Pith. sign in

REVIEW 4 major objections 5 minor 45 references

ReCIT: Reconstructing Full Private Data from Gradient in Parameter-Efficient Fine-Tuning of Large Language Models

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ReCIT reconstructs both contextual prefix and personally identifiable information from a parameter-efficient fine-tuning gradient by combining a poisoned memorization stage, a low-rank token filter, and a token-pairing mechanism.

desk verdict A genuinely new hybrid attack with the broadest PEFT evaluation in the area, but 'full private data from gradient' overstates it: the PII is memorization-triggered recall, and the prefix metric only checks name plus topic. read the letter →

arxiv 2504.20570 v1 pith:XDWTMZZQ submitted 2025-04-29 cs.CR

Jin Xie , Ruishi He , Songze Li , Xiaojun Jia , Shouling Ji This is my paper · ORCID
classification cs.CR
keywords gradientinversionparameter-efficientfine-tuningfederatedlearningprivacyattackPIIrecoverymemorizationtokenextraction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ReCIT is a privacy attack that aims to reconstruct a full private training sample—the surrounding context and the personal identifier embedded in it, such as a phone number or email—from the gradient a client uploads during parameter-efficient fine-tuning (PEFT). The paper's central claim is that earlier attacks recover only one piece of the sample, whereas ReCIT recovers both, by poisoning the pre-trained model so it memorizes PII, extracting a small set of key tokens from the low-rank gradient, and then prompting the fine-tuned model with the recovered prefix to recite the secret. If the claim holds, federated PEFT systems are more exposed than believed: an adversary who controls the model distribution can pull personal data from a single gradient exchange, even at batch sizes up to 128. ReCIT reports up to ten times higher PII recovery than state-of-the-art baselines across LoRA, adapter, and offsite-tuning settings, and is the only tested method that keeps working at large batch sizes.

What carries the argument

The central mechanism is the rank-deficiency theorem applied to PEFT gradients: for a linear layer, the gradient with respect to the weight matrix is $\partial L/\partial W = Z^T \partial L/\partial Y$, so its rank is at most the number of tokens in the batch; when that number is below the embedding dimension, the input embeddings lie in the column space of the gradient. ReCIT uses this to verify candidate tokens by SVD, projecting each token embedding onto the gradient's column space and checking whether the residual distance stays below a threshold. Around this core, three auxiliary mechanisms carry the attack: a PNote poisoning stage that teaches the model to produce explicit 'Person's topic is' statements for memorized PII; a target filter set of roughly 8,000 tokens (common names, PII-topic words, frequent keywords) that makes the vocabulary check tractable; and a token-pairing stage that uses residual distance for small batches and perplexity for large batches to assign names and keywords to the correct PII topic. Together they convert a sparse, high-dimensional gradient into a short list of likely tokens, then into a prompt that triggers the model's memory of the secret.

What would settle it

Run the PII-inference stage with the true prefix given for free, on a model that received no PNote poisoning: if prompting the fine-tuned model with the real prefix rarely produces the true secret, then ReCIT's PII recovery depends on its poison stage rather than on gradient information. A second check is to compare ReCIT's PII accuracy against a 'true-prefix + unpoisoned model' baseline; any accuracy the baseline achieves is pure memorization, and the gap between the two measures how much the gradient-based prefix actually contributes.

Watch

Extended reading notes

Core claim

On its own terms, ReCIT establishes that reconstructing 'full private data' from a PEFT gradient is feasible by splitting the problem into two halves. The context half is solved analytically: because the gradient of a linear layer has rank at most the number of tokens in the batch, every input embedding in the batch lies in the column space of the query gradient, so a candidate token can be confirmed by projecting its embedding onto that space and measuring the residual. The secret half is solved by memory: before the victim fine-tunes, the adversary fine-tunes the model on synthetic samples with Personal Notes that state PII explicitly, so that during the victim's PEFT the model learns to memorize identity-linked secrets and to emit them when prompted with the recovered prefix. After filtering a curated set of about 8,000 names, PII-topic words, and keywords, ReCIT pairs tokens into name-topic-keyword triples using residual distance or perplexity, reconstructs a sentence prefix with a generative language model, and queries the updated model for the PII. The paper reports that this pipeline recovers both prefix and PII on Enron, PersonaChat, and SQuAD v2 across four model families and three PEFT paradigms.

