Pith. sign in

REVIEW 4 major objections 7 minor 2 cited by

Context Reasoner: Incentivizing Reasoning Capability for Contextualized Privacy and Safety Compliance via Reinforcement Learning

T0 review · 4 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Rewarding correct legal-compliance answers with RL raises a 7B LLM's privacy-law accuracy to 88% and improves general reasoning.

desk verdict Solid empirical recipe for RL-based legal compliance, but the headline metric is the same benchmark as the reward; the transfer results are the stronger evidence. read the letter →

arxiv 2505.14585 v2 pith:DEYDAAKY submitted 2025-05-20 cs.CL

Wenbin Hu , Haoran Li , Huihao Jing , Qi Hu , Ziqian Zeng , Sirui Han , Heli Xu , Tianshu Chu
show 2 more authors
Peizhao Hu Yangqiu Song
This is my paper
classification cs.CL
keywords contextualintegritylegalcompliancereinforcementlearningrule-basedrewardLLMsafetyandprivacyGDPREUAIActHIPAA
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that LLM safety and privacy should be treated as contextual legal-compliance decisions, not pattern matching, and that reinforcement learning can train models to make those decisions. The authors formulate compliance through Contextual Integrity theory, which defines privacy as information flows of sender, subject, recipient, and information type, and they connect those flows to GDPR, EU AI Act, and HIPAA. They cold-start a 7B reasoning model on legal reasoning trajectories distilled from a large reasoning model, then run PPO (proximal policy optimization) with a rule-based reward that scores +1 for a correct final legal answer and 0 otherwise. On the legal-compliance test split the resulting model reaches 88.29% accuracy, up from 79.71% for the base reasoning model, and it also improves on LegalBench and MMLU. The paper's central claim is that legal-norm compliance is learnable through verifiable RL and that this training improves rather than harms general reasoning.

What carries the argument

The load-bearing mechanism is a rule-based reward over legal compliance outcomes wrapped around a cold-start supervised fine-tuning step. Before RL, the model is trained on verified trajectories that pair a legal case with a thinking chain and a CI-annotated tuple of sender, recipient, subject, and information type; then PPO maximizes $R(s,a)=1$ if the parsed final answer is correct and $0$ otherwise. This binary reward converts 'be safe and private' into a deterministic objective, while the CI tuple supplies the contextual structure the model reasons over. The paper's ablations show the cold start matters: PPO without it is much weaker, and removing either the CI annotation or the RL step lowers average legal compliance from 88.29% to roughly 86-87%.

What would settle it

Evaluate the same models on an independently labeled set of recent adjudicated cases from the same legal regimes, with labels assigned by legal experts who did not create PrivaCI-Bench; if the PPO model's accuracy advantage over OpenThinker-7B disappears or reverses on those cases, the headline compliance gain is benchmark-specific rather than evidence of legal reasoning.

Watch

Extended reading notes

Core claim

On its own terms, the paper discovers that contextualized legal compliance can serve as a verifiable reward signal for reinforcement learning, and that optimizing it sharpens contextual judgment and transfers to unrelated benchmarks. The setup is the Contextual Integrity tuple $C = \langle S, S_d, R, I, P \rangle$ (sender, subject, recipient, information type, transmission principle), with a case compliant when all its information flows satisfy applicable norms. Regulations from GDPR, EU AI Act, and HIPAA are arranged into hierarchical structures; a verifier filters reasoning trajectories distilled from a large reasoning model; then PPO optimizes reward $R(s,a)=1$ when the parsed legal compliance answer is correct and $0$ otherwise. Starting from OpenThinker-7B, the paper reports 88.29% legal compliance accuracy (versus 79.71% for the base reasoning model), 75.33% on contextual-understanding MCQs, 72.52% balanced accuracy on LegalBench, and 70.47% on MMLU. These results are offered as evidence that rule-based legal-compliance RL induces genuine contextual reasoning rather than narrow overfitting.

Load-bearing premise

The reported compliance gains stand or fall with the correctness of PrivaCI-Bench's legal labels and with a random 8:2 split of that benchmark being a fair test of legal reasoning rather than a test of benchmark-pattern memorization.

