{"total":123,"rows":[{"id":"2401.06121","title":"TOFU: A Task of Fictitious Unlearning for LLMs","created":"2024-01-11","cited_by_count":533,"area":"safety"},{"id":"2310.16789","title":"Detecting Pretraining Data from Large Language Models","created":"2023-10-25","cited_by_count":387,"area":null},{"id":"2402.07841","title":"Do Membership Inference Attacks Work on Large Language Models?","created":"2024-02-12","cited_by_count":195,"area":"safety"},{"id":"2406.06443","title":"LLM Dataset Inference: Did you train on my dataset?","created":"2024-06-10","cited_by_count":110,"area":"safety"},{"id":"2312.03262","title":"Low-Cost High-Power Membership Inference Attacks","created":"2023-12-06","cited_by_count":107,"area":"safety"},{"id":"2404.02936","title":"Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Models","created":"2024-04-03","cited_by_count":103,"area":null},{"id":"2406.10890","title":"RWKU: Benchmarking Real-World Knowledge Unlearning for Large Language Models","created":"2024-06-16","cited_by_count":78,"area":"safety"},{"id":"2406.15968","title":"ReCaLL: Membership Inference via Relative Conditional Log-Likelihoods","created":"2024-06-23","cited_by_count":64,"area":"safety"},{"id":"2409.19798","title":"Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Data","created":"2024-09-29","cited_by_count":50,"area":"safety"},{"id":"2310.09266","title":"User Inference Attacks on Large Language Models","created":"2023-10-13","cited_by_count":36,"area":null},{"id":"2404.17399","title":"Evaluations of Machine Learning Privacy Defenses are Misleading","created":"2024-04-26","cited_by_count":36,"area":null},{"id":"2410.22235","title":"Auditing $f$-Differential Privacy in One Run","created":"2024-10-29","cited_by_count":30,"area":null},{"id":"2310.18933","title":"Label Poisoning is All You Need","created":"2023-10-29","cited_by_count":29,"area":"safety"},{"id":"2407.07737","title":"Fine-Tuning Large Language Models with User-Level Differential Privacy","created":"2024-07-10","cited_by_count":29,"area":null},{"id":"2405.11930","title":"Data Contamination Calibration for Black-box LLMs","created":"2024-05-20","cited_by_count":24,"area":null},{"id":"2503.06808","title":"Privacy Auditing of Large Language Models","created":"2025-03-09","cited_by_count":23,"area":"safety"},{"id":"2404.00473","title":"Privacy Backdoors: Stealing Data with Corrupted Pretrained Models","created":"2024-03-30","cited_by_count":22,"area":null},{"id":"2306.07273","title":"Gaussian Membership Inference Privacy","created":"2023-06-12","cited_by_count":21,"area":"safety"},{"id":"2405.14106","title":"Nearly Tight Black-Box Auditing of Differentially Private Machine Learning","created":"2024-05-23","cited_by_count":21,"area":null},{"id":"2305.18447","title":"Unleashing the Power of Randomization in Auditing Differentially Private ML","created":"2023-05-29","cited_by_count":20,"area":null},{"id":"2309.17310","title":"Leave-one-out Distinguishability in Machine Learning","created":"2023-09-29","cited_by_count":20,"area":null},{"id":"2405.14457","title":"Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Model","created":"2024-05-23","cited_by_count":18,"area":null},{"id":"2402.09477","title":"PANORAMIA: Privacy Auditing of Machine Learning Models without Retraining","created":"2024-02-12","cited_by_count":17,"area":"safety"},{"id":"2405.19524","title":"AI Risk Management Should Incorporate Both Safety and Security","created":"2024-05-29","cited_by_count":17,"area":null},{"id":"2410.02912","title":"Fine-Tuning Language Models with Differential Privacy through Adaptive Noise Allocation","created":"2024-10-03","cited_by_count":14,"area":null},{"id":"2405.03636","title":"The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscape","created":"2024-05-06","cited_by_count":13,"area":null},{"id":"2406.13985","title":"The