Retrieval-Confused Generation is a Good Defender for Privacy Violation Attack of Large Language Models

Hang Fu; Juan Wen; Wanli Peng; Xin Chen; Xinyu He; Xue Yiming

REVIEW 5 major objections 4 minor 32 references

Retrieval-Confused Generation is a Good Defender for Privacy Violation Attack of Large Language Models

T0 review · 5 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a provider-side retrieval-confused generation defense, which replaces the user text in a query with the most dissimilar decoy from a paraphrased database, lowers privacy-violation attack success on eight LLMs while…

desk verdict Clever retrieval-based defense with strong reported numbers, but the evaluation assumes a perfect PVA detector and the metric formula is inverted—needs revision before I'd trust the gains. read the letter →

arxiv 2506.19889 v1 pith:FWWBM4VS submitted 2025-06-24 cs.CR cs.AI

Wanli Peng , Xin Chen , Hang Fu , XinYu He , Xue Yiming , Juan Wen This is my paper

classification cs.CRcs.AI

keywords Retrieval-ConfusedGenerationPrivacyViolationAttackLargeLanguageModelsattributeinferenceadversarialdefenseretrieval-augmentedpromptengineeringtextanonymization

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a provider of a large language model can quietly blunt privacy violation attacks by swapping the user's genuine text in an incoming query for deliberately irrelevant decoy text. The defense, called RCG-Defender, builds a 'disturbed database' by asking an LLM to rewrite privacy-revealing comments into fluent but unrelated ones, then retrieves the entry least similar to the query's user comments and substitutes it before the model answers. The authors report that this lowers the average attack success rate well below three existing anonymization defenses on two datasets and eight LLMs, while adding only one retrieval operation and one inference per query. If true, attribute-inference attacks could be slowed without rejecting queries or revealing that a defense exists, so attackers cannot easily adapt.

What carries the argument

The load-bearing mechanism is retrieval-confused generation (RCG), an inversion of retrieval-augmented generation: instead of retrieving the most relevant supporting text, RCG retrieves the most irrelevant text. It has three moving parts: a paraphrasing prompt that induces an LLM to rewrite privacy-related content into fluent but independent values; a disturbed database built by applying that prompt to genuine user comments; and a 'most irrelevant retrieval' step that computes embedding distances with an off-the-shelf model and picks the database entry with the largest $L_2$ distance from the query's user comments. Replacing the comments in the attack query with that decoy is what turns a correct inference into a wrong one, while keeping the query fluent enough that the defending LLM produces a confident, plausible answer.

What would settle it

An adaptive adversary who knows the disturbed database and replaces each query's user comments with the most similar decoy rather than the most irrelevant one would settle whether the retrieval direction is load-bearing: if attack success returns to the no-defense level, the defense is broken once its database is exposed, and if it stays low, the protective effect comes from the paraphrasing itself.

Watch

Extended reading notes

Core claim

The paper's central claim is that a provider-side defense can make privacy violation attacks fail by feeding the attacking model deliberately mismatched user data. RCG-Defender first builds a 'disturbed database' by prompting an LLM to rewrite the privacy-revealing parts of genuine user comments into plausible but unrelated content. When an attack query arrives, the defender embeds the query's 'user comments' and each database entry, selects the entry with the largest semantic distance, and substitutes it for the original text; the LLM then answers with wrong attributes. Across the synthPAI and RJUA-QA datasets and eight LLMs, the paper reports the lowest average attack success rate among the tested defenses, for example dropping from 0.749 with no defense to 0.316 on synthPAI and from 0.637 to 0.233 on RJUA-QA, while keeping per-query cost to one retrieval plus one inference. Because the model still answers plausibly, the paper argues the defense is covert: an adversary who notices the wrong attributes is likely to attribute them to hallucination.

Load-bearing premise

The defense only works if the provider can reliably recognize which incoming prompts are privacy-violation attacks and separate each prompt's 'user comments' from its instructions; the paper states this in Section 3.1 as an assumption and provides no detector or evaluation of that step.

