LLM-PBE: Assessing Data Privacy in Large Language Models
Not on the map. Why?
Abstract (arXiv)
Large Language Models (LLMs) have become integral to numerous domains, significantly advancing applications in data management, mining, and analysis. Their profound capabilities in processing and interpreting complex language data, however, bring to light pressing concerns regarding data privacy, especially the risk of unintentional training data leakage. Despite the critical nature of this issue, there has been no existing literature to offer a comprehensive assessment of data privacy risks in LLMs. Addressing this gap, our paper introduces LLM-PBE, a toolkit crafted specifically for the systematic evaluation of data privacy risks in LLMs. LLM-PBE is designed to analyze privacy across the entire lifecycle of LLMs, incorporating diverse attack and defense strategies, and handling various data types and metrics. Through detailed experimentation with multiple LLMs, LLM-PBE facilitates an in-depth exploration of data privacy concerns, shedding light on influential factors such as model size, data characteristics, and evolving temporal dimensions. This study not only enriches the understanding of privacy issues in LLMs but also serves as a vital resource for future research in the field. Aimed at enhancing the breadth of knowledge in this area, the findings, resources, and our full technical report are made available at https://llm-pbe.github.io/, providing an open platform for academic and practical advancements in LLM privacy assessment.
Key facts. Cited by 38 papers in the map (data through 7 Oct 2026). Builds on 72 of its 129 references that are in the map. First posted on arXiv 23 Aug 2024.
Builds on
72 of 129 references.
References · 72
- 2017Attention Is All You Needcited by 59,932
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,710
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2016Deep Learning with Differential Privacycited by 2,682
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2019Fine-Tuning Language Models from Human Preferencescited by 2,124
- 2023Code Llama: Open Foundation Models for Codecited by 2,105
- 2023Pythia: A Suite for Analyzing Large Language Models Across Training and Scalingcited by 1,734
38 more
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
- 2019Machine Unlearningcited by 1,020
- 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
- 2021Membership Inference Attacks From First Principlescited by 839
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
- 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
- 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 505
- 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 492
- 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Modelscited by 424
- 2023Scalable Extraction of Training Data from (Production) Language Modelscited by 415
- 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 405
- 2021Differentially Private Fine-tuning of Language Modelscited by 392
- 2021Explaining Neural Scaling Lawscited by 353
- 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
- 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 309
- 2023Analyzing Leakage of Personally Identifiable Information in Language Modelscited by 278
- 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
- 2021ERNIE 3.0: Large-scale Knowledge Enhanced Pre-training for Language Understanding and Generationcited by 258
- 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
- 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
- 2021Machine Unlearning of Features and Labelscited by 223
- 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 218
- 2019Neural Legal Judgment Prediction in Englishcited by 208
- 2022Are Large Pre-Trained Language Models Leaking Your Personal Information?cited by 195
- 2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attackscited by 168
- 2023Beyond Memorization: Violating Privacy Via Inference with Large Language Modelscited by 167
- 2021Counterfactual Memorization in Neural Language Modelscited by 155
- 2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 137
- 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 113
- 2022Synthetic Text Generation with Differential Privacy: A Simple and Practical Recipecited by 108
- 2022The Text Anonymization Benchmark (TAB): A Dedicated Corpus and Evaluation Framework for Text Anonymizationcited by 94
- 2023KGA: A General Machine Unlearning Framework Based on Knowledge Gap Alignmentcited by 94
- 2023Privacy-Preserving In-Context Learning with Differentially Private Few-Shot Generationcited by 94
- 2021Does BERT Pretrained on Clinical Notes Reveal Sensitive Data?cited by 91
- 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 90
- 2022Automatic Clipping: Differentially Private Deep Learning Made Easier and Strongercited by 87
- 2022Position: Considerations for Differentially Private Learning with Large-Scale Public Pretrainingcited by 86
50 most cited of 72 All 72 (JSON)
Built on by
Citing papers per year: 2024: 6; 2025: 22; 2026: 10.
38 papers.