Load-bearing premise

The PII-inference stage assumes the victim's fine-tuning run has caused the model to memorize the exact secret string, so that prompting with the recovered prefix yields the value; without that memorization, the attack cannot recover the PII even if the prefix is perfect.

Editorial extensions

If this is right

  • An adversary who controls the pre-trained model can recover both the context and the linked personal identifier from a single PEFT gradient, even when the victim's batch contains 128 samples.
  • The three major PEFT families under test—LoRA, adapter-based methods, and offsite-tuning—are all vulnerable, so privacy arguments that rely on PEFT's small parameter footprint do not hold in this threat model.
  • Adding Gaussian noise typical of differential privacy at the tested levels weakens the attack but does not eliminate it: ReCIT still recovers PII at batch size 16 with $\sigma=10^{-4}$.
  • Because ReCIT searches only a curated token set instead of the full vocabulary, it is substantially faster than earlier gradient-inversion baselines, with the largest speedup reported at batch size 128.
  • The attack needs no prior knowledge of the prefix or the secret format; the filter set and the generative sentence-assembly step replace that knowledge.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One implication the paper leaves implicit is that the PII stage is memory extraction rather than gradient inversion: the gradient supplies the prefix, and the secret comes from what the model memorized. This suggests the attack's ceiling is set by model memorization, so defenses that suppress memorization (input deduplication, DP training, unlearning) may reduce PII recovery even while prefix reco
  • The PNote poisoning recipe is portable: the same 'Name's topic is' template should work for any structured fact, such as account numbers, passwords, or medical identifiers, with only an enlarged filter set.
  • A testable consequence is that prefix recovery is bounded by the curated 8,000-token set; rare names, unusual PII formats, or low-frequency keywords outside the set should sharply lower recovery rates, which would let defenders estimate exposure by measuring how much of a dataset falls inside such a set.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes ReCIT, a hybrid privacy attack against parameter-efficient fine-tuning (PEFT) in collaborative learning. The attacker controls the pre-trained model, performs a malicious pre-training stage with synthetic 'Personal Notes' (PNotes) to bias the model toward memorizing person-linked secrets, then receives PEFT gradients from a victim client. From the gradients, ReCIT applies a filter-based token extraction (FTE) step that checks whether candidate tokens lie in the column space of the query gradient, followed by token-pairing to associate names, PII topics, and keywords. The recovered fragments are paraphrased by GPT-4o into a prefix, which is then used to prompt the merged model to recite the memorized PII. The paper evaluates ReCIT on Enron Email, Personachat, and SQuAD v2 with GPT-Neo, Bloomz, Llama-3.2, and DeepSeek-R1 across LoRA, FedAdapter, Offsite-Tuning, and full fine-tuning. It reports consistent improvement over DLG, LAMP, Grab, DAGER, and Phish, with PII extraction rates up to roughly 50% at small batch sizes and lower but still leading rates at batch size 128. The authors conclude that PEFT gradients can expose both contextual prefixes and exact private identifiers.

Significance. If the central claim were fully established, this would be an important result for the privacy community: it would show that even parameter-efficient updates leak both context and exact PII, and that a malicious model publisher can amplify this leakage through undetectable pre-training. The paper contributes a useful new attack design that combines gradient-based token membership testing with memorization-based extraction, and it evaluates across a broad set of models, PEFT methods, batch sizes, and defenses, including differential privacy. The runtime comparison is also a practical strength. However, the significance is currently limited by the gap between the headline 'full private data with high fidelity' and the reported metrics: the prefix metric only checks name plus PII-topic token recovery, and the PII metric is an end-to-end success rate that conflates gradient-pairing success, prefix reconstruction, and the model's raw memorization of the secret. The memorization step, which is load-bearing, is never measured in isolation. The work is therefore a plausible and interesting attack proposal, but its strongest conclusions are not yet supported by the evidence as written.

