. [8]

    Midjourney,

    M. Team, “Midjourney,” Artificial intelligence image generation tool, 2023, accessed: 2025-05-13. [Online]. Available: https: //www.midjourney.com

    2023

Show all 141 references
  1. [9]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,

    D. Guo, D. Yang, H. Zhang, J. Song, R. Zhang, R. Xu, Q. Zhu, S. Ma, P. Wang, X. Bi et al., “Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,” arXiv preprint arXiv:2501.12948 , 2025

    2025 arXiv

  2. [10]

    Towards generalist biomedical ai,

    T. Tu, S. Azizi, D. Driess, M. Schaekermann, M. Amin, P.-C. Chang, A. Carroll, C. Lau, R. Tanno, I. Ktena et al. , “Towards generalist biomedical ai,” New England Journal of Medicine AI , vol. 1, no. 3, 2024

    2024

  3. [11]

    The cancer genome atlas pan-cancer analysis project,

    J. N. Weinstein, E. A. Collisson, G. B. Mills, K. R. Shaw, B. A. Ozenberger, K. Ellrott, I. Shmulevich, C. Sander, and J. M. Stuart, “The cancer genome atlas pan-cancer analysis project,” Nature Genetics, vol. 45, no. 10, pp. 1113–1120, 2013

    2013

  4. [12]

    Advances, challenges and opportunities in creating data for trustworthy ai,

    W. Liang, G. A. Tadesse, D. Ho, L. Fei-Fei, M. Zaharia, C. Zhang, and J. Zou, “Advances, challenges and opportunities in creating data for trustworthy ai,” Nature Machine Intelligence, vol. 4, no. 8, pp. 669–677, 2022

    2022

  5. [13]

    General data protection regulation,

    E. Union, “General data protection regulation,” 2016, eU. [Online]. Available: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex %3A32016R0679

    2016

  6. [14]

    Eu ai act,

    ——, “Eu ai act,” 2024, eU. [Online]. Available: https://artificialintelli genceact.eu/

    2024

  7. [15]

    Identity-based encryption from the weil pairing,

    D. Boneh and M. Franklin, “Identity-based encryption from the weil pairing,” in International Cryptology Conference , 2001

    2001

  8. [16]

    A survey on fully homomorphic encryption: An engineering perspective,

    P. Martins, L. Sousa, and A. Mariano, “A survey on fully homomorphic encryption: An engineering perspective,” ACM Computing Surveys , vol. 50, no. 6, pp. 1–33, 2017

    2017

  9. [17]

    Identity-based encryption transformation for flexible sharing of encrypted data in public cloud,

    H. Deng, Z. Qin, Q. Wu, Z. Guan, R. H. Deng, Y . Wang, and Y . Zhou, “Identity-based encryption transformation for flexible sharing of encrypted data in public cloud,” IEEE Transactions on Information Forensics and Security, vol. 15, pp. 3168–3180, 2020

    2020

  10. [18]

    Multimedia watermarking techniques,

    F. Hartung and M. Kutter, “Multimedia watermarking techniques,” Proceedings of the IEEE , vol. 87, no. 7, pp. 1079–1107, 1999

    1999

  11. [19]

    Deepmih: Deep invertible network for multiple image hiding,

    Z. Guan, J. Jing, X. Deng, M. Xu, L. Jiang, Z. Zhang, and Y . Li, “Deepmih: Deep invertible network for multiple image hiding,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 45, no. 1, pp. 372–390, 2022. PERSPECTIVE 11

    2022

  12. [20]

    Nft-based data marketplace with digital watermarking,

    S. Ranjbar Alvar, M. Akbari, D. Yue, and Y . Zhang, “Nft-based data marketplace with digital watermarking,” in ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , 2023, pp. 4756– 4767

    2023

  13. [21]

    A survey of privacy attacks in machine learning,

    M. Rigaki and S. Garcia, “A survey of privacy attacks in machine learning,” ACM Computing Surveys , vol. 56, no. 4, pp. 1–34, 2023

    2023

  14. [22]

    Reconciling privacy and accuracy in ai for medical imaging,

    A. Ziller, T. T. Mueller, S. Stieger, L. F. Feiner, J. Brandt, R. Braren, D. Rueckert, and G. Kaissis, “Reconciling privacy and accuracy in ai for medical imaging,” Nature Machine Intelligence , vol. 6, no. 7, pp. 764–774, 2024

    2024

  15. [23]

    On responsible machine learning datasets emphasizing fairness, privacy and regulatory norms with examples in biometrics and healthcare,

    S. Mittal, K. Thakral, R. Singh, M. Vatsa, T. Glaser, C. Canton Ferrer, and T. Hassner, “On responsible machine learning datasets emphasizing fairness, privacy and regulatory norms with examples in biometrics and healthcare,” Nature Machine Intelligence , vol. 6, no. 8, pp. 93...

