Pith. sign in

REVIEW 4 major objections 6 minor 2 cited by

Generalizing Trust: Weak-to-Strong Trustworthiness in Language Models

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that fairness and robustness can transfer from a smaller to a larger language model during weak-to-strong fine-tuning, but only when both models are trained with trustworthiness regularization, and that privacy does not…

desk verdict The paper's headline 'transfer' claim is confounded: fairness and robustness only improve when the strong model is itself regularized (Eqs. 7–9), and their own Weak TFT rows show no transfer from the weak model alone. read the letter →

arxiv 2501.00418 v1 pith:326EREQX submitted 2024-12-31 cs.LG cs.AI

Martin Pawelczyk , Lillian Sun , Zhenting Qi , Aounon Kumar , Himabindu Lakkaraju This is my paper · ORCID
classification cs.LGcs.AI
keywords weak-to-stronggeneralizationtrustworthinessfairnessdemographicparityadversarialrobustnessout-of-distributionprivacyregularization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether trustworthiness properties—fairness, robustness to out-of-distribution and adversarial inputs, and privacy—can move from a small 'weak' language model to a larger 'strong' model that is fine-tuned on the weak model's outputs. It introduces two training strategies: regularizing only the weak model (Weak Trustworthiness Finetuning) and regularizing both weak and strong models during transfer (Weak and Weak-to-Strong Trustworthiness Finetuning). The central finding is that fairness, OOD robustness, and adversarial robustness transfer and are even amplified only when both models are regularized, while privacy does not transfer because larger models memorize more and privacy is measured against the strong model's own training data. If correct, this provides a recipe for building trustworthy larger models through fine-tuning alone, at a task-performance cost of at most about 1.5 percent.

What carries the argument

The load-bearing mechanism is the weak-to-strong training loss (Eq. 1): a convex combination of cross-entropy against the weak model's labels and an auxiliary confidence loss against the strong model's own hardened predictions, weighted by alpha. Around this, the paper wraps trustworthiness regularizers—a covariance penalty for demographic parity, adversarial and Gaussian-embedding-noise training for robustness, and DP-SGD for privacy—and applies them either to the weak model only (Weak TFT) or to both the weak model and the weak-to-strong model (Weak+WTS TFT, Eqs. 7–9). The paper defines a weak-to-strong trustworthiness trend as the pattern in which the WTS-Naive and WTS-Aux-Loss models are more trustworthy than the weak model and the strong ceiling is more trustworthy than both. The comparison of the three strategies is what carries the argument: the difference between Weak TFT and Weak+WTS TFT isolates the contribution of regularizing the strong model during transfer.

What would settle it

Train the strong model under the Weak+WTS TFT protocol but replace the trustworthy weak labels with labels from an untrustworthy weak model, keeping the strong-stage regularizer and hyperparameters fixed; if fairness and adversarial robustness improve to the same level as in the paper, the transfer claim is falsified because the regularizer alone would explain the improvement.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that weak-to-strong trustworthiness is conditional on where regularization is applied. Using Pythia 14M as the weak model and Pythia 410M as the strong model, the paper finds that with no regularization only robustness shows an incidental weak-to-strong trend; regularizing the weak model alone (Weak TFT) improves the weak model but does not make fairness or adversarial robustness transfer; and regularizing both models (Weak+WTS TFT) produces consistent weak-to-strong trends for fairness, OOD robustness, and adversarial robustness, with the auxiliary-loss model surpassing the naive-transfer model for fairness and adversarial robustness. Privacy is the exception: the regularized WTS model's extraction rate drops from 45 percent to 26 percent, but it remains above the weak model's 14 percent, so privacy does not show a weak-to-strong trend. The paper's summary table marks fairness, OOD robustness, and adversarial robustness as transferred under Weak+WTS TFT and privacy as not transferred under any strategy.

Load-bearing premise

The load-bearing premise is that when the strong model is itself regularized during weak-to-strong training, the resulting fairness and robustness count as inheritance from the weak model's labels rather than as direct effects of the regularizer applied to the strong model.

