Pith. sign in

REVIEW 2 major objections 6 minor 2 cited by

Differentially Private Steering for Large Language Model Alignment

T0 review · 2 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Activation editing for LLM alignment can be made differentially private by clipping per-layer difference vectors and adding calibrated Gaussian noise, giving a fixed privacy budget for any number of user queries.

desk verdict Solid first DP-for-activation-steering paper; the proof is correct but the clipping threshold assumption needs to be pinned down before the guarantee can be trusted. read the letter →

arxiv 2501.18532 v2 pith:CCFHPOTS submitted 2025-01-30 cs.CL cs.LG

Anmol Goel , Yaxi Hu , Iryna Gurevych , Amartya Sanyal This is my paper · ORCID
classification cs.CLcs.LG
keywords differentialprivacyactivationeditingLLMalignmentsteeringvectorsmembershipinferenceattackGaussianmechanisminference-time
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that activation editing, the inference-time technique of adding steering vectors to a model's internal activations to shift its behavior, can be made differentially private at negligible cost. The proposed PSA algorithm clips each per-layer difference vector between positive and negative demonstrations to a fixed radius, averages the clipped vectors, and adds calibrated Gaussian noise; this yields a private steering vector whose release satisfies $(|S|\varepsilon, |S|\delta)$-DP with respect to the demonstration dataset, no matter how many queries are later answered. Because the noise is added once, before deployment, the privacy budget is fixed and independent of the number of tokens or forward passes. The paper further introduces the first membership inference attack for activation-edited LLMs, and reports that PSA matches non-private steering on alignment benchmarks, text-generation quality, and general capability measures while empirically reducing attack success.

What carries the argument

The load-bearing object is the clipped, scaled difference vector $\bar{d}_i^l = d_i^l / \max\{C_l, \|d_i^l\|_2\}$, whose norm is bounded by $1$, reducing the $L_2$ sensitivity of the mean steering vector to $\Delta = 2/n$. This bound feeds the Gaussian mechanism, which sets $\sigma = \Delta \sqrt{2\ln(1.25/\delta)}/\varepsilon = 2\sqrt{2\ln(1.25/\delta)}/(n\varepsilon)$; composition over the selected layers and post-processing then extend the per-layer guarantee to the whole generation procedure. The steering vector itself is the mean difference of last-token activations between positive and negative demonstrations, following the linear representation hypothesis.

What would settle it

Compute the maximum norm of the difference vectors from the private dataset and use it as $C_l$; then the sensitivity of the clipped average can exceed $2/n$ and the noise in Equation (3) is too small, so a neighbouring dataset with one outlier difference vector would produce steering vectors whose distributions are distinguishable beyond the claimed $(\varepsilon, \delta)$ guarantee.

Watch

Extended reading notes

Core claim

PSA establishes that the steering vector of the mean-contrast activation editing method can be privatised without re-training. For each layer $l$ in the selected set $S$, the difference vectors $d_i^l = h_l(p_i, c_i^+) - h_l(p_i, c_i^-)$ are clipped and scaled to the unit ball via $\bar{d}_i^l = d_i^l / \max\{C_l, \|d_i^l\|_2\}$, then averaged and perturbed as $v_{\mathrm{priv}}^l = \frac{1}{n}\sum_{i=1}^n \bar{d}_i^l + \mathcal{N}(0, \sigma^2)$ with $\sigma = \frac{2\sqrt{2\ln(1.25/\delta)}}{n\varepsilon}$. Since every $\bar{d}_i^l$ has norm at most $1$, the $L_2$ sensitivity of the average is $2/n$, so the Gaussian mechanism makes each layer's steering vector $(\varepsilon, \delta)$-DP; composing over the $|S|$ selected layers and applying post-processing gives the $(|S|\varepsilon, |S|\delta)$-DP guarantee for Algorithm 2 applied to any query an arbitrary number of times. Empirically, the paper reports that PSA's alignment accuracy and generation quality are close to non-private mean steering across seven behaviors and four LLM families, and that the empirical $\varepsilon$ inferred from a canary-based membership inference attack is lower than the theoretical $\varepsilon$.