    2024

  16. [24]

    On benchmarking code llms for android malware analysis,

    Y . He, H. She, X. Qian, X. Zheng, Z. Chen, Z. Qin, and L. Cavallaro, “On benchmarking code llms for android malware analysis,” in ACM SIGSOFT International Symposium on Software Testing and Analysis Workshop, 2025

    2025

  17. [25]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Annual Conference on Neural Information Processing Systems , vol. 33, 2020, pp. 6840–6851

    2020

  18. [26]

    Samsung bans chatgpt among employees after sensitive code leak,

    S. Ray, “Samsung bans chatgpt among employees after sensitive code leak,” 2023. [Online]. Available: https://www.forbes.com/sites/siladitya ray/2023/05/02/samsung-bans-chatgpt-and-other-chatbots-for-emplo yees-after-sensitive-code-leak/

    2023

  19. [27]

    Chatgpt is banned in italy over privacy concerns,

    A. Satariano, “Chatgpt is banned in italy over privacy concerns,” 2023. [Online]. Available: https://www.nytimes.com/2023/03/31/technology/ chatgpt-italy-ban.html

    2023

  20. [28]

    Bridging the data provenance gap across text, speech and video,

    S. Longpre, N. Singh, M. Cherep, K. Tiwary, J. Materzynska, W. Bran- non, R. Mahari, N. Obeng-Marnu, M. Dey, M. Hamdy et al., “Bridging the data provenance gap across text, speech and video,” in International Conference on Learning Representations , 2025

    2025

  21. [29]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in ACM SIGSAC Conference on Computer and Communications Security , 2016, pp. 308–318

    2016

  22. [30]

    Black- box dataset ownership verification via backdoor watermarking,

    Y . Li, M. Zhu, X. Yang, Y . Jiang, T. Wei, and S.-T. Xia, “Black- box dataset ownership verification via backdoor watermarking,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 2318– 2332, 2023

    2023

  23. [31]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2009

    2009

  24. [32]

    k-anonymity: A model for protecting privacy,

    L. Sweeney, “k-anonymity: A model for protecting privacy,” Interna- tional Journal of Uncertainty, Fuzziness and Knowledge-based Systems , vol. 10, no. 05, pp. 557–570, 2002

    2002

  25. [33]

    Unlearn- able examples: Making personal data unexploitable,

    H. Huang, X. Ma, S. M. Erfani, J. Bailey, and Y . Wang, “Unlearn- able examples: Making personal data unexploitable,” in International Conference on Learning Representations , 2021

    2021

  26. [34]

    Sok: Dataset copyright auditing in machine learning systems,

    L. Du, X. Zhou, M. Chen, C. Zhang, Z. Su, P. Cheng, J. Chen, and Z. Zhang, “Sok: Dataset copyright auditing in machine learning systems,” in IEEE Symposium on Security and Privacy , 2025

    2025

  27. [35]

    Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection,

    Y . Li, Y . Bai, Y . Jiang, Y . Yang, S.-T. Xia, and B. Li, “Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection,” in Annual Conference on Neural Information Processing Systems, vol. 35, 2022, pp. 13 238–13 250

    2022

  28. [36]

    Zeromark: Towards dataset ownership verification without disclosing watermarks,

    J. Guo, Y . Li, R. Chen, Y . Wu, C. Liu, and H. Huang, “Zeromark: Towards dataset ownership verification without disclosing watermarks,” in Annual Conference on Neural Information Processing Systems , vol. 37, 2024, pp. 120 468–120 500

    2024

  29. [37]

    Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models,

    B. Li, Y . Wei, Y . Fu, Z. Wang, Y . Li, J. Zhang, R. Wang, and T. Zhang, “Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models,” in IEEE Symposium on Security and Privacy, 2025

    2025

  30. [38]

    Duwak: Dual water- marks in large language models,

    C. Zhu, J. Galjaard, P.-Y . Chen, and L. Chen, “Duwak: Dual water- marks in large language models,” in Findings of the Association for Computational Linguistics ACL 2024 , 2024, pp. 11 416–11 436

    2024

  31. [39]

    Tabwak: A watermark for tabular diffusion models,

    C. Zhu, J. Tang, J. M. Galjaard, P.-Y . Chen, R. Birke, C. Bos, L. Y . Chen et al., “Tabwak: A watermark for tabular diffusion models,” in International Conference on Learning Representations , 2025

    2025

  32. [40]

    Optimizing generative ai by backpropagating language model feedback,

    M. Yuksekgonul, F. Bianchi, J. Boen, S. Liu, P. Lu, Z. Huang, C. Guestrin, and J. Zou, “Optimizing generative ai by backpropagating language model feedback,” Nature, vol. 639, no. 8055, pp. 609–616, 2025

    2025

  33. [41]

    Move: Effective and harmless ownership verification via embedded external features,

    Y . Li, L. Zhu, X. Jia, Y . Bai, Y . Jiang, S.-T. Xia, X. Cao, and K. Ren, “Move: Effective and harmless ownership verification via embedded external features,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  34. [42]