Elusive Pursuit of Reproducing PATE-GAN: Benchmarking, Auditing, Debugging","created":"2024-06-20","cited_by_count":13,"area":null},{"id":"2503.04036","title":"Robust Data Watermarking in Language Models by Injecting Fictitious Knowledge","created":"2025-03-06","cited_by_count":12,"area":"safety"},{"id":"2410.06186","title":"The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD","created":"2024-10-08","cited_by_count":11,"area":null},{"id":"2503.14681","title":"DPImageBench: A Unified Benchmark for Differentially Private Image Synthesis","created":"2025-03-18","cited_by_count":11,"area":null},{"id":"2406.07698","title":"Label Smoothing Improves Machine Unlearning","created":"2024-06-11","cited_by_count":9,"area":"safety"},{"id":"2412.08559","title":"Underestimated Privacy Risks for Minority Populations in Large Language Model Unlearning","created":"2024-12-11","cited_by_count":9,"area":"safety"},{"id":"2503.07199","title":"How Well Can Differential Privacy Be Audited in One Run?","created":"2025-03-10","cited_by_count":9,"area":null},{"id":"2506.13009","title":"Rectifying Privacy and Efficacy Measurements in Machine Unlearning: A New Inference Attack Perspective","created":"2025-06-16","cited_by_count":9,"area":"safety"},{"id":"2501.03941","title":"Synthetic Data Privacy Metrics","created":"2025-01-07","cited_by_count":8,"area":null},{"id":"2405.20657","title":"DORY: Deliberative Prompt Recovery for LLM","created":"2024-05-31","cited_by_count":7,"area":null},{"id":"2411.05743","title":"Free Record-Level Privacy Risk Evaluation Through Artifact-Based Methods","created":"2024-11-08","cited_by_count":7,"area":"safety"},{"id":"2508.09603","title":"The Surprising Effectiveness of Membership Inference with Simple N-Gram Coverage","created":"2025-08-13","cited_by_count":7,"area":"safety"},{"id":"2306.00133","title":"A Note On Interpreting Canary Exposure","created":"2023-05-31","cited_by_count":6,"area":null},{"id":"2406.04827","title":"Auditing Differential Privacy Guarantees Using Density Estimation","created":"2024-06-07","cited_by_count":6,"area":null},{"id":"2411.10614","title":"To Shuffle or not to Shuffle: Auditing DP-SGD with Shuffling","created":"2024-11-15","cited_by_count":6,"area":null},{"id":"2506.05126","title":"Membership Inference Attacks on Sequence Models","created":"2025-06-05","cited_by_count":6,"area":"safety"},{"id":"2506.14913","title":"Winter Soldier: Backdooring Language Models at Pre-Training with Indirect Data Poisoning","created":"2025-06-17","cited_by_count":6,"area":"safety"},{"id":"2507.15836","title":"Optimizing Canaries for Privacy Auditing with Metagradient Descent","created":"2025-07-21","cited_by_count":6,"area":"safety"},{"id":"2509.23383","title":"Train Once, Answer All: Many Pretraining Experiments for the Cost of One","created":"2025-09-27","cited_by_count":6,"area":null},{"id":"2402.13087","title":"Revisiting Differentially Private Hyper-parameter Tuning","created":"2024-02-20","cited_by_count":5,"area":null},{"id":"2407.15526","title":"Synthetic Image Learning: Preserving Performance and Preventing Membership Inference Attacks","created":"2024-07-22","cited_by_count":5,"area":"safety"},{"id":"2506.16666","title":"The Hitchhiker's Guide to Efficient, End-to-End, and Tight DP Auditing","created":"2025-06-20","cited_by_count":5,"area":null},{"id":"2506.15349","title":"Enhancing One-run Privacy Auditing with Quantile Regression-Based Membership Inference","created":"2025-06-18","cited_by_count":4,"area":"safety"},{"id":"2507.18365","title":"RecPS: Privacy Risk Scoring for Recommender Systems","created":"2025-07-24","cited_by_count":4,"area":null},{"id":"2508.18671","title":"Auditing Approximate Machine Unlearning for Differentially Private Models","created":"2025-08-26","cited_by_count":4,"area":"safety"},{"id":"2512.16059","title":"ContextLeak: Auditing Leakage in Private In-Context Learning Methods","created":"2025-12-18","cited_by_count":4,"area":null},{"id":"2606.09401","title":"Benchmarking Empirical Privacy Protection for Adaptations of Large Language Models","created":"2026-06-08","cited_by_count":4,"area":null},{"id":"2402.10065","title":"Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakage","created":"2024-02-15","cited_by_count":3,"area":"safety"},{"id":"2503.12314","title":"Empirical Privacy Variance","created":"2025-03-16","cited_by_count":3,"area":null},{"id":"2511.06305","title":"Setting $\\varepsilon$ is not the Issue in Differential Privacy","created":"2025-11-09","cited_by_count":3,"area":null},{"id":"2602.17861","title":"JAX-Privacy: A library for differentially private machine learning","created":"2026-02-19","cited_by_count":3,"area":null},{"id":"2307.11280","title":"Epsilon*: Privacy Metric for Machine Learning Models","created":"2023-07-21","cited_by_count":2,"area":null},{"id":"2403.07588","title":"Visual Privacy Auditing with Diffusion Models","created":"2024-03-12","cited_by_count":2,"area":"diffusion"},{"id":"2405.08134","title":"Many-Shot Regurgitation (MSR) Prompting","created":"2024-05-13","cited_by_count":2,"area":"safety"},{"id":"2410.09311","title":"Data Deletion for Linear Regression with Noisy SGD","created":"2024-10-12","cited_by_count":2,"area":null},{"id":"2411.03730","title":"NeurIPS 2023 Competition: Privacy Preserving Federated Learning Document VQA","created":"2024-11-06","cited_by_count":2,"area":null},{"id":"2501.17762","title":"Improving Privacy Benefits of Redaction","created":"2025-01-29","cited_by_count":2,"area":null},{"id":"2505.03392","title":"Automatic Calibration for Membership Inference Attack on Large Language Models","created":"2025-05-06","cited_by_count":2,"area":"safety"},{"id":"2507.08158","title":"A Unified Framework for Adversary-Aware Differential Privacy Bounds","created":"2025-07-10","cited_by_count":2,"area":"safety"},{"id":"2602.02819","title":"Causal Evaluation of Membership Inference Attacks","created":"2026-02-02","cited_by_count":2,"area":"safety"},{"id":"2603.12142","title":"Understanding Disclosure Risk in Differential Privacy with Applications to Noise Calibration and Auditing (Extended Version)","created":"2026-03-12","cited_by_count":2,"area":"safety"},{"id":"2405.13375","title":"Adaptive Data Analysis for Growing Data","created":"2024-05-22","cited_by_count":1,"area":null},{"id":"2409.03612","title":"VFLGAN-TS: Vertical Federated Learning-based Generative Adversarial Networks for Publication of Vertically Partitioned Time-Series Data","created":"2024-09-05","cited_by_count":1,"area":null},{"id":"2504.16683","title":"MCMC for Bayesian estimation of Differential Privacy from Membership Inference Attacks","created":"2025-04-23","cited_by_count":1,"area":"safety"},{"id":"2505.10941","title":"Privacy-Aware Lifelong Learning","created":"2025-05-16","cited_by_count":1,"area":"safety"},{"id":"2512.04008","title":"Efficient Public Verification of Private ML via Regularization","created":"2025-12-03","cited_by_count":1,"area":null},{"id":"2601.03429","title":"DeepLeak: Privacy Enhancing Hardening of Model Explanations Against Membership Leakage","created":"2026-01-06","cited_by_count":1,"area":null},{"id":"2601.12922","title":"Your Privacy Depends on Others: Collusion Vulnerabilities in Individual Differential Privacy","created":"2026-01-19","cited_by_count":1,"area":null},{"id":"2601.19936","title":"Gap-K%: Measuring Top-1 Prediction Gap for Detecting Pretraining Data","created":"2026-01-16","cited_by_count":1,"area":null},{"id":"2602.08617","title":"ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation","created":"2026-02-09","cited_by_count":1,"area":null},{"id":"2602.16596","title":"Sequential