Pith. sign in

REVIEW 5 major objections 6 minor 79 references

Trustworthy AI: Safety, Bias, and Privacy -- A Survey

T0 review · 5 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This survey argues that LLM safety alignment is superficial unless the model sustains a refuse-or-comply decision through every generation step, that spurious bias is driven by a few hard-to-learn samples, and that membership privacy…

desk verdict A competent, useful survey map of three trustworthiness areas, but its forward-looking safety thesis is the authors' own unvalidated hypothesis and the one original empirical figure is under-documented. read the letter →

arxiv 2502.10450 v2 pith:DR23RK6Z submitted 2025-02-11 cs.CR cs.AIcs.CLcs.LG

Xingli Fang , Jianwei Li , Varun Mulchandani , Jung-Eun Kim This is my paper · ORCID
classification cs.CRcs.AIcs.CLcs.LG
keywords trustworthyAIsafetyalignmentlargelanguagemodelsspuriouscorrelationsmembershipinferenceattacksprivacypreservationdatapruning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey maps three failure modes that undermine trust in deep learning systems and argues that each is more tractable than current practice assumes. For large language models, it contends that safety alignment is only superficial, and that robust safety requires the model to hold a safety reasoning direction at every generation step rather than only at the first tokens. For bias, it argues that spurious correlations are driven by hard-to-learn core features more than by group frequencies, so pruning a small fraction of such samples can remove the easiest route to spurious reliance. For privacy, it frames membership inference risk as a mismatch between model capacity and data complexity, with defenses organized as model-level, external obfuscators, and data-level interventions.

What carries the argument

The paper's load-bearing objects are three. First, the safety reasoning direction: an implicit binary decision to refuse or comply that safety alignment must teach the model to select and sustain across the whole text generation, not just at the start. Second, the hard versus easy spurious sample distinction within an environment: hard-to-understand samples are those whose core features are difficult to learn, and they are the ones that teach the network the spurious shortcut. Third, representation inconsistency: the distance of a sample from the decision boundary and from the origin, which differs between members and non-members and exposes membership. These objects organize the survey's defense taxonomies, freezing safety-critical neurons, pruning hard spurious samples, and aligning member and non-member representations.

What would settle it

Train two instances of an aligned model family from different seeds, locate each model's safety-critical neurons by ablation, and fine-tune both on a benign dataset while freezing those neurons. If the neuron sets do not overlap or freezing them fails to preserve refusal behavior, the superficial-safety and neuron-stability claims are falsified. For the spurious-correlation claim, rerun the eyeglasses experiment with other architectures; if pruning 10% of hard-to-understand male samples does not double worst-group accuracy on female samples with glasses, the sample-level asymmetry claim fails.

Watch

Extended reading notes

Core claim

On its own terms, this survey claims that the standard way AI models fail, taking the easiest available route, is the common thread behind unsafe, biased, and privacy-leaking behavior, and that each failure is addressable by targeting the underlying shortcut. In safety, it adopts the superficial safety alignment hypothesis: current alignment mainly reshapes early-token output distributions, so aligned models remain vulnerable to jailbreak, fine-tuning, and decoding attacks; robust safety requires the model to choose a safety reasoning direction (refuse or comply) and maintain that direction through every generation step. In bias, it reports that spurious correlations are not spread evenly across samples: samples whose core features are hard to learn carry the real signal, so removing 10% of hard-to-understand spurious samples can double worst-group accuracy while removing 97% of easy ones does nothing. In privacy, it argues that membership inference vulnerability is a representational inconsistency between training and test points, and that both model-capacity and data-complexity choices control that inconsistency.

Load-bearing premise

The safety agenda rests on the assumption that safety-critical neurons exist, can be identified, and stay stable when frozen; if neuron-level safety units are not stable across architectures or training runs, the recommended safety reasoning direction approach loses its foundation.