Editorial extensions

If this is right

  • Fairness, OOD robustness, and adversarial robustness can be scaled to larger models by adding trustworthiness regularization to both the weak teacher and the strong student during weak-to-strong fine-tuning, with no need to alter the strong model's pretrained internals beyond fine-tuning.
  • The transfer trend is not tied to one model pairing: fairness and OOD robustness trends hold for 14M and 70M weak models paired with 410M, 1B, and 6.9B strong models, though adversarial robustness transfer breaks down when the weak model is 70M.
  • The trustworthiness gains cost little in task performance: fairness and adversarial robustness improvements, including up to a 60 percent reduction in unfairness, come with accuracy losses no greater than about 1.5 percent.
  • Privacy should not be expected to transfer through weak-to-strong supervision: even with both models regularized, the larger model's extraction rate remains above the weak model's because larger models memorize more and privacy is evaluated on the strong model's own training data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the Weak+WTS TFT results cannot by themselves separate trustworthiness inherited from the weak model from trustworthiness produced by the regularizer applied directly to the strong model; the decisive control is to train the strong model with the same regularizer on labels from an untrustworthy weak model and check whether fairness and robustness improve just as much.
  • Editorial inference: the privacy result suggests a general boundary condition—trustworthiness properties tied to model capacity, such as memorization, may resist weak-to-strong transfer, while properties tied to decision boundaries, such as fairness and robustness, are more amenable.
  • Editorial inference: the breakdown of adversarial robustness transfer with a 70M weak model hints that weak-to-strong trustworthiness may depend on a sufficient capability gap between teacher and student, which is testable by varying the weak/strong size ratio across more checkpoints.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper studies whether trustworthiness properties (fairness, robustness, privacy) can transfer from a small 'weak' language model to a larger 'strong' model under weak-to-strong supervision, i.e., when the strong model is fine-tuned on labels produced by the weak model. It introduces two training strategies: Weak TFT (trustworthiness regularization applied only to the weak model) and Weak+WTS TFT (regularization applied to both weak and strong models). Experiments on Pythia models (14M/70M weak, 410M/1B/6.9B strong) using Adult, OOD Style Transfer, AdvGLUE++, and Enron datasets show that in the Weak+WTS TFT condition, fairness, OOD robustness, and adversarial robustness appear to improve monotonically from the weak model through the weak-to-strong models to the strong ceiling, while privacy does not. The paper interprets these results as evidence that strong models can 'retain and amplify' trustworthiness inherited from regularized weak models.

Significance. If the inheritance claim were established, the paper would open a practical pathway for scaling trustworthiness to large models without full re-training, which is a timely and potentially impactful contribution. The paper is commendable for covering multiple trustworthiness properties, several model sizes, and sensitivity analyses over regularization strengths and auxiliary loss weights, and for including additional metrics such as Equalized Odds and membership inference. However, the central inheritance claim is not currently supported by the experimental design, because the positive results occur precisely in the condition where the strong model is itself regularized with the same trustworthiness objectives. The paper's own Weak TFT results (Table 1) show no weak-to-strong trend for fairness or adversarial robustness when only the weak model is regularized, so the central claim hinges on a confounded comparison. The privacy conclusion is additionally undermined by an inconsistent evaluation protocol across models.

