Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

The Eye of Sherlock Holmes: Uncovering User Private Attribute Profiling via Vision-Language Model Agentic Framework

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Ten ordinary photos can power an AI agent that infers private attributes — health habits, income, MBTI — at 90.5% accuracy, outperforming human analysts by 15 percentage points.

desk verdict Good benchmark and a sensible agentic pipeline, but the headline accuracy numbers are not yet credible because one-third of the evaluation is self-scored by the same model family that powers the best configuration. read the letter →

arxiv 2505.19139 v1 pith:QS5KHM5L submitted 2025-05-25 cs.CV

Feiran Liu , Yuzhe Zhang , Xinyi Huang , Yinan Peng , Xinfeng Li , Lixu Wang , Yutong Shen , Ranjie Duan
show 4 more authors
Simeng Qin Xiaojun Jia Qingsong Wen Wei Dong
This is my paper
classification cs.CV
keywords VisionLanguageModelLargePrivacyInferenceAttackImageUserAttributeProfilingAgenticFrameworkMultimodalModelsPAPIdataset
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

HolmesEye, a hybrid vision-language and large-language model agent, can build a detailed private profile of a person from ten ordinary photographs, inferring not only age, region, and health habits but also income level, occupation, MBTI type, and leadership tendency. The paper argues this 'image private attribute profiling' is a new privacy threat because modern apps and platforms routinely access photo albums, and because it exploits relationships across images rather than any single revealing picture. To make the threat measurable, the authors construct PAPI, a dataset of 2,510 photos from 251 people annotated with 12 private attributes across four domains, and show that HolmesEye reaches 90.5% average inference accuracy, about 10.8 points above strong VLM baselines and 15.0 points above human analysts. A sympathetic reading of the claim: an agent built entirely from existing models and ordinary API access can profile strangers from their everyday photo collections more accurately and roughly three times faster than a human can.

What carries the argument

The load-bearing mechanism is the HolmesEye agentic pipeline, which splits the profiling problem into five phases: Extraction (an LLM-generated prompt makes a VLM read each photo for attribute-relevant details), Analysis (photos are grouped in threes so the VLM can compare objects and styles across images without overflowing its context), Summarization (an LLM assembles the per-image and cross-image evidence into initial attribute guesses), Inquiry (the LLM writes a targeted question about whatever attributes remain uncertain, and the VLM re-examines all ten photos to answer it), and Decision Making (the LLM issues the final profile). The companion dataset, PAPI, supplies the testbed: 251 individuals times 10 self-selected photos each, with 12 labeled attributes in four domains. The three-image grouping is itself an empirical design choice: with 5 or 7 images per group the strongest VLM's reasoning accuracy drops, which is why the framework routes around long-context visual limits instead of trying to brute-force them.

What would settle it

Run the exact ten-photo HolmesEye pipeline on randomly sampled camera-roll photos of consenting volunteers whose attributes are verified by a third party rather than self-reported, and compare average accuracy to the 90.5% claimed; if accuracy falls to the roughly 75.5% human baseline or below, the superhuman profiling result is an artifact of curated input.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that inter-image reasoning is the key to superhuman attribute profiling: a single VLM prompt on a photo collection underperforms, but when a VLM extracts per-image details and cross-image patterns in three-image groups, an LLM summarizer forms initial guesses, forms a targeted question for whatever remains unknown, and only then makes a final judgment, the same models leap from about 80% to 90.5% average accuracy. The most consequential finding is that the gain concentrates in the abstract attributes people least expect to leak from photos — personality (MBTI), social activity, and leadership tendency — where the agent scores 85.6% versus 67.5% for human evaluators. The paper also reports that this holds with smaller open-source models (QwQ-32B and Llama-13B inside the framework outperform the ChatGPT-4o strong-prompt baseline), that ten images is the practical data minimum, and that the framework beats a specialized age-estimation model by 13.8 points even with a naive prompt.

Load-bearing premise

The measured accuracies count only if PAPI's self-selected, partly self-reported images stand in for a real person's actual photo album; if the volunteers picked photos that made their traits easier to read, every reported accuracy overstates the real-world threat.