    I know what you trained last summer: A survey on stealing machine learning models and defences,

    D. Oliynyk, R. Mayer, and A. Rauber, “I know what you trained last summer: A survey on stealing machine learning models and defences,” ACM Computing Surveys , vol. 55, no. 14s, pp. 1–41, 2023

    2023

  35. [43]

    Explanation as a watermark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution,

    S. Shao, Y . Li, H. Yao, Y . He, Z. Qin, and K. Ren, “Explanation as a watermark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution,” in Network and Distributed System Security Symposium, 2025

    2025

  36. [44]

    Sleepermark: Towards robust watermark against fine-tuning text-to- image diffusion models,

    Z. Wang, J. Guo, J. Zhu, Y . Li, H. Huang, M. Chen, and Z. Tu, “Sleepermark: Towards robust watermark against fine-tuning text-to- image diffusion models,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025

    2025

  37. [45]

    Leveraging language model for advanced multiproperty molecular optimization via prompt engineering,

    Z. Wu, O. Zhang, X. Wang, L. Fu, H. Zhao, J. Wang, H. Du, D. Jiang, Y . Deng, D. Cao et al. , “Leveraging language model for advanced multiproperty molecular optimization via prompt engineering,” Nature Machine Intelligence, vol. 6, no. 11, pp. 1359–1369, 2024

    2024

  38. [46]

    Extracting accurate materials data from research papers with conversational language models and prompt engineering,

    M. P. Polak and D. Morgan, “Extracting accurate materials data from research papers with conversational language models and prompt engineering,” Nature Communications, vol. 15, no. 1, p. 1569, 2024

    2024

  39. [47]

    Retrieval- augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. Küttler, M. Lewis, W.-t. Yih, T. Rocktäschel et al. , “Retrieval- augmented generation for knowledge-intensive nlp tasks,” in Annual Conference on Neural Information Processing Systems , vol. 33, 2020, pp. ...

    2020

  40. [48]

    Evaluating retrieval quality in retrieval- augmented generation,

    A. Salemi and H. Zamani, “Evaluating retrieval quality in retrieval- augmented generation,” in International ACM SIGIR Conference on Research and Development in Information Retrieval , 2024, pp. 2395– 2400

    2024

  41. [49]

    Promptcare: Prompt copyright protection by watermark injection and verification,

    H. Yao, J. Lou, Z. Qin, and K. Ren, “Promptcare: Prompt copyright protection by watermark injection and verification,” in IEEE Symposium on Security and Privacy . IEEE, 2024, pp. 845–861

    2024

  42. [50]

    Prompt stealing attacks against text-to-image generation models,

    X. Shen, Y . Qu, M. Backes, and Y . Zhang, “Prompt stealing attacks against text-to-image generation models,” in USENIX Security Sympo- sium, 2024, pp. 5823–5840

    2024

  43. [51]

    A survey on rag meeting llms: Towards retrieval-augmented large language models,

    W. Fan, Y . Ding, L. Ning, S. Wang, H. Li, D. Yin, T.-S. Chua, and Q. Li, “A survey on rag meeting llms: Towards retrieval-augmented large language models,” in ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , 2024, pp. 6491–6501

    2024

  44. [52]

    When machine learning meets privacy: A survey and outlook,

    B. Liu, M. Ding, S. Shaham, W. Rahayu, F. Farokhi, and Z. Lin, “When machine learning meets privacy: A survey and outlook,” ACM Computing Surveys, vol. 54, no. 2, pp. 1–36, 2021

    2021

  45. [53]

    Achieving secure, scalable, and fine-grained data access control in cloud computing,

    S. Yu, C. Wang, K. Ren, and W. Lou, “Achieving secure, scalable, and fine-grained data access control in cloud computing,” in IEEE International Conference on Computer Communications . IEEE, 2010, pp. 1–9

    2010

  46. [54]

    A blockchain- based auditable access control system for private data in service-centric iot environments,

    D. Han, Y . Zhu, D. Li, W. Liang, A. Souri, and K.-C. Li, “A blockchain- based auditable access control system for private data in service-centric iot environments,” IEEE Transactions on Industrial Informatics , vol. 18, no. 5, pp. 3530–3540, 2021

    2021

  47. [55]

    Cheetah: Lean and fast secure two-party deep neural network inference,

    Z. Huang, W.-j. Lu, C. Hong, and J. Ding, “Cheetah: Lean and fast secure two-party deep neural network inference,” in USENIX Security Symposium, 2022, pp. 809–826

    2022

  48. [56]

    Secure transformer inference made non- interactive,

    J. Zhang, X. Yang, L. He, K. Chen, W.-j. Lu, Y . Wang, X. Hou, J. Liu, K. Ren, and X. Yang, “Secure transformer inference made non- interactive,” in Network and Distributed System Security Symposium , 2025

    2025

  49. [57]

    Prompt inversion attack against collaborative inference of large language models,

