Pith. sign in

REVIEW 3 major objections 5 minor 55 references

When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Auditors who can run the public base locally can read a private PEFT adapter's family, coarse rank, and exact version from output residuals, while full adapter recovery remains out of reach.

desk verdict A careful, honest PEFT leakage measurement whose strongest claim—version linkage—needs a probe-seed balance control before I'd trust it. read the letter →

arxiv 2608.05036 v1 pith:EIOCCCVX submitted 2026-08-05 cs.CR

Zhongjiang Yao , Shuangshuang Liang , Chun Yang , LiWei Chen , Gang Shi This is my paper · ORCID
classification cs.CR
keywords parameter-efficientfine-tuningmodelextractionresidualsignaturesLoRAstructureleakageadapterfingerprintingopen-setrejectionblack-boxsecurityPEFTservices
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that public-base PEFT services leak structure through output residuals: when an attacker can execute the public base locally and observe rich victim outputs, paired residuals reveal the private adapter's family, coarse rank, and sometimes its exact checkpoint version. This would matter because services increasingly deploy a public foundation model with a private parameter-efficient adaptation, creating a differential leakage surface that closed-set accuracy alone does not capture. The paper provides a measurement methodology, VectorHijack-SR, plus statistically qualified results across BERT, RoBERTa, and DeBERTa-v3, and it separates visibility from validity and exploitability. The strongest positive consequence is exact-version linkage at AUC 0.940 on held-out LoRA-r64 services, while recovery is shown to be a cost-format trade-off rather than a query or fidelity win.

What carries the argument

The central object is the paired residual $r(x)=O_v(x)-O_b(x)$ between the victim service output and the locally executed public base output, aggregated over batches into service views using magnitude, ranking, entropy, margin, length, template, locality, and spectral statistics. A service-disjoint multinomial logistic classifier produces calibrated posterior bounds over family, locality, and rank buckets, and a cross-fitted hierarchical rejector combines a hybrid meta-score with a Ledoit-Wolf Mahalanobis distance to flag out-of-manifold structures.

What would settle it

Re-run the held-out lineage experiment while swapping in a public base checkpoint one revision older but keeping the same LoRA adapter; if the lineage AUC remains 0.940, the claimed exact-version linkage is confounded with base version. More directly, if a matched-base repetition on the original BERT/MNLI grid does not reproduce at least 8/12 family hits above uniform chance, the headline claim collapses.

Watch

Extended reading notes

Core claim

The central claim is that known-base, rich-output PEFT services can leak actionable structural and version information even though closed-set confidence does not imply universal adapter recovery. By sending identical probes to the victim service and a locally executed copy of the public base, the method computes residual signatures and aggregates them into service-level views; a calibrated closed-set classifier then bounds the PEFT family, layer locality, and coarse rank bucket, and a hierarchical open-set rejector tests whether the victim lies outside the calibrated LoRA manifold. Family leakage exceeds uniform chance on many classification backbones, rank evidence is task-dependent (e.g., 8/9 on BERT/MNLI but 4/9, compatible with chance, on DeBERTa/MNLI), and the ten-seed open-set rejector reaches pooled AUROC 0.804 while failing on structurally close DoRA and LoRA+head variants. Exact-version linkage on five held-out LoRA-r64 services reaches AUC 0.940 with FMR 0.10 at 95% true-match recall, while fair-budget recovery shows no query savings and lower fidelity than distill-then-convert PEFT.

Load-bearing premise

An auditor must be able to run the exact same public base checkpoint and inference code locally as the service does, and the paper's own mismatch detector is near chance, so an external attacker cannot verify that this condition holds.