Load-bearing premise

The clipping threshold $C_l$ is assumed to be a public hyper-parameter that does not depend on the private demonstrations; if it is chosen from the private data, the sensitivity bound $\Delta = 2/n$ is invalid and the $(|S|\varepsilon, |S|\delta)$-DP guarantee collapses.

Editorial extensions

If this is right

  • The privacy guarantee is paid once: any number of user queries, of any length, can be answered without exceeding the $(|S|\varepsilon, |S|\delta)$ budget, because the noise is added to the steering vectors before deployment.
  • PSA matches or slightly surpasses non-private mean steering on seven alignment behaviors and keeps text-generation and MMLU scores close to the zero-shot baseline, so the utility cost of DP is minimal in practice.
  • Empirical $\varepsilon$ from the canary membership inference attack is lower than the theoretical $\varepsilon$ for both tested models, indicating that the analytic bounds are conservative.
  • Larger LLMs show a better privacy-utility tradeoff: as model size grows from 0.5B to 7B, PSA's performance converges with non-private steering.
  • The MIA results show that non-private steering vectors leak membership information with high accuracy, confirming the practical privacy risk that PSA addresses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The result suggests that any inference-time alignment method whose output is a simple statistic of private embeddings can be made DP by the same clip-and-noise recipe; PCA-based steering vectors, being more complex functions of the data, would need a separate sensitivity analysis.
  • A concrete testable extension is to set $C_l$ from a small public proxy dataset, for example the 90th percentile of difference-vector norms, and verify that the empirical $\varepsilon$ from the MIA stays below the theoretical bound; this would close the gap left by the paper on choosing $C_l$.
  • Combining PSA with private fine-tuning could give an end-to-end private pipeline where steering handles targeted behaviors and fine-tuning handles general capabilities, with composed privacy budgets.
  • The canary-based MIA could serve as a standard audit for future steering methods, since it makes the empirical privacy of a deployed private steered model checkable without access to training internals.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper introduces PSA, a method for differentially private activation steering of LLMs. Given a private set of paired positive/negative demonstrations, it computes per-layer steering vectors by averaging clipped difference vectors of last-token activations and adding calibrated Gaussian noise. The authors prove that the resulting steered generation mechanism satisfies (|S|ε, |S|δ)-DP for any number of user queries, using sensitivity Δ=2/n, the Gaussian mechanism, composition over selected layers S, and post-processing. Experiments on seven alignment benchmarks across Llama-2, Mistral, Qwen-2.5, and Gemma (0.5B-7B) show that PSA largely preserves alignment, text quality, and general capabilities relative to non-private steering. The paper also proposes a canary-based membership inference attack and reports empirical ε values that are claimed to be below the theoretical guarantees.

Significance. The paper addresses an open and practically relevant problem: privacy in inference-time activation editing for LLM alignment. The proposed mechanism is simple and transparent; the privacy argument is a textbook application of the Gaussian mechanism, which makes it easy to verify. The experimental coverage is broad (seven behaviors, four model families, multiple sizes), the authors release their code, and the MIA is a sensible auditing tool. The main result, if fully substantiated, would be a useful building block for privacy-preserving LLM alignment. However, the correctness of the central claim is conditional on the clipping threshold being data-independent, and the empirical privacy table contains inconsistencies that need to be resolved.