Editorial extensions

If this is right

  • Ten photos of a person are enough for the HolmesEye pipeline to infer 12 private attributes at 90.5% average accuracy with Claude-3.7-Sonnet, including health habits, income level, occupation, and MBTI type.
  • Profiling accuracy is data-hungry but saturates: on the Claude baseline, five photos yield 62.2% accuracy, ten photos 79.7%, and eleven photos only 80.1%, so ten images is the effective operating point for an attacker.
  • Cross-image analysis in groups of three is the decisive design choice; group sizes of five or seven degrade accuracy, meaning the threat model depends on managing the VLM's long-context limits rather than just adding images.
  • Open-source models are sufficient for the attack: QwQ-32B (78.5%) and Llama-13B (76.3%) inside HolmesEye beat the ChatGPT-4o strong-prompt baseline (75.9%), so the risk is not confined to the largest proprietary systems.
  • The framework's largest edge is on the least visually obvious attributes — MBTI, social activity, and leadership tendency — where it scores 85.6% versus 67.5% for humans, exactly the attributes users would not expect their photos to reveal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The self-curation in PAPI cuts both ways: because volunteers chose photos that 'subtly' reflect attributes, a real album containing explicit cues (e.g., branded goods, workplace ID badges) could be even easier to profile, while random albums full of noise could be harder; neither direction is tested in the paper.
  • If the three-image grouping is required because long-context visual reasoning degrades, a testable defense is to break cross-image coherence — shuffling photo order, inserting unrelated decoy images, or adding small adversarial perturbations — and measuring how much HolmesEye's accuracy drops.
  • The speed figure has a scale implication the paper does not quantify: at roughly 3.4 minutes per person, the same agent could profile tens of thousands of scraped albums per day, turning a per-user privacy leak into a mass-profiling capability that human oversight could not keep pace with.
  • A constructive extension: PAPI and HolmesEye could be inverted into a self-audit tool that shows a user what an automated agent would infer from their own ten photos; the natural experiment is whether seeing such a profile changes photo-sharing behavior.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper identifies a privacy threat it calls 'image private attribute profiling': using a set of ordinary personal photos to infer private attributes such as age, health habits, income, occupation, and MBTI. It introduces PAPI, a dataset of 2,510 images from 251 individuals with 12 attribute labels each, and HolmesEye, a hybrid VLM/LLM agentic framework with extraction, analysis, summarization, inquiry, and decision-making stages. The main empirical claims are that HolmesEye reaches 90.5% average accuracy, outperforms strong VLM baselines by 10.8 percentage points, and surpasses human analysts by 15.0 percentage points while being much faster.

Significance. If the results are trustworthy, the paper documents a serious and timely privacy risk and offers a useful benchmark and framework to the community. The dataset construction is ethically careful, the agentic design is clearly described, and the ablations show which components matter. The central numbers, however, depend on an evaluation setup in which ambiguous attributes are scored by the same model family that powers the strongest HolmesEye configuration, and the dataset construction involves self-selected images and some public stand-ins. These issues must be resolved before the headline accuracy claims can be accepted.

