{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2020:M65JF4TWJRAV3STJPICPJTPAVR","short_pith_number":"pith:M65JF4TW","schema_version":"1.0","canonical_sha256":"67ba92f2764c415dca697a04f4cde0ac6dcac43b3ac418dad339adf83982029c","source":{"kind":"arxiv","id":"2012.07805","version":2},"attestation_state":"computed","paper":{"title":"Extracting Training Data from Large Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CL","cs.LG"],"primary_cat":"cs.CR","authors_text":"Adam Roberts, Alina Oprea, Ariel Herbert-Voss, Colin Raffel, Dawn Song, Eric Wallace, Florian Tramer, Katherine Lee, Matthew Jagielski, Nicholas Carlini, Tom Brown, Ulfar Erlingsson","submitted_at":"2020-12-14T18:39:09Z","abstract_excerpt":"It has become common to publish large (billion parameter) language models that have been trained on private datasets. This paper demonstrates that in such settings, an adversary can perform a training data extraction attack to recover individual training examples by querying the language model.\n  We demonstrate our attack on GPT-2, a language model trained on scrapes of the public Internet, and are able to extract hundreds of verbatim text sequences from the model's training data. These extracted examples include (public) personally identifiable information (names, phone numbers, and email add"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2012.07805","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-12-14T18:39:09Z","cross_cats_sorted":["cs.CL","cs.LG"],"title_canon_sha256":"9f2e4630852505ec21d8a2da7e456b5247ae5d8559b23f0e72eb4d433a54f453","abstract_canon_sha256":"23b0b60f13ad5e93511bcf76527d49ba0b554d4ecc2dedfe7d9db34a4524be98"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:49:21.931490Z","signature_b64":"mhVOt9AkEHlBSlvtQMWv3KmKE6WjDpMMOl6YrhHD0lNBx1Ir7ZCq2dXcjKKJ07pbAScEEGqvsSx7Xup5oZ+LDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"67ba92f2764c415dca697a04f4cde0ac6dcac43b3ac418dad339adf83982029c","last_reissued_at":"2026-07-05T02:49:21.931027Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:49:21.931027Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Extracting Training Data from Large Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CL","cs.LG"],"primary_cat":"cs.CR","authors_text":"Adam Roberts, Alina Oprea, Ariel Herbert-Voss, Colin Raffel, Dawn Song, Eric Wallace, Florian Tramer, Katherine Lee, Matthew Jagielski, Nicholas Carlini, Tom Brown, Ulfar Erlingsson","submitted_at":"2020-12-14T18:39:09Z","abstract_excerpt":"It has become common to publish large (billion parameter) language models that have been trained on private datasets. This paper demonstrates that in such settings, an adversary can perform a training data extraction attack to recover individual training examples by querying the language model.\n  We demonstrate our attack on GPT-2, a language model trained on scrapes of the public Internet, and are able to extract hundreds of verbatim text sequences from the model's training data. These extracted examples include (public) personally identifiable information (names, phone numbers, and email add"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2012.07805","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2012.07805/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2012.07805","created_at":"2026-07-05T02:49:21.931078+00:00"},{"alias_kind":"arxiv_version","alias_value":"2012.07805v2","created_at":"2026-07-05T02:49:21.931078+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2012.07805","created_at":"2026-07-05T02:49:21.931078+00:00"},{"alias_kind":"pith_short_12","alias_value":"M65JF4TWJRAV","created_at":"2026-07-05T02:49:21.931078+00:00"},{"alias_kind":"pith_short_16","alias_value":"M65JF4TWJRAV3STJ","created_at":"2026-07-05T02:49:21.931078+00:00"},{"alias_kind":"pith_short_8","alias_value":"M65JF4TW","created_at":"2026-07-05T02:49:21.931078+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":35,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2606.26627","citing_title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","ref_index":18,"is_internal_anchor":false},{"citing_arxiv_id":"2606.23276","citing_title":"Exposing the Illusion of Erasure in Knowledge Editing for LLMs","ref_index":8,"is_internal_anchor":false},{"citing_arxiv_id":"2606.17168","citing_title":"RepSelect: Robust LLM Unlearning via Representation Selectivity","ref_index":2,"is_internal_anchor":false},{"citing_arxiv_id":"2606.12341","citing_title":"OCELOT: Inference-Leakage Budgets for Privacy-Preserving LLM Agents","ref_index":6,"is_internal_anchor":false},{"citing_arxiv_id":"2606.09038","citing_title":"Personalization Meets Safety:Mechanisms,Risks,and