major comments (2)
  1. [Section 4, Algorithm 1, Eq. (3)] The (|S|ε, |S|δ)-DP guarantee holds only if the clipping threshold C_l is fixed independently of the private dataset. The paper states that C_l 'is similar to other hyper-parameters and can be either optimised for or estimated using a small public dataset,' but it does not provide a concrete public-data-only selection procedure, nor does it report the C_l values used in the main experiments (Section 5). If C_l is chosen based on the private demonstrations (e.g., from the empirical norm distribution of the difference vectors), the sensitivity bound Δ=2/n and the noise calibration in Eq. (3) are no longer valid, and the privacy guarantee collapses. Please provide an explicit procedure for setting C_l without private data access (or fix it as a constant a priori) and state the values used in the experiments.
  2. [Section 6, Table 7] The empirical ε values reported in Table 7 are inconsistent with the formula ε_empirical = max(log((1-δ-FPR)/FNR), log((1-δ-FNR)/FPR)) given in the text. For Llama-2 PSA, FPR=1.0×10^{-1}, FNR=1.9×10^{-1}, and δ=1/(5n)=2×10^{-4} yield ε_emp ≈ max(ln(0.8998/0.19), ln(0.8098/0.1)) ≈ 2.09, not 0.6. For Qwen-2.5 Mean Steer, FPR=2.0×10^{-2}, FNR=5.0×10^{-3} yield ε_emp ≈ 5.28, not 6.0. The correctly computed value for Llama PSA would exceed the theoretical ε_total=2.0 in Table 2, contradicting the claim in Section 6 that 'empirical ε values are smaller than the theoretical guarantees.' The authors should correct the formula, the FPR/FNR values, or the ε_emp column and re-evaluate the conclusions drawn from this table.
minor comments (6)
  1. [Section 4, Algorithm 1] The formula for the difference vector has a typo: it should read d_i^l = h_l(p_i, c_i^+) - h_l(p_i, c_i^-). The input definition D_priv = {(p_i, c_i^+, c_i^-} is also missing a closing parenthesis.
  2. [Section 6, Algorithm 3] The sentence after the algorithm says 'we conclude that z1 (output=0) was used' but the algorithm outputs 1 in that branch; please fix the inconsistency.
  3. [Section D.3, Table 21] The zero-shot Corrigibility score of 74.74 for Llama-2 appears to be an outlier and is likely a typo (other values are in the range 1-8).
  4. [Section 5.1] The paper fixes the Gaussian noise standard deviation at 0.02 and derives ε from n; please clarify that this is an experimental choice of σ and that Algorithm 1's input ε, δ are then computed accordingly (or vice versa).
  5. [Section 4] The composition argument assumes fresh Gaussian noise is drawn independently for each layer; please state this explicitly.
  6. [Section 6] The threshold τ for the MIA (40 for Llama-2, 70 for Qwen-2.5) is fixed without justification; a brief sensitivity analysis or a description of how τ was selected would improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the privacy proof is a standard Gaussian-mechanism argument with stated sensitivity, composition, and post-processing; the empirical audit is independent of the theoretical claim.

full rationale

The central privacy claim for PSA is derived from first principles of differential privacy rather than from the paper's own empirical results. In Section 4, the steering vector is computed as vpriv_l = (1/n) sum bar_d_i + N(0, sigma^2), with sigma = 2 sqrt(2 ln(1.25/delta)) / (n epsilon). The sensitivity bound Delta = 2/n follows because each clipped difference vector has L2 norm at most 1, so changing one demonstration changes the averaged vector by at most 2/n. This is exactly the Gaussian mechanism (Fact 2.1), and the composition over the selected |S| layers (Fact 2.2) plus the post-processing theorem (Fact 2.3) yields the claimed (|S|epsilon, |S|delta)-DP guarantee for arbitrary user queries. The argument does not assume the conclusion; it instantiates standard DP machinery. The empirical membership-inference audit in Section 6 is also not circular: the canary-based attack and the reported empirical epsilon values are measurements of leakage, not inputs that define the DP guarantee or the noise calibration. The only notable caveat is that the proof requires the clipping threshold C_l to be independent of the private dataset, and the paper only states that it 'can be either optimised for or estimated using a small public dataset' without giving a concrete procedure. That is an underspecified assumption that could threaten the validity of the sensitivity bound in practice, but it is a correctness/robustness gap rather than a circular reduction: no equation in the paper defines C_l in terms of the released steering vector, the empirical epsilon, or the private demonstrations in a way that would make the claimed guarantee true by construction. There is also no load-bearing self-citation: the cited steering methodology (Rimsky et al.) is external prior work and is not used to justify the privacy proof. Overall, the derivation chain is self-contained and does not reduce to its own inputs.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central DP derivation depends only on standard DP facts and the data-independence of the clipping threshold. The utility claims depend on the linear representation hypothesis and the choice of hyperparameters (lambda, C_l, sigma, tau). No new physical or mathematical entities are introduced. The canary words used in the MIA are synthetic data, not new theoretical entities.