major comments (4)
  1. [Section 6.1, Evaluation Metrics] The four ambiguous attributes (AG, RE, OC, MBTI) are scored by Claude-3.7-Sonnet, the same model family that yields the best HolmesEye configuration in Table 1 and that also performs the LLM consolidation in Eq. (5). A model scoring its own outputs with an undocumented similarity rubric can systematically favor its own answer patterns, so the reported +10.8-point gain over baselines and +15.0-point gain over humans are not established for these attributes. Please regrade the ambiguous attributes with an independent judge, provide a concrete rubric for the 0-to-1 similarity scale, and report inter-annotator agreement or at least the distribution of raw scores.
  2. [Section 4, Dataset Construction] Participants self-selected ten photos 'that subtly rather than explicitly reflected their attributes' and some supplied similar publicly available images instead of their personal photographs. This selection process can make attribute labels easier to infer than from a real album, and for the public stand-ins the image content may not correspond to the volunteer's true attribute labels. No verification is described beyond follow-up discussions. Because all subsequent human and model evaluations use PAPI, the absolute accuracies in Tables 1, 2, and 5 are upper bounds for a real-world attack. Please report a check of image-label consistency, ideally with independent raters, and state how many images are public stand-ins.
  3. [Section 6.3, Human Evaluation] The human study compares humans with HolmesEye on '50 simulated individuals' from PAPI, but the paper does not specify whether the human raters were trained on the 12-attribute taxonomy, the exact label values per attribute, or the scoring rules for qualitative, quantitative, and ambiguous attributes. It also does not state how many humans rated each individual or how their answers were mapped to the reported accuracy. Without this information, the claim that HolmesEye surpasses human performance by 15.0 percentage points is not fully interpretable. Please describe the instructions, scoring procedure, and the number of raters per individual.
  4. [Section 6.2 and Table 1] The text states that HolmesEye improves over the same VLM by up to 10.7% and over different VLMs by up to 14.5%, but Table 1 contains a 17.9-point gain (LT for Claude-3.7-Sonnet) and the per-attribute gains vary widely. It is also unclear from the table caption whether the 'Strong prompt' baseline uses a prompt tuned separately for each VLM and attribute or a single prompt. Please clarify the baseline protocol and reconcile the numeric summary with the table entries, ideally with confidence intervals or error bars.
minor comments (5)
  1. [Section 6.2, Impact of Numbers for Inter-Image Analysis] The text refers to Table 3 for the group-size results (sizes 2, 3, 5, 7), but Table 3 contains phase ablations; the group-size data appear in Table 4 and Figure 4. Please correct the cross-reference.
  2. [Section 6.2, Ablation Study] The phrase 'removing extraction from the ALM prompt' should read 'VLM prompt'.
  3. [Equation (2)] The limits in the expression for F_inter appear to be mistyped: the subscript runs from i=N_origin+1 to 1, and the meaning of the outer index j=4 is not explained. Please restate the sum over image groups explicitly.
  4. [Table 1 note and Section 6.1] The table says the strong prompt is 'fine-tuned on a single model,' while the text says baselines use the same system prompts as the final step of HolmesEye. Please clarify the exact prompt protocol so the baseline comparison is reproducible.
  5. [References] Reference [14] is cited for Llama-3.1-405B, but that reference is a paper about fine-grained reasoning for fake-news detection; please check the citation.

Circularity Check

1 steps flagged · score 6.0 of 10

The headline accuracy numbers for four ambiguous attributes are graded by Claude-3.7-Sonnet, the same model that produces the best HolmesEye results, so the 90.5% average and the 10.8/15.0-point gains are partly self-scored rather than independently measured.

  1. other [Section 6.1 Evaluation Metrics; Table 1 Claude-3.7-Sonnet row; Table 5 Human Evaluation; Eq. (5) decision step.]
    "To ensure objective evaluation of ambiguous attributes, we used the most powerful LLM, Claude-3.7-Sonnet, to assess ambiguity, generating a similarity score on a five-level scale from 1 to 0, with steps of 0.25."

    The four ambiguous attributes (RE, OC, MBTI, AG) are part of the 12-attribute averages in Tables 1 and 5. For those attributes the reported accuracy is not an external measurement: it is a similarity score produced by Claude-3.7-Sonnet, and the highest-performing HolmesEye row in Table 1 is also the Claude-3.7-Sonnet instantiation (90.5% average; 15.0-point margin over humans in Table 5). The final decision step (Eq. 5) is an LLM consolidation, so the same model family both generates the profile answers and grades their similarity to ground truth. A grader assigning scores to its own answer distribution is not an independent observer: it can systematically prefer its own phrasing and inference patterns, inflating HolmesEye's ambiguous-attribute scores relative to baselines and humans.

full rationale

The core derivation (HolmesEye pipeline, Eqs. 1-5) is not circular: it is an engineering composition of VLM extraction, grouping, LLM summarization, inquiry, and decision, and there is no fitted parameter that is later renamed a prediction. The PAPI dataset, while self-selected and partly using stand-in public images in Section 4 ("some participants opted to provide similar publicly available images rather than their personal photographs"), is an external benchmark with fixed labels for 8 of 12 attributes. The one significant circularity is evaluative: for the four 'ambiguous' attributes, the metric is Claude-3.7-Sonnet's own similarity judgment, while the best HolmesEye configuration is also Claude-3.7-Sonnet. The headline numbers (90.5%, 10.8-point, and 15.0-point gains) therefore partly measure the model grading itself and are not independently established; external re-grading by humans or fixed rubrics is needed. The Section 4 substitution of similar public photos for personal photos is a validity limitation rather than a circularity, and the Section 7 limitations are candid without being circular. Score 6 reflects partial reduction of the central evaluation for one-third of attributes, not a fully fabricated derivation.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