Editorial extensions

If this is right

Providers can deploy the defense at scale because each attack query costs one embedding comparison and one LLM inference, not iterative rewriting.
Because the model answers with plausible wrong attributes rather than refusing, an adversary who notices odd answers has a natural alternative explanation (model hallucination), which preserves the defense's covertness.
The defense is portable across open and closed models and across languages: the paper demonstrates it on eight models and on both an English and a Chinese dataset.
The disturbed database also shields the original user comments from exposure during retrieval, since the stored decoys are paraphrased rather than verbatim private texts.
Under the paper's threat model, normal queries bypass the defense untouched, so ordinary generation quality is supposed to be unaffected.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper's own threat model assumes the provider can reliably detect which incoming prompts are privacy-violation attacks and separate each prompt's 'user comments' from its instructions; a practical deployment would need a separate detector, and an adversary who paraphrases the query so it is not flagged would bypass the defense entirely.
If attackers suspect the decoy database, the 'most irrelevant' rule becomes a liability: choosing instead the most similar database entry turns the mechanism into a standard retrieval that leaks the decoy's attributes, so the defense's survival depends on keeping the database secret.
The same recipe could be adapted to other inference tasks, such as medical history, financial status, or code authorship, by building the disturbed database with target-specific paraphrasing prompts rather than generic privacy rewriting.
A testable extension is per-attribute decoy generation: instead of one globally least-similar comment, pick the decoy that is least informative about the specific attribute the query targets, which the paper's per-attribute results suggest could help on attributes that remain above 80 percent attack success.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Punchline: the retrieval-swap idea is genuinely novel and the reported ASR drops are large, but the evaluation leans on an untested assumption that the defender can identify and parse PVA queries. The paper is worth refereeing, but it needs an end-to-end test and a clean-up of the metric formula.

What's new: RCG-Defender is not another anonymizer. It builds a 'disturbed database' by paraphrasing user comments, then for an incoming attack query it retrieves the most irrelevant entry and swaps it into the query, so the LLM confidently produces a wrong attribute. That is a different mechanism from the iterative anonymization of Staab et al. or IncogniText, and the efficiency argument is real: one retrieval and one LLM call, no iteration. Testing across eight LLMs and two datasets is more coverage than most defense papers in this space, and the comparison set is appropriate.

Soft spots, in rough order of severity. The threat model in Section 3.1 assumes the defender can distinguish PVA queries from normal ones and can separate the user-comments span from the rest of the prompt. No detector, segmenter, or end-to-end evaluation is provided. That means all the numbers in Table 1 are conditional on an oracle that performs these two steps perfectly. In deployment, a missed detection means the defense never triggers, and a parse error means the wrong span gets replaced. This is the load-bearing gap.

The inverted ASR formula in Eq. 1 (N_total/N_attack) is likely a typo, but a referee will trip over it. There are no error bars or variance estimates despite 'average values for three cross-validations.' The RUJA-QA filtering—keeping only samples where the attack succeeds—should be justified more carefully, as it narrows the evaluation to a subset where the attack already works. The covertness claim (adversary mistakes the wrong answer for hallucination) is plausible but untested. The embedding-model ablation shows sensitivity, which is honest, but it also suggests the method's behavior is prompt- and model-dependent.

The citation pattern looks fine: the PVA and anonymization literature is properly credited, and the related work section is accurate.

Who this is for: anyone working on privacy defenses for LLMs. It is not a finished product, but it is a promising direction with a clear failure mode that could be addressed by a lightweight detector baseline. I would send it to review, with major-revision expectations.

Referee Report

5 major / 4 minor

Summary. The paper proposes RCG-Defender, a provider-side defense against privacy violation attacks (PVA) on large language models. The method has two stages: first, an LLM paraphrases user comments with a designed prompt to build a 'disturbed database'; second, for each PVA query, the most semantically irrelevant comment is retrieved from that database and substituted for the original 'user comments' span, so that the victim LLM infers wrong personal attributes. The authors evaluate on synthPAI and RJUA-QA across eight LLMs, comparing against Azure, LLM-ANO, and IncogniText, and report lower average attack success rates and lower per-query time cost. Ablation studies examine the disturbed database, the retrieval strategy, and the embedding model.