Editorial extensions

If this is right

  • Safety alignment that only shapes early-token distributions will keep failing against jailbreak, fine-tuning, and decoding attacks until training enforces a consistent refuse-or-comply direction for the entire response.
  • Targeted data pruning, not environment-balanced datasets, may be enough to fix spurious correlations: removing a small fraction of hard-to-understand spurious samples improves worst-group accuracy without validation-set tuning.
  • Privacy defenses that align training and test representations, such as distribution matching, center-based relaxed learning, or membership-invariant subspaces, should reduce membership inference success without sacrificing utility.
  • If data complexity is the right control knob, increasing the amount or difficulty of training data can reduce privacy leakage rather than increase it, because the model stops memorizing individual points.
  • If safety-critical neurons are stable and freezable, then fine-tuning attacks can be neutralized without retraining the whole model, but current alignment methods that ignore these neurons remain brittle.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The safety hypothesis implies a testable stability requirement: safety-critical neurons should be identified across random seeds, architectures, and base models; if the neuron sets differ per run, the freeze-and-protect recipe needs per-model identification.
  • The hard-sample pruning result suggests a parallel experiment in reasoning tasks: pruning easy short-cut examples from an arithmetic or logic dataset should force the network to learn the general rule, improving length generalization.
  • The capacity-versus-complexity privacy view predicts a U-shaped privacy risk curve as dataset size grows; scanning dataset size against membership inference success would locate the minimum-risk operating point.
  • The three sections may reduce to one mechanism, shortcut reliance, so jailbreak attacks, spurious-feature reliance, and membership leakage might be countered by a single intervention that removes the shortest path from input to confident output.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. This paper presents itself as a comprehensive survey of trustworthy AI, covering three thrusts: safety alignment for large language models, spurious correlations in deep learning, and membership inference attacks and defenses. For each thrust, the paper reviews existing approaches, identifies limitations, and proposes forward-looking research directions. In the safety section, the survey adopts the authors' own 'superficial safety alignment hypothesis' and recommends teaching models to maintain safety reasoning direction throughout generation. In the bias section, it reviews mitigation methods for spurious correlations and highlights the authors' data pruning results. In the privacy section, it categorizes membership inference defenses and presents new empirical observations on the relationship between data complexity and privacy leakage.

Significance. If the survey's forward-looking claims were well supported, the paper could serve as a useful entry point for researchers and practitioners working on safety, bias, and privacy. The survey's taxonomy of alignment methods, attack classes, spurious-correlation mitigation strategies, and membership-inference defenses is helpful and generally consistent with the cited literature. However, the survey's central safety agenda is based almost entirely on the authors' own unpublished or recently published work, which is presented as an accepted premise rather than a hypothesis under debate. The empirical observations in the privacy section lack experimental protocol and error bars, which undermines their credibility. The paper's claim to comprehensiveness is overstated given the selective topical coverage.