major comments (4)
  1. [Appendix A.1, Eqs. (7)–(9); Section 3.2] The Weak+WTS TFT training objective applies the trustworthiness regularizer directly to the strong model parameters, not merely to the weak labels. For fairness (Eq. 7), the strong model's loss contains λ^WTS_Fair · (a_i − ā) · f_θ(x_i); for OOD robustness (Eq. 8), the strong model is trained on its own noise-perturbed embeddings; for adversarial robustness (Eq. 9), the strong model is trained on adversarial examples with weight λ^WTS_Adv. Consequently, the observed improvements in fairness, OOD robustness, and adversarial robustness in the Weak+WTS TFT condition could be produced entirely by direct regularization of the strong model, with the weak model's trustworthiness playing no causal role. The paper's own Table 1 shows that in Weak TFT, where only the weak model is regularized, there is no weak-to-strong trend for fairness or adversarial robustness and only a small trend for OOD robustness. Therefore the central claim that strong models 'retain and amplify' trustworthiness properties inherited from the weak model is not supported. A disentangling experiment is needed, for example comparing (a) strong model regularized and trained on unregularized weak labels versus (b) strong model regularized and trained on regularized weak labels, or comparing both against direct regularization with ground-truth labels. Without such a comparison, the paper should re-scope its claim to 'joint regularization of weak and strong models improves trustworthiness' rather than inheritance.
  2. [Section 4.1] The operational definition of 'weak-to-strong trustworthiness' is purely a monotonicity requirement: WTS-Naive and WTS-Aux-Loss must be more trustworthy than the weak model, and the strong ceiling must be more trustworthy than both. This definition does not require that the strong model's trustworthiness is caused by the weak model's trustworthiness; the trend could hold even if the weak labels contribute nothing and only the strong model's own regularization matters. Indeed, the strong ceiling is trained with ground-truth labels plus regularization, so monotonicity can be satisfied by direct regularization alone. The definition should be tightened to distinguish inheritance from independent regularization, or the central claim should be revised accordingly.
  3. [Appendix C, Section 4.1 (Privacy)] The privacy evaluation is not a controlled comparison. As stated in Appendix C and Figure A12, the weak model and the strong ceiling are evaluated on their own training set D_W, while the WTS model is evaluated on D_WTS, a different training set used for the weak-to-strong stage. Extraction rates depend on the data distribution and the model's memorization of that specific set, so differences between models may reflect dataset differences rather than transfer of privacy properties. The paper acknowledges this in the 'Remarks on the WTS Privacy Trends' paragraph, but the acknowledgment does not resolve the issue: the conclusion that privacy does not exhibit weak-to-strong trustworthiness is not supported by the reported measurements. The authors should evaluate all models on the same held-out data, or otherwise adjust the privacy evaluation to make extraction rates comparable across models.
  4. [Section 4.1] The text states that in the Weak+WTS TFT phase 'we observe a statistically significant improvement of each property from weak models to WTS-Naive models,' but no statistical test is described and Table 1 reports only checkmarks rather than numerical values with confidence intervals or p-values. Given that the paper reports averages over runs, a significance test (e.g., paired bootstrap or t-test across runs) and specification of the number of runs are needed to support this claim, especially since some observed differences (e.g., a few percentage points in OOD accuracy) may be within run-to-run variance.
minor comments (6)
  1. [Eq. (1)] The notation ℓWTS-AUX(x, fθ; α, λ, fw) uses λ without subscripts that connect to the specific trustworthiness regularizer; the definition would be clearer if λ was replaced by the relevant property-specific hyperparameter (λFair, λOOD, λAdv) in each usage.
  2. [Eq. (3)] The text says 'The first term in equation 7 encourages the model to make correct predictions,' but Eq. (3) is the fairness objective; this cross-reference appears to be a typo and should refer to Eq. (3) itself.
  3. [Section 3.1] The symbol λ is used for both the trustworthiness regularization strength and the privacy loss parameter in Eq. (6); these are conceptually different quantities and should be distinguished notationally to avoid confusion.
  4. [Appendix A.1, Eq. (7)] There is a spelling error: 'regulrization strength' should be 'regularization strength.'
  5. [Figure 2 and Table 1] The caption for Figure 2 explains that WTS-Aux-Loss is omitted for privacy because the auxiliary loss is inapplicable to free data generation, but the main text does not describe this limitation when defining the privacy experiments; consider moving this explanation into Section 4.1 for clarity.
  6. [Appendix C.1] There is a typo: 'Equlaized Odds' should be 'Equalized Odds.'

Circularity Check

2 steps flagged · score 6.0 of 10

Weak+WTS TFT applies the trustworthiness regularizer directly to the strong model (Eqs. 7-9), so the headline fairness/robustness 'transfer' is partly enforced rather than inherited; Weak TFT alone shows no such transfer.