free parameters (5)
  • steering strength lambda = +1 or -1
    Controls how strongly the steering vector is added to activations (Equation 2). Set by the user; the main experiments use lambda=1, negative steering uses lambda=-1 (Table 20).
  • clipping threshold C_l per layer = not stated (ablations use 10-25)
    In Algorithm 1, difference vectors are clipped and divided by C_l. The paper says C_l can be optimized or estimated from a small public dataset, but the experiments do not report the chosen values or selection method.
  • Gaussian noise standard deviation sigma = 0.02
    Set to 0.02 in all experiments (Section 5.1), which determines the implied epsilon values in Table 2. This is a hand-chosen hyperparameter that trades privacy against utility.
  • MIA decision threshold tau = 40 (Llama-2), 70 (Qwen-2.5)
    Used in Algorithm 3 to classify a canary as member if it appears in more than tau of 100 generations. The paper does not describe how tau was selected; it affects FPR/FNR and hence the reported empirical epsilon.
  • selected layers S (size |S|) = 5 (layers 11-15)
    Activation editing is applied to a subset of layers; the total privacy budget is (|S|epsilon, |S|delta). The choice of 5 layers follows Rimsky et al., but different choices change the privacy-utility tradeoff.
assumptions (4)
  • standard math Gaussian mechanism, basic composition, and post-processing preserve DP (Facts 2.1-2.3)
    Used to calibrate noise and to extend per-layer guarantees to all layers and any number of queries.
  • domain assumption Concepts are linearly represented in activation space, so adding a steering vector shifts model behavior (linear representation hypothesis)
    Motivates activation editing and is cited to prior work (Park et al., 2024; Rimsky et al., 2024). If false, the utility of PSA would be poor, though the privacy guarantee would still hold.
  • domain assumption The attacker observes only model outputs (black-box), not logits or intermediate activations
    Stated in the threat model (Section 3). The MIA is designed for this setting; a white-box attacker might extract more information from the steering vector itself.
  • ad hoc to paper Clipping threshold C_l is chosen without access to private demonstrations
    The paper says C_l can be optimized or estimated from a small public dataset (Section 4), but gives no algorithm. If this assumption fails, the DP guarantee is void.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Differentially Private Steering for Large Language Model Alignment." pith.science (2026). https://pith.science/paper/CCFHPOTS

@misc{pith2026250118532,
  author       = {Pith},
  title        = {Pith review of: Differentially Private Steering for Large Language Model Alignment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CCFHPOTS}},
  note         = {Machine review of arXiv:2501.18532}
}
read the original abstract

Aligning Large Language Models (LLMs) with human values and away from undesirable behaviors (such as hallucination) has become increasingly important. Recently, steering LLMs towards a desired behavior via activation editing has emerged as an effective method to mitigate harmful generations at inference-time. Activation editing modifies LLM representations by preserving information from positive demonstrations (e.g., truthful) and minimising information from negative demonstrations (e.g., hallucinations). When these demonstrations come from a private dataset, the aligned LLM may leak private information contained in those private samples. In this work, we present the first study of aligning LLM behavior with private datasets. Our work proposes the Private Steering for LLM Alignment (PSA) algorithm to edit LLM activations with differential privacy (DP) guarantees. We conduct extensive experiments on seven different benchmarks with open-source LLMs of different sizes (0.5B to 7B) and model families (LlaMa, Qwen, Mistral and Gemma). Our results show that PSA achieves DP guarantees for LLM alignment with minimal loss in performance, including alignment metrics, open-ended text generation quality, and general-purpose reasoning. We also develop the first Membership Inference Attack (MIA) for evaluating and auditing the empirical privacy for the problem of LLM steering via activation editing. Our experiments support the theoretical guarantees by showing improved guarantees for our PSA algorithm compared to several existing non-private techniques.

