Pith. sign in

REVIEW 4 major objections 5 minor 299 references

A foundation-model AI can be private, verifiable, and auditable at once, the thesis argues, with working prototypes for each pillar.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A thesis demonstrating partial prototypes for zk-verifiable model evaluation and privacy-preserving retrieval, and arguing these pieces can compose into end-to-end auditable AI systems.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection A transparent compilation of solid prior work; PRAG is the real contribution but its core privacy claim is unproven, so treat the synthesis as conditional. the 4 major comments →

arxiv 2509.00085 v1 pith:SMMKKY6J submitted 2025-08-27 cs.CR cs.AIcs.CY

Private, Verifiable, and Auditable AI Systems

Tobin South This is my paper
classification cs.CR cs.AIcs.CY
keywords zero-knowledge proofszkSNARKsverifiable model evaluationprivate retrieval augmented generationmulti-party computationtrusted execution environmentsAI agent delegationAI auditability
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This thesis argues that the three demands that usually pull AI systems in opposite directions—keeping queries and model weights secret, letting outsiders verify what a system actually did, and keeping an auditable record—can be engineered together rather than traded off. Its central technical claims are three: zero-knowledge proofs turn a private-weight model's benchmark results into publicly checkable attestations; multi-party computation over a secret-shared document index answers retrieval-augmented-generation queries without any server seeing the question or the corpus; and standard web authentication flows can be extended so people delegate limited, auditable authority to AI agents. Each piece is demonstrated with working implementations running from small regression and image models up to a small GPT-style language model. If the pieces hold, closed-weight model vendors, holders of sensitive corpora, and agent platforms would no longer have to be trusted on faith.

Core claim

The thesis claims that the friction between privacy, verifiability, and auditability in foundation-model AI is a design problem, not a law of nature, and that existing cryptographic primitives can already resolve it. For closed-weight models, it packages repeated zkSNARK proofs of inference over a benchmark into a verifiable evaluation attestation tied to a hash of the model weights: anyone can confirm an accuracy or fairness claim without seeing the weights, and a later inference can be challenged to confirm the served model matches the attested one. For retrieval-augmented generation, it introduces PRAG, a protocol in which a query embedding is secret-shared across servers holding a secret

What carries the argument

The argument rides on three mechanisms. A zkSNARK 'predict, then prove' pipeline—built on the thesis's ezkl toolkit, which compiles any ONNX-format model into a proof circuit under fixed-point quantization and folds a zero-knowledge hash of the model weights into every proof—is what turns 'this model scored X' into a claim anyone can check without the weights. A secret-shared inverted-file index queried inside multi-party computation, combining an MPC top-k over cluster centroids with oblivious retrieval of candidate vectors, is what lets PRAG do approximate nearest-neighbor search while hiding both query and database. Delegation credentials extending OpenID Connect and User-Managed Access b

Load-bearing premise

PRAG's privacy guarantee assumes a majority of honest-but-curious servers and a corpus that was correctly secret-shared before any query, while the zk evaluation proofs vouch for quantized inference rather than the exact model; if any of those premises fails, the corresponding claim collapses.

What would settle it

Run PRAG with a majority of servers that actively deviate and check whether query embeddings or document contents are exposed, and test whether adversarially chosen inputs can make a zk evaluation attestation diverge from the full-precision model's true output. A third check: see whether a predict-then-prove endpoint can slip in a different model between the served prediction and the later proof, since the thesis concedes challenge-based audits only prove the provider possesses the attested model.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A model vendor could publish benchmark, bias, or safety attestations that any user or regulator can verify without access to model weights, then have live outputs challenged to confirm the model being served is the one attested.
  • Organizations could pool sensitive documents into a secret-shared retrieval index so LLM question-answering draws on distributed private data while no single server sees the documents or the queries.
  • RAG gives LLM systems a built-in audit trail and updatability: outputs trace to the retrieved records that grounded them, and erroneous or stale records can be corrected or deleted without retraining the model.
  • AI agents could carry authenticated, scope-limited delegation credentials verified through existing OAuth/OpenID infrastructure, letting third parties confirm who authorized an action and under what constraints.
  • Verifiable evaluation attestations are small, portable, and cheap to verify, so they can be mirrored and hosted anywhere; the heavy proof cost sits with the model provider, not the auditor.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The predict-then-prove design implies verification can be decoupled from response latency, so as proof costs fall, challenge-based spot audits could become the default in regulated settings—full attestation becomes the baseline, and random or suspicion-triggered challenges enforce it.
  • The same secret-shared retrieval machinery that hides queries and corpora could generalize to other database-side analytics, suggesting a pattern for federated knowledge systems beyond LLM question answering.
  • Two extensions would determine how far the approach travels: a malicious-party-secure version of PRAG, or an accounting of the one-time cost of building the secret-shared index, and a rigorous bound on how much fixed-point quantization lets a zk proof diverge from full-precision model behavior.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript is a PhD thesis that assembles several published and unpublished papers into a unified argument that privacy, verifiability, and auditability can be jointly engineered into foundation-model-based AI systems. Chapter 1 frames the risk landscape and a roadmap coupling cryptographic and confidential-computing tools. Chapter 2 develops zero-knowledge proofs (zkSNARKs) for verifiable model evaluation, sketches partial verification of AI systems, and applies the same primitives to portable data attestations. Chapter 3 is the technical core: it introduces PRAG, a multi-party-computation (MPC) protocol for private retrieval-augmented generation that claims to hide both client queries and the retrieved database, alongside a TEE-based RAG architecture. Chapter 4 treats authenticated delegation and personhood credentials for AI agents, and Chapter 5 synthesizes these components. The strongest concrete results are the verifiable-evaluation experiments on small models (MLP, CNN, LSTM, nanoGPT) and the PRAG experiments on synthetic and real embedding data, reporting accuracy and runtime against non-secure baselines.