Editorial extensions

If this is right

  • A service that exposes full logits or stable top-k scores should treat those outputs as sensitive structural metadata that can reveal adapter family, locality, and coarse rank.
  • Label-only and free-running text interfaces suppress the passive residual signal, bounding the attack surface to rich-output audit settings.
  • Exact-version linkage is achievable under matched-base conditions, enabling provenance checks and unauthorized-reuse detection even without weight recovery.
  • Recovery of a deployable PEFT artifact is a cost-format frontier: posterior-bounded PEFT is cheaper but less accurate than distill-then-convert PEFT, and it does not beat distillation on query count.
  • Open-set rejection detects off-manifold adapters such as IA3 but fails on structurally close variants like DoRA and LoRA+head, so near-neighbor families remain an unresolved gap.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: the same residual-signature feature families are modality-agnostic, so a testable extension is whether family leakage transfers to vision or speech PEFT services, with a prediction that family accuracy stays above chance on ViT or CLIP backbones.
  • Editorial extension: the near-chance base-mismatch detector implies that any practical deployment of the method should require a hash-verified base checkpoint before accepting structural bounds, and building a reliable mismatch detector is an open problem.
  • Editorial extension: the visibility-exploitability gap suggests that defenders can reduce practical risk cheaply by switching to label-only or sampled-token interfaces, since those collapse passive family inference to chance in these experiments.
  • Editorial extension: exact-version linkage likely generalizes beyond MNLI LoRA-r64 to other bases and tasks, but the five held-out services are too few to support a cross-platform attribution claim without a larger independent checkpoint set.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies black-box structural leakage from public-base PEFT services. It introduces VectorHijack-SR, a residual-signature measurement pipeline that converts paired victim/base outputs into calibrated bounds over PEFT family, layer locality, and coarse rank, and evaluates consequences including open-set rejection, base-mismatch robustness, private-version linkage, and cost-matched recovery. The experiments report above-chance family leakage on BERT/MNLI, RoBERTa/MNLI, and DeBERTa-v3; task-dependent rank leakage; an open-set rejector with pooled AUROC 0.804 on a ten-seed BERT grid; exact-version linkage AUC 0.940 on five held-out LoRA-r64 services; and a visibility–exploitability gap with no fair-budget query savings and no fidelity superiority over distill→PEFT. The paper frames these as conditional, measurement-level claims and is explicit about statistical limitations.

Significance. If the results hold, the paper is a valuable security measurement contribution: it demonstrates that rich-output, known-base PEFT services can leak adaptation structure and lineage, while carefully delimiting the conditions under which leakage occurs. The statistical care is a genuine strength: prespecified endpoints, Holm correction, Wilson intervals, service-cluster bootstrap, explicit reporting of non-significant results (e.g., DeBERTa/MNLI rank q=0.350), and an artifact with raw records and reproduction scripts. The three-gate observability model is a useful conceptual contribution, and the negative results (free-running generation, label-only interfaces, no query savings) are reported with restraint. The main risk is the internal validity of the lineage experiment, which carries the 'version information' component of the central claim.