Significance. If the results hold in deployment, RCG-Defender would be the first provider-side, retrieval-based PVA defense, offering a qualitatively different trade-off from client-side iterative anonymization: near-constant per-query cost and a response that does not reveal that a defense is active. The paper's strengths are its breadth of evaluation (eight LLMs, two datasets, three baselines), its honest ablation reporting (including cases where the defense hurts, e.g., the M7 row in Table 1 and the EDU/REL attributes in Figure 7), and the clarity of the core retrieval idea. The main limitations are that the defense is evaluated only under an untested oracle for PVA detection and comment-span separation, the central ASR formula is written inverted, no variance or significance information is reported, and the covertness claim is asserted rather than measured. These issues do not invalidate the core retrieval mechanism, but they substantially narrow what the current experiments demonstrate.

major comments (5)

[Section 3.1] The reported defense results are conditional on an untested oracle. Section 3.1 assumes the defender 'distinguishes the PVA queries' and 'can separate the user comments part of the attack query', but no detector, segmenter, or end-to-end evaluation is provided. In a provider-side deployment, the defense is triggered only after this step, and if detection or parsing fails, the attack proceeds unmitigated. The ASR reductions in Table 1 and Figure 4 therefore measure the retrieval module under perfect preprocessing, not the complete RCG-Defender system. The central claim that RCG-Defender is 'a good defender' should either be rephrased as conditional on these assumptions or supported by an evaluation with a realistic PVA-query classifier and span extractor.
[Equation (1), Table 1] Equation (1) defines ASR as N_total / N_attack, which is inverted; the correct definition is N_attack / N_total. The reported numerical values are consistent with the corrected ratio, so this appears to be a typo, but the central metric definition must be fixed. In addition, Table 1 reports only point estimates with no standard deviations despite the text saying the results are averages over three cross-validations. The per-LLM RJUA-QA results also show non-uniform behavior: RCG-Defender's ASR on M7 (0.4184) is much worse than IncogniText's (0.2164), so the 'lowest average ASR' claim hides substantial variability. Reporting per-fold results and a significance test (e.g., paired bootstrap or Wilcoxon) is necessary to support the superiority claim.
[Sections 1 and 3.3] The covertness claim is never tested. The paper repeatedly argues that RCG-Defender conceals its existence because adversaries will attribute wrong answers to model hallucination, and this is a stated advantage over rejection-based defenses. However, no experiment measures whether an adversary can detect that the user comments were replaced by a retrieval mechanism. The claim is falsifiable and central to the proposed defense paradigm, so it needs at least a simple adversary study (e.g., an LLM judge or human annotators deciding whether responses indicate a defense, hallucination, or a weak model) or a precise threat-model argument explaining why such detection is impossible.
[Section 4.1] The RJUA-QA setup includes a post hoc filtering step that could bias the results. The text says the authors 'filtered 195 question-answer pairs to ensure the LLMs can perform the PVA properly', but it does not state how many samples remained, what the filtering criterion was, or whether the filtering was done before or after selecting the 300 samples for the disturbed database. If samples were removed because the attack already failed, the remaining set may be unusually easy or unusually hard, which would affect the comparability of the ASR numbers across defenses. The paper should report the filtering rule, the final sample counts, and ideally results on the unfiltered set as a robustness check.
[Figure 5 and Section 4.3] The time-efficiency claim is internally inconsistent. The text states that RCG-Defender's results are 'under 10 seconds' for 100 attack queries, but Figure 5's axis is labeled 'Time (minutes)' and the plotted values range up to 80. It is also unclear whether the reported cost includes the one-time construction of the disturbed database and the per-query embedding/retrieval, or only the LLM inference on the defended query. Clarify the units and the exact cost breakdown, including the paraphrasing stage, so that the efficiency comparison with LLM-ANO and IncogniText is reproducible.

minor comments (4)

[Throughout] There are many typos and inconsistent names: 'paragraphing prompt' for 'paraphrasing prompt', 'Mistaral' and 'Mixtrel' for Mistral/Mixtral, 'StmthPAI' for SynthPAI, 'RUJA-QA' for RJUA-QA, 'Azruemethod' for Azure method, 'GCR-Defender' for RCG-Defender, and 'distrubed' for 'disturbed'. These should be corrected in a thorough pass.
[Section 4.4] The retrieval-strategy ablation is said to be shown in 'Table 7', but the corresponding item is Figure 7; the reference should be fixed. The same section uses 'beg-large' and 'bge-large' inconsistently for the same embedding model.
[Section 4.2] The evaluation protocol for baselines should be stated more precisely: the text says the three anonymization methods 'modify the PVA queries' and then the attack is run on the modified queries, but it is not clear whether Azure and IncogniText were given the same prompt structure and whether their outputs were parsed with the same 'user comments' extraction as RCG-Defender.
[Section 5] The conclusion says the method 'makes the LLMs generate some wrong personal attributes', but the paper does not verify that the replaced comments actually lead to wrong attributes with high probability on all tested LLMs; the ASR metric only measures aggregate success, so a sentence acknowledging the per-attribute variation (e.g., SEX remaining over 80% in Figure 4) would be more accurate.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: RCG-Defender is an empirical retrieval heuristic evaluated against external PVA benchmarks; the only concerns are an untested deployment oracle and a same-LLM evaluation confound, not definitional reduction.