Editorial extensions

If this is right

  • Cold-start SFT on legal reasoning trajectories alone lifts legal compliance from 79.71% to 87.36%, and PPO adds a further point to 88.29% on the PrivaCI-Bench test split.
  • The trained model generalizes beyond the three laws: balanced accuracy on LegalBench rises to 72.52% from 63.54%, and MMLU rises to 70.47% from 68.42%.
  • Contextual-understanding probes improve to 75.33% from 60.69% for the base reasoning model, suggesting the RL step sharpens extraction of senders, recipients, subjects, and information attributes.
  • The recipe transfers across model scales: appendix results on Qwen2.5 and Qwen3 families show legal-compliance gains from +1.85 to +35.67 accuracy points depending on the starting model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the reward is a 0/1 correctness signal, the same recipe should transfer to any compliance domain with a deterministic verifier, such as policy checkers, medical guidelines, or formal specifications, turning rule-checking into an RL objective.
  • The evaluation uses a random 8:2 split of one benchmark; a stronger test of whether the model learned legal reasoning rather than benchmark patterns would be temporal or jurisdictional generalization, for example cases decided after the training cutoff or jurisdictions where the same facts are labeled differently.
  • The CI tuple format creates a natural audit trail: the model's predicted sender, recipient, subject, and information-type fields could be surfaced to explain each permitted or prohibited verdict, which is a testable extension for explainability.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. This paper proposes Context Reasoner, a two-stage pipeline that aligns LLMs with privacy/safety regulations under the Contextual Integrity framework. The method cold-starts OpenThinker-7B by SFT on 5,080 DeepSeek-R1-distilled legal reasoning trajectories derived from PrivaCI-Bench training cases, then applies PPO with a sparse rule-based reward (Eq. 1: +1 if the parsed final compliance choice matches the PrivaCI-Bench label, 0 otherwise). The headline results are an 88.29% vs. 79.71% legal compliance accuracy on a random 20% holdout of PrivaCI-Bench (+8.58%), 75.33% vs. 60.69% on self-authored contextual-understanding MCQs (Table 2), and generalization gains on LegalBench (+8.98% balanced accuracy), MMLU (+2.05%), LawBench, TruthfulQA, and Winogrande. Appendix experiments extend the recipe to Qwen2.5-0.5B/1.5B/3B and Qwen3-0.6B/4B/8B/32B. The central claim is that legal-compliance RL 'significantly enhances' compliance while preserving or improving general reasoning.

Significance. The proposal is timely and the recipe is plausible: using legal compliance outcomes as rule-based RL rewards is a natural extension of the reasoning-RL paradigm to safety and privacy. The paper ships reproducible artifacts (code, training details, prompt templates in Appendix B), the appendix multi-family ablations (Tables 10-11) are good practice, and the balanced-sample robustness check (Table 16) is a thoughtful addition. The independent generalization results - LegalBench, LawBench, MMLU, TruthfulQA, Winogrande - whose labels are not used in the reward or SFT supervision, provide genuine evidence of capability transfer beyond the reward distribution. However, the central claim as worded rests on a yardstick (PrivaCI-Bench) that simultaneously supplies the reward signal (Eq. 1) and the headline test metric (Table 1), and that benchmark was constructed by a largely overlapping author group. The manuscript offers no independent validation of that yardstick, no statistical support for 'significantly,' and several of the paper's own appendix tables show PPO failing to improve over its SFT cold start.

