Pith. sign in

REVIEW 4 major objections 4 minor 44 references

How Private is Your Attention? Bridging Privacy with In-Context Learning

T0 review · 4 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Differential privacy during pretraining has a provable, dimension-dependent cost for in-context learning.

desk verdict Timely problem and a sensible algorithm, but the central privacy-cost bound is unproven: the key norm estimate is wrong by a factor of sqrt(D), and the stated rates do not follow. read the letter →

arxiv 2504.16000 v1 pith:TEMY2RAK submitted 2025-04-22 stat.ML cs.AIcs.CLcs.CRcs.LG

Soham Bonnerjee , Zhen Wei (Kingsley) Yeon , Anna Asch , Sagnik Nandy , Promit Ghosal This is my paper · ORCID
classification stat.MLcs.AIcs.CLcs.CRcs.LG MSC 68T0762J0568Q32
keywords differentialprivacyin-contextlearninglinearattentionregressionGaussianmechanismearlystoppingadversarialrobustnessexcessrisk
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether in-context learning—solving a new task from labeled examples in the prompt—remains feasible when the model is pretrained under formal differential privacy. It studies the simplest case: a single linear attention head performing linear regression, trained on $N$ prompts, each holding $L$ labeled feature–response pairs. The paper claims the first quantitative privacy–accuracy trade-off for in-context learning: the excess test error caused by private pretraining is bounded by roughly $N^{-1}L^{-3}\log(1/\delta)/\varepsilon^2$ in a low-dimensional regime (equivalently $N^{-3/2}L^{-2}$ when $L\asymp\sqrt{N}$), and by $D^2N^{-2}L^{-2}\log(1/\delta)/\varepsilon^2$ in a high-dimensional regime, up to logarithmic factors. If correct, these rates tell a practitioner how many prompts and examples are needed to make privacy cheap, and why training must stop early in over-parameterized settings. The paper also claims that the private method resists adversarial corruption of a training prompt far better than standard ridge pretraining.

What carries the argument

The load-bearing object is the reduction of a linear attention head to a bilinear form. With the off-diagonal blocks of the value and key–query matrices set to zero, the head’s prediction on a prompt collapses to $\langle\Gamma, Z\rangle$, where $\Gamma = w^{\mathrm{PV}}_{22}W^{\mathrm{KQ}}_{11}$ is the learned parameter and $Z = L^{-1}x_{L+1}\sum_{i=1}^L y_i x_i^{\top}$ is the prompt feature. Training minimizes a regularized squared error over $\Gamma$. The private algorithm (NoisyHead) clips responses, projects the parameter to a bounded ball, and adds Gaussian noise to every gradient step; the analysis runs on three high-probability events bounding the parameter norm, the prompt-feature norm, and the response range. The trade-off that drives the results is between the descent error $(1-\eta_0\lambda)^T$ and the noise accumulation $\sigma^2\eta_0^2D T^2\log(2T/\delta)/(N^2\varepsilon^2)$, whose balance dictates the early-stopping rule.

What would settle it

Run a concentration check: fix $D=5$, draw $w\sim N(0,I)$, $x_i$ uniformly on the sphere, $y_i=w^{\top}x_i+\epsilon_i$, and compute the empirical maximum over many prompts of $\|L^{-1}x_{k,L+1}\sum_{i=1}^L y_{k,i}x_{k,i}^{\top}\|_F$. If this maximum exceeds $C/\sqrt{L}$ by a factor growing with $\log N$ or $D$, the bound in Theorem 4.1 is wrong and the rates in Theorem 4.2 must be revised; establishing the true rate requires a separate concentration bound for $\sum_i y_i x_i$.

Watch

Extended reading notes

Core claim

The central discovery is a bound on the cost of privacy: the gap between the prediction error of a differentially private linear attention head and that of the non-private ridge estimator. Writing the predictor as $\langle\Gamma, Z\rangle$, where $\Gamma$ is the learned weight matrix and $Z$ is the prompt feature matrix, the paper shows that after $T$ private gradient steps the squared gap is at most $G_0^2[(1-\eta_0\lambda)^T R^2 + \sigma^2\eta_0^2 D T^2 \log(2T/\delta)/(N^2\varepsilon^2)]$ with high probability. The first term is the cost of not optimizing enough; the second is the cost of privacy noise. Minimizing over $T$ reproduces the two regimes: when the feature dimension $D$ is small, the privacy cost decays as $N^{-1}L^{-3}\varepsilon^{-2}\log(1/\delta)$ (equivalently $N^{-3/2}L^{-2}$ when $L\asymp\sqrt{N}$); when $N/D^2=O(1)$ and $L/D=O(1)$, it decays as $D^2N^{-2}L^{-2}\varepsilon^{-2}\log(1/\delta)$. In the over-parameterized case $N\asymp L^2\asymp D^2$, test error first falls as optimization progresses and then rises as accumulated noise dominates, so the optimal number of iterations is $\Theta(\log N)$.