    W. Qu, Y . Zhou, Y . Wu, T. Xiao, B. Yuan, Y . Li, and J. Zhang, “Prompt inversion attack against collaborative inference of large language models,” in IEEE Symposium on Security and Privacy , 2025

    2025

  50. [58]

    Palm-e: An embodied multimodal language model,

    D. Driess, F. Xia, M. S. Sajjadi, C. Lynch, A. Chowdhery, B. Ichter, A. Wahid, J. Tompson, Q. Vuong, T. Yu et al., “Palm-e: An embodied multimodal language model,” in International Conference on Machine Learning. PMLR, 2023, pp. 8469–8488

    2023

  51. [59]

    Towards transparency and knowledge exchange in ai-assisted data analysis code generation,

    R. Haase, “Towards transparency and knowledge exchange in ai-assisted data analysis code generation,” Nature Computational Science , pp. 1–2, 2025

    2025

  52. [60]

    Sok: On the role and future of aigc watermarking in the era of gen-ai,

    K. Ren, Z. Yang, L. Lu, J. Liu, Y . Li, J. Wan, X. Zhao, X. Feng, and S. Shao, “Sok: On the role and future of aigc watermarking in the era of gen-ai,” arXiv preprint arXiv:2411.11478 , 2024

    2024 arXiv

  53. [61]

    Sok: Watermarking for ai-generated content,

    X. Zhao, S. Gunn, M. Christ, J. Fairoze, A. Fabrega, N. Carlini, S. Garg, S. Hong, M. Nasr, F. Tramer et al., “Sok: Watermarking for ai-generated content,” in IEEE Symposium on Security and Privacy , 2025

    2025

  54. [62]

    Generative ai meets copyright,

    P. Samuelson, “Generative ai meets copyright,” Science, vol. 381, no. 6654, pp. 158–161, 2023

    2023

  55. [63]

    Radar: Robust ai-text detection via adversarial learning,

    X. Hu, P.-Y . Chen, and T.-Y . Ho, “Radar: Robust ai-text detection via adversarial learning,” in Annual Conference on Neural Information PERSPECTIVE 12 Processing Systems, vol. 36, 2023, pp. 15 077–15 095

    2023

  56. [64]

    Rigid: A training-free and model- agnostic framework for robust ai-generated image detection,

    Z. He, P.-Y . Chen, and T.-Y . Ho, “Rigid: A training-free and model- agnostic framework for robust ai-generated image detection,” arXiv preprint arXiv:2405.20112, 2024

    2024 arXiv

  57. [65]

    Where are we in audio deepfake detection? a systematic analysis over generative and detection models,

    X. Li, P.-Y . Chen, and W. Wei, “Where are we in audio deepfake detection? a systematic analysis over generative and detection models,” ACM Transactions on Internet Technology , 2025

    2025

  58. [66]

    Knowledge distillation: A survey,

    J. Gou, B. Yu, S. J. Maybank, and D. Tao, “Knowledge distillation: A survey,” International Journal of Computer Vision , vol. 129, no. 6, pp. 1789–1819, 2021

    2021

  59. [67]

    Decoding the ai pen: Techniques and challenges in detecting ai-generated text,

    S. Abdali, R. Anarfi, C. Barberan, and J. He, “Decoding the ai pen: Techniques and challenges in detecting ai-generated text,” in ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2024, pp. 6428–6436

    2024

  60. [68]

    Glaze: Protecting artists from style mimicry by text-to-image models,

    S. Shan, J. Cryan, E. Wenger, H. Zheng, R. Hanocka, and B. Y . Zhao, “Glaze: Protecting artists from style mimicry by text-to-image models,” in USENIX Security Symposium , 2023, pp. 2187–2204

    2023

  61. [69]

    Calibrating noise to sensitivity in private data analysis,

    C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in Theory of Cryptography Conference. Springer, 2006, pp. 265–284

    2006

  62. [70]

    Safeear: Content privacy-preserving audio deepfake detection,

    X. Li, K. Li, Y . Zheng, C. Yan, X. Ji, and W. Xu, “Safeear: Content privacy-preserving audio deepfake detection,” in ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 3585– 3599

    2024

  63. [71]

    Data protection in ai services: A survey,

    C. Meurisch and M. Mühlhäuser, “Data protection in ai services: A survey,” ACM Computing Surveys , vol. 54, no. 2, pp. 1–38, 2021

    2021

  64. [72]

    Privacy-preserving deep learning,

    R. Shokri and V . Shmatikov, “Privacy-preserving deep learning,” in ACM SIGSAC Conference on Computer and Communications Security , 2015, pp. 1310–1321

    2015

  65. [73]

    Backdoor learning: A survey,

    Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” IEEE Transactions on Neural Networks and Learning Systems , vol. 35, no. 1, pp. 5–22, 2022

    2022

  66. [74]