major comments (5)
  1. [Section 2.4] The survey presents the authors' 'superficial safety alignment hypothesis' [1] as the basis for its recommended research agenda, without flagging it as the authors' own perspective or discussing competing viewpoints. The statement 'this survey paper acknowledges the hypothesis from [1], and believes that a robust safety alignment should teach the model to select and maintain the correct safety reasoning direction throughout the entire text generation process' adopts the hypothesis without independent validation. Moreover, the cited base result [27] actually shows that simply retaining safety-critical parameters does not preserve safety under fine-tuning attacks; the neuron-level freezing result in [1] is the load-bearing step, but it is not validated in the survey. The survey should either provide independent evidence, clearly attribute the hypothesis as the authors' position, or present it with appropriate caveats.
  2. [Section 4.1, Fig. 2] The claim that using the full dataset (rather than half) prevents privacy leakage is supported only by a figure without experimental protocol: no details on the dataset split, training hyperparameters, attack setup, or error bars; the caption mentions one model (MobileNetV3-S) and 40 runs, but the figure does not show variation across runs. This empirical claim is used to motivate the discussion of privacy trade-offs and should be either rigorously documented or removed. Without these details, the claim is unverifiable.
  3. [Section 4.2, Fig. 3] The visualization is taken from the authors' own prior work [61] but is used in the survey to support a general claim about 'multiple privacy-risky layers' without any description of the experimental setup, the definition of the plotted quantities (e.g., 'distance to the decision boundary' is computed as the difference between the 1st and 2nd maximum probabilities, but the distance to the origin in the penultimate layer is not defined), or how many runs were used. This figure should be either described in sufficient detail or explicitly labeled as a reproduction from the authors' previous publication.
  4. [Abstract and Conclusion] The paper claims to be a 'comprehensive survey' of trustworthy AI, but the coverage is narrow: safety is restricted to alignment and inference-time attacks; bias is limited to spurious correlations; privacy is limited to membership inference attacks. Many central topics in trustworthy AI (e.g., fairness metrics, model unlearning, watermarking, interpretability, transparency) are omitted without a scope statement. The title and abstract should be adjusted to reflect the actual scope, or the paper should include a section delimiting its scope.
  5. [Sections 4.1-4.2] The paper interleaves original empirical results (Fig. 2, Fig. 3) with survey content without a dedicated experimental methods section, making it methodologically ambiguous. The authors should either add a clear experimental setup for these new results (including data, hyperparameters, metrics, and statistical tests) or remove the new claims and refer to their prior publications. This ambiguity affects the paper's reproducibility and its suitability as a survey.
minor comments (6)
  1. [Section 2.2.3] The acronym 'RLAF' appears to be a typo for 'RLAIF' (Reinforcement Learning with AI Feedback).
  2. [Section 2.2.2] The 'Superficial Alignment Hypothesis' from [16] and the 'Superficial Safety Alignment Hypothesis' from [1] are distinct concepts; the survey should distinguish them explicitly to avoid confusion.
  3. [Section 4.1] The phrase 'data capacity' is used to mean 'dataset size'; consider using 'dataset size' or 'data complexity' consistently to avoid ambiguity with model capacity.
  4. [References] Reference [17] is incomplete; it should include the publication venue and year.
  5. [Section 3.4] Figure 1 is first discussed in Section 3.4, but the caption says it is excerpted from [44]; the figure should be introduced at its first mention and its provenance should be stated there.
  6. [Section 4.2.1] The distinction between 'model-level solutions' and 'external obfuscators' is not crisp; a brief sentence clarifying that model-level solutions modify the training procedure while obfuscators post-process predictions would aid readability.

Circularity Check

2 steps flagged · score 4.0 of 10

The survey's forward-looking safety agenda in §2.4 is explicitly adopted from the authors' own 'superficial safety alignment hypothesis' ([1], [29]) and is load-bearing, while the bulk of the survey is externally grounded.

  1. self citation load bearing [Section 2.4, paragraph beginning 'All of these highlight...' (page 6)]
    "In this context, this survey paper acknowledges the hypothesis from [1], and believes that a robust safety alignment should teach the model to select and maintain the correct safety reasoning direction throughout the entire text generation process. This perspective is aligned with recent work in [29], which not only supports this view but also introduces practical techniques to enforce such reasoning consistency."

    The survey's central safety prescription is not derived from independent evidence; it is explicitly an endorsement of the authors' own hypothesis from [1] (Li & Kim, 'Superficial safety alignment hypothesis') and supported by the authors' own ICML 2025 paper [29]. The paragraph converts the authors' earlier research position into the survey's accepted premise, so the main forward-looking agenda in the safety section reduces to a self-citation chain rather than a survey of externally validated alternatives. No independent benchmark, architecture-generalization study, or external evaluation is offered to support the reasoning-direction mechanism.

  2. self citation load bearing [Section 2.4, first paragraph (page 6)]
    "In contrast, [1] demonstrated that the atomic functional unit for safety in LLMs resides at the neuron level and successfully mitigated finetuning attacks by freezing updates to these safety-critical components."