Significance. If the claims are correct, the manuscript offers two substantive contributions: (a) a working, open-source route to verifiable evaluations of closed-weight models using zkSNARKs, demonstrated across several model classes; and (b) a first-of-its-kind MPC-based private RAG protocol that hides both query and database from any single server, with an IVF approximation intended to achieve sublinear communication. The thesis is honest about many practical limitations, including slow proving, quantization drift, the semi-honest assumption, and the absence of end-to-end system integration. It also ships reproducible artifacts (ezkl, a Crypten-based PRAG implementation, GitHub code), which is a concrete strength. However, the central security claim of PRAG is not accompanied by a formal proof, and the advertised sublinear communication is not actually established for the described protocol. These are load-bearing gaps that prevent the manuscript from being accepted in its current form.

major comments (4)
  1. [§3.2.1.4, Algorithm 1] The paper claims sublinear communication for ΠIVFQuery, but the described candidate-reduction step computes [candidates] := MatMult([closest buckets], [IVF]), where [closest buckets] is an nprobe×nc one-hot matrix and [IVF] has size nc×m×d. With nc=α√N and m=O(√N), a standard Shamir MPC matrix product requires communication O(nprobe·nc·m·d)=O(nprobe·N·d), linear in N. To realize the claimed sublinear behavior, the protocol needs a genuinely sublinear oblivious-selection primitive and a precise cost model; neither is specified or analyzed. This affects the headline contribution of the IVF protocol and must be corrected, or the claims scaled back.
  2. [§3.2.1.1, Algorithm 1] The central privacy guarantee — that no server observes a client's query or can see the database content — is stated but not proven. There is no ideal/real simulation, no leakage analysis for the repeated argmax/scale-down used in ExactTopk, no treatment of fixed-point truncation after multiplications, and no analysis of the padding pattern in fixed-size clusters or tie-breaking in distance comparisons. The experiments (Figs. 3.3, 3.4) measure only runtime and retrieval accuracy, not leakage. The semi-honest, honest-majority assumption alone does not rule out order/timing/tie leaks. A formal security statement with a simulation-based proof, or at least a precise leakage profile, is required for the main protocol.
  3. [§2.1.3, §2.1.8.3, Table 2.1] The verifiable-evaluation attestation is produced for a fixed-point quantized circuit, and the model-weight hash H(W) and witness outputs are quantized. The thesis does not formally state the relationship between the attested quantized model and the original float model, nor does it bound the accuracy difference caused by quantization. Because the calibration procedure is run on the benchmark test set (Sec. 2.1.8.3), the attestation can be tuned to that test set. The paper should state precisely what property is proven (e.g., existence of a quantized model with weights W_quant that achieves metric A on the quantized benchmark) and how that relates to the claim 'models with fixed private weights achieve stated performance'.
  4. [§2.2] This section is presented as a contribution ('Verifiable computation of partial AI systems') but is only a project abstract. No protocol definition, threat model, security argument, or experiments are provided. As written, this purported contribution cannot be evaluated. It should either be removed from the list of claimed contributions or developed at the same level of detail as Section 2.1.
minor comments (5)
  1. [§3.2.1.2] The text says 'we run argmax([x]) to get the current minimum's index'; if the goal is the minimum, the function should be argmin. Please correct the terminology or clarify the convention.
  2. [Figure 2.3 caption] 'multi-layered perceptions' should read 'multi-layer perceptrons'.
  3. [Table 2.1] Specify whether Prove Time is per inference, per token, or per entire benchmark; the nanoGPT entry (2781 s) is ambiguous without this context.
  4. [Figure 3.4] The axes should be labeled more explicitly, especially the x-axis of the accuracy/nprobe plot (fraction nprobe/nc) and the y-axis of the scaling plot (time per query).
  5. [§2.1.8.2] The sentence 'Argument 3 is constructed without leveraging the intermediate calculations of 2.1.8.2' refers to a section number in a confusing way; rephrase to reference the appropriate equations.

Circularity Check

0 steps flagged

No circular derivation: the technical chapters build on standard, externally checkable primitives and disclose their assumptions rather than defining predictions from fitted inputs.

full rationale

The thesis is a compilation of the author's own prior papers, and several chapters are explicitly self-citational (e.g., Sec. 1.1: "This section is based on the 'Risks to Privacy' section of the First International AI Safety Report [28] that I had the honor of authoring"; Sec. 2.1.8.1: "The ezkl toolkit, which underpins the system and is a contribution from the authors"). However, this self-citation is not load-bearing in the derivation chain. Each technical contribution is implemented and evaluated against external, non-secure baselines: Chapter 2 reports measured proof times, proof sizes, and accuracy tradeoffs for real models (Table 2.1, Fig. 2.3), and Chapter 3 compares PRAG retrieval accuracy and latency with standard IVF and exact search (Figs. 3.3, 3.4). These builds on standard cryptographic primitives—Halo2/ezkl zkSNARKs, Shamir secret sharing, Crypten MPC—whose security properties are inherited from established theory, not imported from the author's own prior claims. The PRAG privacy guarantee is explicitly scoped to a semi-honest, honest-majority model (Sec. 3.2.1.1: "we assume that all parties in the system are semi-honest ... at most t < n_servers/2 of the servers are corrupt"), and the thesis also states that data owners are assumed to have already secret-shared their data. That is a stated trust model, not a fitted input renamed as a prediction. The absence of a formal ideal/real simulation proof for Algorithm 1 is a real verification gap, but a missing security proof is a correctness risk, not circularity: no equation in the paper is defined in terms of the result it is supposed to establish. Similarly, the zk evaluation system proves quantized inference, and the thesis discloses this calibration tradeoff (Sec. 2.1.8.3: "When accuracy is sacrificed, the quantized input-output pair may be different from the original values by a few percent"), rather than silently equating quantized and exact inference. Overall, the derivation chains are self-contained in the sense that they reduce to stated assumptions and standard primitives, and no load-bearing conclusion is produced by construction from its own input. Score 0.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 2 invented entities