Load-bearing premise

The rates in Theorem 4.2 rest on the assumption that the prompt feature matrix $Z_k$ has Frobenius norm at most about $C/\sqrt{L}$ with high probability, but the proof derives this from separate bounds on feature sums and label magnitudes, silently assuming the label–feature sum $\sum_i y_i x_i$ is controlled by the feature sum—a step that need not hold when labels are correlated with features.

Editorial extensions

If this is right

  • A practitioner can set the number of training prompts $N$ and prompt length $L$ to hit a target privacy cost: in the low-dimensional regime the cost shrinks like $N^{-1}L^{-3}$, so privacy becomes affordable once both are sufficiently large.
  • Private pretraining in the over-parameterized regime requires early stopping: test error is minimized near $T=\Theta(\log N)$ iterations, and further optimization only adds privacy noise.
  • Differentially private pretraining acts as a regularizer against adversarial prompt poisoning: under the paper’s conditions, one corrupted prompt moves the private predictor less than it moves ridge regression.
  • The cost of privacy decomposes into an optimization term and a noise-injection term, giving a template for comparing future private pretraining algorithms.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The apparent gap in the proof of Theorem 4.1—deriving the bound on $Z_k$ from separate bounds on feature sums and label magnitudes—suggests the stated rates are not yet fully justified; closing it may require a separate concentration argument for $\sum_i y_i x_i$ and could introduce extra logarithmic or dimension factors.
  • The early-stopping phenomenon likely extends beyond linear attention: any private iterative training method whose per-step noise variance grows with sensitivity will face the same U-shaped test error, so privacy-aware iteration schedules matter as much as architecture choice.
  • The robustness comparison hints at a broader principle: clipping and bounded projections, usually viewed as privacy tools, double as defenses against data poisoning; this could be tested on softmax attention or on language models under prompt-level attacks.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes NoisyHead, a differentially private pretraining algorithm for a linear attention head trained to perform in-context linear regression, and analyzes the excess prediction risk of the private estimator relative to the non-private ridge estimator. The main claims are Theorem 4.1 and Theorem 4.2: in a low-dimensional regime the cost of privacy is bounded by O(1/(N^{3/2}L^2) log(1/delta)/epsilon^2), and in a high-dimensional regime by O(D^2/(N^2L^2) log(1/delta)/epsilon^2), up to polylogarithmic factors. The paper also claims Proposition 4.1 on early stopping and Theorem 5.1 on robustness to adversarial prompt perturbations, with supporting simulations in Sections 6 and Appendix B.

Significance. If the main theorems were correct, this would be the first quantitative characterization of how differential privacy degrades in-context learning, and the robustness result relative to ridge regression would be a valuable additional contribution. The paper has clear strengths: the algorithm is explicitly specified, the privacy analysis follows a standard composition argument, the experimental code is publicly available, and the simulations cover the claimed regimes. However, the central proof contains a load-bearing error: the bound on the norm of the prompt feature matrix that underpins Theorems 4.1 and 4.2 is not valid under the stated data-generating model. Because the headline rates rest on this bound, the main contribution is not established as written.