full rationale

The derivation chain is self-contained and empirical. The defense pipeline (Section 3.2, Algorithm 1) consists of a manually authored paraphrasing prompt, off-the-shelf embedding models, and an L2-distance-based 'most irrelevant' retrieval from a held-out database; no parameter is fitted to the attack success rate, and no 'prediction' is computed from the same data used to choose the method. The success metric ASR is defined by Eq. (1) from the external PVA formulation of Staab et al. [18], and the datasets (synthPAI [28], RJUA-QA [10]) are external; the database-building comments and the attack-query comments are disjoint by user/sample. The only notable limitations are not circularity: Section 3.1 explicitly assumes the defender 'distinguishes the PV A queries' and 'can separate the "user comments" part of the attack query', which is an untested oracle for deployment, and GPT-3.5 and GLM4-plus both build the disturbed databases and serve as victim models in Table 1, which is an evaluation confound for those rows. Neither limitation makes any equation or output equal to its input by construction, and no load-bearing self-citation occurs; the paper's central comparison is against external baselines on external data.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The method rests on several unverified premises beyond the central empirical result: the defender can isolate attack queries and their user-comment text, the paraphrasing model hides attribute cues, the embedding distance picks comments that produce wrong inferences, and the victim model responds naturally to the substituted text. These are domain assumptions, not derived results.

free parameters (4)

Paraphrasing prompt design = "Replace the information related to personal privacy in the comments with random values unrelated to the original…
Hand-crafted prompt shown in Figure 3; no prompt search or sensitivity analysis is reported, and it directly determines the quality of the disturbed database.
Embedding model = bge-large-en-v1.5
Selected as the default from three candidates based on ablation; no single model is best for all LLMs, so the choice is a hand-tuned design decision.
Disturbed database size (SynthPAI) = 100 synthetic users
Chosen by hand for database construction; no sensitivity analysis on this size is given.
Disturbed database size (RJUA-QA) = 300 samples (195 after filtering)
Chosen by hand; the additional filtering of 195 samples for 'proper PVA' is a post-hoc selection.

assumptions (5)

domain assumption The defender can identify PVA queries and separate the 'user comments' part of the query.
Section 3.1 states this as an explicit assumption; the method is only triggered on detected PVA queries and only modifies the separated comment text.
domain assumption LLM paraphrasing removes or hides private-attribute cues while keeping text fluent.
Section 3.2 and Figure 3 assume the paraphrasing prompt 'covers' attribute-revealing content; only one case study is shown, no systematic check.
domain assumption The most irrelevant comment in embedding L2 space is the best substitute for inducing wrong attribute inference.
Section 3.2 uses L2 distance on bge-large embeddings to pick the farthest comment; the paper does not justify why farthest correlates with wrong inference.
domain assumption The victim LLM will answer based on the substituted comments and not detect the replacement.
The defense's effectiveness and covertness both depend on the LLM treating the defended query as normal; no experiment tests this.
standard math L2 distance is an appropriate metric for semantic (ir)relevance of text embeddings.
Standard practice in embedding retrieval; not the main risk.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Retrieval-Confused Generation is a Good Defender for Privacy Violation Attack of Large Language Models." pith.science (2026). https://pith.science/paper/FWWBM4VS

@misc{pith2026250619889,
  author       = {Pith},
  title        = {Pith review of: Retrieval-Confused Generation is a Good Defender for Privacy Violation Attack of Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FWWBM4VS}},
  note         = {Machine review of arXiv:2506.19889}
}

read the original abstract

Recent advances in large language models (LLMs) have made a profound impact on our society and also raised new security concerns. Particularly, due to the remarkable inference ability of LLMs, the privacy violation attack (PVA), revealed by Staab et al., introduces serious personal privacy issues. Existing defense methods mainly leverage LLMs to anonymize the input query, which requires costly inference time and cannot gain satisfactory defense performance. Moreover, directly rejecting the PVA query seems like an effective defense method, while the defense method is exposed, promoting the evolution of PVA. In this paper, we propose a novel defense paradigm based on retrieval-confused generation (RCG) of LLMs, which can efficiently and covertly defend the PVA. We first design a paraphrasing prompt to induce the LLM to rewrite the "user comments" of the attack query to construct a disturbed database. Then, we propose the most irrelevant retrieval strategy to retrieve the desired user data from the disturbed database. Finally, the "data comments" are replaced with the retrieved user data to form a defended query, leading to responding to the adversary with some wrong personal attributes, i.e., the attack fails. Extensive experiments are conducted on two datasets and eight popular LLMs to comprehensively evaluate the feasibility and the superiority of the proposed defense method.