major comments (3)
  1. [Section 3.5 / 6.1 / Table 13] The lineage experiment does not specify how probe seeds are assigned to positive versus hard-negative pairs. Section 3.5 states that positive pairs use distinct probe views of the same checkpoint, but it does not state whether hard-negative pairs also combine two different probe seeds or how seed-pair identities are balanced. Because each service view is averaged over queries from a particular probe seed, and the seed determines query subset, template, length, and margin statistics, the pair representation q(a,b) in Eq. (16) can encode seed identity (e.g., 'are these two views from different seeds?') rather than checkpoint lineage. The service-pair bootstrap does not remove this confound because it resamples the same view objects. Please report the seed-pair distribution for positives and negatives, match seed-pair identity across positive and negative pairs, and add a seed-only control (e.g., a scorer trained to distinguish seed-pair types) to show that the AUC 0.940 reflects checkpoint identity rather than probe-seed identity.
  2. [Section 3.5 vs. Appendix C.3 / Table 20] There is an internal inconsistency about which hard negatives were used to train the lineage scorer. Section 3.5 says the scorer is trained 'only on exact-checkpoint positive pairs and the strict hard negative' (same task, base, family, modules, rank, different checkpoint), but Appendix C.3 lists additional hard negatives: same task/different family, different task/same family, and quantized or output-weakened views of both classes. If any of these easier negatives entered training or threshold selection, the held-out AUC on strict same-family negatives in Table 13 could be optimistic because the scorer would have learned to reject family/task mismatches rather than checkpoint-specific identity. Please clarify which negatives were used in each stage and, if necessary, retrain on strict negatives only and re-report the held-out AUC.
  3. [Section 3.5 / Table 13] The five held-out services yield a very wide AUC confidence interval ([0.889, 1.000]), and the paper appropriately acknowledges this. However, because the lineage result is the paper's strongest positive consequence, the report should state more explicitly that the point estimate is fragile and that a larger number of independently trained checkpoints—or a paired analysis that controls for probe-seed identity—is needed before the version-linkage claim can be treated as robust. Adding such a statement would not change the experimental results but would align the strength of the conclusion with the evidence.
minor comments (5)
  1. [Affiliations] The affiliation line for the second author reads 'King's Collage London'; this should be 'King's College London'.
  2. [Table 16 / Table 18] Table 16 reports known accuracy 0.956 with n=45, while Table 18 shows 39 known views accepted as seen, 0 as wrong, and 6 as unknown (39+6=45); please clarify the denominator and definition of known accuracy, since 39/45 = 0.867.
  3. [Table 19] In Table 19, the 'Detect' column appears to report the rejection rate at a locked threshold, while the text reports a locked-protocol mismatch AUROC near 0.45; please make the reporting unit explicit in the caption.
  4. [Table 11] The caption of Table 11 appears to have a formatting issue in the 'Top-k union' row, where the utility value 1.000 is separated from the rest of the row; please reformat the table.
  5. [General terminology] The paper uses the term 'service-disjoint classifier' to describe a split that is actually checkpoint-disjoint; consider aligning the terminology with the data-generation process to avoid confusion.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: all primary claims are held-out empirical measurements, and no equation or self-citation reduces a result to its inputs by construction.

full rationale

VectorHijack-SR is an empirical measurement pipeline, not a derivation chain. The structural posterior p_cl(h|z) is defined as the softmax of a class-balanced logistic model fit on calibration services and is explicitly disclaimed as a Bayesian posterior over private weights (Section 3.3 and Appendix A.1). Family, rank, and open-set results are evaluated on service-disjoint held-out victims: the hierarchical rejector is trained on leave-one-known-structure-out pseudo-unknowns with thresholds locked on separate services (Section 3.4), and the ten-seed pooled AUROC 0.804 is a held-out measurement, not a fitted artifact. The lineage scorer in Section 3.5 is trained only on exact-checkpoint positive pairs versus same-structure independently-trained hard negatives, with calibration, threshold-selection, and test checkpoints disjoint (Table 20 and Appendix C.3); the AUC 0.940 on five held-out services is therefore a measured generalization, not an identity. The paper's own Limitations (Section 9) and Appendix C.2 concede that the public-base mismatch detector is near chance and that five lineage services give a wide interval, so the strongest claims are not rescued by definitional sleight-of-hand. No load-bearing self-citation or imported uniqueness theorem occurs; all referenced external works are standard baselines, and the central statistics are computed from the reported runs rather than cited. Coarse rank buckets are hand-chosen, but task dependence is honestly presented, including a DeBERTa/MNLI rank result explicitly compatible with chance after Holm correction (Table 3). The skeptic's probe-seed confound for lineage attribution is a validity threat, not a circularity step: the paper does not define the same-vs-independent label in terms of probe-seed identity, and no equation in the paper makes the predicted quantity equal to an input feature by construction.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The empirical claims rely on standard supervised learning and statistical inference. The main hand-chosen parameters are the rank bucket boundaries and the service-view batch size, both disclosed. No new physical or conceptual entities are introduced.