major comments (4)
  1. [Appendix A.3, Eq. (A.4)] The claim that D2 and D3 imply max_k ||L^{-1} x_{k,L+1} sum_i y_{k,i} x_{k,i}^T||_F <= G is not valid. Since x_{k,L+1} has unit norm, the relevant quantity is L^{-1} ||sum_i y_{k,i} x_{k,i}||. The argument would require ||sum_i y_{k,i} x_{k,i}|| <= C ||sum_i x_{k,i}||, but under the model y_i = w^T x_i + epsilon_i, conditional on w, E[sum_i y_{k,i} x_{k,i}] = (L/D) w, so the typical norm of the label-feature sum is L/||w||/D, not C times the norm of the feature sum. A separate concentration argument cannot rescue the scaling G ~ C/sqrt(L), because the drift term L w/D is first-order, not a fluctuation. Eq. (A.4) is therefore false at the level of typical scales.
  2. [Theorems 4.1 and 4.2(i)] The invalid bound (A.4) is load-bearing because the proof of Theorem 4.1 identifies the projected features with the true features, eZ_k = Z_k, under D2 and D3. In the low-dimensional regime of Theorem 4.2(i), with D=O(1), L ~ sqrt(N) -> infinity, the hyperparameter G in (4.1) satisfies G ~ C/sqrt(L) -> 0, while a typical prompt satisfies ||Z_k||_F ~ 1/sqrt(D), which is bounded away from zero. Hence the event eZ_k = Z_k has probability tending to zero, and the proof in Appendix A.3 does not bound the actual algorithm in the regime where Theorem 4.2(i) is claimed to hold. Consequently the headline rate (4.3) is unsupported.
  3. [Appendix A.6, Eq. (A.20)] The robustness bound (A.20) is dimensionally inconsistent with the earlier norm bound (A.13). Cauchy-Schwarz together with ||Z||_F <= G0 and G0 ~ C/sqrt(L) from (4.1) gives ( <Gamma_hat - Gamma_hat_bad, Z> )^2 <= C^2 R^2 / L up to logarithmic factors, not C^2 L R^2 as written. This matters for Theorem 5.1: the comparison (5.3) requires the left-hand side to be smaller than alpha^2 mu^2/(N lambda), and the lower-bound condition in (5.2) does not imply that inequality when (A.20) is stated as C^2 L R^2. Theorem 5.1 is therefore not established as stated.
  4. [Theorem 4.1 and Theorem 4.2(i)] The step-size conditions are internally inconsistent. Theorem 4.1 requires eta0 < lambda/(2lambda + G^2)^2, but the low-dimensional proof of Theorem 4.2(i) uses eta0 ~ lambda ~ 1. When G -> 0 and lambda ~ 1, the upper bound is approximately 1/4, so no sequence with eta0 ~ 1 satisfies the hypotheses of Theorem 4.1. This further undermines the parameter regime claimed in Theorem 4.2(i), even apart from the issue with (A.4).
minor comments (4)
  1. [Eq. (4.1) and Appendix A.3] The definition of G in (4.1) uses (log(N/kappa))^{1/2}/D, while Lemma A.2 and the proof in Appendix A.3 naturally yield a factor (log(N/kappa))^{1/2}/sqrt(D). The two displays should be reconciled.
  2. [Section B.1] The experiments set kappa = 1, but the theorems require kappa to be a failure probability; with kappa = 1 the stated probability bounds of the form 1 - 4kappa are nonpositive. A concrete failure probability should be specified and used consistently.
  3. [Lemma A.1] The lemma is stated for variables z_kj but the text applies it to the labels y_{k,i}; the notation should be aligned.
  4. [Appendix A.6] The proof of Theorem 5.1 uses the notation Gamma_T_bad and Gamma_hat_bad inconsistently; the perturbed estimator should be defined once and used consistently throughout the appendix.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the privacy cost bound is derived analytically from the algorithm and stated assumptions, with no fitted parameter or self-citation chain forcing the result.

full rationale

I find no circularity in this paper. The cost of privacy is explicitly defined as the excess prediction error (⟨Γ̂,Z⟩−⟨Γ*,Z⟩)^2 of the private estimator over the non-private ridge estimator, and Theorem 4.1 derives an upper bound for this quantity from the projected-gradient-descent recursion in Algorithm 1, including the Gaussian noise terms. The clipping and projection parameters C, G, R are set in equation (4.1) to make the concentration events D1, D2, D3, and the test-feature event hold with high probability; they are not fitted to any simulation output or to the target bound itself. Theorem 4.2 then substitutes these parameter choices into bound (4.2) and selects T to balance the descent error and the noise error, and Proposition 4.1 is a specialization of that calculation. The numerical experiments evaluate the resulting excess risk on independent test prompts, so they do not reverse-engineer the theorem. The one suspicious inference flagged by a reader—that (A.4) follows from D2 and D3—is a potential correctness gap in a concentration argument, not a circularity: it does not assume the conclusion, and even if the bound on the label-feature sum were unsupported, that would be an error in the proof rather than a reduction of the result to its own inputs. Citations to prior work (Cai et al. for privacy composition and concentration lemmas, Zhang et al. and Lu et al. for the in-context linear regression setup) provide standard external ingredients, not a self-citation chain that forces the claimed rates. No step in the derivation defines its output in terms of the quantity it purports to predict, and no fitted parameter is renamed as a prediction. Therefore the paper is not circular; the appropriate score is 0.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The central claims rest on the data model, the reduction of the attention head to a linear map, and the high-probability parameter choices. No quantities are fitted to the simulation data, so the circularity burden is low. However, the proof requires a concentration bound for ||sum_i y_i x_i|| that is not stated as a lemma.