    Medical large language models are vulnerable to data-poisoning attacks,

    D. A. Alber, Z. Yang, A. Alyakin, E. Yang, S. Rai, A. A. Valliani, J. Zhang, G. R. Rosenbaum, A. K. Amend-Thomas, D. B. Kurland et al., “Medical large language models are vulnerable to data-poisoning attacks,” Nature Medicine, pp. 1–9, 2025

    2025

  67. [75]

    Refine: Inversion-free backdoor defense via model reprogramming,

    Y . Chen, S. Shao, E. Huang, Y . Li, P.-Y . Chen, Z. Qin, and K. Ren, “Refine: Inversion-free backdoor defense via model reprogramming,” in International Conference on Learning Representations , 2025

    2025

  68. [76]

    Which model generated this image? a model-agnostic approach for origin attribution,

    F. Liu, H. Luo, Y . Li, P. Torr, and J. Gu, “Which model generated this image? a model-agnostic approach for origin attribution,” in European Conference on Computer Vision , 2024, pp. 282–301

    2024

  69. [77]

    Machine unlearning,

    L. Bourtoule, V . Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, “Machine unlearning,” in IEEE Symposium on Security and Privacy . IEEE, 2021, pp. 141–159

    2021

  70. [78]

    Communication theory of secrecy systems,

    C. E. Shannon, “Communication theory of secrecy systems,” The Bell System Technical Journal, vol. 28, no. 4, pp. 656–715, 1949

    1949

  71. [79]

    New directions in cryptography,

    W. Diffie and M. E. Hellman, “New directions in cryptography,” IEEE Transactions on Information Theory , vol. 22, no. 6, 1976

    1976

  72. [80]

    Encryption and steganog- raphy of synthetic gene circuits,

    O. Purcell, J. Wang, P. Siuti, and T. K. Lu, “Encryption and steganog- raphy of synthetic gene circuits,” Nature Communications, vol. 9, no. 1, p. 4942, 2018

    2018

  73. [81]

    Dac-macs: Effective data access control for multiauthority cloud storage systems,

    K. Yang, X. Jia, K. Ren, B. Zhang, and R. Xie, “Dac-macs: Effective data access control for multiauthority cloud storage systems,” IEEE Transactions on Information Forensics and Security , vol. 8, no. 11, pp. 1790–1801, 2013

    2013

  74. [82]

    Protecting intellectual property with reliable availability of learning models in ai-based cybersecurity services,

    G. Ren, J. Wu, G. Li, S. Li, and M. Guizani, “Protecting intellectual property with reliable availability of learning models in ai-based cybersecurity services,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 2, pp. 600–617, 2022

    2022

  75. [83]

    Activedaemon: Unconscious dnn dormancy and waking up via user-specific invisible token,

    G. Ren, G. Li, S. Li, L. Chen, and K. Ren, “Activedaemon: Unconscious dnn dormancy and waking up via user-specific invisible token,” in Network and Distributed System Security Symposium , 2024

    2024

  76. [84]

    Non-transferable learning: A new approach for model ownership verification and applicability authorization,

    L. Wang, S. Xu, R. Xu, X. Wang, and Q. Zhu, “Non-transferable learning: A new approach for model ownership verification and applicability authorization,” in International Conference on Learning Representations, 2021

    2021

  77. [85]

    Improving non-transferable representation learning by harnessing content and style,

    Z. Hong, Z. Wang, L. Shen, Y . Yao, Z. Huang, S. Chen, C. Yang, M. Gong, and T. Liu, “Improving non-transferable representation learning by harnessing content and style,” in International Conference on Learning Representations , 2024

    2024

  78. [86]

    A gan-based defense framework against model inversion attacks,

    X. Gong, Z. Wang, S. Li, Y . Chen, and Q. Wang, “A gan-based defense framework against model inversion attacks,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 4475–4487, 2023

    2023

  79. [87]

    l-diversity: Privacy beyond k-anonymity,

    A. Machanavajjhala, D. Kifer, J. Gehrke, and M. Venkitasubramaniam, “l-diversity: Privacy beyond k-anonymity,” ACM Transactions on Knowl- edge Discovery from Data , vol. 1, no. 1, pp. 3–54, 2007

    2007

  80. [88]

    Composition attacks and auxiliary information in data privacy,

    S. R. Ganta, S. P. Kasiviswanathan, and A. Smith, “Composition attacks and auxiliary information in data privacy,” in ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , 2008, pp. 265–273

    2008

  81. [89]

    Locally differentially private document generation using zero shot prompting,

    S. Utpala, S. Hooker, and P.-Y . Chen, “Locally differentially private document generation using zero shot prompting,” in Conference on Empirical Methods in Natural Language Processing , 2023

    2023

  82. [90]

    Local differentially private heavy hitter detection in data streams with bounded memory,

    X. Li, W. Liu, J. Lou, Y . Hong, L. Zhang, Z. Qin, and K. Ren, “Local differentially private heavy hitter detection in data streams with bounded memory,” ACM SIGMOD/PODS International Conference on Management of Data , vol. 2, no. 1, pp. 1–27, 2024