This is an empirical benchmark and framework paper, so the ledger is dominated by data collection and evaluation assumptions rather than fitted model parameters. The only hand-tuned hyperparameter visible is the 3-image grouping, which was chosen on an evaluation subset. The most consequential assumptions are the reliability of self-reported labels and the validity of LLM-judged similarity scores for abstract attributes.

free parameters (2)
  • Inter-image group size = 3
    Chosen after an empirical sweep of group sizes 2, 3, 5, and 7 on 50 individuals, and the best value was used for all main results with no held-out validation (Sec. 6.2, Table 4).
  • Images per person in PAPI = 10
    Dataset design choice justified by accuracy saturating around 10 images in Sec. 6.2; this value directly shapes the benchmark and every downstream accuracy number.
assumptions (4)
  • domain assumption Volunteer self-reported attribute labels are accurate ground truth.
    Sec. 4: participants provided ground-truth labels for 12 indicators based on their actual circumstances. If these labels are biased, inconsistent, or aspirational, every accuracy number is unreliable.
  • domain assumption The ten images each volunteer selected are subtle rather than explicit reflections of their attributes, and are representative of real personal albums.
    Sec. 4 instructs participants to select photos that 'subtly rather than explicitly reflected their attributes.' This controls task difficulty and external validity.
  • ad hoc to paper Claude-3.7-Sonnet's similarity scores are a valid measure of attribute inference quality for ambiguous attributes.
    Sec. 6.1 uses Claude-3.7-Sonnet to score RE, OC, MBTI, and AG on a five-level scale. The judge is from the same model family as the strongest evaluated component, making the metric partly self-referential.
  • domain assumption Zero-shot API responses reflect stable model capability rather than prompt or version artifacts.
    Sec. 6.1 lists multiple proprietary models and system prompts, but no API temperature, version pinning, repetition statistics, or stability checks are reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Eye of Sherlock Holmes: Uncovering User Private Attribute Profiling via Vision-Language Model Agentic Framework." pith.science (2026). https://pith.science/paper/QS5KHM5L

@misc{pith2026250519139,
  author       = {Pith},
  title        = {Pith review of: The Eye of Sherlock Holmes: Uncovering User Private Attribute Profiling via Vision-Language Model Agentic Framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QS5KHM5L}},
  note         = {Machine review of arXiv:2505.19139}
}
read the original abstract

Our research reveals a new privacy risk associated with the vision-language model (VLM) agentic framework: the ability to infer sensitive attributes (e.g., age and health information) and even abstract ones (e.g., personality and social traits) from a set of personal images, which we term "image private attribute profiling." This threat is particularly severe given that modern apps can easily access users' photo albums, and inference from image sets enables models to exploit inter-image relations for more sophisticated profiling. However, two main challenges hinder our understanding of how well VLMs can profile an individual from a few personal photos: (1) the lack of benchmark datasets with multi-image annotations for private attributes, and (2) the limited ability of current multimodal large language models (MLLMs) to infer abstract attributes from large image collections. In this work, we construct PAPI, the largest dataset for studying private attribute profiling in personal images, comprising 2,510 images from 251 individuals with 3,012 annotated privacy attributes. We also propose HolmesEye, a hybrid agentic framework that combines VLMs and LLMs to enhance privacy inference. HolmesEye uses VLMs to extract both intra-image and inter-image information and LLMs to guide the inference process as well as consolidate the results through forensic analysis, overcoming existing limitations in long-context visual reasoning. Experiments reveal that HolmesEye achieves a 10.8% improvement in average accuracy over state-of-the-art baselines and surpasses human-level performance by 15.0% in predicting abstract attributes. This work highlights the urgency of addressing privacy risks in image-based profiling and offers both a new dataset and an advanced framework to guide future research in this area.

Figures

Figures reproduced from arXiv: 2505.19139 by the authors.