Sort:
By area:
- 2024Understanding World or Predicting Future? A Comprehensive Survey of World Modelscited by 161
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
- 2025The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMscited by 24
- 2024When LLMs Go Online: The Emerging Threat of Web-Enabled LLMscited by 22
- 2025Can Textual Gradient Work in Federated Learning?cited by 14
- 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemblecited by 11
- 2024Underestimated Privacy Risks for Minority Populations in Large Language Model Unlearningcited by 9
- 2025The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigationcited by 9
- 2025IP Leakage Attacks Targeting LLM-Based Multi-Agent Systemscited by 8
- 2024PII-Scope: A Comprehensive Study on Training Data PII Extraction Attacks in LLMscited by 6
- 2025PANORAMA: A synthetic PII-laced dataset for studying sensitive data memorization in LLMscited by 6
- 2025Beyond Data Privacy: New Privacy Risks for Large Language Modelscited by 6
26 more
- 2025DP-Fusion: Token-Level Differentially Private Inference for Large Language Modelscited by 5
- 2026Long Context, Less Focus: A Scaling Gap in LLMs Revealed through Privacy and Personalizationcited by 5
- 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agentscited by 4
- 2024Multi-PA: A Multi-perspective Benchmark on Privacy Assessment for Large Vision-Language Modelscited by 3
- 2025Less or More: Towards Glanceable Explanations for LLM Recommendations Using Ultra-Small Devicescited by 3
- 2025Enterprise AI Must Enforce Participant-Aware Access Controlcited by 3
- 2025ACAI for SBOs: AI Co-creation for Advertising and Inspiration for Small Business Ownerscited by 2
- 2025Beyond PII: How Users Attempt to Estimate and Mitigate Implicit LLM Inferencecited by 2
- 2025A Hierarchical Imprecise Probability Approach to Reliability Assessment of Large Language Modelscited by 2
- 2026Position: Weight Space Should Be a First-Class Generative AI Modalitycited by 2
- 2024Bridging Today and the Future of Humanity: AI Safety in 2024 and Beyondcited by 1
- 2025Explore Activation Sparsity in Recurrent LLMs for Energy-Efficient Neuromorphic Computingcited by 1
- 2025Detecting Instruction Fine-tuning Attacks using Influence Functioncited by 1
- 2025PrivacyXray: Detecting Privacy Breaches in LLMs through Semantic Consistency and Probability Certaintycited by 1
- 2025Towards Privacy-Preserving and Personalized Smart Homes via Tailored Small Language Modelscited by 1
- 2025A Survey: Towards Privacy and Security in Mobile Large Language Modelscited by 1
- 2026TrustLDM: Benchmarking Trustworthiness in Language Diffusion Modelscited by 1
- 2026IDP-Bench: Benchmarking ability of LLMs to protect personal information in interdependent privacy contextscited by 1
- 2025Small Language Models: Architectures, Techniques, Evaluation, Problems and Future Adaptationcited by 0
- 2025Towards Reliable and Generalizable Differentially Private Machine Learning (Extended Version)cited by 0
- 2025A global log for medical AIcited by 0
- 2026How Far Are VLMs from Privacy Awareness in the Physical World? An Empirical Studycited by 0
- 2026Large Language Models in Transportation Systems Management and Operations: From Text Reasoning to Multi-modal Decision Supportcited by 0
- 2026SpeechLLM Meets Federated Learning for End-to-End ASR: English and Italian Case Studiescited by 0
- 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agentscited by 0
- 2026Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMscited by 0
- 2026Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs28 Sep 2026
- 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agents3 Sep 2026
- 2026SpeechLLM Meets Federated Learning for End-to-End ASR: English and Italian Case Studies28 Jul 2026
- 2026IDP-Bench: Benchmarking ability of LLMs to protect personal information in interdependent privacy contexts6 Jun 2026
- 2026Large Language Models in Transportation Systems Management and Operations: From Text Reasoning to Multi-modal Decision Support31 May 2026
- 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents18 May 2026
- 2026Position: Weight Space Should Be a First-Class Generative AI Modality18 May 2026
- 2026How Far Are VLMs from Privacy Awareness in the Physical World? An Empirical Study6 May 2026
- 2026TrustLDM: Benchmarking Trustworthiness in Language Diffusion Models15 Apr 2026
- 2026Long Context, Less Focus: A Scaling Gap in LLMs Revealed through Privacy and Personalization16 Feb 2026
- 2025A Hierarchical Imprecise Probability Approach to Reliability Assessment of Large Language Models1 Nov 2025
- 2025A global log for medical AI5 Oct 2025
26 more
- 2025Enterprise AI Must Enforce Participant-Aware Access Control18 Sep 2025
- 2025Beyond Data Privacy: New Privacy Risks for Large Language Models16 Sep 2025
- 2025Beyond PII: How Users Attempt to Estimate and Mitigate Implicit LLM Inference15 Sep 2025
- 2025A Survey: Towards Privacy and Security in Mobile Large Language Models2 Sep 2025
- 2025Towards Reliable and Generalizable Differentially Private Machine Learning (Extended Version)21 Aug 2025
- 2025Towards Privacy-Preserving and Personalized Smart Homes via Tailored Small Language Models10 Jul 2025
- 2025The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigation8 Jul 2025