Mitigations in Personalized LLMs","ref_index":88,"is_internal_anchor":false},{"citing_arxiv_id":"2606.07996","citing_title":"MC-PDD: Masked Corpus-Level Pretraining Data Detection for Black-Box Large Language Models","ref_index":15,"is_internal_anchor":false},{"citing_arxiv_id":"2607.00605","citing_title":"Auditing Forgetting in Limited Memory Language Models","ref_index":2,"is_internal_anchor":false},{"citing_arxiv_id":"2607.00527","citing_title":"AI Native Games: A Survey and Roadmap","ref_index":86,"is_internal_anchor":false},{"citing_arxiv_id":"2606.06286","citing_title":"LLMs Can Leak Training Data But Do They Want To? A Propensity-Aware Evaluation of Memorization in LLMs","ref_index":1,"is_internal_anchor":false},{"citing_arxiv_id":"2606.05936","citing_title":"Epistemic Injustice in Language Models: An Audit of Pretraining Filters and Guardrails","ref_index":3,"is_internal_anchor":false},{"citing_arxiv_id":"2606.02822","citing_title":"Which Defense Closes Which Threat? Attributing OWASP-LLM-Top-10 Coverage and Its Brittleness Under Paraphrasing","ref_index":2,"is_internal_anchor":false},{"citing_arxiv_id":"2606.09844","citing_title":"The Interlocutor Effect: Why LLMs Leak More Personal Data to Agents Than Humans","ref_index":13,"is_internal_anchor":false},{"citing_arxiv_id":"2605.25902","citing_title":"Reading the Finetuning Prior: Verbatim Content Recovery via Contrastive Decoding Diffing","ref_index":3,"is_internal_anchor":false},{"citing_arxiv_id":"2605.27825","citing_title":"MRMMIA: Membership Inference Attacks on Memory in Chat Agents","ref_index":2,"is_internal_anchor":false},{"citing_arxiv_id":"2107.06499","citing_title":"Deduplicating Training Data Makes Language Models Better","ref_index":13,"is_internal_anchor":false},{"citing_arxiv_id":"2402.16391","citing_title":"Industry Practitioners Perspectives on AI Model Quality: Perceptions, Challenges, and Solutions","ref_index":32,"is_internal_anchor":false},{"citing_arxiv_id":"2501.02407","citing_title":"Towards the Anonymization of the Language Modeling","ref_index":9,"is_internal_anchor":false},{"citing_arxiv_id":"2605.22786","citing_title":"LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systems","ref_index":4,"is_internal_anchor":false},{"citing_arxiv_id":"2505.18853","citing_title":"Smoothie: Smoothing Diffusion on Token Embeddings for Text Generation","ref_index":5,"is_internal_anchor":false},{"citing_arxiv_id":"2509.14594","citing_title":"SynBench: A Benchmark for Differentially Private Text Generation","ref_index":8,"is_internal_anchor":false},{"citing_arxiv_id":"2205.10487","citing_title":"Scaling Laws and Interpretability of Learning from Repeated Data","ref_index":21,"is_internal_anchor":false},{"citing_arxiv_id":"2502.03387","citing_title":"LIMO: Less is More for Reasoning","ref_index":253,"is_internal_anchor":false},{"citing_arxiv_id":"2512.08875","citing_title":"When Tables Leak: Attacking String Memorization in LLM-Based Tabular Data Generation","ref_index":9,"is_internal_anchor":false},{"citing_arxiv_id":"2403.07691","citing_title":"ORPO: Monolithic Preference Optimization without Reference Model","ref_index":11,"is_internal_anchor":false},{"citing_arxiv_id":"2202.07646","citing_title":"Quantifying Memorization Across Neural Language Models","ref_index":4,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR","json":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR.json","graph_json":"https://pith.science/api/pith-number/M65JF4TWJRAV3STJPICPJTPAVR/graph.json","events_json":"https://pith.science/api/pith-number/M65JF4TWJRAV3STJPICPJTPAVR/events.json","paper":"https://pith.science/paper/M65JF4TW"},"agent_actions":{"view_html":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR","download_json":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR.json","view_paper":"https://pith.science/paper/M65JF4TW","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2012.07805&json=true","fetch_graph":"https://pith.science/api/pith-number/M65JF4TWJRAV3STJPICPJTPAVR/graph.json","fetch_events":"https://pith.science/api/pith-number/M65JF4TWJRAV3STJPICPJTPAVR/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/action/timestamp_anchor","attest_storage":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/action/storage_attestation","attest_author":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/action/author_attestation","sign_citation":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/action/citation_signature","submit_replication":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/action/replication_record"}},"created_at":"2026-07-05T02:49:21.931078+00:00","updated_at":"2026-07-05T02:49:21.931078+00:00"}