Figure 1
Figure 1. HolmesEye develops VLM perception and LLM rea￾soning to extract private attributes from image collections, analyzing both individual images and cross-image patterns to profile users across four attribute domains. What sensitive information can be extracted from seemingly ordinary images when analyzed by increasingly capable AI systems? Our research reveals a concerning answer to this question: mod￾ern VLMs, when str… view at source ↗
Figure 2
Figure 2. The PAPI dataset consists of 2,510 images collected from 251 volunteers across 31 occupations, with each individual [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The process of inferring private information using the HolmesEye framework. Step 1 extracts individual image [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: The impact of the number of PAPI single-person [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. The Man Behind the Sound: Demystifying Audio Private Attribute Profiling via Multimodal Large Language Model Agents

    cs.CR 2025-07 unverdicted novelty 6.0 of 10

    A multi-agent audio-language model framework can automatically profile private attributes, such as age, health, and income, directly from general audio recordings.

Reference graph

Works this paper leans on

61 extracted references · 38 canonical work pages · cited by 1 Pith paper

  1. [1]

    Savitha Sam Abraham, Sowmya S Sundaram, et al. 2019. Fairness in clustering with multiple sensitive attributes.arXiv preprint arXiv:1910.05113(2019)

    arXiv 2019

  2. [2]

    Anthropic. 2025. Claude 3.7 Sonnet System Card. https://assets.anthropic.com/ m/785e231869ea8b3b/original/claude-3-7-sonnet-system-card.pdf

    2025

  3. [3]

    Lemi Baruh, Ekin Secinti, and Zeynep Cemalcilar. 2017. Online privacy concerns and privacy management: A meta-analytical review.Journal of Communication 67, 1 (2017), 26–53

    2017

  4. [4]

    Rainer Bye, Seyit A Camtepe, and Sahin Albayrak. 2009. Design and modeling of collaboration architecture for security. In2009 International Symposium on Collaborative Technologies and Systems. IEEE, 330–341

    work page 2009

  5. [5]

    Manuel J Carvajal, Kevin A Clauson, Jennifer Gershman, and Hyla H Polen

    work page

  6. [6]

    Ping Chen, Xingpeng Zhang, Ye Li, Ju Tao, Bin Xiao, Bing Wang, and Zongjie Jiang. 2023. DAA: A Delta Age AdaIN operation for age estimation via binary code transformer. In2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 15836–15845. https://doi.org/10.1109/CVPR52729.2023.01520

    arXiv 2023

  7. [7]

    Peng Cheng and Utz Roedig. 2022. Personal voice assistant security and privacy— a survey.Proc. IEEE110, 4 (2022), 476–507

    work page 2022

  8. [8]

    Paula Delgado-Santos, Giuseppe Stragapede, Ruben Tolosana, Richard Guest, Farzin Deravi, and Ruben Vera-Rodriguez. 2022. A survey of privacy vulnerabil- ities of mobile device sensors.ACM Computing Surveys (CSUR)54, 11s (2022), 1–30

    work page 2022

Show all 61 references
  1. [9]

    Junfeng Fang, Yukai Wang, Ruipeng Wang, Zijun Yao, Kun Wang, An Zhang, Xiang Wang, and Tat-Seng Chua. 2025. SafeMLRM: Demystifying Safety in Multi-modal Large Reasoning Models.arXiv preprint arXiv:2504.08813(2025)

    2025 arXiv

  2. [10]

    Yoram Gdalyahu, Daphna Weinshall, and Michael Werman. 2001. Self- organization in vision: stochastic clustering for image segmentation, perceptual grouping, and image database organization.IEEE Transactions on Pattern Analysis and Machine Intelligence23, 10 (2001), 1053–1074

    2001

  3. [11]

    André Gooßen, Thomas Pralow, and Rolf-Rainer Grigat. 2009. Medical X-ray image enhancement by intra-image and inter-image similarity. InMedical Imaging 2009: Image Processing, Vol. 7259. SPIE, 162–171

    2009

  4. [12]

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. 2022. Membership inference attacks on machine learning: A survey.ACM Computing Surveys (CSUR)54, 11s (2022), 1–37

    2022

  5. [13]

    Bargav Jayaraman and David Evans. 2022. Are attribute inference attacks just imputation?In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security(2022), 1569–1582

    2022

  6. [14]

    Yiqiao Jin, Xiting Wang, Ruichao Yang, Yizhou Sun, Wei Wang, Hao Liao, and Xing Xie. 2022. Towards fine-grained reasoning for fake news detection. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 36. 5746–5754