Figures

Figures reproduced from arXiv: 2506.19889 by the authors.

**Figure 2.** The framework of the proposed RCG-Defender. It is composed of two stages: disturbed database construction and confused [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Case study of the sentence paraphrasing using the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: The average attack success rate (ASR) of eight LLMs for different attributes in SynthPAI and RJUA-QA. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 5.** Figure 5: The time cost of the RCG-Denfender and LLM-ANO [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 6.** Figure 6: The ablation experimental results for the disturbed [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

32 extracted references · 12 canonical work pages

[1]

Aahill. 2023. What is azure ailanguage azureaiservices. (2023)

work page 2023
[2]

Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, et al. 2023. Qwen technical report.arXiv preprint arXiv:2309.16609(2023)

arXiv 2023
[3]

Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2024. Security and privacy challenges of large language models: A survey.Comput. Surveys(2024)

work page 2024
[4]

Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Jingyuan Ma, Rui Li, Heming Xia, Jingjing Xu, Zhiyong Wu, Baobao Chang, et al . 2024. A survey on in-context learning. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 1107–1128

work page 2024
[5]

Wenqi Fan, Yujuan Ding, Liangbo Ning, Shijie Wang, Hengyun Li, Dawei Yin, Tat-Seng Chua, and Qing Li. 2024. A survey on rag meeting llms: Towards retrieval-augmented large language models. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 6491–6501

2024
[6]

Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka, Ricardo Mendes, Xue Jiang, and Xuebing Zhou. 2024. IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization. InNeurips Safe Generative AI Workshop

work page 2024
[7]

Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, et al . 2024. A survey on hallucination in large language models: Principles, taxonomy, chal- lenges, and open questions.ACM Transactions on Information Systems(2024)

work page 2024
[8]

Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Processing Systems33 (2020), 9459–9474

2020

Show all 32 references

[9]

Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Cheng- gang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. 2024. Deepseek-v3 technical report.arXiv preprint arXiv:2412.19437(2024)

2024 arXiv
[10]

Shiwei Lyu, Chenfei Chi, Hongbo Cai, Lei Shi, Xiaoyan Yang, Lei Liu, Xiang Chen, Deng Zhao, Zhiqiang Zhang, Xianguo Lyu, et al . 2023. RJUA-QA: A Comprehensive QA Dataset for Urology.arXiv preprint arXiv:2312.09785(2023)

2023 arXiv
[11]

2010.Guide to protecting the confidentiality of personally identifiable information

Erika McCallister. 2010.Guide to protecting the confidentiality of personally identifiable information. Diane Publishing

2010
[12]

Ori Ram, Yoav Levine, Itay Dalmedigos, Dor Muhlgay, Amnon Shashua, Kevin Leyton-Brown, and Yoav Shoham. 2023. In-context retrieval-augmented language Conference acronym ’XX, June 03–05, 2018, Woodstock, NY T rovato et al. Table 2: The ablation experimental results for the embe...

2023
[13]

Pranab Sahoo, Ayush Kumar Singh, Sriparna Saha, Vinija Jain, Samrat Mondal, and Aman Chadha. 2024. A systematic survey of prompt engineering in large language models: Techniques and applications.arXiv preprint arXiv:2402.07927 (2024)

2024 arXiv
[14]

do anything now

Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. 1671–1685

2024
[15]

Kaize Shi, Xueyao Sun, Qing Li, and Guandong Xu. 2024. Compressing Long Context for Enhancing RAG with AMR-based Concept Distillation.arXiv preprint arXiv:2405.03085(2024)

2024 arXiv
[16]

Kurt Shuster, Spencer Poff, Moya Chen, Douwe Kiela, and Jason Weston. 2021. Retrieval Augmentation Reduces Hallucination in Conversation. InFindings of the Association for Computational Linguistics: EMNLP 2021. 3784–3803