    The load-bearing empirical step that supports the survey's robust-safety recommendation is taken solely from the authors' own [1]. The paper immediately notes that [27] (an external paper) found retaining safety-critical parameters does not preserve safety under fine-tuning attacks; [1] is then cited as the result that overcomes this limitation, but the survey provides no independent confirmation. The survey's suggested path to robust alignment therefore rests on a self-cited neuron-level freezing claim that is not externally verified or reproduced in the text.

full rationale

This is a survey, not a derivation paper, so most of its content is a literature map and not circular: the safety background on SFT, RLHF, DPO, and jailbreak/fine-tuning/decoding attacks is externally sourced, and the spurious-correlation and membership-inference sections are grounded in a wide external literature with the authors' own works ([44], [61], [69]) cited as empirical contributions rather than as assumptions that make the conclusions true by construction. The genuine circularity concern is concentrated in Section 2.4, where the survey's forward-looking safety agenda is explicitly taken from the authors' own 'superficial safety alignment hypothesis' [1] and supported by the authors' own companion paper [29]. The load-bearing premise—that neuron-level safety units exist and can be frozen to preserve safety—is presented as an accepted finding solely on the authority of [1], with no independent validation in the survey. This is load-bearing self-citation, but it is not a fitted parameter renamed as a prediction or a definitional identity, so the score is 4 rather than 6 or higher. The rest of the survey's content remains externally grounded.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The survey's central perspectives are borrowed from self-cited prior work, especially the neuron-level safety hypothesis and the data-complexity privacy claim. There are no new free parameters or invented entities, but the review's forward-looking claims rest on premises that are not independently validated in this paper.

assumptions (3)
  • domain assumption Safety alignment can be decomposed into an implicit binary decision (refuse or fulfill) at each generation step.
    Adopted from [1] and [29], both by the paper's authors. Section 2.4 says the survey acknowledges this hypothesis; the survey offers no independent evidence.
  • ad hoc to paper The empirical result in Fig. 2 (full dataset leaks less than half) is valid despite no experimental protocol being provided.
    Section 4.1 uses this result to argue that increasing data capacity can prevent privacy leakage; without protocol and error bars, the claim is an unsupported premise of the privacy discussion.
  • domain assumption Most spurious-correlation mitigation requires sample-environment membership information or a reliable proxy for it.
    Section 3.3 lists this as a limitation of existing techniques, but the survey's proposed direction still depends on identifying hard samples within environments, which inherits the same assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Trustworthy AI: Safety, Bias, and Privacy -- A Survey." pith.science (2026). https://pith.science/paper/DR23RK6Z

@misc{pith2026250210450,
  author       = {Pith},
  title        = {Pith review of: Trustworthy AI: Safety, Bias, and Privacy -- A Survey},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DR23RK6Z}},
  note         = {Machine review of arXiv:2502.10450}
}
read the original abstract

The capabilities of artificial intelligence systems have been advancing to a great extent, but these systems still struggle with failure modes, vulnerabilities, and biases. In this paper, we study the current state of the field, and present promising insights and perspectives regarding concerns that challenge the trustworthiness of AI models. In particular, this paper investigates the issues regarding three thrusts: safety, privacy, and bias, which hurt models' trustworthiness. For safety, we discuss safety alignment in the context of large language models, preventing them from generating toxic or harmful content. For bias, we focus on spurious biases that can mislead a network. Lastly, for privacy, we cover membership inference attacks in deep neural networks. The discussions addressed in this paper reflect our own experiments and observations.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

79 extracted references · 61 canonical work pages

  1. [1]

    arXiv:2410.10862 (2024)

    Li, J., Kim, J.-E.: Superficial safety alignment hypothesis. arXiv:2410.10862 (2024)

    arXiv 2024

  2. [44]

    In: ICLR (2025)

    Mulchandani, V ., Kim, J.-E.: Severing spurious correlations with data pruning. In: ICLR (2025)

    work page 2025

  3. [61]

    In: AAAI/ACM AIES (2024)