    2022

  7. [15]

    Mohsen Jozani, Emmanuel Ayaburi, Myung Ko, and Kim-Kwang Raymond Choo

  8. [16]

    Nakyoung Kim, Hyeontaek Oh, and Jun Kyun Choi. 2023. A privacy scoring framework: Automation of privacy compliance and risk evaluation with standard indicators.Journal of King Saud University-Computer and Information Sciences 35, 1 (2023), 514–525

    2023

  9. [17]

    Aobo Kong, Shiwan Zhao, Hao Chen, Qicheng Li, Yong Qin, Ruiqi Sun, Xin Zhou, Enzhi Wang, and Xiaohang Dong. 2023. Better zero-shot reasoning with role-play prompting.arXiv preprint arXiv:2308.07702(2023)

    2023 arXiv

  10. [18]

    Jingjin Li, Chao Chen, Mostafa Rahimi Azghadi, Hossein Ghodosi, Lei Pan, and Jun Zhang. 2023. Security and privacy problems in voice assistant applications: A survey.Computers & Security134 (2023), 103448

    2023

  11. [19]

    Jiaqi Li, Mengmeng Wang, Zilong Zheng, and Muhan Zhang. 2023. Loogle: Can long-context language models understand long contexts?arXiv preprint arXiv:2311.04939(2023)

    2023 arXiv

  12. [20]

    Songze Li, Ruoxi Cheng, and Xiaojun Jia. 2025. TUNI: A Textual Unimodal De- tector for Identity Inference in CLIP Models. InProceedings of the Sixth Workshop on Privacy in Natural Language Processing. 1–13

    2025

  13. [21]

    Zhong-Zhi Li, Duzhen Zhang, Ming-Liang Zhang, Jiaxin Zhang, Zengyan Liu, Yuxuan Yao, Haotian Xu, Junhao Zheng, Pei-Jie Wang, Xiuyi Chen, et al. 2025. From system 1 to system 2: A survey of reasoning large language models.arXiv preprint arXiv:2502.17419(2025)

    2025 arXiv

  14. [22]

    Yue Liu, Hongcheng Gao, Shengfang Zhai, Xia Jun, Tianyi Wu, Zhiwei Xue, Yulin Chen, Kenji Kawaguchi, Jiaheng Zhang, and Bryan Hooi. 2025. GuardReasoner: Towards Reasoning-based LLM Safeguards.arXiv preprint arXiv:2501.18492 (2025)

    2025

  15. [23]

    Yue Liu, Jiaying Wu, Yufei He, Hongcheng Gao, Hongyu Chen, Baolong Bi, Jiaheng Zhang, Zhiqi Huang, and Bryan Hooi. 2025. Efficient Inference for Large Reasoning Models: A Survey.arXiv preprint arXiv:2503.23077(2025)

    2025 arXiv

  16. [24]

    Jinda Lu, Junkang Wu, Jinghan Li, Xiaojun Jia, Shuo Wang, YiFan Zhang, Junfeng Fang, Xiang Wang, and Xiangnan He. 2025. DAMO: Data-and Model-aware Alignment of Multi-modal LLMs.arXiv preprint arXiv:2502.01943(2025)

    2025 arXiv

  17. [25]

    Chenyang Ma, Kai Lu, Ta-Ying Cheng, Niki Trigoni, and Andrew Markham. 2024. Spatialpin: Enhancing spatial reasoning capabilities of vision-language models through prompting and interacting 3d priors.arXiv preprint arXiv:2403.13438 (2024)

    2024 arXiv

  18. [26]

    J Reid Meloy, Kris Mohandie, James L Knoll, and Jens Hoffmann. 2015. The concept of identification in threat assessment.Behavioral Sciences & the Law33, 2-3 (2015), 213–237

    2015

  19. [27]

    Shervin Minaee, Tomas Mikolov, Narjes Nikzad, Meysam Chenaghlu, Richard Socher, Xavier Amatriain, and Jianfeng Gao. 2024. Large language models: A survey.arXiv preprint arXiv:2402.06196(2024)

    2024 arXiv

  20. [28]

    OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Bal- com, Paul Baltescu, et al. 2024. GPT-4 Technical Report...