major comments (4)
  1. [§3.3, Eq. (1); §4.1; Table 1] The headline claim that RL 'significantly enhances legal compliance' is measured entirely on a random 20% split of PrivaCI-Bench (Table 1), while the same benchmark's compliance labels supply the SFT supervision (§4.2, 5,080 trajectories) and the rule-based reward in Eq. (1). PrivaCI-Bench (Li et al., 2025) shares 8 of this paper's 10 authors, so the +8.58% gain currently measures fit to one group's annotation scheme for legal outcome rather than validated legal correctness; a random split controls case-level memorization but says nothing about the validity of the labels themselves. The independent LegalBench and MMLU results partially mitigate the concern for general capability transfer, but they do not evaluate the same compliance task. Please: (i) report an evaluation on an independently constructed compliance benchmark or on cases with authoritative legal outcomes; (ii) report inter-annotator agreement for the PrivaCI-Bench labels, or a second-opinion legal-expert audit on a sample of the test split; (iii) report per-label confusion matrices so the direction of errors is visible. If independent validation is not available, the abstract and §5.1 should be reframed as 'improvement on PrivaCI-Bench' rather than 'enhances legal compliance' simpliciter.
  2. [§5.1; Tables 1, 10, 11, 6] The paper uses 'significantly' repeatedly (Abstract, §5.1, §5.3) but reports single runs with no error bars, seeds, or significance tests. This is not merely cosmetic: several of the paper's own results show PPO failing to improve over its SFT cold start - Qwen2.5-0.5B (61.64 vs. 61.82, Table 10), Qwen2.5-3B (85.11 vs. 85.77, Table 10), Qwen3-4B (86.49 vs. 87.97, Table 11), Qwen3-8B (87.77 vs. 87.73, Table 11) - and Table 6 shows identical MMLU scores for SFT and PPO (70.47). Claim 1 in §5.1 ('PPO training on OpenThinker-7B-SFT ... can further improve performance') and the related MMLU discussion in §5.3 should be qualified to acknowledge these settings. Additionally, the test sets are small in some domains: HIPAA has 211 total cases per Table 3, so the test split contains roughly 43 items, meaning a one-item difference moves accuracy by about 2.3 points and the HIPAA column of Table 1 should not be interpreted at face value. Please report multiple seeds with means and standard deviations, or bootstrap confidence intervals over test items, and align the significance language with what is actually reported.
  3. [§5.1; Table 3] The aggregate accuracy metric is computed over a heavily imbalanced label distribution (GDPR is 78.5% 'prohibited' per Table 3; HIPAA has only 19 prohibited cases). No majority-class baseline or per-class accuracy is reported, so it is unclear how much of the reported gain reflects true minority-class discrimination. The GDPR column alone shows Qwen2.5-7B-Instruct at 88.05 (near the 78.5% majority prior) exceeding OpenThinker-7B at 87.26, so the averaged +8.58% in Table 1 is driven mostly by the AI Act column. Please report macro-averaged accuracy or per-label precision/recall for each regulation, together with a majority-class baseline, so the reader can see where the improvement actually originates.
  4. [§3.2; §3.1] Two load-bearing components of the cold-start data pipeline are left unspecified. (i) The 'meticulously designed legal verifier' that filters the DeepSeek-R1 trajectories (Fig. 1, §3.2) is not described: is it a rule-based parser over legal citations, an LLM judge, or human-annotated? What are the pass/fail rates and failure modes? (ii) The 268k-triplet knowledge graph constructed with GPT-4o (§3.1, §4.1) is presented as context-aware grounding, but no validation of triplet correctness or coverage is given. Since the SFT data quality is the main driver of the reported gains (SFT alone accounts for most of the improvement in Table 1), both components need concrete specification or, at minimum, an error analysis; without this, the method cannot be reproduced or independently assessed.
minor comments (7)
  1. [§4.4; Table 5] Section 4.4 states that 'LegalBench consists of 162 tasks', but Table 5 reports only four categories (Interpretation, Issue, Rhetorical, Rule); specify exactly which tasks or subset were evaluated and the number of items per category, since the balanced-accuracy values depend directly on the subset.
  2. [§5.3, finding 5; Figure 4] The TruthfulQA results are only shown graphically; report the exact accuracies for the 'MCQ single answer' and 'MCQ multiple answers' settings in the text so the claimed +2.04% improvement can be verified numerically.
  3. [§2.1] The structure line reads 'SENDER transmits SUBJECT's INFOMATION to RECIPIENT under TRANSMISSION PRINCIPLE' (typo), and the formal line 'F ⊢ C ⇐ ⇒ ∀(...)' has a formatting glitch; also clarify whether the transmission principle p(s,sd,r,i) is a predicate over the four CI parameters as defined in the tuple C := ⟨S,Sd,R,I,P⟩.
  4. [§3.3, Eq. (1); §4.2] Specify how the 'compliant' condition in Eq. (1) is extracted from the trajectory a (for example, parsing the final 'Choice: X' token); this determines what the reward actually measures, especially for the binary GDPR cases versus the three-way EU AI Act and HIPAA cases.
  5. [Appendix B] The statement that the experiments required 'a total of 1 month of GPU hours' is ambiguous; state the hardware-time product explicitly (for example, 8 H800 GPUs for 30 days) and separate the main-experiment budget from the ablations.
  6. [Appendix C, Table 13] The sentence 'our model can reason about legal compliance more efficiently and with better performance' compares models at different accuracy operating points without a defined efficiency metric; either report a tokens-per-correct-answer figure or temper the claim.
  7. [Abstract] The sentence 'Our source code are available' is ungrammatical; also consider moving the code link to a footnote in accordance with journal style.

Circularity Check

1 steps flagged · score 4.0 of 10

PrivaCI-Bench labels serve as both the RL reward and the headline legal-compliance metric, so the +8.58% gain is largely a within-benchmark optimization result; external benchmarks provide partial independent support.

  1. fitted input called prediction [Section 3.3 Eq. (1); Section 4.1; Section 4.4 (Legal Compliance); Table 1]
    "The reward is based on the compliance result of the corresponding legal case, parsed from the solution part of the reasoning trajectories. If the legal compliance result from the model is correct, the reward is +1; otherwise, it is 0. ... We evaluate the models on legal compliance questions from the testing set of legal cases described in Section 4.1. Each legal compliance question determines whether the case is permitted, prohibited, or not applicable under a specific regulation."