free parameters (2)
  • Rank bucket boundaries = low: r<=16; mid: 16<r<=128; high: r>128
    These boundaries are chosen by the authors; rank inference results in Table 3 depend on this coarse partition.
  • Signature batch size = 100 queries; batches smaller than 50 discarded
    Batch aggregation size affects the variance of service views and therefore the stability of the fitted classifiers (Appendix B).
assumptions (3)
  • domain assumption The auditor knows and can locally execute the exact public base checkpoint, tokenizer, and inference code that the service uses.
    Explicitly stated in Section 2.2 as the primary matched-base measurement condition; the mismatch detector is near chance, so this premise cannot be verified externally.
  • domain assumption Service-level residual signatures are stable enough across independent training runs for discriminative classification.
    The closed-set classifier (Section 3.3) treats each service view as a sample; the empirical results test this, but the underlying stability is assumed for generalization.
  • standard math Statistical inference on small grids uses victim/seed outcomes as the unit, and Wilson intervals and exact binomial tests are appropriate given the sample size.
    Stated in Section 4.5; this is a standard statistical approach.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services." pith.science (2026). https://pith.science/paper/EIOCCCVX

@misc{pith2026260805036,
  author       = {Pith},
  title        = {Pith review of: When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EIOCCCVX}},
  note         = {Machine review of arXiv:2608.05036}
}
read the original abstract

Services increasingly deploy public foundation models with private parameter-efficient adaptations, creating a differential information leakage risk when auditors or adversaries can execute the public base model locally and observe victim outputs. We present VectorHijack-SR, a measurement methodology that converts paired victim/base residuals into calibrated structural bounds over PEFT family, layer locality, and coarse rank, while separating metadata visibility from open-world validity and operational exploitability. Our estimator aggregates query-level magnitude, ranking, entropy, margin, length, template, locality, and spectral statistics into service-level representations. A service-disjoint classifier quantifies structural evidence, and a cross-fitted hierarchical rejector evaluates whether a victim lies outside the calibrated LoRA manifold. Across classification backbones, family leakage exceeds uniform chance on BERT/MNLI (8/12), RoBERTa/MNLI (21/24), and DeBERTa-v3 on MNLI (12/18) and AG News (15/18). Rank inference is task dependent: BERT/MNLI and DeBERTa/AG News reach 8/9, whereas DeBERTa/MNLI achieves 4/9 and is statistically compatible with chance after correction. On a ten-seed BERT open-set grid, the rejector achieves pooled AUROC 0.804 (95% CI [0.660, 0.927]) and known accuracy 0.956, but remains limited on structurally close DoRA and LoRA+head variants. Exact-version linkage on five held-out LoRA-r64 services reaches AUC 0.940. Experiments reveal a visibility-exploitability gap: two-stage recovery provides no fair-budget query savings, posterior-selected PEFT underperforms distill-then-convert PEFT (0.356 vs. 0.517), and free-running generation remains near chance. These results show that known-base, rich-output PEFT services can leak actionable structural and version information, while closed-set confidence alone does not establish universal adapter recovery.

Figures

Figures reproduced from arXiv: 2608.05036 by the authors.

Figure 1
Figure 1. System overview of VectorHijack-SR. Identical probes are sent to the PEFT-enabled service and the locally executed [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Generation mechanism analysis: step-wise KL un [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 53 canonical work pages

  1. [1]

    Turning your weakness into a strength: Watermarking deep neural networks by back- dooring

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by back- dooring. In27th USENIX Security Symposium, pages 1615–1631. USENIX Association, 2018

    work page 2018

  2. [2]

    Model leeching: An extrac- tion attack targeting large language models, 2023

    Lewis Birch, William Hackett, Stefan Trawicki, Neeraj Suri, and Peter Garraghan. Model leeching: An extrac- tion attack targeting large language models, 2023

    work page 2023

  3. [3]