  1. self definitional [Appendix A.1, Eqs. (7)-(9); Section 3.2 'Weak+WTS TFT']
    "θ∗ ∈ arg minθ 1/N Σ ℓWTS-AUX(xi, fθ; α, λW_Fair, fw) + λWTS_Fair · (ai − ā) · fθ(xi) ... (1 − λWTS_Adv) ℓWTS-AUX(xi, fθ; α, λW_Adv, fw) + λWTS_Adv ℓWTS-AUX(x′i, fθ; α, λW_Adv, fw)"

    In the Weak+WTS TFT regime the trustworthiness regularizer is applied directly to the strong model's own parameters: the fairness term λWTS_Fair·(ai−ā)·fθ(xi), the OOD term fθ(xi; λWTS_OOD), and the adversarial term λWTS_Adv·ℓ(fθ(x′i), fθ). The measured 'weak-to-strong trustworthiness' of the WTS-Naive and WTS-Aux-Loss models is therefore partly the value of the very objective being optimized, not a property inherited from the weak model. The paper's own Weak TFT rows, where only the weak model is regularized, show no WTS trend for fairness or adversarial robustness, so the apparent transfer appears exactly when the strong model itself is regularized. This makes the central positive claim reduce by construction to direct regularization.

  2. other [Section 4.1, definition of weak-to-strong trustworthiness and Weak+WTS TFT results]
    "We define weak-to-strong trustworthiness as the trend of the WTS-Naive and WTS-Aux-Loss models being more trustworthy than the weak model, and the strong ceiling being more trustworthy than the WTS-Naive and WTS-Aux-Loss models. ... For fairness, OOD robustness, and adversarial robustness, we observe a statistically significant improvement of each property from weak models to WTS-Naive models."

    The operational definition of weak-to-strong trustworthiness is a monotonic trend in trustworthiness metrics across WTS models. In Weak+WTS TFT those WTS models are trained with the same trustworthiness metrics as loss terms, so the trend is enforced rather than observed as emergent inheritance. The definition therefore does not distinguish 'the strong model inherited trustworthiness from the weak labels' from 'the strong model was directly regularized to be trustworthy.' This conflation is load-bearing because the paper's headline claim of generalization rests on the Weak+WTS TFT rows.

full rationale

The paper's core derivation chain is not self-citation-based: the Burns et al. weak-to-strong framework, the Pythia model suite, and the trustworthiness regularization losses are all standard external tools, and no load-bearing claim rests on a uniqueness theorem or on prior work by the same authors. However, the central positive result — that fairness, adversarial robustness, and OOD robustness transfer to strong models — is partially circular. In the Weak+WTS TFT strategy, the strong model's loss contains the trustworthiness regularizer directly (Eq. 7 for fairness, Eq. 8 for OOD, Eq. 9 for adversarial robustness), so improvements in those properties can be caused by direct regularization of the target model, not by inheritance from weak labels. The paper's own Weak TFT condition, where only the weak model is regularized, shows no weak-to-strong trend for fairness or adversarial robustness and only a small OOD gain, confirming that the decisive improvements appear precisely when the strong model itself is regularized. The operational definition of weak-to-strong trustworthiness as a monotonic trend also does not separate these two mechanisms. Some parts of the evidence are independent: the No-TFT natural OOD and adversarial trends, the privacy negative result, and the model-size and lambda sensitivity analyses do not rest on the contested attribution. This partial, construction-level confounding in the headline regime warrants a score of 6; the absence of self-citation circularity and the presence of some independent trends prevent a higher score.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The conclusions rest on domain assumptions (demographic parity as fairness, Pythia sizes as weak/strong, adversarial and OOD regularizers as valid, extraction attack as privacy proxy) and on several hyperparameters chosen by validation. No new physical or mathematical entities are introduced.