    Fang, X., Kim, J.-E.: Representation magnitude has a liability to privacy vulnerability. In: AAAI/ACM AIES (2024)

    work page 2024

  4. [27]

    In: ICML (2024)

    Wei, B., Huang, K.,et al.: Assessing the brittleness of safety alignment via pruning and low-rank modifications. In: ICML (2024)

    work page 2024

  5. [2]

    arXiv:2405.19524 (2024)

    Qi, X., Huang, Y ., et al.: Ai risk management should incorporate both safety and security. arXiv:2405.19524 (2024)

    arXiv 2024

  6. [3]

    https://openai.com/chatgpt

    OpenAI: ChatGPT (2022). https://openai.com/chatgpt

    work page 2022

  7. [4]

    arXiv:2312.11805 (2023)

    Gemini, G.: Gemini: a family of highly capable multimodal models. arXiv:2312.11805 (2023)

    arXiv 2023

  8. [5]

    https://www.brusselstimes.com/430098/ belgian-man-commits-suicide-following-exchanges-with-chatgpt 14

    Brussels Times: Belgian man commits suicide following exchanges with ChatGPT (2023). https://www.brusselstimes.com/430098/ belgian-man-commits-suicide-following-exchanges-with-chatgpt 14

    work page 2023

Show all 79 references
  1. [6]

    The British Journal of Psychiatry224(2), 33–35 (2024)

    Monteith, S., Glenn, T.,et al.: Artificial intelligence and increasing misinformation. The British Journal of Psychiatry224(2), 33–35 (2024)

    2024

  2. [7]

    arXiv:2307.09288 (2023)

    Touvron, H., Martin, L., et al.: Llama 2: Open foundation and fine-tuned chat models. arXiv:2307.09288 (2023)

    2023 arXiv

  3. [8]

    arXiv:2407.21783 (2024)

    Dubey, A., Jauhri, A., et al.: The Llama 3 herd of models. arXiv:2407.21783 (2024)

    2024 arXiv

  4. [9]

    arXiv:2501.12948 (2025)

    Guo, D., Yang, D., et al.: Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv:2501.12948 (2025)

    2025 arXiv

  5. [10]

    In: Neurips (2020)

    Brown, T., Mann, B.,et al.: Language models are few-shot learners. In: Neurips (2020)

    2020

  6. [11]

    arXiv:2112.00861 (2021)

    Askell, A., Bai, Y ., et al.: A general language assistant as a laboratory for alignment. arXiv:2112.00861 (2021)

    2021 arXiv

  7. [12]

    In: NeurIPS (2022)

    Ouyang, L., Wu, J.,et al.: Training language models to follow instructions with human feedback. In: NeurIPS (2022)

    2022

  8. [13]

    arXiv:2204.05862 (2022)

    Bai, Y ., Jones, A., et al.: Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv:2204.05862 (2022)

    2022 arXiv

  9. [14]

    In: NeurIPS (2022)

    Wei, J., Wang, X.,et al.: Chain-of-thought prompting elicits reasoning in large language models. In: NeurIPS (2022)

    2022

  10. [15]

    Nature Machine Intelligence5(12), 1486–1496 (2023)

    Xie, Y ., Yi, J.,et al.: Defending chatgpt against jailbreak attack via self-reminders. Nature Machine Intelligence5(12), 1486–1496 (2023)

    2023

  11. [16]

    In: NeurIPS (2024)

    Zhou, C., Liu, P.,et al.: Lima: Less is more for alignment. In: NeurIPS (2024)

    2024

  12. [17]

    Christiano, P., Leike, J., et al.: Deep Reinforcement Learning from Human Preferences

  13. [18]

    arXiv:2212.08073 (2022)

    Bai, Y ., Kadavath, S., et al.: Constitutional ai: Harmlessness from ai feedback. arXiv:2212.08073 (2022)

    2022 arXiv

  14. [19]

    arXiv:2308.01320 (2023)