    Eq. (1) defines the RL reward as an indicator that the model's legal-compliance answer matches the benchmark's permitted/prohibited/not-applicable label. Table 1 reports accuracy on a random 20% holdout of the same PrivaCI-Bench cases using exactly the same label predicate as the correctness criterion. The claimed '+8.58% accuracy improvement in safety/privacy benchmarks' is therefore the value of the training reward on a held-out slice of the same annotation scheme, not an independent measure of legal compliance. The random split prevents memorization of individual cases, but the correctness predicate itself is identical to the reward signal, and the benchmark labels come from the authors' own PrivaCI-Bench.

full rationale

The central legal-compliance claim rests on Table 1, where the evaluation metric is accuracy on the PrivaCI-Bench test split. The RL reward in Eq. (1) is the indicator that the model's final compliance answer matches the same PrivaCI-Bench permitted/prohibited/not-applicable labels. Thus the reported improvement is the training objective measured on a holdout of the same label scheme. This is a partial circularity: the holdout split makes the comparison a legitimate empirical result within the benchmark, and the paper also reports gains on external benchmarks (LegalBench +8.98, MMLU +2.05, TruthfulQA +2.04, LawBench), so the general capability claim has independent content. However, the headline claim of 'significantly enhances legal compliance' is not independently validated, because the ground-truth labels that define compliance are both the reward signal and the evaluation criterion, and they come from a benchmark authored by overlapping researchers. The score of 4 reflects this partial circularity rather than a complete reduction of the derivation to its inputs.

Assumptions & free parameters 9 free parameters · 6 assumptions · 0 invented entities

The central claim rests on the correctness of the PrivaCI-Bench labels, the GPT-4o-generated knowledge graph, and the unspecified verifier, plus several hand-chosen training hyperparameters. No new theoretical entity is introduced; the main artifacts are data and training choices.

free parameters (9)
  • SFT learning rate = 5e-6
    Chosen by hand; affects cold-start quality.
  • PPO actor learning rate = 5e-7
    Chosen by hand for PPO training.
  • PPO critic learning rate = 9e-6
    Chosen by hand for PPO training.
  • PPO KL coefficient = 1e-2
    Regularization strength chosen by hand.
  • Batch sizes = SFT batch size 1; PPO batch size 2
    Chosen by hand, likely due to GPU constraints.
  • Max token length = SFT 4096; PPO 2048
    Chosen by hand; truncates reasoning chains.
  • Inference temperature = 0.2
    Chosen for evaluation; affects determinism.
  • Number of cold-start trajectories = 5,080
    Selected from the training set; size chosen by authors.
  • Knowledge graph triplet count = 268k
    Generated by GPT-4o; scale and coverage chosen without a stated quality threshold.
assumptions (6)
  • domain assumption Contextual Integrity theory is an appropriate normative framework for LLM safety and privacy.
    The paper adopts CI (Section 2.1) as the basis for formulating safety and privacy as information-flow compliance; if CI is not the right normative model, the alignment target is mis-specified.
  • domain assumption PrivaCI-Bench compliance labels are correct for GDPR, EU AI Act, and HIPAA.
    The reward (Eq. 1) and the headline metric (Table 1) both use these labels; incorrect labels would invalidate both the training signal and the evaluation.
  • domain assumption The GPT-4o-generated 268k sender-subject-recipient knowledge graph accurately represents roles and attributes in legal cases.
    Section 3.1 says the KG is constructed by GPT-4o and used as the context-aware legal case database; errors propagate into CI annotations.
  • domain assumption The rule-based verifier correctly filters DeepSeek-R1 distilled trajectories for case relevance and legal compliance.
    Section 3.2 says responses are validated by the verifier, but the verifier is not specified; if it passes incorrect trajectories, cold-start data is noisy.
  • domain assumption Reinforcement learning with a sparse outcome reward can incentivize general reasoning, as shown in math domains.
    The paper relies on prior RL-for-reasoning results (DeepSeek-R1, SimpleRL) to expect generalization; this is an empirical assumption, not proven here.
  • domain assumption The 8:2 train/test split of PrivaCI-Bench yields a representative held-out evaluation.
    Section 4.1; if cases are not independent or the split leaks similar cases, reported compliance gains are inflated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Context Reasoner: Incentivizing Reasoning Capability for Contextualized Privacy and Safety Compliance via Reinforcement Learning." pith.science (2026). https://pith.science/paper/DEYDAAKY

@misc{pith2026250514585,
  author       = {Pith},
  title        = {Pith review of: Context Reasoner: Incentivizing Reasoning Capability for Contextualized Privacy and Safety Compliance via Reinforcement Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DEYDAAKY}},
  note         = {Machine review of arXiv:2505.14585}
}
read the original abstract

While Large Language Models (LLMs) exhibit remarkable capabilities, they also introduce significant safety and privacy risks. Current mitigation strategies often fail to preserve contextual reasoning capabilities in risky scenarios. Instead, they rely heavily on sensitive pattern matching to protect LLMs, which limits the scope. Furthermore, they overlook established safety and privacy standards, leading to systemic risks for legal compliance. To address these gaps, we formulate safety and privacy issues into contextualized compliance problems following the Contextual Integrity (CI) theory. Under the CI framework, we align our model with three critical regulatory standards: GDPR, EU AI Act, and HIPAA. Specifically, we employ reinforcement learning (RL) with a rule-based reward to incentivize contextual reasoning capabilities while enhancing compliance with safety and privacy norms. Through extensive experiments, we demonstrate that our method not only significantly enhances legal compliance (achieving a +8.58% accuracy improvement in safety/privacy benchmarks) but also further improves general reasoning capability. For OpenThinker-7B, a strong reasoning model that significantly outperforms its base model Qwen2.5-7B-Instruct across diverse subjects, our method enhances its general reasoning capabilities, with +2.05% and +8.98% accuracy improvement on the MMLU and LegalBench benchmark, respectively.