    Quantifying memorization across neural language mod- els

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language mod- els. InInternational Conference on Learning Represen- tations, 2023

    work page 2023

  4. [4]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In30th USENIX Security Symposium (USENIX Security 21), pages 2633–2650. USENIX Association, 2021

    work page 2021

  5. [5]

    Exploring Connections Between Active Learning and Model Extraction

    Varun Chandrasekaran, Kamalika Chaudhuri, Irene Gia- comelli, Somesh Jha, and Songbai Yan. Exploring con- nections between active learning and model extraction. arXiv preprint arXiv:1811.02054, 2018

    work page Pith review arXiv 2018

  6. [6]

    MeaeQ: Mount model extraction attacks with efficient queries

    Chengwei Dai, Minxuan Lv, Kun Li, and Wei Zhou. MeaeQ: Mount model extraction attacks with efficient queries. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 12671–12684, 2023

    work page 2023

  7. [7]

    QLoRA: Efficient finetuning of quan- 12 tized LLMs

    Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. QLoRA: Efficient finetuning of quan- 12 tized LLMs. InAdvances in Neural Information Pro- cessing Systems, volume 36, 2023

    work page 2023

  8. [8]

    Do membership inference attacks work on large language models? InFirst Conference on Language Modeling, 2024

    Michael Duan, Anshuman Suri, Niloofar Mireshghal- lah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Ha- jishirzi. Do membership inference attacks work on large language models? InFirst Conference on Language Modeling, 2024

    work page 2024

Show all 55 references
  1. [9]

    Membership inference at- tacks against fine-tuned large language models via self- prompt calibration

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Membership inference at- tacks against fine-tuned large language models via self- prompt calibration. InAdvances in Neural Information Processing Systems, volume 37, 2024

    2024

  2. [10]

    De- BERTaV3: Improving DeBERTa using ELECTRA-style pre-training with gradient-disentangled embedding shar- ing, 2021

    Pengcheng He, Jianfeng Gao, and Weizhu Chen. De- BERTaV3: Improving DeBERTa using ELECTRA-style pre-training with gradient-disentangled embedding shar- ing, 2021

    2021

  3. [11]

    Extracted BERT model leaks more information than you think! InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 1530–1537, 2022

    Xuanli He, Lingjuan Lyu, Chen Chen, and Qiongkai Xu. Extracted BERT model leaks more information than you think! InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 1530–1537, 2022

    2022

  4. [12]

    Xuanli He, Lingjuan Lyu, Qiongkai Xu, and Lichao Sun. Model extraction and adversarial transferability, your BERT is vulnerable! InProceedings of the 2021 Confer- ence of the North American Chapter of the Association for Computational Linguistics: Human Language Tech- nologies...

    2021

  5. [13]

    Parameter- efficient transfer learning for nlp

    Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin de Laroussilhe, Andrea Ges- mundo, Mona Attariyan, and Sylvain Gelly. Parameter- efficient transfer learning for nlp. InInternational Con- ference on Machine Learning, pages 2790–2799. PMLR, 2019

    2019

  6. [14]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685, 2021

    2021 arXiv

  7. [15]

    Editing models with task arithmetic

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Worts- man, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. InInternational Conference on Learning Representations, 2023

    2023

  8. [16]

    High accuracy and high fidelity extraction of neural networks

    Matthew Jagielski, Nicholas Carlini, David Berthelot, Alexey Kurakin, and Nicolas Papernot. High accuracy and high fidelity extraction of neural networks. In29th USENIX Security Symposium (USENIX Security 20), pages 1345–1362. USENIX Association, 2020

    2020

  9. [17]

    Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot

    Hengrui Jia, Christopher A. Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. Entangled wa- termarks as a defense against model extraction. In 30th USENIX Security Symposium, pages 1937–1954. USENIX Association, 2021

    1937

  10. [18]