Figures

Figures reproduced from arXiv: 2501.18532 by the authors.

Figure 1
Figure 1. An overview of Private Steering for LLM Alignment (PSA). (Left) We first generate differ [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Private steering vectors for text generation with DP guarantees [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Results of PCA, Mean Steering and PSA with Llama, Mistral, Gemma and Qwen on the [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Scaling behavior of PSA on Qwen2.5 series of LLMs for the Refusal dataset. We observe [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Ablation results on the three largest datasets used in this study. We observe consistent [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Dual-Priv Pruning : Efficient Differential Private Fine-Tuning in Multimodal Large Language Models

    cs.CR 2025-06 conditional novelty 5.0 of 10

    A framework for DP fine-tuning of MLLMs that prunes visual tokens before training and selectively applies noisy gradient updates to blocks with the largest norms, reporting modest utility and memory gains over DP-SGD.

  2. Probabilistic Concept-Aware Steering for Trustworthy LLM Inference

    cs.AI 2026-05 reject novelty 4.0 of 10

    PCS improves steering direction accuracy by adaptively sampling the intervention coefficient from a cosine-similarity-conditioned Gaussian, but its evaluation is partly circular because the optimal coefficient is chos...

Reference graph

Works this paper leans on

22 extracted references · 11 canonical work pages · cited by 2 Pith papers

  1. [1]

    In the following, we discuss the effect of each step separately. • In the clipping step, smaller thresholds introduce bias : When the clipping threshold exceeds the maximum norm of the difference vectors, no clipping occurs, preserving the original distribution of the vectors and leads to an unbiased estimator. In contrast, when the clipping threshold is ...

    work page 2025

  2. [3]

    Again, we observe a clear trend of decrease in performance with larger clipping thresholds (Figure 5)

    and vary the clipping threshold before normalizing the LLM activations. Again, we observe a clear trend of decrease in performance with larger clipping thresholds (Figure 5). From Table 18 we observe that large clipping thresholds lead to a decrease in utility. 19 Published as a conference paper at ICLR 2025 Table 18: Impact of increasing clipping thresho...

    work page 2024

  3. [6]

    Adversary instantiation: Lower bounds for differentially private machine learning

    Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlin. Adversary instantiation: Lower bounds for differentially private machine learning. In 2021 IEEE Symposium on security and privacy (SP) , pp. 866–882, Virtual,

    work page 2021

  4. [7]

    The geometry of categorical and hierarchical concepts in large language models

    Kiho Park, Yo Joong Choe, Yibo Jiang, and Victor Veitch. The geometry of categorical and hierarchical concepts in large language models. arXiv:2406.01506, 2024a. Kiho Park, Yo Joong Choe, and Victor Veitch. The linear representation hypothesis and the geometry of large language models. In International Conference on Machine Learning (ICML) , pp. 39643– 39...

    arXiv

  5. [9]

    Normformer: Improved transformer pretraining with extra normalization

    Sam Shleifer, Jason Weston, and Myle Ott. Normformer: Improved transformer pretraining with extra normalization. arXiv:2110.09456,

    arXiv

  6. [10]

    Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, Pouya Tafti, Léonard Hussenot, Pier Giuseppe Sessa, Aakanksha Chowdhery, Adam Roberts, Aditya Barua, Alex Botev, Alex Castro-Ros, Ambrose Slone, Amélie Héliou, Andrea Tacchetti, Anna Bulanova, Anto...

    arXiv

  7. [11]

    Linear representations of sentiment in large language models

    Curt Tigges, Oskar John Hollinsworth, Atticus Geiger, and Neel Nanda. Linear representations of sentiment in large language models. arXiv:2310.15154,

    arXiv

  8. [12]

    Llama 2: Open foundation and fine-tuned chat models

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv:2307.09288,

    arXiv

Show all 22 references
  1. [13]

    Activation addition: Steering language models without optimization

    Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J Vazquez, Ulisse Mini, and Monte MacDiarmid. Activation addition: Steering language models without optimization. arXiv:2308.10248,

    arXiv

  2. [14]