major comments (4)
  1. [Section IV-D and Section V-A (Figure 7)] The PII inference stage assumes that after the victim's PEFT run, the merged model has memorized the exact secret string, so that prompting with a recovered prefix such as "Name's topic is" yields the value. The manuscript never measures this memorization independently of the full attack pipeline: the reported PII extraction rate conflates FTE and pairing success, GPT-4o prefix paraphrasing, and the model's own recall of the secret. The ablations in Figure 7 remove PNotes or the entire malicious training, but they do not distinguish the failure modes. I request a control experiment in which the attacker is given the correct prefix and only the PII inference step is tested, across different numbers of local epochs E. Without this control, the contribution of gradient analysis to PII recovery cannot be attributed.
  2. [Section V-B (Metric definitions)] The 'prefix extraction rate' is defined as the percentage of test samples for which both the name token and the PII topic token are accurately recovered and correctly paired. This is a much weaker notion than reconstructing the contextual prefix of the training sequence. Yet the paper's claims in the abstract and Section I are phrased as 'full private data' and 'contextual prefix' recovery. The metric should be complemented by a full-prefix fidelity measure, such as token-level accuracy, BLEU, or ROUGE, or the claims should be explicitly scoped to 'name and PII-topic fragment recovery'.
  3. [Section V-B (Figures 4 and 5, Table II)] The absolute success rates do not support the 'high fidelity' characterization. For LoRA at batch size 2, PII extraction rates are roughly 45-48%, and at batch size 128 they fall to about 25% on Enron/Personachat and 25% on SQuAD v2. Even the best case is around 50%. The phrase 'achieves recovery of full private data from PEFT gradients with high fidelity' is therefore an overstatement. The authors should either temper the abstract/conclusion claims or show settings where exact full-sequence recovery is actually achieved at a high rate.
  4. [Section V-A and Appendix VII] The synthetic PII test set and the PNote training set are both generated by prompting GPT-4o, and the target filter set and PNote summaries are manually constructed from the same kind of person-linked PII templates. This distributional overlap may inflate the apparent success of the attack: the model may memorize the synthetic pattern rather than the specific gradient signal, and FTE may perform better because the test tokens resemble the filter lexicon. I suggest evaluating on a disjoint PII distribution, for example real-world public PII datasets or a held-out set generated with different templates and different random seeds, and reporting false-positive rates of the token filter.
minor comments (5)
  1. [Section III, Threat Model] The subsection heading contains a typo: 'Adverary's goal' should be 'Adversary's goal'.
  2. [Equation (5)] The notation PNote_theta is used before being defined; please define the PNote generation step explicitly before the optimization objective.
  3. [Section IV-B] The text says that for LoRA the 'approximate gradient is often applied to the query layers,' but LoRA in practice updates multiple matrices in the attention and MLP blocks. Please clarify which weight matrices are actually used in the FTE membership test.
  4. [Section IV-D] The term 'merged model' should be defined precisely, e.g., the model obtained by adding the received PEFT updates to the pre-trained weights as in Eq. (2).
  5. [Figure 1] The comparison table in Figure 1 is difficult to read because the text is very small and some entries are condensed. A higher-resolution figure or a separate table would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ReCIT's gradient-to-prefix analysis is self-contained, and the PII stage is a designed memorization/recall mechanism rather than a derivation equivalent to its inputs.

