{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:UA3XGK77LUFHRMGELCJL3TGS4K","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b06019ce5b75992b2a951189cca889496b638d2340b8e0b9215822312bf60218","cross_cats_sorted":["cs.AI","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-26T20:41:50Z","title_canon_sha256":"150425b500b5e9e32550ad471f64d1cf55fd4b940e85b99a4096c963d046e864"},"schema_version":"1.0","source":{"id":"2402.17012","kind":"arxiv","version":4}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.17012","created_at":"2026-07-05T08:43:53Z"},{"alias_kind":"arxiv_version","alias_value":"2402.17012v4","created_at":"2026-07-05T08:43:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.17012","created_at":"2026-07-05T08:43:53Z"},{"alias_kind":"pith_short_12","alias_value":"UA3XGK77LUFH","created_at":"2026-07-05T08:43:53Z"},{"alias_kind":"pith_short_16","alias_value":"UA3XGK77LUFHRMGE","created_at":"2026-07-05T08:43:53Z"},{"alias_kind":"pith_short_8","alias_value":"UA3XGK77","created_at":"2026-07-05T08:43:53Z"}],"graph_snapshots":[{"event_id":"sha256:31aec203b69a5095681caf13a0b4e836548f67cde5cf1638ff070c6edd66bb1f","target":"graph","created_at":"2026-07-05T08:43:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2402.17012/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In this paper we develop state-of-the-art privacy attacks against Large Language Models (LLMs), where an adversary with some access to the model tries to learn something about the underlying training data. Our headline results are new membership inference attacks (MIAs) against pretrained LLMs that perform hundreds of times better than baseline attacks, and a pipeline showing that over 50% (!) of the fine-tuning dataset can be extracted from a fine-tuned LLM in natural settings. We consider varying degrees of access to the underlying model, pretraining and fine-tuning data, and both MIAs and t","authors_text":"Jason Wang, Jeffrey G. Wang, Marvin Li, Seth Neel","cross_cats":["cs.AI","cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-26T20:41:50Z","title":"Pandora's White-Box: Precise Training Data Detection and Extraction in Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.17012","kind":"arxiv","version":4},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:985989e85a79180fed600a708362d8d6ca8419cad8833c66e248138171b126dc","target":"record","created_at":"2026-07-05T08:43:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b06019ce5b75992b2a951189cca889496b638d2340b8e0b9215822312bf60218","cross_cats_sorted":["cs.AI","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-26T20:41:50Z","title_canon_sha256":"150425b500b5e9e32550ad471f64d1cf55fd4b940e85b99a4096c963d046e864"},"schema_version":"1.0","source":{"id":"2402.17012","kind":"arxiv","version":4}},"canonical_sha256":"a037732bff5d0a78b0c45892bdccd2e28cc2299e08d045df599b51d75ddc10ba","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a037732bff5d0a78b0c45892bdccd2e28cc2299e08d045df599b51d75ddc10ba","first_computed_at":"2026-07-05T08:43:53.495805Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:43:53.495805Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"/fCR5EiIITwOQSbgtwlcs8WXDh1GvyxNMrfO9M01jfxjQraK94cEDH6d/v/nTOkvRkzWUOKa8OWGSrjebFTnAg==","signature_status":"signed_v1","signed_at":"2026-07-05T08:43:53.496279Z","signed_message":"canonical_sha256_bytes"},"source_id":"2402.17012","source_kind":"arxiv","source_version":4}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:985989e85a79180fed600a708362d8d6ca8419cad8833c66e248138171b126dc","sha256:31aec203b69a5095681caf13a0b4e836548f67cde5cf1638ff070c6edd66bb1f"],"state_sha256":"cf54f8dce71083b25539dd77e9e9a479f9357ad109362096117aa87b45f4a33c"}