free parameters (6)
  • lambda_Fair (weak and WTS) = not reported; selected from trade-off curves
    Controls fairness regularization in Eq. 3 and Eq. 7; the claimed fairness transfer depends on this value.
  • lambda_Adv = 0.3
    Selected in Appendix A.2 as the best clean/adversarial trade-off for weak and WTS models.
  • OOD Gaussian noise std (lambda_OOD) = 2e-3
    Set in Appendix A.2; determines OOD robustness transfer in Eq. 5 and Eq. 8.
  • Auxiliary loss weight alpha = 0.1 to 0.25 depending on task
    Weights the auxiliary confidence loss in Eq. 1; chosen via trade-off curves (max alpha 0.1 to 0.3).
  • DP-SGD noise variance (tau^2) = not reported
    Determines privacy guarantees for the weak model; the missing value hampers replication.
  • Warm-up period and number of epochs = 0.2 and 6 (adversarial); 1 epoch (OOD)
    Additional transfer-hyperparameters selected via trade-off curves (Appendix A.2).
assumptions (5)
  • domain assumption Demographic parity is the operative fairness criterion and the covariance regularizer (Eq. 3) enforces it.
    Fairness conclusions are specific to demographic parity; other fairness definitions could transfer differently.
  • domain assumption Smaller Pythia models are 'weaker' and larger Pythia models are 'stronger' for the tasks studied.
    The weak-to-strong framing depends on this ordering (Section 3.1).
  • domain assumption Adversarial training and Gaussian embedding noise are valid elicitors of adversarial and OOD robustness.
    These regularizers define the robustness properties being transferred; other robustness procedures might give different results.
  • domain assumption Extraction attack rate (Carlini et al.) is a valid measure of training-data privacy leakage.
    Privacy conclusions are based on this proxy (Section 4).
  • domain assumption Burns et al.'s auxiliary confidence loss remains applicable when combined with trustworthiness regularizers.
    The WTS loss (Eq. 1) and Appendix A.1 objectives inherit the auxiliary-loss design; no new justification is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Generalizing Trust: Weak-to-Strong Trustworthiness in Language Models." pith.science (2026). https://pith.science/paper/326EREQX

@misc{pith2026250100418,
  author       = {Pith},
  title        = {Pith review of: Generalizing Trust: Weak-to-Strong Trustworthiness in Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/326EREQX}},
  note         = {Machine review of arXiv:2501.00418}
}
read the original abstract

The rapid proliferation of generative AI, especially large language models, has led to their integration into a variety of applications. A key phenomenon known as weak-to-strong generalization - where a strong model trained on a weak model's outputs surpasses the weak model in task performance - has gained significant attention. Yet, whether critical trustworthiness properties such as robustness, fairness, and privacy can generalize similarly remains an open question. In this work, we study this question by examining if a stronger model can inherit trustworthiness properties when fine-tuned on a weaker model's outputs, a process we term weak-to-strong trustworthiness generalization. To address this, we introduce two foundational training strategies: 1) Weak Trustworthiness Finetuning (Weak TFT), which leverages trustworthiness regularization during the fine-tuning of the weak model, and 2) Weak and Weak-to-Strong Trustworthiness Finetuning (Weak+WTS TFT), which extends regularization to both weak and strong models. Our experimental evaluation on real-world datasets reveals that while some trustworthiness properties, such as fairness, adversarial, and OOD robustness, show significant improvement in transfer when both models were regularized, others like privacy do not exhibit signs of weak-to-strong trustworthiness. As the first study to explore trustworthiness generalization via weak-to-strong generalization, our work provides valuable insights into the potential and limitations of weak-to-strong generalization.

Figures

Figures reproduced from arXiv: 2501.00418 by the authors.