The thesis's central claims rest on standard cryptographic primitives with well-known assumptions, plus several domain-specific assumptions that are not tested in the manuscript: semi-honest MPC, pre-shared secret databases, TEE trust, and TDS trust. The fitted or tuned parameters are index and quantization settings that directly set the reported accuracy and speed. No new physical entities are needed, but two new system-level artifacts (the delegation credential and Community Transformer) are proposed without external validation.

free parameters (4)
  • IVF cluster count coefficient alpha = not stated; n_c = alpha * sqrt(N)
    Section 3.2.1.3 sets the cluster count to alpha * sqrt(N) and calls alpha a free parameter that can be tuned. The sublinear communication and recall numbers reported by PRAG depend on this choice.
  • nprobe (clusters inspected per query) = not stated
    Section 3.2.1.3 and Figure 3.4: nprobe trades retrieval recall against query time. The accuracy and speed comparisons are reported for chosen nprobe values, without sensitivity analysis across the reported database sizes.
  • fixed-point precision (scale) in MPC = not stated
    Section 3.2.1.2 encodes real embeddings as fixed-point integers with precision f. The choice of f affects overflow, truncation, and retrieval accuracy; no value is given.
  • zk quantization calibration = not stated
    Section 2.1.8.1 and 2.1.8.3: calibration choices around quantization and scale trade accuracy versus resources. Witness values can differ from original values by a few percent, and calibration is done on the benchmark test set before proving.
axioms (6)
  • standard math Zero-knowledge SNARK soundness and knowledge soundness, plus trusted setup via Perpetual Powers of Tau.
    Section 2.1.6.3 attributes security to the underlying halo2/zkSNARK assumptions and trusted setup. Correctness, soundness, and confidentiality of the attestations rest on these.
  • domain assumption Honest-majority semi-honest MPC with at most t < n/2 corrupted servers.
    Section 3.2.1.1 states this trust model for PRAG. All privacy guarantees for retrieval inherit from it.
  • domain assumption A trusted dealer generates shared random values for preprocessing.
    Section 3.2.1.2 says, as common in secure ML literature, that a trusted dealer generates shared randomness, and other techniques could distribute this. The protocol benchmarks do not account for this trust.
  • domain assumption AI question answering can be modeled as embedding-based top-k retrieval followed by LLM inference.
    Chapter 3 defines RAG and PRAG around neural embeddings and top-k nearest neighbor search. The privacy and auditability results apply to this architecture.
  • domain assumption Trusted Execution Environments provide confidentiality and remote attestation without mathematical guarantees.
    Section 1.3.4.1 and Chapter 3.3 rely on confidential computing hardware. The thesis itself notes these hardware solutions lack the mathematical security guarantees of cryptographic solutions.
  • domain assumption A Trusted Data Source exists, signs data faithfully, and keeps its private key uncompromised.
    Section 2.3.2 and 2.3.4 state that proofs are valid relative to the TDS-signed original, but not if the TDS publishes incorrect data or its key leaks. The redact-and-prove claims depend on this root of trust.
invented entities (2)
  • Verifiable delegation credential for AI agents no independent evidence
    purpose: Express user-authorized, scoped permissions for autonomous agents using OIDC/OAuth patterns and signatures, so third-party services can verify what an agent may do.
    Section 4.1 describes the credential and protocol extensions but provides no implementation, deployment, or external test. No independent falsifiable handle is given.
  • Community Transformers data trust with TEE enclaves no independent evidence
    purpose: A pooled, auditable private knowledge repository for RAG with confidential execution, proposed in Section 3.4.
    Described as an architecture and protocol sketch. No system is built, no measurements are reported, and no external evidence of feasibility is provided.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Private, Verifiable, and Auditable AI Systems." pith.science (2026). https://pith.science/paper/SMMKKY6J

@misc{pith2026250900085,
  author       = {Pith},
  title        = {Pith review of: Private, Verifiable, and Auditable AI Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SMMKKY6J}},
  note         = {Machine review of arXiv:2509.00085}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

The growing societal reliance on artificial intelligence necessitates robust frameworks for ensuring its security, accountability, and trustworthiness. This thesis addresses the complex interplay between privacy, verifiability, and auditability in modern AI, particularly in foundation models. It argues that technical solutions that integrate these elements are critical for responsible AI innovation. Drawing from international policy contributions and technical research to identify key risks in the AI pipeline, this work introduces novel technical solutions for critical privacy and verifiability challenges. Specifically, the research introduces techniques for enabling verifiable and auditable claims about AI systems using zero-knowledge cryptography; utilizing secure multi-party computation and trusted execution environments for auditable, confidential deployment of large language models and information retrieval; and implementing enhanced delegation mechanisms, credentialing systems, and access controls to secure interactions with autonomous and multi-agent AI systems. Synthesizing these technical advancements, this dissertation presents a cohesive perspective on balancing privacy, verifiability, and auditability in foundation model-based AI systems, offering practical blueprints for system designers and informing policy discussions on AI safety and governance.

Figures

Figures reproduced from arXiv: 2509.00085 by Tobin South.