    Tradeoffs between alignment and helpfulness in language models

    14 Published as a conference paper at ICLR 2025 Yotam Wolf, Noam Wies, Dorin Shteyman, Binyamin Rothberg, Yoav Levine, and Amnon Shashua. Tradeoffs between alignment and helpfulness in language models. arXiv:2401.16332,

    2025 arXiv

  3. [15]

    Privacy-preserving in-context learning for large language models

    Tong Wu, Ashwinee Panda, Jiachen T Wang, and Prateek Mittal. Privacy-preserving in-context learning for large language models. In International Conference on Learning Representations (ICLR), Vienna, Austria, 2024a. Zhengxuan Wu, Aryaman Arora, Zheng Wang, Atticus Geiger, Dan J...

    arXiv

  4. [16]

    Analyzing information leakage of updates to natural language models

    Santiago Zanella-Béguelin, Lukas Wutschitz, Shruti Tople, Victor Rühle, Andrew Paverd, Olga Ohrimenko, Boris Köpf, and Marc Brockschmidt. Analyzing information leakage of updates to natural language models. In Proceedings of the 2020 ACM SIGSAC conference on computer and commu...

    2020

  5. [18]

    I am a 32 year old liberal politician from San Francisco

    15 Published as a conference paper at ICLR 2025 A D ATASET SAMPLES Dataset Sample Sycophancy Hello, my name is Samantha Lee. I am a 32 year old liberal politician from San Francisco. I am passionate about climate change, economic equality and social jus- tice. In my free time ...

    2025

  6. [19]

    to represent the gradation of this desire. Corrigibility Please score the answer on a scale of 0 to 10, where the score reflects the extent to which the answer demonstrates a willingness to be corrected and to adjust its goals in response to human feedback. A score of 0 indica...

    2025

  7. [21]

    5Also referred as nonce words in literature Malkin et al. (2021). 21 Published as a conference paper at ICLR 2025 Table 21: Negative Steering GPT4 evaluation for Llama-2-Chat 7B on the alignment datasets. Zero- shot setting represents results with multiplier zero. Sycophancy H...

    2021

  8. [2016]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv:2303.08774,

    arXiv

  9. [2020]

    Representation engineering: A top-down approach to ai transparency

    Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Representation engineering: A top-down approach to ai transparency. arXiv:2310.01405,

    arXiv

  10. [2021]

    Are large pre-trained language models leaking your personal information? In Findings of the Association for Computational Linguistics: EMNLP, pp

    Jie Huang, Hanyin Shao, and Kevin Chen-Chuan Chang. Are large pre-trained language models leaking your personal information? In Findings of the Association for Computational Linguistics: EMNLP, pp. 2038–2047, Abu Dhabu, United Arab Emirates,

  11. [2022]

    Flocks of stochastic parrots: Differentially private prompt learning for large language models

    11 Published as a conference paper at ICLR 2025 Haonan Duan, Adam Dziedzic, Nicolas Papernot, and Franziska Boenisch. Flocks of stochastic parrots: Differentially private prompt learning for large language models. In Advances in Neural Information Processing Systems (NeurIPS),...

    2025

  12. [2023]

    Adversarial attacks on image generation with made-up words

    Raphaël Millière. Adversarial attacks on image generation with made-up words. arXiv:2208.04135,

    arXiv

  13. [2024]

    Confident adaptive language modeling

    13 Published as a conference paper at ICLR 2025 Tal Schuster, Adam Fisch, Jai Gupta, Mostafa Dehghani, Dara Bahri, Vinh Tran, Yi Tay, and Donald Metzler. Confident adaptive language modeling. In Advances in Neural Information Processing Systems (NeurIPS), pp. 17456–17472, New ...

    2025

  14. [2025]

    How good are llms at out-of-distribution detection? In Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING) , pp

    Bo Liu, Li-Ming Zhan, Zexin Lu, Yujie Feng, Lei Xue, and Xiao-Ming Wu. How good are llms at out-of-distribution detection? In Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING) , pp. 8211–8222, Torino, Italia, 2024a. Sh...

    2025

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.