Figure 2
Figure 2. Weak-to-strong trustworthiness for Pythia 14M/410M models. Trustworthiness properties and task performance for our four properties: Fairness, OOD Robustness, Adversarial Robustness, and Privacy. Note that lower values are better for the top plot in Figure 2a as the y-axis is Unfairness (DPD). Similarly, lower values are better for the top plot in Figure 2d as the the y-axis is Extraction Rate. Results for WTS-Aux-Lo… view at source ↗
Figure 3
Figure 3. Varying Lambda for Weak+WTS TFT. Results for WTS-Aux-Loss for privacy are omitted since it was the only task involving free data generation, making the auxiliary loss function inapplicable. Fairness OOD Robustness Adv. Robustness Privacy No TFT × ✓ ✓ × Weak TFT × ✓ × × Weak+WTS TFT ✓ ✓ ✓ × [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. On Weak-to-Strong Generalization and f-Divergence

    cs.LG 2025-06 conditional novelty 6.0 of 10

    Replacing cross-entropy with f-divergence losses in weak-to-strong generalization gives modest accuracy gains and improved label-noise tolerance, though the paper's theoretical equivalence result is constructed after ...

  2. The Capabilities and Limitations of Weak-to-Strong Generalization: Generalization and Calibration

    cs.LG 2025-02 reject novelty 5.0 of 10

    The paper derives generalization and calibration bounds for weak-to-strong generalization and extends a known regression result from squared loss to KL divergence.

Reference graph

Works this paper leans on

44 extracted references · 19 canonical work pages · cited by 2 Pith papers

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016

    2016

  2. [2]

    Types of out-of-distribution texts and how to detect them

    Udit Arora, William Huang, and He He. Types of out-of-distribution texts and how to detect them. arXiv preprint arXiv:2109.06827, 2021. 9

    arXiv 2021

  3. [3]

    Pythia: A suite for analyzing large language models across training and scaling

    Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, et al. Pythia: A suite for analyzing large language models across training and scaling. In International Conference on Machine Learning (ICML), pages 2397–2430. PMLR, 2023

    work page 2023

  4. [4]

    Man is to computer programmer as woman is to homemaker? debiasing word embeddings

    Tolga Bolukbasi, Kai-Wei Chang, James Y Zou, Venkatesh Saligrama, and Adam T Kalai. Man is to computer programmer as woman is to homemaker? debiasing word embeddings. Advances in neural information processing systems, 29, 2016

    2016

  5. [5]

    Language models are realistic tabular data generators

    Vadim Borisov, Kathrin Seßler, Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. Language models are realistic tabular data generators. In International Conference on Learning Representations (ICLR), 2023

    work page 2023

  6. [6]

    Generating sentences from a continuous space

    Samuel R Bowman, Luke Vilnis, Oriol Vinyals, Andrew M Dai, Rafal Jozefowicz, and Samy Bengio. Generating sentences from a continuous space. arXiv preprint arXiv:1511.06349, 2015

    arXiv 2015

  7. [7]

    Sparks of artificial general intelligence: Early experiments with gpt-4

    Sébastien Bubeck, Varun Chandrasekaran, Ronen Eldan, Johannes Gehrke, Eric Horvitz, Ece Kamar, Peter Lee, Yin Tat Lee, Yuanzhi Li, Scott Lundberg, et al. Sparks of artificial general intelligence: Early experiments with gpt-4. arXiv:2303.12712, 2023

    arXiv 2023

  8. [8]

    Weak-to-strong generalization: Eliciting strong capabilities with weak supervision

    Collin Burns, Pavel Izmailov, Jan Hendrik Kirchner, Bowen Baker, Leo Gao, Leopold Aschenbrenner, Yining Chen, Adrien Ecoffet, Manas Joglekar, Jan Leike, et al. Weak-to-strong generalization: Eliciting strong capabilities with weak supervision. In International Conference on Machine Learning (ICML). PMLR, 2024

    work page 2024

Show all 44 references
  1. [9]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), page...

    2021

  2. [10]

    Retiring adult: New datasets for fair machine learning

    Frances Ding, Moritz Hardt, John Miller, and Ludwig Schmidt. Retiring adult: New datasets for fair machine learning. Advances in neural information processing systems, 34:6478–6490, 2021

    2021

  3. [11]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pages 265–284. Springer, 2006

    2006

  4. [12]

    BAE: BERT-based adversarial examples for text classification

    Siddhant Garg and Goutham Ramakrishnan. BAE: BERT-based adversarial examples for text classification. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu, editors,Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6174–6181,...