2021
[17]

Zayne Sprague, Fangcong Yin, Juan Diego Rodriguez, Dongwei Jiang, Manya Wadhwa, Prasann Singhal, Xinyu Zhao, Xi Ye, Kyle Mahowald, and Greg Durrett
[18]

Robin Staab, Mark Vero, Mislav Balunovic, and Martin Vechev. 2024. Beyond Memorization: Violating Privacy via Inference with Large Language Models. In The Twelfth International Conference on Learning Representations

2024
[19]

Robin Staab, Mark Vero, Mislav Balunovi ´c, and Martin Vechev. 2024. Large language models are advanced anonymizers.arXiv preprint arXiv:2402.13846 (2024)

2024 arXiv
[20]

Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. 2023. Llama: Open and efficient foundation language models.arXiv preprint arXiv:2302.13971(2023)

2023 arXiv
[21]

Harsh Trivedi, Niranjan Balasubramanian, Tushar Khot, and Ashish Sabharwal
[22]

Tianduo Wang, Shichen Li, and Wei Lu. 2024. Self-Training with Direct Prefer- ence Optimization Improves Chain-of-Thought Reasoning. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 11917–11928

2024
[23]

Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems35 (2022), 24824–24837

2022
[24]

Junda Wu, Cheng-Chun Chang, Tong Yu, Zhankui He, Jianing Wang, Yupeng Hou, and Julian McAuley. 2024. Coral: Collaborative retrieval-augmented large language models improve long-tail recommendation. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data...

2024
[25]

Jiacheng Ye, Zhiyong Wu, Jiangtao Feng, Tao Yu, and Lingpeng Kong. 2023. Compositional exemplars for in-context learning. InInternational Conference on Machine Learning. PMLR, 39818–39833

2023
[26]

Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. 2024. Jailbreak attacks and defenses against large language models: A survey.arXiv preprint arXiv:2407.04295(2024)

2024 arXiv
[27]

Wenhao Yu, Zhihan Zhang, Zhenwen Liang, Meng Jiang, and Ashish Sabharwal
[28]

Hanna Yukhymenko, Robin Staab, Mark Vero, and Martin Vechev. 2024. A synthetic dataset for personal attribute inference.Advances in Neural Information Processing Systems37 (2024), 120735–120779

2024
[29]

Yuchen Zhuang, Yue Yu, Kuan Wang, Haotian Sun, and Chao Zhang. 2023. Toolqa: A dataset for llm question answering with external tools.Advances in Neural Information Processing Systems36 (2023), 50117–50143

2023
[30]

Improving language models via plug-and-play retrieval feedback.arXiv preprint arXiv:2305.14002(2023)

2023 arXiv
[2023]

InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)

Interleaving Retrieval with Chain-of-Thought Reasoning for Knowledge- Intensive Multi-Step Questions. InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 10014– 10037
[2024]

To cot or not to cot? chain-of-thought helps mainly on math and symbolic reasoning.arXiv preprint arXiv:2409.12183(2024)

2024 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Aahill. 2023. What is azure ailanguage azureaiservices. (2023)

work page 2023

[2] [2]

Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, et al. 2023. Qwen technical report.arXiv preprint arXiv:2309.16609(2023)

arXiv 2023

[3] [3]

Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2024. Security and privacy challenges of large language models: A survey.Comput. Surveys(2024)

work page 2024

[4] [4]

Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Jingyuan Ma, Rui Li, Heming Xia, Jingjing Xu, Zhiyong Wu, Baobao Chang, et al . 2024. A survey on in-context learning. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 1107–1128

work page 2024

[5] [5]

Wenqi Fan, Yujuan Ding, Liangbo Ning, Shijie Wang, Hengyun Li, Dawei Yin, Tat-Seng Chua, and Qing Li. 2024. A survey on rag meeting llms: Towards retrieval-augmented large language models. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 6491–6501

2024

[6] [6]

Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka, Ricardo Mendes, Xue Jiang, and Xuebing Zhou. 2024. IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization. InNeurips Safe Generative AI Workshop

work page 2024

[7] [7]

Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, et al . 2024. A survey on hallucination in large language models: Principles, taxonomy, chal- lenges, and open questions.ACM Transactions on Information Systems(2024)

work page 2024

[8] [8]

Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Processing Systems33 (2020), 9459–9474

2020