Figure 1.1
Figure 1.1. Figure 1.1: Risks to privacy from AI fall into three risk groups: (1) risks associated with [PITH_FULL_IMAGE:figures/full_fig_p020_1_1.png] view at source ↗
Figure 1.2
Figure 1.2. Figure 1.2: A high-level overview of the relationship between security goals, attacker types, [PITH_FULL_IMAGE:figures/full_fig_p022_1_2.png] view at source ↗
Figure 1.3
Figure 1.3. Figure 1.3: The key general computational components of the generative AI pipeline from [PITH_FULL_IMAGE:figures/full_fig_p023_1_3.png] view at source ↗
Figure 1.4
Figure 1.4. Figure 1.4: Two attacker models: internal and external. [PITH_FULL_IMAGE:figures/full_fig_p025_1_4.png] view at source ↗
Figure 1.5
Figure 1.5. Figure 1.5: What are we protecting? Key classes of sensitive data in generative AI. [PITH_FULL_IMAGE:figures/full_fig_p025_1_5.png] view at source ↗
Figure 1.6
Figure 1.6. Figure 1.6: A summary of how classes of solutions exist in the framework presented. [PITH_FULL_IMAGE:figures/full_fig_p028_1_6.png] view at source ↗
Figure 1.7
Figure 1.7. Figure 1.7: Three key elements of the AI ecosystem that we didn’t discuss in this section, but [PITH_FULL_IMAGE:figures/full_fig_p033_1_7.png] view at source ↗
Figure 2.1
Figure 2.1. Figure 2.1: A high-level overview of the motivations and system design, which is augmented [PITH_FULL_IMAGE:figures/full_fig_p038_2_1.png] view at source ↗
Figure 2
Figure 2. Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p041_2.png] view at source ↗
Figure 2.2
Figure 2.2. Figure 2.2: System diagram of verifiable ML evaluation using the zkSNARK ezkl toolkit. A [PITH_FULL_IMAGE:figures/full_fig_p042_2_2.png] view at source ↗
Figure 2
Figure 2. Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p045_2.png] view at source ↗
Figure 2.3
Figure 2.3. Figure 2.3: Time and RAM requirements for model proofs with increasing model sizes across [PITH_FULL_IMAGE:figures/full_fig_p046_2_3.png] view at source ↗
Figure 2
Figure 2. Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p058_2.png] view at source ↗
Figure 2.4
Figure 2.4. Figure 2.4: Different approaches to fine-tuning model. Left: a full model, which requires [PITH_FULL_IMAGE:figures/full_fig_p059_2_4.png] view at source ↗
Figure 2.5
Figure 2.5. Figure 2.5: Diagram of the three services in the redact-and-prove system. (Left) An individual, [PITH_FULL_IMAGE:figures/full_fig_p064_2_5.png] view at source ↗
Figure 3.1
Figure 3.1. Figure 3.1: Overview of PRAG architecture using a distributed, secret-shared inverted file [PITH_FULL_IMAGE:figures/full_fig_p077_3_1.png] view at source ↗
Figure 3
Figure 3. Figure 3 [PITH_FULL_IMAGE:figures/full_fig_p077_3.png] view at source ↗
Figure 3.2
Figure 3.2. Figure 3.2: Process flow for retrieving the top-k nearest documents using MPC and oblivious [PITH_FULL_IMAGE:figures/full_fig_p080_3_2.png] view at source ↗
Figure 3
Figure 3. Figure 3 [PITH_FULL_IMAGE:figures/full_fig_p083_3.png] view at source ↗
Figure 3
Figure 3. Figure 3 [PITH_FULL_IMAGE:figures/full_fig_p084_3.png] view at source ↗
Figure 3.3
Figure 3.3. Figure 3.3: Time taken to retrieve top-k closest vectors in the database for end-to-end MPC [PITH_FULL_IMAGE:figures/full_fig_p085_3_3.png] view at source ↗
Figure 3.4
Figure 3.4. Figure 3.4: Information retrieval using IVF improves accuracy with increased [PITH_FULL_IMAGE:figures/full_fig_p086_3_4.png] view at source ↗
Figure 4.1
Figure 4.1. Figure 4.1: Conceptual overview of a verifiable delegation credential for AI agents. Users issue [PITH_FULL_IMAGE:figures/full_fig_p097_4_1.png] view at source ↗
Figure 4.2
Figure 4.2. Figure 4.2: Authenticated delegation can benefit from user identification or verification of [PITH_FULL_IMAGE:figures/full_fig_p100_4_2.png] view at source ↗
Figure 4.3
Figure 4.3. Figure 4.3: Integration of OpenID Connect (OIDC) and User-Managed Access (UMA) [PITH_FULL_IMAGE:figures/full_fig_p105_4_3.png] view at source ↗
Figure 4.4
Figure 4.4. Figure 4.4: An overview of the key topics addressed in the Personhood Credentials paper [PITH_FULL_IMAGE:figures/full_fig_p119_4_4.png] view at source ↗
Figure 5
Figure 5. Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p127_5.png] view at source ↗
Figure 5.1
Figure 5.1. Figure 5.1: An outline of all the different components of an AI system that this thesis has [PITH_FULL_IMAGE:figures/full_fig_p128_5_1.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

299 extracted references · 22 canonical work pages · 10 internal anchors

  1. [1]

    The Washington Post, Apr 2023

    Inside the secret list of websites that make AI like ChatGPT sound smart — washing- tonpost.com. The Washington Post, Apr 2023

    2023

  2. [2]

    Cooperation, competition, and maliciousness: LLM-stakeholders interactive negotiation

    Sahar Abdelnabi, Amr Gomaa, Sarath Sivaprasad, Lea Schönherr, and Mario Fritz. Cooperation, competition, and maliciousness: LLM-stakeholders interactive negotiation. September 2023

    2023

  3. [3]

    Multi-orbac: A new access control model for distributed, heterogeneous and collaborative systems

    Anas Abou El Kalam and Yves Deswarte. Multi-orbac: A new access control model for distributed, heterogeneous and collaborative systems. InProceedings of the IEEE Symposium on Systems and Information Security, 2006

    2006

  4. [4]

    Blinder–scalable, robust anony- mous committed broadcast

    Ittai Abraham, Benny Pinkas, and Avishay Yanai. Blinder–scalable, robust anony- mous committed broadcast. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 1233–1252, 2020

    2020

  5. [5]

    Personhood credentials: Artificial intelligence and the value of privacy-preserving tools to distinguish who is real online

    Steven Adler, Zoë Hitzig, Shrey Jain, Catherine Brewer, Wayne Chang, Renée DiResta, Eddy Lazzarin, Sean McGregor, Wendy Seltzer, Divya Siddarth, Nouran Soliman, Tobin South, Connor Spelliscy, Manu Sporny, Varya Srivastava, John Bailey, Brian Christian, Andrew Critch, Ronnie Falcon, Heather Flanagan, Kim Hamilton Duffy, Eric Ho, Claire R Leibowicz, Srikant...