full rationale

ReCIT is an engineered attack, not a derivation with fitted predictions. The gradient-analysis part (FTE, Theorems 1-2, Eq. 6-7) is self-contained: it applies the standard rank-deficiency of the gradient with respect to weight matrices, imported from external prior work [31], [32], and filters a fixed 8,000-token set (names, PII topics, keywords) against the column space of the gradient. No parameter is fitted to the target PII value; the 150 test secrets are distinct from the 300 PNote training samples, and the attacker is explicitly assumed to have no prior knowledge of either the PII or the prefix. The PII-inference stage (Section IV-D) prompts the merged model with the recovered 'Name's topic is' prefix and reads the completion. That is memory extraction rather than gradient inversion, and the paper's headline overstates the role of the gradient channel for the PII component; but it is not circular, because the recalled secret is not an input to the FTE or pairing steps. The PNote poisoning is the attack mechanism, not a hidden re-use of the test output. There are no load-bearing self-citations: the rank theorem and Morse-Sard argument are attributed to external prior work, and the baseline comparisons are against independently published attacks. The main caveats (test distribution generated in the same GPT-4o style as the poison data, no memorization-only control, and E=30 local epochs) are evaluation-validity concerns that belong under correctness risk, not circularity. I find no step where Eq. X reduces to Eq. Y by construction or where a fitted parameter is renamed as a prediction.

Assumptions & free parameters 5 free parameters · 6 assumptions · 1 invented entities

The attack depends on several stated or imported assumptions: the low-rank gradient theorem from prior work, the bn<=d condition for exact filtering, the Morse-Sard heuristic, and the empirical claim that 30-epoch PEFT plus PNotes makes the model memorize exact PII. The target filter set, FTE threshold, Bc, and PNote mix are hand-chosen values that affect results. PNotes are an introduced construct with only in-paper evidence.

free parameters (5)
  • FTE threshold zeta = 1e-5 (b<=16), 1e-6 (16<b<=64), 1e-7 (b>64)
    Chosen per batch-size range in Section V-A; directly controls which tokens are accepted as present in the batch, and no sensitivity analysis is reported.
  • Reference batch size Bc = 16
    Section V-A sets Bc=16 as the switch between residual-distance pairing and PPL-based pairing; the choice is not derived from data or theory.
  • PNote sample mix in malicious training = 200 PNote appended + 100 PNote summary samples
    Section V-A; ablation in Figure 8 shows extraction rate depends on the number of PNote samples, saturating around 250 plus samples.
  • Target filter set composition = approx 8000 tokens (6000 names, 200 PII topics, 2000 keywords)
    Section IV-B; sizes chosen by hand to cut vocabulary search; the set is described as flexibly expandable, so results depend on this curated list.
  • LoRA rank r = 64
    Section V-A; choice of LoRA rank affects gradient rank and the assumptions used by DAGER and ReCIT, but only one value is tested.
assumptions (6)
  • standard math Low-rank gradient theorem from prior work: the gradient of a linear layer has rank at most the batch size, so token embeddings lie in the column space of the gradient.
    Invoked in Section IV-B as Theorem 1 and Theorem 2, based on references [31] and [32].
  • domain assumption Total token count in a batch is at most the embedding dimension (bn <= d) for exact rank-deficiency filtering.
    Section IV-B states this as the mild assumption; it is violated for large batches, which the authors handle with PPL pairing instead.
  • domain assumption Client PEFT with 30 epochs and causal LM loss causes exact memorization of PII strings present in the fine-tuning data.
    PII inference in Section IV-D queries the model for a completion; ablations show PNotes are required, and no independent memorization measurement is provided.
  • standard math Morse-Sard theorem implies a token embedding not in the training batch is unlikely to lie in the gradient column space.
    Used in Section IV-B to justify threshold-based filtering; imported from DAGER and not re-derived.
  • domain assumption Threat model: the attacker controls the pre-trained model and can run a poison-training phase without detection.
    Stated in Section III-C; this is the precondition that makes PNotes and later inference possible.
  • domain assumption Perplexity of the string "Name's topic is leaked" ranks correct name-topic pairs above incorrect ones.
    Used for large-batch pairing in Section IV-C; no evaluation of this ranking criterion is provided.
invented entities (1)
  • Personal Notes (PNotes) with <PN> tags
    purpose: Malicious pre-training construct that teaches the model to summarize and recite PII, enabling later extraction.
    Introduced in Section IV-A; effectiveness is shown only through the paper's own ablation (Figure 7), with no external falsifiable handle.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ReCIT: Reconstructing Full Private Data from Gradient in Parameter-Efficient Fine-Tuning of Large Language Models." pith.science (2026). https://pith.science/paper/XDWTMZZQ