Figures

Figures reproduced from arXiv: 2505.14585 by the authors.

Figure 1
Figure 1. First, we prepare structured regulations and legal cases stored in a database. Next, we perform distillation [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Ablation studies for the legal compliance task. All results are evaluated in %. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Lawbench (Chinese law) results. Evaluation [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: PPO training curves. Reward model is rule-based using the legal compliance outcome as the reward. [PITH_FULL_IMAGE:figures/full_fig_p017_5.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. HKGAI-V1: Towards Regional Sovereign Large Language Model for Hong Kong

    cs.CL 2025-07 reject novelty 5.0 of 10

    A DeepSeek-based model fine-tuned for Hong Kong outperforms general models on Hong Kong benchmarks, but most of those benchmarks are self-authored and unreleased.

  2. A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models

    cs.CL 2025-09 conditional novelty 4.0 of 10

    A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.

Reference graph

Works this paper leans on

66 extracted references · 8 canonical work pages · cited by 2 Pith papers

  1. [1]

    Alignment Studio: Aligning Large Language Models to Particular Contextual Regulations

    Swapnaja Achintalwar, Ioana Baldini, Djallel Bouneffouf, Joan Byamugisha, Maria Chang, Pierre Dognin, Eitan Farchi, Ndivhuwo Makondo, Aleksandra Mojsilovic, Manish Nagireddy, Karthikeyan Natesan Ramamurthy, Inkit Padhi, Orna Raz, Jesus Rios, Prasanna Sattigeri, Moninder Singh, Siphiwe Thwala, Rosario A. Uceda-Sosa, and Kush R. Varshney. 2024. https://arxi...

    work page Pith review arXiv 2024

  2. [2]

    Rouzbeh Behnia, Mohammadreza Reza Ebrahimi, Jason Pacheco, and Balaji Padmanabhan. 2022. https://doi.org/10.1109/icdmw58026.2022.00078 Ew-tune: A framework for privately fine-tuning large language models with differential privacy . In 2022 IEEE International Conference on Data Mining Workshops (ICDMW), page 560–566. IEEE

    arXiv 2022

  3. [3]

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. 2022. https://doi.org/10.1109/SP46214.2022.9833649 Membership inference attacks from first principles . In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897--1914

    arXiv 2022

  4. [4]

    Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. https://arxiv.org/abs/1802.08232 The secret sharer: Evaluating and testing unintended memorization in neural networks . Preprint, arXiv:1802.08232

    arXiv 2019

  5. [5]

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. https://arxiv.org/abs/2012.07805 Extracting training data from large language models . Preprint, arXiv:2012.07805

    arXiv 2021

  6. [6]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2024. https://arxiv.org/abs/2310.08419 Jailbreaking black box large language models in twenty queries . Preprint, arXiv:2310.08419

    arXiv 2024

  7. [7]

    Yulin Chen, Haoran Li, Yuexin Li, Yue Liu, Yangqiu Song, and Bryan Hooi. 2025 a . Topicattack: An indirect prompt injection attack via topic transition. arXiv preprint arXiv:2507.13686

    arXiv 2025

  8. [8]

    Yulin Chen, Haoran Li, Yuan Sui, Yufei He, Yue Liu, Yangqiu Song, and Bryan Hooi. 2025 b . https://doi.org/10.18653/v1/2025.acl-long.890 Can indirect prompt injection attacks be detected and removed? In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 18189--18206, Vienna, Austria. Asso...

    doi:10.18653/v1/2025.acl-long.890 2025

Show all 66 references
  1. [9]

    Yize Cheng, Vinu Sankar Sadasivan, Mehrdad Saberi, Shoumik Saha, and Soheil Feizi. 2025. https://arxiv.org/abs/2506.07001 Adversarial paraphrasing: A universal attack for humanizing ai-generated text . Preprint, arXiv:2506.07001

    2025

  2. [10]

    Zhao Cheng, Diane Wan, Matthew Abueg, Sahra Ghalebikesabi, Ren Yi, Eugene Bagdasarian, Borja Balle, Stefan Mellem, and Shawn O'Banion. 2024. Ci-bench: Benchmarking contextual integrity of ai assistants on synthetic data. arXiv preprint arXiv:2409.13903

    2024 arXiv

  3. [11]

    Ganqu Cui, Lifan Yuan, Zefan Wang, Hanbin Wang, Wendi Li, Bingxiang He, Yuchen Fan, Tianyu Yu, Qixin Xu, Weize Chen, Jiarui Yuan, Huayu Chen, Kaiyan Zhang, Xingtai Lv, Shuo Wang, Yuan Yao, Xu Han, Hao Peng, Yu Cheng, and 4 others. 2025. https://arxiv.org/abs/2502.01456 Process...