    2024

  6. [6]

    Personhood credentials: Artificial intelligence and the value of privacy-preserving tools to distinguish who is real online.arXiv preprint arXiv:2408.07892, 2024

    Steven Adler, Zoë Hitzig, Shrey Jain, Catherine Brewer, Wayne Chang, Renée DiResta, Eddy Lazzarin, Sean McGregor, Wendy Seltzer, Divya Siddarth, et al. Personhood credentials: Artificial intelligence and the value of privacy-preserving tools to distinguish who is real online.arXiv preprint arXiv:2408.07892, 2024

    Pith/arXiv arXiv 2024

  7. [7]

    Privformer: Privacy-preserving transformer with mpc

    Yoshimasa Akimoto, Kazuto Fukuchi, Youhei Akimoto, and Jun Sakuma. Privformer: Privacy-preserving transformer with mpc. In2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 392–410. IEEE, 2023

    2023

  8. [8]

    Reproducibility of Machine Learning: Terminology, Recommendations and Open Issues

    Riccardo Albertoni, Sara Colantonio, Piotr Skrzypczy’nski, and Jerzy Stefanowski. Reproducibility of machine learning: Terminology, recommendations and open issues. ArXiv, abs/2302.12691, 2023. 135

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  9. [9]

    Restatement (Third) of Agency

    American Law Institute. Restatement (Third) of Agency. American Law Institute, Philadelphia, PA, 2006

    2006

  10. [10]

    Introducing the model context protocol, November 2024

    Anthropic. Introducing the model context protocol, November 2024. URL https: //www.anthropic.com/news/model-context-protocol

    2024

  11. [11]

    The Human Condition

    Hannah Arendt. The Human Condition. University of Chicago Press, Chicago, 1958

    1958

  12. [12]

    Can foundation models help us achieve perfect secrecy?, 2022

    Simran Arora and Christopher Ré. Can foundation models help us achieve perfect secrecy?, 2022

    2022

  13. [13]

    Reasoning over Public and Private Data in Retrieval-Based Systems

    Simran Arora, Patrick Lewis, Angela Fan, Jacob Kahn, and Christopher R’e. Reasoning over public and private data in retrieval-based systems.ArXiv, abs/2203.11027, 2022

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  14. [14]

    Reasoning over public and private data in retrieval-based systems.Trans

    Simran Arora, Patrick Lewis, Angela Fan, Jacob Kahn, and Christopher Ré. Reasoning over public and private data in retrieval-based systems.Trans. Assoc. Comput. Linguist., 11:902–921, August 2023

    2023

  15. [15]

    Privacy-preserving search of similar patients in genomic data.Cryptology ePrint Archive, 2017

    Gilad Asharov, Shai Halevi, Yehuda Lindell, and Tal Rabin. Privacy-preserving search of similar patients in genomic data.Cryptology ePrint Archive, 2017

    2017

  16. [16]

    wav2vec 2.0: A framework for self-supervised learning of speech representations.Advances in neural information processing systems, 33:12449–12460, 2020

    Alexei Baevski, Yuhao Zhou, Abdelrahman Mohamed, and Michael Auli. wav2vec 2.0: A framework for self-supervised learning of speech representations.Advances in neural information processing systems, 33:12449–12460, 2020

    2020

  17. [17]

    Kairouz, Marco Gruteser, Se- woong Oh, Borja Balle, and Daniel Ramage

    Eugene Bagdasarian, Ren Yi, Sahra Ghalebikesabi, P. Kairouz, Marco Gruteser, Se- woong Oh, Borja Balle, and Daniel Ramage. Airgapagent: Protecting privacy-conscious conversational agents, 2024

    2024

  18. [18]

    Artificial intelligence can persuade humans on political issues

    Hui Bai, Jan Voelkel, Johannes Eichstaedt, and Robb Willer. Artificial intelligence can persuade humans on political issues. September 2023

    2023

  19. [19]

    Bakker, Martin Chadwick, Hannah Sheahan, Michael Henry Tessler, Lucy Campbell-Gillingham, Jan Balaguer, Nathan McAleese, Amelia Glaese, John Aslanides, Matthew M

    Michiel A. Bakker, Martin Chadwick, Hannah Sheahan, Michael Henry Tessler, Lucy Campbell-Gillingham, Jan Balaguer, Nathan McAleese, Amelia Glaese, John Aslanides, Matthew M. Botvinick, and Christopher Summerfield. Fine-tuning language models to find agreement among humans with diverse preferences.ArXiv, abs/2211.15006, 2022

    Pith/arXiv arXiv 2022

  20. [20]

    The path of robotics law.California Law Review Circuit, 6:45, 2015

    Jack M Balkin. The path of robotics law.California Law Review Circuit, 6:45, 2015

    2015

  21. [21]

    Towards human-ai teaming to mitigate alert fatigue in security operations centres

    Mohan Baruwal Chhetri, Shahroz Tariq, Ronal Singh, Fatemeh Jalalvand, Cecile Paris, and Surya Nepal. Towards human-ai teaming to mitigate alert fatigue in security operations centres. ACM Trans. Internet Technol., 24(3), July 2024. ISSN 1533-5399. doi:10.1145/3670009. URL https://doi.org/10.1145/3670009

    doi:10.1145/3670009 2024

  22. [22]

    Manrai, and Marzyeh Ghassemi

    Andrew Beam, Arjun K. Manrai, and Marzyeh Ghassemi. Challenges to the repro- ducibility of machine learning models in health care.JAMA, 2020

    2020

  23. [23]

    Beam, Arjun K

    Andrew L. Beam, Arjun K. Manrai, and Marzyeh Ghassemi. Challenges to the Reproducibility of Machine Learning Models in Health Care.JAMA, 323(4):305–306, 01 2020. ISSN 0098-7484. 136

    2020

  24. [24]

    Anya Belz, Craig Thomson, Ehud Reiter, Gavin Abercrombie, Jose Maria Alonso-Moral, Mohammad Arvan, Jackie Chi Kit Cheung, Mark Cieliebak, Elizabeth Clark, Kees van Deemter, Tanvi Dinkar, Ondrej Dusek, Steffen Eger, Qixiang Fang, Albert Gatt, Dimitra Gkatzia, Javier Gonz’alez-Corbelle, Dirk Hovy, Manuela Hurlimann, Takumi Ito, John D. Kelleher, Filip Klubi...