    Yao, Z., Aminabadi, R., et al.: Deepspeed-chat: Easy, fast and affordable rlhf training of chatgpt-like models at all scales. arXiv:2308.01320 (2023)

    2023 arXiv

  15. [20]

    In: NeurIPS (2024)

    Rafailov, R., Sharma, A.,et al.: Direct preference optimization: Your language model is secretly a reward model. In: NeurIPS (2024)

    2024

  16. [21]

    In: ICLR (2023)

    Liu, R., Yang, R.,et al.: Training socially aligned language models on simulated social interactions. In: ICLR (2023)

    2023

  17. [22]

    In: ICML (2023)

    Korbak, T., Shi, K.,et al.: Pretraining language models with human preferences. In: ICML (2023)

    2023

  18. [23]

    arXiv:2307.15043 (2023)

    Zou, A., Wang, Z., et al.: Universal and transferable adversarial attacks on aligned 15 language models. arXiv:2307.15043 (2023)

    2023 arXiv

  19. [24]

    arXiv:2311.03191 (2023)

    Li, X., Zhou, Z., et al.: Deepinception: Hypnotize large language model to be jailbreaker. arXiv:2311.03191 (2023)

    2023 arXiv

  20. [25]

    Qi, X., Zeng, Y .,et al.: Fine-tuning aligned language models compromises safety, even when users do not intend to! In: ICLR (2023)

    2023

  21. [26]

    In: ICLR (2023)

    Huang, Y ., Gupta, S.,et al.: Catastrophic jailbreak of open-source llms via exploiting generation. In: ICLR (2023)

    2023

  22. [28]

    arXiv:2407.09121 (2024)

    Yuan, Y ., Jiao, W., et al.: Refuse whenever you feel unsafe: Improving safety in llms via decoupled refusal training. arXiv:2407.09121 (2024)

    2024 arXiv

  23. [29]

    In: ICML (2025)

    Li, J., Kim, J.-E.: Safety alignment can be not superficial with explicit safety signals. In: ICML (2025)

    2025

  24. [30]

    arXiv:1907.02893 (2019)

    Arjovsky, M., Bottou, L., Gulrajani, I., Lopez-Paz, D.: Invariant risk minimization. arXiv:1907.02893 (2019)

    2019 arXiv

  25. [31]

    Nature Machine Intelligence2(11), 665–673 (2020)

    Geirhos, R., Jacobsen, J.-H.,et al.: Shortcut learning in deep neural networks. Nature Machine Intelligence2(11), 665–673 (2020)

    2020

  26. [32]

    In: ICLR (2023)

    Kirichenko, P., Izmailov, P., Wilson, A.: Last layer re-training is sufficient for robustness to spurious correlations. In: ICLR (2023)

    2023

  27. [33]

    In: NeurIPS (2020)

    Shah, H., Tamuly, K.,et al.: The pitfalls of simplicity bias in neural networks. In: NeurIPS (2020)

    2020

  28. [34]

    Wiley, New York, NY (1998)

    Vapnik, V .: Statistical Learning Theory. Wiley, New York, NY (1998)

    1998

  29. [35]

    In: ICML (2021)

    Liu, E.Z., Haghgoo, B.,et al.: Just train twice: Improving group robustness without training group information. In: ICML (2021)

    2021

  30. [36]

    In: AISTATS (2024)

    Yang, Y ., Gan, E.,et al.: Identifying spurious biases early in training through the lens of simplicity bias. In: AISTATS (2024)

    2024

  31. [37]

    In: NeurIPS (2023)

    Deng, Y ., Yang, Y .,et al.: Robust learning with progressive data expansion against spurious correlation. In: NeurIPS (2023)

    2023

  32. [38]

    In: ICLR (2021)

    Ahmed, F., Bengio, Y .,et al.: Systematic generalisation with group invariant predictions. In: ICLR (2021)

    2021

  33. [39]

    In: ICML (2022) 16

    Zhang, M., Sohoni, N.,et al.: Correct-n-contrast: a contrastive approach for improving robustness to spurious correlations. In: ICML (2022) 16