    Mika Juuti, Sebastian Szyller, Samuel Marchal, and N. Asokan. PRADA: Protecting against DNN model stealing attacks. In2019 IEEE European Symposium on Security and Privacy, pages 512–527, 2019

    2019

  11. [19]

    Sanjay Kariyappa, Atul Prakash, and Moinuddin K. Qureshi. MAZE: Data-free model stealing attack using zeroth-order gradient estimation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13814–13823, 2021

    2021

  12. [20]

    Sanjay Kariyappa and Moinuddin K. Qureshi. Defend- ing against model stealing attacks with adaptive misin- formation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 770– 778, 2020

    2020

  13. [21]

    The thieves on sesame street are polyglots—extracting multilingual models from mono- lingual APIs

    Nitish Shirish Keskar, Bryan McCann, Caiming Xiong, and Richard Socher. The thieves on sesame street are polyglots—extracting multilingual models from mono- lingual APIs. InProceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, pages 6203–6207, 2020

    2020

  14. [22]

    A watermark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. InProceedings of the 40th In- ternational Conference on Machine Learning, pages 17061–17084, 2023

    2023

  15. [23]

    ClearStamp: A human-visible and robust model- ownership proof based on transposed model training

    Torsten Krauss, Jasper Stang, and Alexandra Dmitrienko. ClearStamp: A human-visible and robust model- ownership proof based on transposed model training. In33rd USENIX Security Symposium (USENIX Security 24), pages 5269–5286. USENIX Association, 2024

    2024

  16. [24]

    The power of scale for parameter-efficient prompt tuning

    Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3045– 3059, 2021

    2021

  17. [25]

    Prefix-tuning: Optimiz- ing continuous prompts for generation

    Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimiz- ing continuous prompts for generation. InProceedings of the 59th Annual Meeting of the Association for Com- putational Linguistics and the 11th International Joint Conference on Natural Language Processing, pages 4582–4597, 2021

    2021

  18. [26]

    Jian Liu, Rui Zhang, Sebastian Szyller, Kui Ren, and N. Asokan. False claims against model ownership reso- lution. In33rd USENIX Security Symposium (USENIX 13 Security 24), pages 6885–6902. USENIX Association, 2024

    2024

  19. [27]

    DoRA: Weight- decomposed low-rank adaptation

    Shih-Yang Liu, Chien-Yi Wang, Hongxu Yin, Pavlo Molchanov, Yu-Chiang Frank Wang, Kwang-Ting Cheng, and Min-Hung Chen. DoRA: Weight- decomposed low-rank adaptation. InProceedings of the 41st International Conference on Machine Learning, 2024

    2024

  20. [28]

    Privacy-preserving low-rank adap- tation against membership inference attacks for latent diffusion models, 2024

    Zihao Luo, Xilie Xu, Feng Liu, Yun Sing Koh, Di Wang, and Jingfeng Zhang. Privacy-preserving low-rank adap- tation against membership inference attacks for latent diffusion models, 2024

    2024

  21. [29]

    Dataset inference: Ownership resolution in ma- chine learning

    Pratyush Maini, Mohammad Yaghini, and Nicolas Pa- pernot. Dataset inference: Ownership resolution in ma- chine learning. InInternational Conference on Learning Representations, 2021

    2021

  22. [30]

    Membership inference attacks against language models via neighbourhood compari- son

    Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Tay- lor Berg-Kirkpatrick. Membership inference attacks against language models via neighbourhood compari- son. InFindings of the Association for Computational Linguistics: ACL 2...

    2023

  23. [31]

    Meta Llama 3 model card

    Meta AI. Meta Llama 3 model card. Model documenta- tion, 2024

    2024

  24. [32]

    Quantifying privacy risks of masked language models using membership inference attacks

    Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, ...