free parameters (8)
  • Clipping bound C = sqrt(2 nu log(NL/kappa))
    Chosen so that all response labels in training prompts satisfy |y| <= C with probability at least 1-kappa.
  • Projection radius G (training prompts) = ~ C/sqrt(L) (1 + (log(N/kappa))^{1/2}/D)
    Chosen so that the unprojected feature matrices Z_k have Frobenius norm at most G with high probability, so the projection is inactive. The text has a typo (C sqrt(L) vs C/sqrt(L)).
  • Projection radius G0 (test prompt) = ~ C/sqrt(L) (1 + (log(1/kappa))^{1/2}/D)
    Chosen to bound the norm of the test feature matrix Z with high probability.
  • Weight radius R = ~ lambda^{-1} C^2 sqrt(N/L) (1 + (log(1/kappa))^{1/2}/D)
    Chosen so that the ridge estimator Gamma* lies in the Frobenius ball of radius R with high probability.
  • Regularization strength lambda = lambda ~ 1 (low-dim), lambda ~ N/D (high-dim)
    Chosen to balance the optimization and privacy-noise error terms; standard choices in ridge regression for ICL.
  • Step size eta0 = in (0, lambda/((2 lambda + G^2)^2))
    Chosen to guarantee contraction of gradient descent, per Theorem 4.1.
  • Number of iterations T = log(N^2 L D^3)/log((1-eta0 lambda)^{-1}) (low-dim) or r ~ N (high-dim)
    Chosen to balance the exponentially decaying optimization error and the quadratically growing noise error; the 'early stopping' point.
  • Failure probability kappa = kappa >= ... (e.g., exp(-D^2) in low-dim)
    Appears in the high-probability parameter choices and the probability of the good events; not a data-fitted parameter.
assumptions (5)
  • domain assumption Data generating model: x_i i.i.d. ~ U(S^{D-1}), w ~ N(0,I_D) per prompt, epsilon_i i.i.d. ~ N(0,tau^2)
    Used throughout Section 2 and the proofs; defines the in-context learning task.
  • domain assumption The attention head parameters w_{12}^{PV}=0 and w_{12}^{KQ}=0
    Reduces the predictor to <Gamma,Z>; justified in Appendix A.1 by symmetry and by gradient-flow invariance in Zhang et al. [2024].
  • standard math Standard concentration inequalities (Hoeffding, covering number, sub-Gaussian) for features on the sphere
    Used in Lemmas A.1-A.3 to choose C, G, R and to assert the good events D1,D2,D3.
  • standard math The regularized loss is lambda-strongly convex and (G^2+2 lambda)-smooth
    Needed for the gradient descent contraction argument in the proof of Theorem 4.1.
  • domain assumption Regime conditions: N >> D^2 L^{-2}, and either D^2 << log(NL) (low-dim) or D^2 >> log(NL) with N/D^2 = O(1), L/D = O(1) (high-dim)
    Define the two regimes in which the rates in Theorem 4.2 are claimed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of How Private is Your Attention? Bridging Privacy with In-Context Learning." pith.science (2026). https://pith.science/paper/TEMY2RAK

@misc{pith2026250416000,
  author       = {Pith},
  title        = {Pith review of: How Private is Your Attention? Bridging Privacy with In-Context Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TEMY2RAK}},
  note         = {Machine review of arXiv:2504.16000}
}
read the original abstract

In-context learning (ICL)-the ability of transformer-based models to perform new tasks from examples provided at inference time-has emerged as a hallmark of modern language models. While recent works have investigated the mechanisms underlying ICL, its feasibility under formal privacy constraints remains largely unexplored. In this paper, we propose a differentially private pretraining algorithm for linear attention heads and present the first theoretical analysis of the privacy-accuracy trade-off for ICL in linear regression. Our results characterize the fundamental tension between optimization and privacy-induced noise, formally capturing behaviors observed in private training via iterative methods. Additionally, we show that our method is robust to adversarial perturbations of training prompts, unlike standard ridge regression. All theoretical findings are supported by extensive simulations across diverse settings.