    2022

  34. [40]

    In: ICML (2024)

    Pezeshki, M., Bouchacourt, D.,et al.: Discovering environments with XRM. In: ICML (2024)

    2024

  35. [41]

    In: ICLR (2024)

    Gandelsman, Y ., Efros, A.A., Steinhardt, J.: Interpreting CLIP’s image representation via text-based decomposition. In: ICLR (2024)

    2024

  36. [42]

    In: ICLR (2020)

    Sagawa, S., Koh, P.W.,et al.: Distributionally robust neural networks. In: ICLR (2020)

    2020

  37. [43]

    In: NeurIPS (2023)

    Moayeri, M., Wang, W., Singla, S., Feizi, S.: Spuriosity rankings: Sorting data to measure and mitigate biases. In: NeurIPS (2023)

    2023

  38. [45]

    In: ICLR (2021)

    Gulrajani, I., Lopez-Paz, D.: In search of lost domain generalization. In: ICLR (2021)

    2021

  39. [46]

    In: IJCAI (2023)

    Zhang, H., Li, L.,et al.: On the paradox of learning to reason from data. In: IJCAI (2023)

    2023

  40. [47]

    In: ICLR (2025)

    Nikankin, Y ., Reusch, A.,et al.: Arithmetic without algorithms: Language models solve math with a bag of heuristics. In: ICLR (2025)

    2025

  41. [48]

    In: ICLR (2024)

    Zhou, H., Bradley, A.,et al.: What algorithms can transformers learn? a study in length generalization. In: ICLR (2024)

    2024

  42. [49]

    In: ICLR (2024)

    Lee, N., Sreenivasan, K.,et al.: Teaching arithmetic to small transformers. In: ICLR (2024)

    2024

  43. [50]

    arXiv:2202.05189 (2022)

    Yang, Y .-Y ., Chou, C.-N., Chaudhuri, K.: Understanding rare spurious correlations in neural network. arXiv:2202.05189 (2022)

    2022 arXiv

  44. [51]

    Journal of Computer Security28(1), 35–70 (2020)

    Yeom, S., Giacomelli, I.,et al.: Overfitting, robustness, and malicious algorithms: A study of potential causes of privacy risk in machine learning. Journal of Computer Security28(1), 35–70 (2020)

    2020

  45. [52]

    In: NeurIPS (2022)

    Carlini, N., Jagielski, M.,et al.: The privacy onion effect: Memorization is relative. In: NeurIPS (2022)

    2022

  46. [53]

    In: NeurIPS (2022)

    Tan, J., Mason, B.,et al.: Parameters or privacy: A provable tradeoff between overpa- rameterization and membership inference. In: NeurIPS (2022)

    2022

  47. [54]

    In: AISTATS (2023)

    Tan, J., LeJeune, D.,et al.: A blessing of dimensionality in membership inference through regularization. In: AISTATS (2023)

    2023

  48. [55]

    arXiv:2006.05336 (2020)

    Kaya, Y ., Hong, S., Dumitras, T.: On the effectiveness of regularization against membership inference attacks. arXiv:2006.05336 (2020)

    2020 arXiv

  49. [56]

    Kaya, Y ., Dumitras, T.: When does data augmentation help with membership inference 17 attacks? In: ICML (2021)

    2021

  50. [57]

    Yu, D., Zhang, H.,et al.: How does data augmentation affect privacy in machine learning? In: AAAI (2021)

    2021

  51. [58]

    In: USENIX Security (2022)

    Yuan, X., Zhang, L.: Membership inference attacks and defenses in neural network pruning. In: USENIX Security (2022)

    2022

  52. [59]

    In: ICML (2023)

    Tarun, A., Chundawat, V .,et al.: Deep regression unlearning. In: ICML (2023)

    2023

  53. [60]

    In: NeurIPS (2024)

    Wang, W., Dziedzic, A.,et al.: Localizing memorization in SSL vision encoders. In: NeurIPS (2024)