@misc{pith2026250420570,
  author       = {Pith},
  title        = {Pith review of: ReCIT: Reconstructing Full Private Data from Gradient in Parameter-Efficient Fine-Tuning of Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XDWTMZZQ}},
  note         = {Machine review of arXiv:2504.20570}
}
abstract

Parameter-efficient fine-tuning (PEFT) has emerged as a practical solution for adapting large language models (LLMs) to custom datasets with significantly reduced computational cost. When carrying out PEFT under collaborative learning scenarios (e.g., federated learning), it is often required to exchange model updates (or gradients) across parties. These gradients, even with limited dimensions, can cause severe breach of data privacy. Recent works have shown that both contextual prefixes and personally identifiable information (PII) can be exposed through gradients. However, \emph{simultaneously} and \emph{accurately} recovering both components from the same training instance remains infeasible due to the following challenges: 1) limited number of PEFT parameters; 2) high-dimensional token spaces; and 3) large batch sizes. We propose ReCIT, a novel privacy attack that addresses all challenges, and achieves recovery of \emph{full} private data from PEFT gradients with high fidelity. Specifically, ReCIT proposes to enhance the memorization capability of the pre-trained model through malicious fine-tuning with Personal Notes; ReCIT also proposes a novel filter-based token extraction technique and a token pairing mechanism, to accurately reconstruct tokens from the training sequences with large batch sizes. Extensive evaluations show that ReCIT consistently outperforms state-of-the-art gradient inversion and memorization-based attacks across different PEFT paradigms. It achieves up to 10$\times$ higher PII recovery rates and remains effective across varying batch sizes, especially in settings where prefix reconstruction is intractable for conventional approaches. These findings highlight an urgent need to reassess the privacy guarantees of PEFT, especially in decentralized or shared training environments.

Figures

Figures reproduced from arXiv: 2504.20570 by the authors.

Figure 1
Figure 1. Comparison of Data Reconstruction Attacks: Examples are reconstructed using the Personachat dataset with LLaMA-3.2-3B in LoRA fine-turning, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of ReCIT. It mainly includes the following steps: 1) The adversary uses a generated dataset with PNotes to strengthen memorization and [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Overview of constructing PNote dataset. 2) Malicious Training with PNote Dataset: Notably, this malicious training phase can be conducted entirely in a black￾box fashion, without access to the client’s private data. The process acts as an additional pre-training stage that subtly reorients the model’s internal representations to favor PII retention. At inference time, the adversary can prompt the model using context… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Comparison of Prefix reconstruction between ReCIT and other baselines [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Comparison of PII reconstruction between ReCIT and other baselines [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: PII reconstruction performance of ReCIT across different models and [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Ablation study of ReCIT highlighting the impact of PII strengthening [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 9
Figure 9. Figure 9: PII reconstruction performance comparison across different PII sample rate per batch, using the PersonaChat dataset with LoRA and Bloomz-3B. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 13 canonical work pages

  1. [1]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    arXiv 2023

  2. [2]

    Attention is all you need,

    A. Vaswani, “Attention is all you need,” Advances in Neural Information Processing Systems, 2017

    2017

  3. [3]

    A survey of large language models,

    W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y . Hou, Y . Min, B. Zhang, J. Zhang, Z. Dong et al. , “A survey of large language models,” arXiv preprint arXiv:2303.18223, 2023

    arXiv 2023

  4. [4]

    Scaling laws for neural language models,

    J. Kaplan, S. McCandlish, T. Henighan, T. B. Brown, B. Chess, R. Child, S. Gray, A. Radford, J. Wu, and D. Amodei, “Scaling laws for neural language models,” arXiv preprint arXiv:2001.08361 , 2020. 13

    arXiv 2001

  5. [5]

    Few-shot parameter-efficient fine-tuning is better and cheaper than in-context learning,

    H. Liu, D. Tam, M. Muqeeth, J. Mohta, T. Huang, M. Bansal, and C. A. Raffel, “Few-shot parameter-efficient fine-tuning is better and cheaper than in-context learning,” Advances in Neural Information Processing Systems, vol. 35, pp. 1950–1965, 2022