Figures

Figures reproduced from arXiv: 2504.16000 by the authors.

Figure 1
Figure 1. Excess risk of NoisyHead for the low￾dimensional set-up with D = 5 [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 3
Figure 3. Comparison of prediction error under adversarial perturbations for different values of [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figure 4
Figure 4. Excess risk of NoisyHead as a function of training set size N for different values of the privacy parameter ε with D = ⌊ √ N⌋. B Numerical Experiments Details This section details and extends upon the numerical examples presented in Section 6. B.1 Effect of privacy on prediction risk: low- vs. high-dimensional regimes In Section 6.1, we empirically investigate how the level of privacy, parameterized by ε, affects th… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 23 canonical work pages

  1. [1]

    Abadi, A

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308--318. ACM, 2016

    work page 2016

  2. [2]

    Akyürek, J

    E. Akyürek, J. Andreas, and K. G. Lin. What learning algorithm is in-context learning? investigations with linear models. In International Conference on Learning Representations (ICLR), 2022. URL https://openreview.net/forum?id=rd4DBk3whU

    work page 2022

  3. [3]

    R. Anil, B. Ghazi, V. Gupta, R. Kumar, and P. Manurangsi. Large-scale differentially private bert. arXiv preprint arXiv:2108.01624, 2021

    arXiv 2021

  4. [4]

    Anwar, J

    U. Anwar, J. Von Oswald, L. Kirsch, D. Krueger, and S. Frei. Adversarial robustness of in-context learning in transformers for linear regression. arXiv preprint arXiv:2411.05189, 2024

    arXiv 2024

  5. [5]

    Black, S

    S. Black, S. Biderman, E. Hallahan, Q. Anthony, L. Gao, L. Golding, H. He, C. Leahy, K. McDonell, J. Phang, et al. Gpt-neox-20b: An open-source autoregressive language model. https://arxiv.org/abs/2204.06745, 2022

    arXiv 2022

  6. [6]

    Bombari and M

    S. Bombari and M. Mondelli. Privacy for free in the overparameterized regime. Proceedings of the National Academy of Sciences, 122 0 (15): 0 e2423072122, 2025

    work page 2025

  7. [7]

    T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, et al. Language models are few-shot learners. In Advances in Neural Information Processing Systems, volume 33, pages 1877--1901, 2020

    work page 1901

  8. [8]

    Z. Bu, X. Zhang, S. Zha, M. Hong, and G. Karypis. Pre-training differentially private models with limited public data. Advances in Neural Information Processing Systems, 37: 0 94652--94683, 2024

    work page 2024

Show all 44 references
  1. [9]

    Bubeck, V

    S. Bubeck, V. Chandrasekaran, R. Eldan, J. Gehrke, E. Horvitz, E. Kamar, P. Lee, Y. Lee, Y. T. Li, S. Lundberg, et al. Sparks of artificial general intelligence: Early experiments with gpt-4. https://arxiv.org/abs/2303.12712, 2023

    2023 arXiv

  2. [10]

    T. T. Cai, Y. Wang, and L. Zhang. The cost of privacy: optimal rates of convergence for parameter estimation with differential privacy. Ann. Statist., 49 0 (5): 0 2825--2850, 2021. ISSN 0090-5364,2168-8966. doi:10.1214/21-aos2058. URL https://doi.org/10.1214/21-aos2058

    2021 doi

  3. [11]

    Carlini, F

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, et al. Extracting training data from large language models. In USENIX Security Symposium, 2021. URL https://arxiv.org/abs/2012.07805

    2021 arXiv

  4. [12]

    Carlini, F

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, and K. Lee. Membership inference attacks from first principles. In Proceedings of the IEEE Symposium on Security and Privacy, 2022. URL https://arxiv.org/abs/2112.03570

    2022 arXiv

  5. [13]

    Chaudhuri, C

    K. Chaudhuri, C. Monteleoni, and A. D. Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 12: 0 1069--1109, 2011

    2011

  6. [14]

    Z. Dai, N. Golowich, C. Zhang, J. Sohl-Dickstein, and B. Neyshabur. Transformers as statisticians: Provable in-context learning with in-context algorithm selection. In Advances in Neural Information Processing Systems (NeurIPS), 2023. URL https://openreview.net/forum?id=ceqN1LULfV

    2023

  7. [15]

    Dennstädt, J

    F. Dennstädt, J. Hastings, P. M. Putora, M. Schmerder, and N. Cihoric. Implementing large language models in healthcare while balancing control, collaboration, costs and security. npj Digital Medicine, 8 0 (1): 0 143, 2025. doi:10.1038/s41746-025-01476-7. URL https://www.natur...