    2025 arXiv

  4. [12]

    DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, and 181 others. 2025. https://arxiv.org/abs/2501.129...

    2025 arXiv

  5. [13]

    Zheye Deng, Chunkit Chan, Tianshi Zheng, Wei Fan, Weiqi Wang, and Yangqiu Song. 2025. Structuring the unstructured: A systematic review of text-to-structure generation for agentic ai with a universal evaluation framework. arXiv preprint arXiv:2508.12257

    2025 arXiv

  6. [14]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. https://arxiv.org/abs/1810.04805 Bert: Pre-training of deep bidirectional transformers for language understanding . Preprint, arXiv:1810.04805

    2019 arXiv

  7. [15]

    Wei Fan, Haoran Li, Zheye Deng, Weiqi Wang, and Yangqiu Song. 2024. Goldcoin: Grounding large language models in privacy laws via contextual integrity theory. arXiv preprint arXiv:2406.11149

    2024 arXiv

  8. [16]

    Xiao Fang, Shangkun Che, Minjia Mao, Hongzhe Zhang, Ming Zhao, and Xiaohang Zhao. 2024. https://arxiv.org/abs/2309.09825 Bias of ai-generated content: An examination of news produced by large language models . Preprint, arXiv:2309.09825

    2024 arXiv

  9. [17]

    Zhiwei Fei, Xiaoyu Shen, Dawei Zhu, Fengzhe Zhou, Zhuo Han, Songyang Zhang, Kai Chen, Zongwen Shen, and Jidong Ge. 2023. https://arxiv.org/abs/2309.16289 Lawbench: Benchmarking legal knowledge of large language models . Preprint, arXiv:2309.16289

    2023 arXiv

  10. [18]

    Sahra Ghalebikesabi, Eugene Bagdasaryan, Ren Yi, Itay Yona, Ilia Shumailov, Aneesh Pappu, Chongyang Shi, Laura Weidinger, Robert Stanforth, Leonard Berrada, Pushmeet Kohli, Po-Sen Huang, and Borja Balle. 2024. https://arxiv.org/abs/2408.02373 Operationalizing contextual integr...

    2024 arXiv

  11. [19]

    Xiangming Gu, Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Ye Wang, Jing Jiang, and Min Lin. 2024. https://arxiv.org/abs/2402.08567 Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast . Preprint, arXiv:2402.08567

    2024 arXiv

  12. [20]

    Ho, Christopher Ré, Adam Chilton, Aditya Narayana, Alex Chohlas-Wood, Austin Peters, Brandon Waldon, Daniel N

    Neel Guha, Julian Nyarko, Daniel E. Ho, Christopher Ré, Adam Chilton, Aditya Narayana, Alex Chohlas-Wood, Austin Peters, Brandon Waldon, Daniel N. Rockmore, Diego Zambrano, Dmitry Talisman, Enam Hoque, Faiz Surani, Frank Fagan, Galit Sarfaty, Gregory M. Dickinson, Haggai Porat...

    2023 arXiv

  13. [21]

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. https://arxiv.org/abs/2009.03300 Measuring massive multitask language understanding . Preprint, arXiv:2009.03300

    2021 arXiv

  14. [22]

    Jian Hu, Xibin Wu, Zilin Zhu, Xianyu, Weixun Wang, Dehao Zhang, and Yu Cao. 2024. Openrlhf: An easy-to-use, scalable and high-performance rlhf framework. arXiv preprint arXiv:2405.11143

    2024 arXiv

  15. [23]

    Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, and Ting Liu. 2025. https://doi.org/10.1145/3703155 A survey on hallucination in large language models: Principles, taxonomy, challenges, and o...

    2025 doi

  16. [24]

    Kimi, Angang Du, Bofei Gao, Bowei Xing, Changjiu Jiang, Cheng Chen, Cheng Li, Chenjun Xiao, Chenzhuang Du, Chonghua Liao, Chuning Tang, Congcong Wang, Dehao Zhang, Enming Yuan, Enzhe Lu, Fengxiang Tang, Flood Sung, Guangda Wei, Guokun Lai, and 75 others. 2025. https://arxiv.or...

    2025 arXiv

  17. [25]

    Isack Lee and Haebin Seong. 2025. https://arxiv.org/abs/2410.13334 Biasjailbreak:analyzing ethical biases and jailbreak vulnerabilities in large language models . Preprint, arXiv:2410.13334

    2025

  18. [26]

    Haoran Li, Yulin Chen, Jinglong Luo, Jiecong Wang, Hao Peng, Yan Kang, Xiaojin Zhang, Qi Hu, Chunkit Chan, Zenglin Xu, Bryan Hooi, and Yangqiu Song. 2024 a . https://arxiv.org/abs/2310.10383 Privacy in large language models: Attacks, defenses and future directions . Preprint, ...