    1950

  6. [6]

    Parameter-efficient fine-tuning of large- scale pre-trained language models,

    N. Ding, Y . Qin, G. Yang, F. Wei, Z. Yang, Y . Su, S. Hu, Y . Chen, C.-M. Chan, W. Chen et al. , “Parameter-efficient fine-tuning of large- scale pre-trained language models,” Nature Machine Intelligence, vol. 5, no. 3, pp. 220–235, 2023

    2023

  7. [7]

    Parameter-efficient fine-tuning for large models: A comprehensive survey,

    Z. Han, C. Gao, J. Liu, J. Zhang, and S. Q. Zhang, “Parameter-efficient fine-tuning for large models: A comprehensive survey,” arXiv preprint arXiv:2403.14608, 2024

    arXiv 2024

  8. [8]

    Lora: Low-rank adaptation of large language models,

    E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, and W. Chen, “Lora: Low-rank adaptation of large language models,” arXiv preprint arXiv:2106.09685 , 2021

    arXiv 2021

Show all 45 references
  1. [9]

    Offsite-tuning: Transfer learning without full model,

    G. Xiao, J. Lin, and S. Han, “Offsite-tuning: Transfer learning without full model,” arXiv preprint arXiv:2302.04870 , 2023

    2023 arXiv

  2. [10]

    Fedlegal: The first real-world federated learning benchmark for legal nlp,

    Z. Zhang, X. Hu, J. Zhang, Y . Zhang, H. Wang, L. Qu, and Z. Xu, “Fedlegal: The first real-world federated learning benchmark for legal nlp,” in Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , 2023, pp. 3492– 3507

    2023

  3. [11]

    Improving lora in privacy-preserving federated learning,

    Y . Sun, Z. Li, Y . Li, and B. Ding, “Improving lora in privacy-preserving federated learning,” arXiv preprint arXiv:2403.12313 , 2024

    2024 arXiv

  4. [12]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems , vol. 32, 2019

    2019

  5. [13]

    Lamp: Extracting text from gradients with language model priors,

    M. Balunovic, D. Dimitrov, N. Jovanovi ´c, and M. Vechev, “Lamp: Extracting text from gradients with language model priors,” Advances in Neural Information Processing Systems , vol. 35, pp. 7641–7654, 2022

    2022

  6. [14]

    Dager: Exact gradient inversion for large language models,

    I. Petrov, D. I. Dimitrov, M. Baader, M. N. Müller, and M. Vechev, “Dager: Exact gradient inversion for large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2405.15586

    2024 arXiv

  7. [15]

    Quantifying memorization across neural language models,

    N. Carlini, D. Ippolito, M. Jagielski, K. Lee, F. Tramer, and C. Zhang, “Quantifying memorization across neural language models,” arXiv preprint arXiv:2202.07646, 2022

    2022 arXiv

  8. [16]

    Sentence embedding leaks more information than you expect: Generative embedding inversion attack to recover the whole sentence,

    H. Li, M. Xu, and Y . Song, “Sentence embedding leaks more information than you expect: Generative embedding inversion attack to recover the whole sentence,” arXiv preprint arXiv:2305.03010 , 2023

    2023 arXiv

  9. [17]

    Decepticons: Corrupted transformers breach pri- vacy in federated learning for language models,

    L. Fowl, J. Geiping, S. Reich, Y . Wen, W. Czaja, M. Goldblum, and T. Goldstein, “Decepticons: Corrupted transformers breach pri- vacy in federated learning for language models,” arXiv preprint arXiv:2201.12675, 2022

    2022 arXiv

  10. [18]

    Teach llms to phish: Stealing private information from language mod- els,

    A. Panda, C. A. Choquette-Choo, Z. Zhang, Y . Yang, and P. Mittal, “Teach llms to phish: Stealing private information from language mod- els,” arXiv preprint arXiv:2403.00871 , 2024

    2024 arXiv

  11. [19]

    Fishing for user data in large-batch federated learning via gradient magnifica- tion,