    2024 arXiv

  21. [29]

    Luis Salvador-Carulla, Federico Alonso, Rafael Gomez, Carolyn O Walsh, José Al- menara, Mencía Ruiz, María José Abellán, and eVITAL group. 2013. Basic concepts in the taxonomy of health-related behaviors, habits and lifestyle.International journal of environmental research and...

    2013

  22. [30]

    Schulze Buschoff, Max Kölbl, Daniel Braun, and Kristian Kersting

    Luca M. Schulze Buschoff, Max Kölbl, Daniel Braun, and Kristian Kersting. 2024. Visual cognition in multimodal large language models.Nature Machine Intelli- gence(2024). https://doi.org/10.1038/s42256-024-00963-y

    2024 doi

  23. [31]

    Robin Staab, Mark Vero, Mislav Balunovic, and Martin Vechev. 2023. Beyond memorization: Violating privacy via inference with large language models. In The Twelfth International Conference on Learning Representations

    2023

  24. [32]

    Diederik A Stapel, Willem Koomen, and Joop van der Pligt. 1996. The referents of trait inferences: The impact of trait concepts versus actor–trait links on sub- sequent judgments.Journal of Personality and Social Psychology70, 3 (1996), 437

    1996

  25. [33]

    Tianci Sun, Chengyu Zheng, Xiu Li, Yanli Gao, Jie Nie, Lei Huang, and Zhiqiang Wei. 2025. Strong and Weak Prompt Engineering for Remote Sensing Image- Text Cross-Modal Retrieval.IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing(2025)

    2025

  26. [34]

    2004.Threat modeling

    Frank Swiderski and Window Snyder. 2004.Threat modeling. Microsoft Press

    2004

  27. [35]

    Gemini Team, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, et al. 2024. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context.arXiv preprint arXiv:2403.05530(2024)

    2024 arXiv

  28. [36]

    Caroline B Terwee, Lidwine B Mokkink, Mireille NM van Poppel, Mai JM China- paw, Willem van Mechelen, and Henrica CW de Vet. 2010. Qualitative attributes and measurement properties of physical activity questionnaires: a checklist. Sports medicine40 (2010), 525–537

    2010

  29. [37]

    Kristinn R Thórisson. 2007. Integrated AI systems.Minds and Machines17 (2007), 11–25

    2007

  30. [38]

    1999.Technologies, techniques, tools, and trends

    Bhavani Thuraisingham and Data Maning. 1999.Technologies, techniques, tools, and trends. CRC press

    1999

  31. [39]

    Batuhan Tömekçe, Mark Vero, Robin Staab, and Martin Vechev. 2024. Private attribute inference from images with vision-language models. InNeurIPS

    2024

  32. [40]

    Imdad Ullah, Roksana Boreli, Salil S Kanhere, Sanjay Chawla, Tariq Ahamed Ahanger, and Usman Tariq. 2020. Protecting private attributes in app based mobile user profiling.IEEE Access8 (2020), 143818–143836

    2020

  33. [41]

    Cheng Wang, Yue Liu, Baolong Li, Duzhen Zhang, Zhongzhi Li, and Junfeng Fang

  34. [42]

    Jingya Wang, Xiatian Zhu, Shaogang Gong, and Wei Li. 2017. Attribute recogni- tion by joint recurrent learning of context and correlation. InProceedings of the IEEE International Conference on Computer Vision. 531–540

    2017

  35. [43]

    Kun Wang, Guibin Zhang, Zhenhong Zhou, Jiahao Wu, Miao Yu, Shiqian Zhao, Chenlong Yin, Jinhu Fu, Yibo Yan, Hanjun Luo, et al. 2025. A Comprehensive Survey in LLM (-Agent) Full Stack Safety: Data, Training and Deployment.arXiv preprint arXiv:2504.15585(2025). ACM MM, 2025, Dubl...

    2025 arXiv

  36. [44]

    Yiqi Wang, Wentao Chen, Xiaotian Han, Xudong Lin, Haiteng Zhao, Yongfei Liu, Bohan Zhai, Jianbo Yuan, Quanzeng You, and Hongxia Yang. 2024. Exploring the reasoning abilities of multimodal large language models (mllms): A com- prehensive survey on emerging trends in multimodal ...