    2025 doi

  8. [16]

    X. Dong, Y. Xu, and D. Radev. General-purpose in-context learning by meta-learning transformers. arXiv preprint arXiv:2212.10559, 2022. URL https://arxiv.org/abs/2212.10559

    2022 arXiv

  9. [17]

    Dwork, F

    C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating noise to sensitivity in private data analysis. In Proceedings of the 3rd Theory of Cryptography Conference (TCC), volume 3876 of Lecture Notes in Computer Science, pages 265--284. Springer, 2006. doi:10.1007/11681878_...

    2006 doi

  10. [18]

    Feldman, T

    V. Feldman, T. Zrnic, R. Bassily, and K. Talwar. Privacy amplification by iteration. In Advances in Neural Information Processing Systems (NeurIPS), volume 31, 2018

    2018

  11. [19]

    S. Garg, X. Li, T. Zhou, and S. Ermon. What can transformers learn in-context? a case study of simple function classes. In Advances in Neural Information Processing Systems (NeurIPS), 2022. URL https://proceedings.neurips.cc/paper_files/paper/2022/hash/fd09bd8a5e61ae58b07b9052...

    2022

  12. [20]

    S. Gopi, P. Jain, P. K. Kothari, and A. G. Thakurta. Dp-agd: Private adaptive gradient descent with optimal utility. In Advances in Neural Information Processing Systems (NeurIPS), 2021

    2021

  13. [21]

    X. Gu, W. Li, X. Zhang, Q. Wang, B. Ding, and Y. Zhang. Differential privacy mechanisms in neural tangent kernel regression. arXiv preprint arXiv:2407.13621, 2024. URL https://arxiv.org/abs/2407.13621

    2024 arXiv

  14. [22]

    Hoory, A

    S. Hoory, A. Feder, A. Tendler, S. Erell, A. Peled-Cohen, I. Laish, H. Nakhost, U. Stemmer, A. Benjamini, A. Hassidim, et al. Learning and evaluating a differentially private pre-trained language model. In Findings of the Association for Computational Linguistics: EMNLP 2021, ...

    2021

  15. [23]

    Jain and A

    P. Jain and A. Thakurta. Differentially private learning with kernels. In Proceedings of the 30th International Conference on Machine Learning, pages 118--126. PMLR, 2013. URL https://proceedings.mlr.press/v28/jain13.html

    2013

  16. [24]

    T. Ji, C. Luo, Y. Guo, J. Ji, W. Liao, and P. Li. Differentially private community detection in attributed social networks. In Proceedings of The Eleventh Asian Conference on Machine Learning, pages 16--31. PMLR, 2019. URL https://proceedings.mlr.press/v101/ji19a.html

    2019

  17. [25]

    Kamath and J

    G. Kamath and J. Ullman. A primer on private statistics. arXiv preprint arXiv:2005.00010, 2020. URL https://arxiv.org/abs/2005.00010

    2005 arXiv

  18. [26]

    L. Ke, S. Tong, P. Cheng, and K. Peng. Exploring the frontiers of llms in psychological applications: A comprehensive review. arXiv preprint arXiv:2401.01519, 2024. URL https://arxiv.org/abs/2401.01519

    2024 arXiv

  19. [27]

    X. Li, T. Ma, R. Zhang, M. Ganjali, and O. Mir. Large language models can be strong differentially private learners. In International Conference on Learning Representations (ICLR), 2022. URL https://arxiv.org/abs/2110.05679

    2022 arXiv

  20. [28]

    X. Li, V. Patel, S. Kumar, et al. Privacy preserving strategies for electronic health records in the era of large language models. Journal of Biomedical Informatics, 137: 0 104567, Jan 2025. doi:10.1016/j.jbi.2024.104567. URL https://pubmed.ncbi.nlm.nih.gov/39820020/

    2025

  21. [29]

    Liang, K

    H. Liang, K. Balasubramanian, and L. Lai. Transformers handle endogeneity in in-context linear regression. In The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=QfhU3ZC2g1