    2020 doi

  5. [13]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URL http://arxiv.org/abs/1412.6572

    2015 arXiv

  6. [14]

    Reducing sentiment bias in language models via counterfactual evaluation

    Po-Sen Huang, Huan Zhang, Ray Jiang, Robert Stanforth, Johannes Welbl, Jack Rae, Vishal Maini, Dani Yogatama, and Pushmeet Kohli. Reducing sentiment bias in language models via counterfactual evaluation. In Trevor Cohn, Yulan He, and Yang Liu, editors, Findings of the Associat...

    2020 doi

  7. [15]

    Students parrot their teachers: Membership inference on model distillation

    Matthew Jagielski, Milad Nasr, Katherine Lee, Christopher A Choquette-Choo, Nicholas Carlini, and Florian Tramer. Students parrot their teachers: Membership inference on model distillation. Advances in Neural Information Processing Systems, 36, 2024

    2024

  8. [16]

    Is BERT really robust? A strong baseline for natural language attack on text classification and entailment

    Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is BERT really robust? A strong baseline for natural language attack on text classification and entailment. In The Thirty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Appl...

    2020

  9. [17]

    The enron corpus: A new dataset for email classification research

    Bryan Klimt and Yiming Yang. The enron corpus: A new dataset for email classification research. In European conference on machine learning, pages 217–226. Springer, 2004

    2004

  10. [18]

    Certified robustness to adversarial examples with differential privacy

    Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE symposium on security and privacy (SP) , pages 656–672. IEEE, 2019

    2019

  11. [19]

    Gaussian membership inference privacy

    Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. Gaussian membership inference privacy. Advances in Neural Information Processing Systems, 36, 2024. 10

    2024

  12. [20]

    Certified adversarial robustness with additive noise

    Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. Advances in neural information processing systems, 32, 2019

    2019

  13. [21]

    BERT-ATTACK: Adversarial attack against BERT using BERT

    Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. BERT-ATTACK: Adversarial attack against BERT using BERT. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu, editors, Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (E...

    2020 doi

  14. [22]

    Focal loss for dense object detection

    T Lin. Focal loss for dense object detection. arXiv preprint arXiv:1708.02002, 2017

    2017 arXiv

  15. [23]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  16. [24]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Confe...

    2018

  17. [25]

    Repeated knowledge distillation with confidence masking to mitigate membership inference attacks

    Federico Mazzone, Leander van den Heuvel, Maximilian Huber, Cristian Verdecchia, Maarten Everts, Florian Hahn, and Andreas Peter. Repeated knowledge distillation with confidence masking to mitigate membership inference attacks. In Proceedings of the 15th ACM Workshop on Artifi...

    2022

  18. [26]

    Semi-supervised knowledge transfer for deep learning from private training data

    Nicolas Papernot, Martín Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi-supervised knowledge transfer for deep learning from private training data. arXiv preprint arXiv:1610.05755, 2016

    2016 arXiv

  19. [27]

    Language models are unsupervised multitask learners

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9, 2019

    2019

  20. [28]

    Are emergent abilities of large language models a mirage? Advances in Neural Information Processing Systems, 36, 2024

    Rylan Schaeffer, Brando Miranda, and Sanmi Koyejo. Are emergent abilities of large language models a mirage? Advances in Neural Information Processing Systems, 36, 2024

    2024

  21. [29]

    Membership privacy for machine learning models through knowledge transfer

    Virat Shejwalkar and Amir Houmansadr. Membership privacy for machine learning models through knowledge transfer. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 9549–9557, 2021

    2021

  22. [30]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference...

    2014 arXiv

  23. [31]

    Rethinking the inception architecture for computer vision

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2818–2826, 2016

    2016

  24. [32]

    Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architecture

    Xinyu Tang, Saeed Mahloujifar, Liwei Song, Virat Shejwalkar, Milad Nasr, Amir Houmansadr, and Prateek Mittal. Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architecture. In 31st USENIX Security Symposium (USENIX Security 22), pages 143...