    2024

  83. [91]

    Pate-gan: Generating synthetic data with differential privacy guarantees,

    J. Jordon, J. Yoon, and M. Van Der Schaar, “Pate-gan: Generating synthetic data with differential privacy guarantees,” in International Conference on Learning Representations , 2018

    2018

  84. [92]

    Public-key cryptosystems based on composite degree residuosity classes,

    P. Paillier, “Public-key cryptosystems based on composite degree residuosity classes,” in International Conference on the Theory and Applications of Cryptographic Techniques . Springer, 1999, pp. 223– 238

    1999

  85. [93]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in International Conference on Artificial Intelligence and Statistics. PMLR, 2017, pp. 1273–1282

    2017

  86. [94]

    Distributed learning of deep neural network over multiple agents,

    O. Gupta and R. Raskar, “Distributed learning of deep neural network over multiple agents,” Journal of Network and Computer Applications , vol. 116, pp. 1–8, 2018

    2018

  87. [95]

    Data-driven federated learning in drug discovery with knowledge distillation,

    T. Hanser, E. Ahlberg, A. Amberg, L. T. Anger, C. Barber, R. J. Brennan, A. Brigo, A. Delaunois, S. Glowienke, N. Greene et al., “Data-driven federated learning in drug discovery with knowledge distillation,” Nature Machine Intelligence, pp. 1–14, 2025

    2025

  88. [96]

    Domain watermark: Effective and harmless dataset copyright protection is closed at hand,

    J. Guo, Y . Li, L. Wang, S.-T. Xia, H. Huang, C. Liu, and B. Li, “Domain watermark: Effective and harmless dataset copyright protection is closed at hand,” in Annual Conference on Neural Information Processing Systems, vol. 36, 2024

    2024

  89. [97]

    Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark,

    C. Wei, Y . Wang, K. Gao, S. Shao, Y . Li, Z. Wang, and Z. Qin, “Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark,” IEEE Transactions on Information Forensics and Security , 2024

    2024

  90. [98]

    Defending against model stealing via verifying embedded external features,

    Y . Li, L. Zhu, X. Jia, Y . Jiang, S.-T. Xia, and X. Cao, “Defending against model stealing via verifying embedded external features,” in AAAI Conference on Artificial Intelligence , vol. 36, no. 2, 2022, pp. 1464–1472

    2022

  91. [99]

    Fedtracker: Furnishing ownership verification and traceability for federated learning model,

    S. Shao, W. Yang, H. Gu, Z. Qin, L. Fan, Q. Yang, and K. Ren, “Fedtracker: Furnishing ownership verification and traceability for federated learning model,” IEEE Transactions on Dependable and Secure Computing, vol. 22, no. 1, pp. 114–131, 2024

    2024

  92. [100]

    Fragile watermarking with error-free restoration capability,

    X. Zhang and S. Wang, “Fragile watermarking with error-free restoration capability,” IEEE Transactions on Multimedia , vol. 10, no. 8, pp. 1490– 1499, 2008

    2008

  93. [101]

    Neunac: A novel fragile watermarking algorithm for integrity protection of neural networks,

    M. Botta, D. Cavagnino, and R. Esposito, “Neunac: A novel fragile watermarking algorithm for integrity protection of neural networks,” Information Sciences, vol. 576, pp. 228–241, 2021

    2021

  94. [102]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in IEEE Symposium on Security and Privacy . IEEE, 2017, pp. 3–18

    2017

  95. [103]

    Towards label-only membership inference attack against pre-trained large language models,

    Y . He, B. Li, L. Liu, Z. Ba, W. Dong, Y . Li, Z. Qin, K. Ren, and C. Chen, “Towards label-only membership inference attack against pre-trained large language models,” in USENIX Security Symposium , 2025

    2025

  96. [104]

    Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,

    X. Cao, J. Jia, and N. Z. Gong, “Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,” in ACM Asia Conference on Computer and Communications Security , 2021, pp. 14–25

    2021

  97. [105]

    Llmmap: Finger- printing for large language models,

    D. Pasquini, E. M. Kornaropoulos, and G. Ateniese, “Llmmap: Finger- printing for large language models,” in USENIX Security Symposium , 2025

    2025

  98. [106]

    A digital signature based on a conventional encryption function,

    R. C. Merkle, “A digital signature based on a conventional encryption function,” in Conference on the Theory and Application of Cryptographic Techniques. Springer, 1987, pp. 369–378

    1987

  99. [107]

    The md4 message digest algorithm,

    R. L. Rivest, “The md4 message digest algorithm,” in International Cryptology Conference. Springer, 1991, pp. 303–311

    1991

  100. [108]

    A survey of blockchain-based strategies for healthcare,

    E. J. De Aguiar, B. S. Faiçal, B. Krishnamachari, and J. Ueyama, “A survey of blockchain-based strategies for healthcare,” ACM Computing Surveys, vol. 53, no. 2, pp. 1–27, 2020

    2020

  101. [109]

    Smartphone-based dna diagnostics for malaria detection using deep learning for local decision support and blockchain technology for security,

    X. Guo, M. A. Khalid, I. Domingos, A. L. Michala, M. Adriko, C. Rowel, D. Ajambo, A. Garrett, S. Kar, X. Yan et al., “Smartphone-based dna diagnostics for malaria detection using deep learning for local decision support and blockchain technology for security,” Nature Electroni...