    2024 arXiv

  19. [27]

    Haoran Li, Wei Fan, Yulin Chen, Jiayang Cheng, Tianshu Chu, Xuebing Zhou, Peizhao Hu, and Yangqiu Song. 2024 b . Privacy checklist: Privacy violation detection grounding on contextual integrity theory. arXiv preprint arXiv:2408.10053

    2024 arXiv

  20. [28]

    Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song. 2023 a . https://arxiv.org/abs/2304.05197 Multi-step jailbreaking privacy attacks on chatgpt . Preprint, arXiv:2304.05197

    2023 arXiv

  21. [29]

    Haoran Li, Wenbin Hu, Huihao Jing, Yulin Chen, Qi Hu, Sirui Han, Tianshu Chu, Peizhao Hu, and Yangqiu Song. 2025. https://arxiv.org/abs/2502.17041 Privaci-bench: Evaluating privacy with contextual integrity and legal compliance . Preprint, arXiv:2502.17041

    2025 arXiv

  22. [30]

    Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2024 c . https://arxiv.org/abs/2311.03191 Deepinception: Hypnotize large language model to be jailbreaker . Preprint, arXiv:2311.03191

    2024 arXiv

  23. [31]

    Yuanchun Li, Hao Wen, Weijun Wang, Xiangyu Li, Yizhen Yuan, Guohong Liu, Jiacheng Liu, Wenxing Xu, Xiang Wang, Yi Sun, Rui Kong, Yile Wang, Hanfei Geng, Jian Luan, Xuefeng Jin, Zilong Ye, Guanjing Xiong, Fan Zhang, Xiang Li, and 6 others. 2024 d . https://arxiv.org/abs/2401.05...

    2024 arXiv

  24. [32]

    Zihao Li, Zhuoran Yang, and Mengdi Wang. 2023 b . https://arxiv.org/abs/2305.18438 Reinforcement learning with human feedback: Learning dynamic choices via pessimism . Preprint, arXiv:2305.18438

    2023 arXiv

  25. [33]

    Stephanie Lin, Jacob Hilton, and Owain Evans. 2022. https://arxiv.org/abs/2109.07958 Truthfulqa: Measuring how models mimic human falsehoods . Preprint, arXiv:2109.07958

    2022 arXiv

  26. [34]

    Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu. 2024. https://arxiv.org/abs/2306.05499 Prompt injection attack against llm-integrated applications . Preprint, arXiv:2306.05499

    2024 arXiv

  27. [35]

    Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. 2024. https://arxiv.org/abs/2310.17884 Can llms keep a secret? testing privacy implications of language models via contextual integrity theory . Preprint, arXiv:2310.17884

    2024 arXiv

  28. [36]

    Helen Nissenbaum. 2009. Privacy in context: Technology, policy, and the integrity of social life. In Privacy in context. Stanford University Press

    2009

  29. [37]

    OpenAI, :, Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, Aleksander Mądry, Alex Baker-Whitcomb, Alex Beutel, Alex Borzunov, Alex Carney, Alex Chow, Alex Kirillov, and 401 others. 2024....

    2024 arXiv

  30. [38]

    Team OpenThoughts. 2025. Open Thoughts . https://open-thoughts.ai

    2025

  31. [39]

    Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and...

    2022 arXiv

  32. [40]

    Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Guha Thakurta

    Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, H. Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Guha Thakurta. 2023. https://doi.org/10.1613/jair.1.14649 How to dp-fy ml: A practical guide to machine learning with differential ...

    2023 doi

  33. [41]

    Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, and 25 others. 2025. https://arxiv.org/abs/2412.15115 Qwe...

    2025 arXiv

  34. [42]

    Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. 2019. https://arxiv.org/abs/1907.10641 Winogrande: An adversarial winograd schema challenge at scale . Preprint, arXiv:1907.10641

    2019 arXiv

  35. [43]

    Jordan, and Pieter Abbeel

    John Schulman, Sergey Levine, Philipp Moritz, Michael I. Jordan, and Pieter Abbeel. 2017 a . https://arxiv.org/abs/1502.05477 Trust region policy optimization . Preprint, arXiv:1502.05477

    2017 arXiv

  36. [44]

    John Schulman, Philipp Moritz, Sergey Levine, Michael Jordan, and Pieter Abbeel. 2018. https://arxiv.org/abs/1506.02438 High-dimensional continuous control using generalized advantage estimation . Preprint, arXiv:1506.02438

    2018 arXiv

  37. [45]

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017 b . https://arxiv.org/abs/1707.06347 Proximal policy optimization algorithms . Preprint, arXiv:1707.06347

    2017 arXiv

  38. [46]

    Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. 2021. https://arxiv.org/abs/2006.12557 Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks . Preprint, arXiv:2006.12557

    2021 arXiv

  39. [47]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. https://arxiv.org/abs/2308.03825 "do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models . Preprint, arXiv:2308.03825