    2022

  25. [33]

    T3: Tree-autoencoder constrained adversarial text generation for targeted attack

    Boxin Wang, Hengzhi Pei, Boyuan Pan, Qian Chen, Shuohang Wang, and Bo Li. T3: Tree-autoencoder constrained adversarial text generation for targeted attack. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu, editors, Proceedings of the 2020 Conference on Empirical Methods i...

    2020 doi

  26. [34]

    Adversarial GLUE: A multi-task benchmark for robustness evaluation of language mod- els

    Boxin Wang, Chejian Xu, Shuohang Wang, Zhe Gan, Yu Cheng, Jianfeng Gao, Ahmed Hassan Awadal- lah, and Bo Li. Adversarial GLUE: A multi-task benchmark for robustness evaluation of language mod- els. In Joaquin Vanschoren and Sai-Kit Yeung, editors, Proceedings of the Neural Inf...

    2021

  27. [35]

    Decodingtrust: A comprehensive assessment of trustworthiness in gpt models

    Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, et al. Decodingtrust: A comprehensive assessment of trustworthiness in gpt models. In Proceedings of the Neural Information Processing Systems (...

    2023

  28. [36]

    Eda: Easy data augmentation techniques for boosting performance on text classification tasks

    Jason Wei and Kai Zou. Eda: Easy data augmentation techniques for boosting performance on text classification tasks. arXiv preprint arXiv:1901.11196, 2019. 11

    1901 arXiv

  29. [37]

    Emergent abilities of large language models

    Jason Wei, Yi Tay, Rishi Bommasani, Colin Raffel, Barret Zoph, Sebastian Borgeaud, Dani Yogatama, Maarten Bosma, Denny Zhou, Donald Metzler, et al. Emergent abilities of large language models. arXiv preprint arXiv:2206.07682, 2022

    2022 arXiv

  30. [38]

    Revisiting out-of-distribution robustness in nlp: Benchmarks, analysis, and llms evaluations

    Lifan Yuan, Yangyi Chen, Ganqu Cui, Hongcheng Gao, Fangyuan Zou, Xingyi Cheng, Heng Ji, Zhiyuan Liu, and Maosong Sun. Revisiting out-of-distribution robustness in nlp: Benchmarks, analysis, and llms evaluations. Advances in Neural Information Processing Systems, 36:58478–58507, 2023

    2023

  31. [39]

    Fairness constraints: Mechanisms for fair classification

    Muhammad Bilal Zafar, Isabel Valera, Manuel Gomez Rogriguez, and Krishna P Gummadi. Fairness constraints: Mechanisms for fair classification. In Artificial intelligence and statistics (AISTATS), pages 962–970. PMLR, 2017

    2017

  32. [40]

    Word-level textual adversarial attacking as combinatorial optimization

    Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. Word-level textual adversarial attacking as combinatorial optimization. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel R. Tetreault, editors,Proceedings of the 58th Annual Meeting...

    2020 doi

  33. [41]

    Gender bias in coreference resolution: Evaluation and debiasing methods

    Jieyu Zhao, Tianlu Wang, Mark Yatskar, Vicente Ordonez, and Kai-Wei Chang. Gender bias in coreference resolution: Evaluation and debiasing methods. In Marilyn Walker, Heng Ji, and Amanda Stent, editors,Proceedings of the 2018 Conference of the North American Chapter of the Ass...

    2018 doi

  34. [42]

    Resisting membership inference attacks through knowledge distillation

    Junxiang Zheng, Yongzhi Cao, and Hanpin Wang. Resisting membership inference attacks through knowledge distillation. Neurocomputing, 452:114–126, 2021

    2021

  35. [43]

    Freelb: Enhanced adversarial training for natural language understanding

    Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. Freelb: Enhanced adversarial training for natural language understanding. arXiv preprint arXiv:1909.11764, 2019. 12 A Weak to Strong Training Process A.1 Training Objective for Weak+WTS TFT In this section...

    1909 arXiv

  36. [495]

    URL https://aclanthology.org/2020.emnlp-main.495

    2020

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.