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  25. [25]

    Zerocash: Decentralized anonymous payments from bitcoin

    Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer, and Madars Virza. Zerocash: Decentralized anonymous payments from bitcoin. 2014 IEEE Symposium on Security and Privacy, 2014

    2014

  26. [26]

    Bender and Batya Friedman

    Emily M. Bender and Batya Friedman. Data Statements for Natural Language Process- ing: Toward Mitigating System Bias and Enabling Better Science.Transactions of the Association for Computational Linguistics, 6:587–604, 2018. doi:10.1162/tacl_a_00041. URL https://aclanthology.org/Q18-1041. Place: Cambridge, MA Publisher: MIT Press

    doi:10.1162/tacl_a_00041 2018

  27. [27]

    On the dangers of stochastic parrots: Can language models be too big? InProceedings of the 2021 ACM conference on fairness, accountability, and transparency, pages 610–623, 2021

    Emily M Bender, Timnit Gebru, Angelina McMillan-Major, and Shmargaret Shmitchell. On the dangers of stochastic parrots: Can language models be too big? InProceedings of the 2021 ACM conference on fairness, accountability, and transparency, pages 610–623, 2021

    2021

  28. [28]

    Yoshua Bengio, Sören Mindermann, Daniel Privitera, Tamay Besiroglu, Rishi Bom- masani, Stephen Casper, Yejin Choi, Philip Fox, Ben Garfinkel, Danielle Goldfarb, Hoda Heidari, Anson Ho, Sayash Kapoor, Leila Khalatbari, Shayne Longpre, Sam Manning, Vasilios Mavroudis, Mantas Mazeika, Julian Michael, Jessica Newman, Kwan Yee Ng, Chinasa T. Okolo, Deborah Raj...

    2025

  29. [29]

    K. P. Bennett and O. L. Mangasarian. Robust linear programming discrimination of two linearly inseparable sets.Optimization Methods and Software, 1:23–34, 1992

    1992

  30. [30]

    zktax: A pragmatic way to support zero-knowledge tax disclosures

    Alex Berke, Tobin South, Robert Mahari, Kent Larson, and Alex Pentland. zktax: A pragmatic way to support zero-knowledge tax disclosures. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 4952–4954, 2024

    2024

  31. [31]

    Language (technology)ispower: Acriticalsurveyof"bias"innlp

    Su Lin Blodgett, Solon Barocas, Hal Daumé III, and Hanna Wallach. Language (technology)ispower: Acriticalsurveyof"bias"innlp. arXiv preprint arXiv:2005.14050, 2020

    Pith/arXiv arXiv 2005

  32. [32]

    Privacy expectations for human-autonomous vehicle interactions, 2022

    Cara Bloom and Josiah Emery. Privacy expectations for human-autonomous vehicle interactions, 2022

    2022

  33. [33]

    Help wanted: An examination of hiring algorithms, equity, and bias

    Miranda Bogen and Aaron Rieke. Help wanted: An examination of hiring algorithms, equity, and bias. 2018

    2018

  34. [34]

    Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S

    Rishi Bommasani, Drew A. Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S. Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, Erik Brynjolfsson, Shyamal Buch, Dallas Card, Rodrigo Castellon, Niladri Chatterji, Annie Chen, Kathleen Creel, Jared Quincy Davis, Dora Demszky, Chris Donahue, Moussa Doumbouya, Esin Durmus, Stef...

    Pith/arXiv arXiv 2022

  35. [35]

    Halo infinite: Recursive zk-snarks from any additive polynomial commitment scheme.Cryptology ePrint Archive, 2020

    Dan Boneh, Justin Drake, Ben Fisch, and Ariel Gabizon. Halo infinite: Recursive zk-snarks from any additive polynomial commitment scheme.Cryptology ePrint Archive, 2020. 138

    2020

  36. [36]

    Proof-of-Personhood: Redemocratizing permissionless cryptocurrencies

    MariaBorge, EleftheriosKokoris-Kogias, PhilippJovanovic, LinusGasser, NicolasGailly, and Bryan Ford. Proof-of-Personhood: Redemocratizing permissionless cryptocurrencies. In 2017 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, April 2017

    2017

  37. [37]

    Proof-of-Personhood: Redemocratizing permissionless cryptocurren- cies

    MariaBorge, EleftheriosKokoris-Kogias, PhilippJovanovic, LinusGasser, NicolasGailly, and Bryan Ford. Proof-of-Personhood: Redemocratizing permissionless cryptocurren- cies. In 2017 IEEE European Symposium on Security and Privacy Workshops, EU- ROS&PW, pages 23–26. IEEE Computer Society, 2017. doi:10.1109/EuroSPW.2017.46. URL https://www.computer.org/csdl/...

    doi:10.1109/eurospw.2017.46 2017

  38. [38]

    What will it take to fix benchmarking in natural language understanding?arXiv preprint arXiv:2104.02145, 2021

    Samuel R Bowman and George E Dahl. What will it take to fix benchmarking in natural language understanding?arXiv preprint arXiv:2104.02145, 2021

    Pith/arXiv arXiv 2021

  39. [39]

    Ontology-based access control for fair data.Data Intelligence, 2(1-2):66–77, 01 2020

    Christopher Brewster, Barry Nouwt, Stephan Raaijmakers, and Jack Verhoosel. Ontology-based access control for fair data.Data Intelligence, 2(1-2):66–77, 01 2020. ISSN 2641-435X. doi:10.1162/dint_a_00029. URL https://doi.org/10.1162/dint_a_ 00029

    work page doi:10.1162/dint_a_00029 2020

  40. [40]

    Language models are few-shot learners.Advances in neural information processing systems, 33:1877–1901, 2020