    2024

  54. [62]

    In: CCS (2016)

    Abadi, M., Chu, A., Goodfellow, I.,et al.: Deep learning with differential privacy. In: CCS (2016)

    2016

  55. [63]

    In: CCS (2018)

    Nasr, M., Shokri, R., Houmansadr, A.: Machine learning with membership privacy using adversarial regularization. In: CCS (2018)

    2018

  56. [64]

    In: Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, pp

    Li, J., Li, N., Ribeiro, B.: Membership inference attacks and defenses in classification models. In: Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, pp. 5–16 (2021)

    2021

  57. [65]

    In: ICLR (2022)

    Chen, D., Yu, N., Fritz, M.: Relaxloss: Defending membership inference attacks without losing utility. In: ICLR (2022)

    2022

  58. [66]

    In: ACSAC (2023)

    Tan, M., Xie, X., Sun, J., Wang, T.: Mitigating membership inference attacks via weighted smoothing. In: ACSAC (2023)

    2023

  59. [67]

    In: Network and Distributed System Security (NDSS) Symposium (2024)

    Chen, Z., Pattabiraman, K.: Overconfidence is a dangerous thing: Mitigating mem- bership inference attacks by enforcing less confident prediction. In: Network and Distributed System Security (NDSS) Symposium (2024)

    2024

  60. [68]

    In: ICML (2024)

    Liu, Z., Feng, L.,et al.: Mitigating privacy risk in membership inference by convex- concave loss. In: ICML (2024)

    2024

  61. [69]

    In: UAI (2024)

    Fang, X., Kim, J.-E.: Center-based relaxed learning against membership inference attacks. In: UAI (2024)

    2024

  62. [70]

    arXiv:2410.06814 (2024)

    Hu, Q., Zhang, H., Wei, H.: Defending membership inference attacks via privacy-aware sparsity tuning. arXiv:2410.06814 (2024)

    2024 arXiv

  63. [71]

    In: 33rd USENIX Security Sym- posium (USENIX Security 24), pp

    Li, J., Li, N., Ribeiro, B.: MIST: Defending against membership inference attacks through Membership-Invariant subspace training. In: 33rd USENIX Security Sym- posium (USENIX Security 24), pp. 2387–2404. USENIX Association, Philadelphia, 18 PA (2024).https://www.usenix.org/con...

    2024

  64. [72]

    In: CCS (2019)

    Jia, J., Salem, A.,et al.: Memguard: Defending against black-box membership inference attacks via adversarial examples. In: CCS (2019)

    2019

  65. [73]

    In: AAAI (2023)

    Yang, Z., Wang, L.,et al.: Purifier: Defending data inference attacks via transforming confidence scores. In: AAAI (2023)

    2023

  66. [74]

    In: USENIX Security (2022)

    Stadler, T., Oprisanu, B., Troncoso, C.: Synthetic data–anonymisation groundhog day. In: USENIX Security (2022)

    2022

  67. [75]

    In: ICLR (2024)

    Ye, J., Borovykh, A., Hayou, S., Shokri, R.: Leave-one-out distinguishability in machine learning. In: ICLR (2024)

    2024

  68. [76]

    Li, Q., Wang, C.-L., Cao, Y ., Wang, D.: Data lineage inference: Uncovering privacy vulnerabilities of dataset pruning (2024)

    2024

  69. [77]

    Dong, T., Zhao, B., Lyu, L.: Privacy for free: How does dataset condensation help privacy? In: ICML (2022)

    2022

  70. [78]

    In: AAAI (2021)

    Shejwalkar, V ., Houmansadr, A.: Membership privacy for machine learning models through knowledge transfer. In: AAAI (2021)

    2021

  71. [79]

    In: USENIX Security (2022) 19

    Tang, X., Mahloujifar, S.,et al.: Mitigating membership inference attacks by self- distillation through a novel ensemble architecture. In: USENIX Security (2022) 19

    2022

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.