Membership Inference Attacks","created":"2026-02-18","cited_by_count":1,"area":"safety"},{"id":"2604.18352","title":"Tight Auditing of Differential Privacy in MST and AIM","created":"2026-04-20","cited_by_count":1,"area":null},{"id":"2605.25819","title":"On Reliability of Membership Inference Vulnerability Evaluation","created":"2026-05-25","cited_by_count":1,"area":"safety"},{"id":"2606.28386","title":"Data Provenance for Image Auto-Regressive Generation","created":"2026-06-22","cited_by_count":1,"area":"safety"},{"id":"2606.28479","title":"Decomposing Memorization Reduction in Privacy-Preserving Fine-Tuning of SLMs for CSIRTs","created":"2026-06-26","cited_by_count":1,"area":null},{"id":"2607.05898","title":"Auditing of Unlearning Algorithms","created":"2026-07-07","cited_by_count":1,"area":"safety"},{"id":"2609.04382","title":"Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys","created":"2026-09-03","cited_by_count":1,"area":null},{"id":"2311.09200","title":"Are Normalizing Flows the Key to Unlocking the Exponential Mechanism?","created":"2023-11-15","cited_by_count":0,"area":null},{"id":"2412.01756","title":"Adversarial Sample-Based Approach for Tighter Privacy Auditing in Final Model-Only Scenarios","created":"2024-12-02","cited_by_count":0,"area":null},{"id":"2503.07775","title":"Sublinear Algorithms for Wasserstein and Total Variation Distances: Applications to Fairness and Privacy Auditing","created":"2025-03-10","cited_by_count":0,"area":null},{"id":"2503.12045","title":"Auditing Differential Privacy in the Black-Box Setting","created":"2025-03-15","cited_by_count":0,"area":null},{"id":"2508.15141","title":"Towards Reliable and Generalizable Differentially Private Machine Learning (Extended Version)","created":"2025-08-21","cited_by_count":0,"area":null},{"id":"2510.09114","title":"On the Fairness of Privacy Protection: Measuring and Mitigating the Disparity of Group Privacy Risks for Differentially Private Machine Learning","created":"2025-10-10","cited_by_count":0,"area":null},{"id":"2510.10510","title":"f-INE: A Hypothesis Testing Framework for Estimating Influence under Training Randomness","created":"2025-10-12","cited_by_count":0,"area":null},{"id":"2510.10902","title":"Auditing Information Disclosure During Large-Scale Gradient-Based Training via Gradient Uniqueness","created":"2025-10-13","cited_by_count":0,"area":null},{"id":"2510.23427","title":"PrivacyGuard: A Modular Framework for Privacy Auditing in Machine Learning","created":"2025-10-27","cited_by_count":0,"area":null},{"id":"2511.14084","title":"Observational Auditing of Label Privacy","created":"2025-11-18","cited_by_count":0,"area":null},{"id":"2511.21804","title":"Beyond Membership: Limitations of Add/Remove Adjacency in Differential Privacy","created":"2025-11-26","cited_by_count":0,"area":null},{"id":"2512.14388","title":"Black-Box Auditing of Quantum Model: Lifted Differential Privacy with Quantum Canaries","created":"2025-12-16","cited_by_count":0,"area":null},{"id":"2602.06518","title":"Sequential Auditing for f-Differential Privacy","created":"2026-02-06","cited_by_count":0,"area":null},{"id":"2603.11799","title":"Exponential-Family Membership Inference: From LiRA and RMIA to BaVarIA","created":"2026-03-12","cited_by_count":0,"area":"safety"},{"id":"2603.19258","title":"MAPLE: Metadata Augmented Private Language Evolution","created":"2026-02-26","cited_by_count":0,"area":null},{"id":"2603.22968","title":"Beyond Theoretical Bounds: Empirical Privacy Loss Calibration for Text Rewriting Under Local Differential Privacy","created":"2026-03-24","cited_by_count":0,"area":null},{"id":"2604.15851","title":"DPrivBench: Benchmarking LLMs' Reasoning for Differential Privacy","created":"2026-04-17","cited_by_count":0,"area":"lr"}],"next_cursor":"100"}