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners.Advances in neural information processing systems, 33:1877–1901, 2020

    1901

  41. [41]

    Gender shades: Intersectional accuracy disparities in commercial gender classification

    Joy Buolamwini and Timnit Gebru. Gender shades: Intersectional accuracy disparities in commercial gender classification. In Conference on fairness, accountability and transparency, pages 77–91. PMLR, 2018

    2018

  42. [42]

    Gender shades: Intersectional accuracy disparities in commercial gender classification

    Joy Buolamwini and Timnit Gebru. Gender shades: Intersectional accuracy disparities in commercial gender classification. InProceedings of the 1st Conference on Fairness, Accountability and Transparency, Machine Learning Research, pages 77–91. PMLR,

  43. [43]

    What do I think about biometric proof of personhood? Blog, 2023

    Vitalik Buterin. What do I think about biometric proof of personhood? Blog, 2023. URL https://vitalik.eth.limo/general/2023/07/24/biometric.html

    2023

  44. [44]

    C2PA Technical Specification, 2023

    C2PA. C2PA Technical Specification, 2023. URL https://c2pa.org/specifications/ specifications/1.3/specs/C2PA_Specification.html#_introduction

    2023

  45. [45]

    Honey I snarked the GPT

    Alexander Camuto, Bianca Gănescu, Jonathan Passerat-Palmbach, and Jason Morton. Honey I snarked the GPT. EZKL Blog, Oct 2023

    2023

  46. [46]

    Steps in hardware, leaps in performance

    Alexander Camuto, Sofia Wawrzyniak, and Jason Morton. Steps in hardware, leaps in performance. EZKL Blog, Nov 2023

    2023

  47. [47]

    Splitting and parallelizing proofs

    Alexander Camuto, Sofia Wawrzyniak, and Jason Morton. Splitting and parallelizing proofs. EZKL Blog, Oct 2023. 139

    2023

  48. [48]

    Removing additional commitment cost

    Alexander Camuto, Sofia Wawrzyniak, and Jason Morton. Removing additional commitment cost. EZKL Blog, Oct 2023

    2023

  49. [49]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In30th USENIX security symposium (USENIX security 21), pages 2633–2650. USENIX Association, August 2021

    2021

  50. [50]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In11th International Conference on Learning Representations (ICLR 2023), Kigali, Rwanda, 2022

    2023

  51. [51]

    Extracting training data from diffusion models

    Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In32nd USENIX security symposium (USENIX security 23), pages 5253–5270, Anaheim, CA, August 2023. USENIX Association

    2023

  52. [52]

    Trust and incentives in agency

    Ramon Casadesus-Masanell and Daniel F Spulber. Trust and incentives in agency. Southern California Interdisciplinary Law Journal, 15:45, 2005

    2005

  53. [53]

    Secure computation with fixed-point numbers

    Octavian Catrina and Amitabh Saxena. Secure computation with fixed-point numbers. In Financial Cryptography and Data Security: 14th International Conference, FC 2010, Tenerife, Canary Islands, January 25-28, 2010, Revised Selected Papers 14, pages 35–50. Springer, 2010

    2010

  54. [54]

    Harms from increasingly agentic algorithmic systems

    Alan Chan, Rebecca Salganik, Alva Markelius, Chris Pang, Nitarshan Rajkumar, Dmitrii Krasheninnikov, Lauro Langosco, Zhonghao He, Yawen Duan, Micah Carroll, et al. Harms from increasingly agentic algorithmic systems. InProceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency, pages 651–666, 2023

    2023

  55. [55]

    Visibility into ai agents

    Alan Chan, Carson Ezell, Max Kaufmann, Kevin Wei, Lewis Hammond, Herbie Bradley, Emma Bluemke, Nitarshan Rajkumar, David Krueger, Noam Kolt, et al. Visibility into ai agents. InThe 2024 ACM Conference on Fairness, Accountability, and Transparency, pages 958–973, 2024

    2024

  56. [56]

    Ids for ai systems.arXiv preprint arXiv:2406.12137, 2024

    Alan Chan, Noam Kolt, Peter Wills, Usman Anwar, Christian Schroeder de Witt, Nitarshan Rajkumar, Lewis Hammond, David Krueger, Lennart Heim, and Markus Anderljung. Ids for ai systems.arXiv preprint arXiv:2406.12137, 2024

    Pith/arXiv arXiv 2024

  57. [57]

    A survey on evaluation of large language models

    Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, et al. A survey on evaluation of large language models. ACM Transactions on Intelligent Systems and Technology, 15(3): 1–45, 2024

    2024

  58. [58]

    Sense of community in the urban environment: A catalyst for participation and community development.American journal of community psychology, 18(1):55–81, 1990

    David M Chavis and Abraham Wandersman. Sense of community in the urban environment: A catalyst for participation and community development.American journal of community psychology, 18(1):55–81, 1990. 140

    1990

  59. [59]

    Zkml: An optimizing system for ml inference in zero-knowledge proofs

    Bing-Jyue Chen, Suppakit Waiwitlikhit, Ion Stoica, and Daniel Kang. Zkml: An optimizing system for ml inference in zero-knowledge proofs. InProceedings of the Nineteenth European Conference on Computer Systems, pages 560–574, 2024

    2024

  60. [60]

    {SANNS}: Scaling up secure approximate{k-Nearest} neighbors search

    Hao Chen, Ilaria Chillotti, Yihe Dong, Oxana Poburinnaya, Ilya Razenshteyn, and M Sadegh Riazi. {SANNS}: Scaling up secure approximate{k-Nearest} neighbors search. In 29th USENIX Security Symposium (USENIX Security 20), pages 2111–2128, 2020

    2020

  61. [61]

    How is chatgpt’s behavior changing over time? arXiv preprint arXiv:2307.09009, 2023

    Lingjiao Chen, Matei Zaharia, and James Zou. How is chatgpt’s behavior changing over time? arXiv preprint arXiv:2307.09009, 2023

    Pith/arXiv arXiv 2023

  62. [62]

    MarkChen, JerryTworek, Heewoo Jun, Qiming Yuan, HenriquePondedeOliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, Nick Ryder, Mikhail Pavlov, Alethea Power, Lukasz Kaiser, Mohammad Bavarian, Cle...