    2025

  22. [30]

    Lieber, T

    D. Lieber, T. Wolf, I. Golan, A. Shmidman, O. Sharir, and Y. Shoham. Jurassic-1: Technical details and evaluation. https://www.ai21.com/blog/jurassic-1-open-access, 2021. AI21 Labs Whitepaper

    2021

  23. [31]

    Y. Lu, M. Letey, J. A. Zavatone-Veth, A. Maiti, and C. Pehlevan. In-context learning by linear attention: Exact asymptotics and experiments. In NeurIPS 2024 Workshop on Mathematics of Modern Machine Learning, 2024

    2024

  24. [32]

    Majmudar, C

    J. Majmudar, C. Dupuy, C. Peris, S. Smaili, R. Gupta, and R. Zemel. Differentially private decoding in large language models. arXiv preprint arXiv:2205.13621, 2022

    2022 arXiv

  25. [33]

    B. Ni, N. Li, and W. Li. Detecting communities under differential privacy. In Proceedings of the 25th ACM International on Conference on Information and Knowledge Management, pages 597--606. ACM, 2016. doi:10.1145/2994620.2994624. URL https://dl.acm.org/doi/10.1145/2994620.2994624

    2016

  26. [34]

    J. W. Rae, S. Borgeaud, T. Cai, K. Millican, J. Hoffmann, F. Song, J. Aslanides, S. Henderson, R. Ring, S. Young, et al. Scaling language models: Methods, analysis & insights from training gopher. https://arxiv.org/abs/2112.11446, 2021

    2021 arXiv

  27. [35]

    Rigollet and J.-C

    P. Rigollet and J.-C. H \"u tter. High-dimensional statistics. arXiv preprint arXiv:2310.19244, 2023

    2023 arXiv

  28. [36]

    Tirumala, Adithya Renduchintala et al

    A. Tirumala, Adithya Renduchintala et al. Memorization in large language models: Quantifying, understanding, and reducing. In arXiv preprint arXiv:2202.07646, 2022. URL https://arxiv.org/abs/2202.07646

    2022 arXiv

  29. [37]

    Vladymyrov, J

    M. Vladymyrov, J. V. Oswald, M. Sandler, and R. Ge. Linear transformers are versatile in-context learners. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL https://openreview.net/forum?id=p1ft33Mu3J

    2024

  30. [38]

    Wang and J

    D. Wang and J. Xu. On sparse linear regression in the local differential privacy model. In Proceedings of the 36th International Conference on Machine Learning, pages 6628--6637. PMLR, 2019. URL https://proceedings.mlr.press/v97/wang19m.html

    2019

  31. [39]

    Y. Wang, H. Zhang, and Y. Liu. In-context learning for attention scheme: from single softmax regression to multiple softmax regression via a tensor trick. In International Conference on Learning Representations (ICLR), 2023. URL https://openreview.net/forum?id=j-D4N9T4U3

    2023

  32. [40]

    Y. Xie, Y. Lu, Z. Lin, J. Wei, E. Zhang, C. Raffel, L. Kong, T. Hashimoto, and C. D. Manning. An explanation of in-context learning as implicit bayesian inference. arXiv preprint arXiv:2211.15661, 2022. URL https://arxiv.org/abs/2211.15661

    2022 arXiv

  33. [41]

    X. Yu, S. Gopi, et al. Differentially private fine-tuning of language models. arXiv preprint arXiv:2303.08774, 2023. URL https://arxiv.org/abs/2303.08774

    2023 arXiv

  34. [42]

    Zhang, S

    R. Zhang, S. Frei, and P. L. Bartlett. Trained transformers learn linear models in-context. J. Mach. Learn. Res., 25: 0 Paper No. [49], 55, 2024. ISSN 1532-4435,1533-7928

    2024

  35. [43]

    Zhang, T

    T. Zhang, T. Zhu, K. Gao, W. Zhou, and P. S. Yu. Balancing learning model privacy, fairness, and accuracy with early stopping criteria. IEEE Trans. Neural Netw. Learn. Syst., 34 0 (9): 0 5557--5569, 2023. ISSN 2162-237X,2162-2388. doi:10.1109/tnnls.2021.3129592. URL https://do...

    2023

  36. [44]

    Zhang, K

    X. Zhang, K. Talwar, and D. Zhang. Understanding the difficulty of training transformers with differential privacy. arXiv preprint arXiv:2104.05800, 2021

    2021 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.