    Y . Wen, J. Geiping, L. Fowl, M. Goldblum, and T. Goldstein, “Fishing for user data in large-batch federated learning via gradient magnifica- tion,” arXiv preprint arXiv:2202.00580 , 2022

    2022 arXiv

  12. [20]

    Hiding in plain sight: Disguising data stealing attacks in federated learning,

    K. Garov, D. I. Dimitrov, N. Jovanovi ´c, and M. Vechev, “Hiding in plain sight: Disguising data stealing attacks in federated learning,” arXiv preprint arXiv:2306.03013, 2023

    2023 arXiv

  13. [21]

    Loki: Large-scale data reconstruction attack against fed- erated learning through model manipulation,

    J. C. Zhao, A. Sharma, A. R. Elkordy, Y . H. Ezzeldin, S. Avestimehr, and S. Bagchi, “Loki: Large-scale data reconstruction attack against fed- erated learning through model manipulation,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE, 2024, pp. 1287–1305

    2024

  14. [22]

    Exploring memorization in fine-tuned language models,

    S. Zeng, Y . Li, J. Ren, Y . Liu, H. Xu, P. He, Y . Xing, S. Wang, J. Tang, and D. Yin, “Exploring memorization in fine-tuned language models,” arXiv preprint arXiv:2310.06714 , 2023

    2023 arXiv

  15. [23]

    Be like a goldfish, don’t memorize! mitigating memorization in generative llms,

    A. Hans, J. Kirchenbauer, Y . Wen, N. Jain, H. Kazemi, P. Singhania, S. Singh, G. Somepalli, J. Geiping, A. Bhatele et al., “Be like a goldfish, don’t memorize! mitigating memorization in generative llms,” Advances in Neural Information Processing Systems , vol. 37, pp. 24 022...

    2024

  16. [24]

    Analyzing leakage of personally identifiable information in language models,

    N. Lukas, A. Salem, R. Sim, S. Tople, L. Wutschitz, and S. Zanella- Béguelin, “Analyzing leakage of personally identifiable information in language models,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 346–363

    2023

  17. [25]

    Precurious: How innocent pre- trained language models turn into privacy traps,

    R. Liu, T. Wang, Y . Cao, and L. Xiong, “Precurious: How innocent pre- trained language models turn into privacy traps,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 3511–3524

    2024

  18. [26]

    Pii- compass: Guiding llm training data extraction prompts towards the target pii via grounding,

    K. K. Nakka, A. Frikha, R. Mendes, X. Jiang, and X. Zhou, “Pii- compass: Guiding llm training data extraction prompts towards the target pii via grounding,” arXiv preprint arXiv:2407.02943 , 2024

    2024 arXiv

  19. [27]

    Parameter-efficient transfer learning for nlp,

    N. Houlsby, A. Giurgiu, S. Jastrzebski, B. Morrone, Q. De Laroussilhe, A. Gesmundo, M. Attariyan, and S. Gelly, “Parameter-efficient transfer learning for nlp,” in International conference on machine learning . PMLR, 2019, pp. 2790–2799

    2019

  20. [28]

    Propile: Probing privacy leakage in large language models,

    S. Kim, S. Yun, H. Lee, M. Gubri, S. Yoon, and S. J. Oh, “Propile: Probing privacy leakage in large language models,” Advances in Neural Information Processing Systems , vol. 36, pp. 20 750–20 762, 2023

    2023

  21. [29]

    Learning to reason and memorize with self-notes,

    J. Lanchantin, S. Toshniwal, J. Weston, S. Sukhbaatar et al., “Learning to reason and memorize with self-notes,” Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  22. [30]

    Chain of thought prompting elicits reasoning in large language models,

    J. Wei, X. Wang, D. Schuurmans, M. Bosma, E. H. Chi, Q. Le, and D. Zhou, “Chain of thought prompting elicits reasoning in large language models,” CoRR, vol. abs/2201.11903, 2022. [Online]. Available: https://arxiv.org/abs/2201.11903

    2022 arXiv

  23. [31]

    Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis,

    S. Kariyappa, C. Guo, K. Maeng, W. Xiong, G. E. Suh, M. K. Qureshi, and H.-H. S. Lee, “Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis,” in International Conference on Machine Learning . PMLR, 2023, pp. 15 884–15 899

    2023

  24. [32]

    Spear: Exact gradient inversion of batches in federated learning,

    D. I. Dimitrov, M. Baader, M. N. Müller, and M. Vechev, “Spear: Exact gradient inversion of batches in federated learning,” arXiv preprint arXiv:2403.03945, 2024

    2024 arXiv

  25. [33]

    M. W. Hirsch, Differential topology . Springer Science & Business Media, 2012, vol. 33

    2012

  26. [34]

    Stevenson, Oxford dictionary of English

    A. Stevenson, Oxford dictionary of English . Oxford University Press, 2010

    2010

  27. [35]

    The enron corpus: A new dataset for email classification research,

    B. Klimt and Y . Yang, “The enron corpus: A new dataset for email classification research,” in European conference on machine learning . Springer, 2004, pp. 217–226

    2004

  28. [36]

    Personalizing dialogue agents: I have a dog, do you have pets too,

    S. Zhang, “Personalizing dialogue agents: I have a dog, do you have pets too,” arXiv preprint arXiv:1801.07243 , 2018

    2018 arXiv

  29. [37]

    Know what you don’t know: Unanswerable questions for squad,

    P. Rajpurkar, R. Jia, and P. Liang, “Know what you don’t know: Unanswerable questions for squad,” arXiv preprint arXiv:1806.03822 , 2018

    2018 arXiv

  30. [38]

    The pile: An 800gb dataset of diverse text for language modeling,

    L. Gao, S. Biderman, S. Black, L. Golding, T. Hoppe, C. Foster, J. Phang, H. He, A. Thite, N. Nabeshima et al. , “The pile: An 800gb dataset of diverse text for language modeling,” arXiv preprint arXiv:2101.00027, 2020

    2020 arXiv

  31. [39]

    Crosslingual generalization through multitask finetuning,

    N. Muennighoff, T. Wang, L. Sutawika, A. Roberts, S. Biderman, T. L. Scao, M. S. Bari, S. Shen, Z.-X. Yong, H. Schoelkopf et al., “Crosslingual generalization through multitask finetuning,” arXiv preprint arXiv:2211.01786, 2022

    2022 arXiv

  32. [40]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale et al. , “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  33. [41]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,

    D. Guo, D. Yang, H. Zhang, J. Song, R. Zhang, R. Xu, Q. Zhu, S. Ma, P. Wang, X. Bi et al., “Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,” arXiv preprint arXiv:2501.12948 , 2025

    2025 arXiv

  34. [42]

    Huggingface’s transformers: State-of-the-art natural language processing,

    T. Wolf, “Huggingface’s transformers: State-of-the-art natural language processing,” arXiv preprint arXiv:1910.03771 , 2019

    1910 arXiv

  35. [43]

    Uncovering gradient inversion risks in practical language model training,

    X. Feng, Z. Ma, Z. Wang, E. J. Chegne, M. Ma, A. Abuadbba, and G. Bai, “Uncovering gradient inversion risks in practical language model training,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 3525–3539

    2024

  36. [44]

    Fedadapter: Efficient federated learning for modern nlp,

    D. Cai, Y . Wu, S. Wang, F. X. Lin, and M. Xu, “Fedadapter: Efficient federated learning for modern nlp,” arXiv preprint arXiv:2205.10162 , 2022. 14 APPENDIX VII. PII S AMPLE GENERATION We designed a diverse set of samples to train and test mod- els’ ability to memorize PII. B...

    2022 arXiv

  37. [2025]

    The updated warranty is valid until December 31, 2027

    His booking reference is X8P4T9R6Y2 • Hi Kristy,\nYour warranty extension with Serial Num- ber ZYX123GHJ789 has been approved. The updated warranty is valid until December 31, 2027. For more questions, please reach out! • Political Campaign Announcement Candidate: Lacy Date: M...

    2027

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.