    2024 arXiv

  37. [45]

    Yaru Wang, Ning Zheng, Ming Xu, Tong Qiao, Qiang Zhang, Feipeng Yan, and Jian Xu. 2019. Hierarchical identifier: Application to user privacy eavesdropping on mobile payment app.Sensors19, 14 (2019), 3052

    2019

  38. [46]

    2015.Evaluation of human work

    John R Wilson and Sarah Sharples. 2015.Evaluation of human work. CRC press

    2015

  39. [47]

    Feng Wu, Lei Cui, Shaowen Yao, and Shui Yu. 2024. Inference attacks in machine learning as a service: A taxonomy, review, and promising directions.arXiv preprint arXiv:2406.02027(2024)

    2024 arXiv

  40. [48]

    Hu Xu, Gargi Ghosh, Po-Yao Huang, Prahal Arora, Masoumeh Aminzadeh, Christoph Feichtenhofer, Florian Metze, and Luke Zettlemoyer. 2021. Vlm: Task- agnostic video-language model pre-training for video understanding.arXiv preprint arXiv:2105.09996(2021)

    2021 arXiv

  41. [49]

    Shen Yan, Di Huang, and Mohammad Soleymani. 2020. Mitigating biases in mul- timodal personality assessment.Proceedings of the 2020 International Conference on Multimodal Interaction(2020), 361–369

    2020

  42. [50]

    Hong-Bao Ye, Hsiang-Yang Weng, and Hewijin Christine Jiau. 2020. Exploiting third-party sdk sensitive data leakage. In2020 International Computer Symposium (ICS). IEEE, 485–490

    2020

  43. [51]

    Duzhen Zhang, Yahan Yu, Jiahua Dong, Chenxing Li, Dan Su, Chenhui Chu, and Dong Yu. 2024. MM-LLMs: Recent advances in multimodal large language models.Findings of ACL(2024)

    2024

  44. [52]

    Wanrong Zhang, Olga Ohrimenko, and Rachel Cummings. 2022. Attribute pri- vacy: Framework and mechanisms. InProceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency. 757–766

    2022

  45. [53]

    Weifeng Zhang, Jing Yu, Wenhong Zhao, and Chuan Ran. 2021. DMRFNet: deep multimodal reasoning and fusion for visual question answering and explanation generation.Information Fusion72 (2021), 70–79

    2021

  46. [54]

    Benjamin Zi Hao Zhao, Aviral Agrawal, Catisha Coburn, Hassan Jameel Asghar, Raghav Bhaskar, Mohamed Ali Kaafar, Darren Webb, and Peter Dickinson. 2021. On the (in) feasibility of attribute inference attacks on machine learning models. In2021 IEEE European Symposium on Security...

    2021

  47. [55]

    Luyin Zhao and Sebastian Elbaum. 2003. Quality assurance under the open source development model.Journal of Systems and Software66, 1 (2003), 65–75

    2003

  48. [56]

    Tianyi Zhao, Liangliang Zhang, Yao Ma, and Lu Cheng. 2024. A survey on safe multi-modal learning systems.In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining(2024), 6655–6665

    2024

  49. [57]

    Yuanshi Zheng, Jingying Ma, and Long Wang. 2017. Consensus of hybrid multi- agent systems.IEEE transactions on neural networks and learning systems29, 4 (2017), 1359–1365

    2017

  50. [58]

    Chaoshun Zuo, Zhiqiang Lin, and Yinqian Zhang. 2019. Why does your data leak? uncovering the data leakage in cloud from mobile apps. In2019 IEEE Symposium on Security and Privacy (SP). IEEE, 1296–1310

    2019

  51. [2013]

    Associations of gender and age groups on the knowledge and use of drug information resources by American pharmacists.Pharmacy practice11, 2 (2013), 71

    2013

  52. [2020]

    https://doi.org/10.1016/j.chb.2020.106260

    Privacy concerns and benefits of engagement with social media-enabled apps: A privacy calculus perspective.Computers in Human Behavior107 (2020), 106260. https://doi.org/10.1016/j.chb.2020.106260

    2020

  53. [2025]

    Safety in Large Reasoning Models: A Survey.arXiv preprint arXiv:2504.17704 (2025)

    2025 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.