- 2025DP-Fusion: Token-Level Differentially Private Inference for Large Language Models6 Jul 2025
- 2025PrivacyXray: Detecting Privacy Breaches in LLMs through Semantic Consistency and Probability Certainty24 Jun 2025
- 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble16 Jun 2025
- 2025The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMs6 Jun 2025
- 2025Small Language Models: Architectures, Techniques, Evaluation, Problems and Future Adaptation26 May 2025
- 2025IP Leakage Attacks Targeting LLM-Based Multi-Agent Systems18 May 2025
- 2025PANORAMA: A synthetic PII-laced dataset for studying sensitive data memorization in LLMs18 May 2025
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr 2025
- 2025Detecting Instruction Fine-tuning Attacks using Influence Function12 Apr 2025
- 2025ACAI for SBOs: AI Co-creation for Advertising and Inspiration for Small Business Owners9 Mar 2025
- 2025Can Textual Gradient Work in Federated Learning?27 Feb 2025
- 2025Less or More: Towards Glanceable Explanations for LLM Recommendations Using Ultra-Small Devices26 Feb 2025
- 2025Explore Activation Sparsity in Recurrent LLMs for Energy-Efficient Neuromorphic Computing9 Jan 2025
- 2024Multi-PA: A Multi-perspective Benchmark on Privacy Assessment for Large Vision-Language Models27 Dec 2024
- 2024Underestimated Privacy Risks for Minority Populations in Large Language Model Unlearning11 Dec 2024
- 2024Understanding World or Predicting Future? A Comprehensive Survey of World Models21 Nov 2024
- 2024When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs18 Oct 2024
- 2024Bridging Today and the Future of Humanity: AI Safety in 2024 and Beyond9 Oct 2024
- 2024PII-Scope: A Comprehensive Study on Training Data PII Extraction Attacks in LLMs9 Oct 2024
- 2024When LLMs Go Online: The Emerging Threat of Web-Enabled LLMscited by 22
- 2025IP Leakage Attacks Targeting LLM-Based Multi-Agent Systemscited by 8
- 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agentscited by 4
- 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agentscited by 0
- 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agents3 Sep 2026
- 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents18 May 2026
- 2025IP Leakage Attacks Targeting LLM-Based Multi-Agent Systems18 May 2025
- 2024When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs18 Oct 2024
- 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemblecited by 11
- 2024Underestimated Privacy Risks for Minority Populations in Large Language Model Unlearningcited by 9
- 2025The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigationcited by 9
- 2025DP-Fusion: Token-Level Differentially Private Inference for Large Language Modelscited by 5
- 2025The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigation8 Jul 2025
- 2025DP-Fusion: Token-Level Differentially Private Inference for Large Language Models6 Jul 2025
- 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble16 Jun 2025
- 2024Underestimated Privacy Risks for Minority Populations in Large Language Model Unlearning11 Dec 2024
- 2025The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMscited by 24
- 2025Can Textual Gradient Work in Federated Learning?cited by 14
- 2024PII-Scope: A Comprehensive Study on Training Data PII Extraction Attacks in LLMscited by 6
- 2025PANORAMA: A synthetic PII-laced dataset for studying sensitive data memorization in LLMscited by 6
- 2025Beyond Data Privacy: New Privacy Risks for Large Language Modelscited by 6
- 2026Long Context, Less Focus: A Scaling Gap in LLMs Revealed through Privacy and Personalizationcited by 5
- 2025Less or More: Towards Glanceable Explanations for LLM Recommendations Using Ultra-Small Devicescited by 3
- 2025Enterprise AI Must Enforce Participant-Aware Access Controlcited by 3
- 2025ACAI for SBOs: AI Co-creation for Advertising and Inspiration for Small Business Ownerscited by 2
- 2025Beyond PII: How Users Attempt to Estimate and Mitigate Implicit LLM Inferencecited by 2
- 2025A Hierarchical Imprecise Probability Approach to Reliability Assessment of Large Language Modelscited by 2
- 2026Position: Weight Space Should Be a First-Class Generative AI Modalitycited by 2
12 most cited of 24 All 24 (JSON)
- 2026Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs28 Sep 2026
- 2026SpeechLLM Meets Federated Learning for End-to-End ASR: English and Italian Case Studies28 Jul 2026
- 2026IDP-Bench: Benchmarking ability of LLMs to protect personal information in interdependent privacy contexts6 Jun 2026
- 2026Position: Weight Space Should Be a First-Class Generative AI Modality18 May 2026
- 2026Long Context, Less Focus: A Scaling Gap in LLMs Revealed through Privacy and Personalization16 Feb 2026
- 2025A Hierarchical Imprecise Probability Approach to Reliability Assessment of Large Language Models1 Nov 2025
- 2025A global log for medical AI5 Oct 2025
- 2025Enterprise AI Must Enforce Participant-Aware Access Control18 Sep 2025
- 2025Beyond Data Privacy: New Privacy Risks for Large Language Models16 Sep 2025
- 2025Beyond PII: How Users Attempt to Estimate and Mitigate Implicit LLM Inference15 Sep 2025
- 2025A Survey: Towards Privacy and Security in Mobile Large Language Models2 Sep 2025
- 2025Towards Reliable and Generalizable Differentially Private Machine Learning (Extended Version)21 Aug 2025
12 newest of 24 All 24 (JSON)