    2021

  102. [110]

    Eraser: Machine unlearning in mlaas via an inference serving-aware approach,

    Y . Hu, J. Lou, J. Liu, W. Ni, F. Lin, Z. Qin, and K. Ren, “Eraser: Machine unlearning in mlaas via an inference serving-aware approach,” in ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 3883–3897

    2024

  103. [111]

    Certified data removal from machine learning models,

    C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten, “Certified data removal from machine learning models,” in International Conference on Machine Learning , 2020, pp. 3832–3842

    2020

  104. [112]

    Certified minimax unlearning with generalization rates and deletion capacity,

    J. Liu, J. Lou, Z. Qin, and K. Ren, “Certified minimax unlearning with generalization rates and deletion capacity,” in Annual Conference on Neural Information Processing Systems , 2023

    2023

  105. [113]

    Wagle: Strategic weight attribution for effective and modular unlearning in large language models,

    J. Jia, J. Liu, Y . Zhang, P. Ram, N. B. Angel, and S. Liu, “Wagle: Strategic weight attribution for effective and modular unlearning in large language models,” in Annual Conference on Neural Information Processing Systems, 2024

    2024

  106. [114]

    California consumer privacy act,

    C. S. Legislature, “California consumer privacy act,” 2018, uSA. [Online]. Available: https://leginfo.legislature.ca.gov/faces/billCompare Client.xhtml?bill_id=201720180AB375

    2018

  107. [115]

    Federal zero trust data security guide,

    Z. T. Z. D. S. W. Group, “Federal zero trust data security guide,” 2024. [Online]. Available: https://www.cio.gov/assets/files/Zero-Trust-Data-S ecurity-Guide_Oct24-Final.pdf

    2024

  108. [116]

    Ethics guidelines for trustworthy ai,

    E. Commission, “Ethics guidelines for trustworthy ai,” 2019, eU. [Online]. Available: https://digital-strategy.ec.europa.eu/en/library/ethics -guidelines-trustworthy-ai

    2019

  109. [117]

    General-purpose ai code of practice (draft),

    E. Union, “General-purpose ai code of practice (draft),” 2025, eU; Found via news article on computing.co.uk. [Online]. Available: https://www.computing.co.uk/news/2025/legislation-regulation/third-d raft-of-general-purpose-ai-code-of-practice-published

    2025

  110. [118]

    Cybersecurity law of the prc,

    C. A. of China, “Cybersecurity law of the prc,” 2016, china. [Online]. Available: https://www.cac.gov.cn/2016-11/07/c_1119867116.htm

    2016

  111. [119]

    Data security law of the people’s republic of china,

    T. S. C. of the National People’s Congress, “Data security law of the people’s republic of china,” 2021. [Online]. Available: https://www.cac.gov.cn/2021-06/11/c_1624994566919140.htm

    2021

  112. [120]

    Personal information protection law of the prc,

    G. of the People’s Republic of China, “Personal information protection law of the prc,” 2021, china. [Online]. Available: https://www.gov.cn/xinwen/2021-08/20/content_5632486.htm

    2021

  113. [121]

    Administrative measures for generative artificial intelligence services,

    C. A. of China, “Administrative measures for generative artificial intelligence services,” 2023, china. [Online]. Available: https: //www.cac.gov.cn/2023-07/13/c_1690898327029107.htm

    2023

  114. [122]

    Action plan of the development of trustworthy data space,

    N. D. Administration, “Action plan of the development of trustworthy data space,” 2024, china. [Online]. Available: https://www.nda.gov.cn/s jj/zwgk/zcfb/1122/20241122164142182915964_pc.html

    2024

  115. [123]

    Implementation plan on improving data circulation security governance to better promote the marketization and valorization of data elements,

    N. Development and R. Commission, “Implementation plan on improving data circulation security governance to better promote the marketization and valorization of data elements,” 2025, china. [Online]. Available: https://www.ndrc.gov.cn/xwdt/tzgg/202501/t20250115_139 5694.html

    2025

  116. [124]

    Methods for identifying synthetic content generated by artificial intelligence,

    C. A. of China, “Methods for identifying synthetic content generated by artificial intelligence,” 2025, china. [Online]. Available: https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm

    2025

  117. [125]

    Artificial intelligence mission austria 2030,

    A. Ministry, “Artificial intelligence mission austria 2030,” 2019, austria. [Online]. Available: https://www.bmk.gv.at/themen/innovation/publikat ionen/ikt/ai/aimat.html

    2019

  118. [126]