    2021

  63. [63]

    The-x: Privacy-preserving transformer inference with homomorphic encryption

    Tianyu Chen, Hangbo Bao, Shaohan Huang, Li Dong, Binxing Jiao, Daxin Jiang, Haoyi Zhou, Jianxin Li, and Furu Wei. The-x: Privacy-preserving transformer inference with homomorphic encryption. arXiv preprint arXiv:2206.00216, 2022

    Pith/arXiv arXiv 2022

  64. [64]

    Can language models be instructed to protect personal information? October 2023

    Yang Chen, Ethan Mendes, Sauvik Das, Wei Xu, and Alan Ritter. Can language models be instructed to protect personal information? October 2023

    2023

  65. [65]

    Can you fake it until you make it? impacts of differentially private synthetic data on downstream classification fairness

    Victoria Cheng et al. Can you fake it until you make it? impacts of differentially private synthetic data on downstream classification fairness. InProceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, FAccT ’21, pages 149–160, 3 2021. doi:10.1145/3442188.3445879. URL https://doi.org/10.1145/3442188.3445879

    arXiv 2021

  66. [66]

    Fast large-scale honest-majority mpc for malicious adversaries

    Koji Chida, Daniel Genkin, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, Yehuda Lindell, and Ariel Nof. Fast large-scale honest-majority mpc for malicious adversaries. In Advances in Cryptology–CRYPTO 2018: 38th Annual International Cryptology Confer- ence, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part III 38, pages 34–64. Springer, 2018

    2018

  67. [67]

    Civil Resolution Tribunal (British Columbia). Patel v. wong, 2024 bccrt 149, 2024. URL https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.html. Accessed: 2025-01-06. 141

    2024

  68. [68]

    The measure and mismeasure of fairness: A critical review of fair machine learning.ArXiv, abs/1808.00023, 2018

    Sam Corbett-Davies and Sharad Goel. The measure and mismeasure of fairness: A critical review of fair machine learning.ArXiv, abs/1808.00023, 2018

    Pith/arXiv arXiv 2018

  69. [69]

    Advancing differential privacy: Where we are now and future directions for real-world deployment

    Rachel Cummings et al. Advancing differential privacy: Where we are now and future directions for real-world deployment. Harvard Data Science Review, 6(1), 1 2024. doi:10.1162/99608f92.d3197524. URL https://doi.org/10.1162/99608f92.d3197524

    doi:10.1162/99608f92.d3197524 2024

  70. [70]

    Dagher, Benedikt Bünz, Joseph Bonneau, Jeremy Clark, and Dan Boneh

    Gaby G. Dagher, Benedikt Bünz, Joseph Bonneau, Jeremy Clark, and Dan Boneh. Provisions: Privacy-preserving proofs of solvency for bitcoin exchanges.Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, 2015

    2015

  71. [71]

    Scalable and unconditionally secure multiparty computation

    Ivan Damgård and Jesper Buus Nielsen. Scalable and unconditionally secure multiparty computation. In Annual International Cryptology Conference, pages 572–590. Springer, 2007

    2007

  72. [72]

    Practical covertly secure mpc for dishonest majority–or: breaking the spdz limits

    Ivan Damgård, Marcel Keller, Enrique Larraia, Valerio Pastro, Peter Scholl, and Nigel P Smart. Practical covertly secure mpc for dishonest majority–or: breaking the spdz limits. In Computer Security–ESORICS 2013: 18th European Symposium on Research in Computer Security, Egham, UK, September 9-13, 2013. Proceedings 18, pages 1–18. Springer, 2013

    2013

  73. [73]

    The mnist database of handwritten digit images for machine learning research

    Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6):141–142, 2012

    2012

  74. [74]

    PhD thesis, Lehigh University, 2023

    Tal Derei.Accelerating the PlonK zkSNARK Proving System using GPU Architectures. PhD thesis, Lehigh University, 2023

    2023

  75. [75]

    Trust but verify: A guide to algorithms and the law

    Deven R Desai and Joshua A Kroll. Trust but verify: A guide to algorithms and the law. Harv. JL & Tech., 31:1, 2017

    2017

  76. [76]

    Puma: Secure inference of llama-7b in five minutes.ArXiv, abs/2307.12533, 2023

    Ye Dong, Wen jie Lu, Yancheng Zheng, Haoqi Wu, Derun Zhao, Jin Tan, Zhicong Huang, Cheng Hong, Tao Wei, and Wen-Chang Cheng. Puma: Secure inference of llama-7b in five minutes.ArXiv, abs/2307.12533, 2023

    arXiv 2023

  77. [77]

    Citadel: Enclaves with strong microarchitectural isolation and secure shared memory on a speculative out-of-order processor

    Jules Drean, Miguel Gomez-Garcia, Thomas Bourgeat, and Srinivas Devadas. Citadel: Enclaves with strong microarchitectural isolation and secure shared memory on a speculative out-of-order processor. 2023

    2023

  78. [78]

    Do membership inference attacks work on large language models? February 2024

    Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models? February 2024

    2024

  79. [79]

    cqlin: Efficient linear operations on kzg commitments with cached quotients

    Liam Eagen and Ariel Gabizon. cqlin: Efficient linear operations on kzg commitments with cached quotients. Cryptology ePrint Archive, Paper 2023/393, 2023

    2023

  80. [80]

    Oversight for Frontier AI through a Know-Your- Customer Scheme for Compute Providers, October 2023

    Janet Egan and Lennart Heim. Oversight for Frontier AI through a Know-Your- Customer Scheme for Compute Providers, October 2023. URL http://arxiv.org/abs/ 2310.13625. arXiv:2310.13625 [cs]. 142

    Pith/arXiv arXiv 2023

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.