    2024 arXiv

  40. [48]

    Haochen Shi, Tianshi Zheng, Weiqi Wang, Baixuan Xu, Chunyang Li, Chunkit Chan, Tao Fan, Yangqiu Song, and Qiang Yang. 2025. Inferencedynamics: Efficient routing across llms through structured capability and knowledge profiling. arXiv preprint arXiv:2505.16303

    2025 arXiv

  41. [49]

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. https://arxiv.org/abs/1610.05820 Membership inference attacks against machine learning models . Preprint, arXiv:1610.05820

    2017 arXiv

  42. [50]

    Yan Shvartzshnaider and Vasisht Duddu. 2025. https://arxiv.org/abs/2409.03735 Investigating privacy bias in training data of language models . Preprint, arXiv:2409.03735

    2025

  43. [51]

    Jacob Steinhardt, Pang Wei Koh, and Percy Liang. 2017. https://arxiv.org/abs/1706.03691 Certified defenses for data poisoning attacks . Preprint, arXiv:1706.03691

    2017 arXiv

  44. [52]

    Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. 2020. https://arxiv.org/abs/2007.08432 Data poisoning attacks against federated learning systems . Preprint, arXiv:2007.08432

    2020 arXiv

  45. [53]

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. 2023. https://arxiv.org/abs/2302.13971 Llama:...

    2023 arXiv

  46. [54]

    Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, Wayne Xin Zhao, Zhewei Wei, and Jirong Wen. 2024 a . https://doi.org/10.1007/s11704-024-40231-1 A survey on large language model based autonomous agents . Fron...

    2024 doi

  47. [55]

    Peiyi Wang, Lei Li, Zhihong Shao, R. X. Xu, Damai Dai, Yifei Li, Deli Chen, Y. Wu, and Zhifang Sui. 2024 b . https://arxiv.org/abs/2312.08935 Math-shepherd: Verify and reinforce llms step-by-step without human annotations . Preprint, arXiv:2312.08935

    2024 arXiv

  48. [56]

    Sophie Xhonneux, Alessandro Sordoni, Stephan Günnemann, Gauthier Gidel, and Leo Schwinn. 2024. https://arxiv.org/abs/2405.15589 Efficient adversarial training in llms with continuous attacks . Preprint, arXiv:2405.15589

    2024 arXiv

  49. [57]

    Zhiheng Xi, Wenxiang Chen, Xin Guo, Wei He, Yiwen Ding, Boyang Hong, Ming Zhang, Junzhe Wang, Senjie Jin, Enyu Zhou, Rui Zheng, Xiaoran Fan, Xiao Wang, Limao Xiong, Yuhao Zhou, Weiran Wang, Changhao Jiang, Yicheng Zou, Xiangyang Liu, and 10 others. 2023. https://arxiv.org/abs/...

    2023 arXiv

  50. [58]

    Tian Xie, Zitian Gao, Qingnan Ren, Haoming Luo, Yuqian Hong, Bryan Dai, Joey Zhou, Kai Qiu, Zhirong Wu, and Chong Luo. 2025. https://arxiv.org/abs/2502.14768 Logic-rl: Unleashing llm reasoning with rule-based reinforcement learning . Preprint, arXiv:2502.14768

    2025 arXiv

  51. [59]

    Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. https://doi.org/10.1016/j.hcc.2024.100211 A survey on large language model (llm) security and privacy: The good, the bad, and the ugly . High-Confidence Computing, 4(2):100211

    2024

  52. [60]

    Yauwai Yim, Chunkit Chan, Tianyu Shi, Zheye Deng, Wei Fan, Tianshi Zheng, and Yangqiu Song. 2024. https://doi.org/10.1109/WI-IAT62293.2024.00074 Evaluating and enhancing llms agent based on theory of mind in guandan: A multi-player cooperative game under imperfect information ...

    2024

  53. [61]

    Yueqin Yin, Shentao Yang, Yujia Xie, Ziyi Yang, Yuting Sun, Hany Awadalla, Weizhu Chen, and Mingyuan Zhou. 2025. https://arxiv.org/abs/2501.02790 Segmenting text and learning their rewards for improved rlhf in language model . Preprint, arXiv:2501.02790

    2025 arXiv

  54. [62]

    Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. 2022. https://arxiv.org/abs/2110.06500 Differentially private fine-tuning of language model...

    2022 arXiv

  55. [63]

    Weihao Zeng, Yuzhen Huang, Wei Liu, Keqing He, Qian Liu, Zejun Ma, and Junxian He. 2025. 7b model and 8k examples: Emerging reasoning with reinforcement learning is both effective and efficient. https://hkust-nlp.notion.site/simplerl-reason. Notion Blog

    2025

  56. [64]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. https://arxiv.org/abs/2307.15043 Universal and transferable adversarial attacks on aligned language models . Preprint, arXiv:2307.15043

    2023 arXiv

  57. [65]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  58. [66]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.