    Artificial intelligence and data act,

    G. of Canada, “Artificial intelligence and data act,” 2022, canada; URL links to a companion document. [Online]. Available: https://ised-isde.canada.ca/site/innovation-better-canada/en/artificial-i ntelligence-and-data-act-aida-companion-document

    2022

  119. [127]

    Brazilian ai regulation,

    B. Senate, “Brazilian ai regulation,” 2023, brazil. [Online]. Available: https://www25.senado.leg.br/web/atividade/materias/-/materia/157233

    2023

  120. [128]

    Enhancing Access to and Sharing of Data in the Age of Artificial Intelligence,

    OECD, “Enhancing Access to and Sharing of Data in the Age of Artificial Intelligence,” 2025, [Online; accessed date]. [Online]. Available: https://www.oecd.org/en/publications/enhancing-access-to-a nd-sharing-of-data-in-the-age-of-artificial-intelligence_23a70dca-en. html

    2025

  121. [129]

    Joint statement on building trustworthy data governance frameworks to encourage development of innovative and privacy-protective ai,

    O. of the Australian Information Commissioner, “Joint statement on building trustworthy data governance frameworks to encourage development of innovative and privacy-protective ai,” 2025, joint Statement. [Online]. Available: https://www.oaic.gov.au/news/media-c entre/joint-st...

    2025

  122. [130]

    Fit-print: Towards false-claim-resistant model ownership verification via targeted fingerprint,

    S. Shao, H. Zhu, H. Yao, Y . Li, T. Zhang, Z. Qin, and K. Ren, “Fit-print: Towards false-claim-resistant model ownership verification via targeted fingerprint,” arXiv preprint arXiv:2501.15509 , 2025

    2025 arXiv

  123. [131]

    Safegen: Mitigating sexually explicit content generation in text-to-image models,

    X. Li, Y . Yang, J. Deng, C. Yan, Y . Chen, X. Ji, and W. Xu, “Safegen: Mitigating sexually explicit content generation in text-to-image models,” in ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 4807–4821

    2024

  124. [132]

    Deepfake detection: A comprehensive survey from the reliability perspective,

    T. Wang, X. Liao, K. P. Chow, X. Lin, and Y . Wang, “Deepfake detection: A comprehensive survey from the reliability perspective,” ACM Computing Surveys , vol. 57, no. 3, pp. 1–35, 2024

    2024

  125. [133]

    A survey on bias and fairness in machine learning,

    N. Mehrabi, F. Morstatter, N. Saxena, K. Lerman, and A. Galstyan, “A survey on bias and fairness in machine learning,” ACM Computing Surveys, vol. 54, no. 6, pp. 1–35, 2021

    2021

  126. [134]

    A benchmark for semantic sensitive information in llms outputs,

    Q. Zhang, H. Qiu, D. Wang, Y . Li, T. Zhang, W. Zhu, H. Weng, L. Yan, and C. Zhang, “A benchmark for semantic sensitive information in llms outputs,” in International Conference on Learning Representations , 2025

    2025

  127. [135]

    Defending chatgpt against jailbreak attack via self-reminders,

    Y . Xie, J. Yi, J. Shao, J. Curl, L. Lyu, Q. Chen, X. Xie, and F. Wu, “Defending chatgpt against jailbreak attack via self-reminders,” Nature Machine Intelligence, vol. 5, no. 12, pp. 1486–1496, 2023

    2023

  128. [136]

    Extracting training data from large language models,

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. B. Brown, D. Song, U. Erlingsson, A. Oprea, and C. Raffel, “Extracting training data from large language models,” in USENIX Security Symposium , 2021, pp. 1–18

    2021

  129. [137]

    Computational safety for generative ai: A signal processing perspective,

    P.-Y . Chen, “Computational safety for generative ai: A signal processing perspective,” arXiv preprint arXiv:2502.12445 , 2025

    2025

  130. [138]

    Adv-watermark: A novel watermark perturbation for adversarial examples,

    X. Jia, X. Wei, X. Cao, and X. Han, “Adv-watermark: A novel watermark perturbation for adversarial examples,” in ACM International Conference on Multimedia, 2020, pp. 1579–1587

    2020

  131. [139]

    Watermark vaccine: Adversarial attacks to prevent watermark removal,

    X. Liu, J. Liu, Y . Bai, J. Gu, T. Chen, X. Jia, and X. Cao, “Watermark vaccine: Adversarial attacks to prevent watermark removal,” inEuropean Conference on Computer Vision . Springer, 2022, pp. 1–17

    2022

  132. [140]

    Distilling the knowledge in a neural network,

    G. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,” in Annual Conference on Neural Information Processing Systems Workshop, 2014

    2014

  133. [141]

    Model-agnostic meta-learning for fast adaptation of deep networks,

    C. Finn, P. Abbeel, and S. Levine, “Model-agnostic meta-learning for fast adaptation of deep networks,” in International Conference on Machine Learning. PMLR, 2017, pp. 1126–1135

    2017

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.