    2022

  25. [33]

    Com- prehensive privacy analysis of deep learning: Passive and active white-box inference attacks against central- ized and federated learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Com- prehensive privacy analysis of deep learning: Passive and active white-box inference attacks against central- ized and federated learning. In2019 IEEE Symposium on Security and Privacy, pages 739–753, 2019

    2019

  26. [34]

    SoK: All you need to know about on-device ML model extraction—the gap between research and practice

    Tushar Nayan, Qiming Guo, Mohammed Al Duniawi, Marcus Botacin, Selcuk Uluagac, and Ruimin Sun. SoK: All you need to know about on-device ML model extraction—the gap between research and practice. In 33rd USENIX Security Symposium, pages 5233–5250. USENIX Association, 2024

    2024

  27. [35]

    Knockoff nets: Stealing functionality of black-box mod- els

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box mod- els. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4954– 4963, 2019

    2019

  28. [36]

    Prediction poisoning: Utility-constrained defenses against model stealing attacks

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Prediction poisoning: Utility-constrained defenses against model stealing attacks. InInternational Confer- ence on Learning Representations, 2020

    2020

  29. [37]

    Berkay Celik, and Ananthram Swami

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. InProceedings of the 2017 ACM Asia Conference on Computer and Communications Security, pages 506– 519, 2017

    2017

  30. [38]

    Kornaropoulos, and Giuseppe Ateniese

    Dario Pasquini, Evgenios M. Kornaropoulos, and Giuseppe Ateniese. LLMmap: Fingerprinting for large language models. In34th USENIX Security Symposium (USENIX Security 25), pages 299–318, Seattle, W A, Au- gust 2025. USENIX Association

    2025

  31. [39]

    DeepEclipse: How to break white-box DNN-watermarking schemes

    Alessandro Pegoraro, Carlotta Segna, Kavita Kumari, and Ahmad-Reza Sadeghi. DeepEclipse: How to break white-box DNN-watermarking schemes. In33rd USENIX Security Symposium (USENIX Security 24), pages 5287–5304. USENIX Association, 2024

    2024

  32. [40]

    AdapterFusion: Non-destructive task composition for transfer learning

    Jonas Pfeiffer, Aishwarya Kamath, Andreas Rueckle, Kyunghyun Cho, and Iryna Gurevych. AdapterFusion: Non-destructive task composition for transfer learning. InProceedings of the 16th Conference of the European Chapter of the Association for Computational Linguis- tics, pages 4...

    2021

  33. [41]

    LoRA soups: Merging LoRAs for practical skill composition tasks

    Akshara Prabhakar, Yuanzhi Li, Karthik Narasimhan, Sham Kakade, Eran Malach, and Samy Jelassi. LoRA soups: Merging LoRAs for practical skill composition tasks. InProceedings of the 31st International Con- ference on Computational Linguistics: Industry Track, pages 644–655, Abu...

    2025

  34. [42]

    Provably robust multi-bit watermarking for AI-generated text

    Wenjie Qu, Wengrui Zheng, Tianyang Tao, Dong Yin, Yanze Jiang, Zhihua Tian, Wei Zou, Jinyuan Jia, and Jiaheng Zhang. Provably robust multi-bit watermarking for AI-generated text. In34th USENIX Security Sym- posium (USENIX Security 25), pages 201–220, Seattle, W A, August 2025....

    2025

  35. [43]

    LoRA-Leak: Membership in- ference attacks against LoRA fine-tuned language mod- els, 2025

    Delong Ran, Xinlei He, Tianshuo Cong, Anyu Wang, Qi Li, and Xiaoyun Wang. LoRA-Leak: Membership in- ference attacks against LoRA fine-tuned language mod- els, 2025

    2025

  36. [44]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vi- taly Shmatikov. Membership inference attacks against machine learning models. In2017 IEEE Symposium on Security and Privacy, pages 3–18, 2017. 14

    2017

  37. [45]

    ModelGuard: Information-theoretic de- fense against model extraction attacks

    Minxue Tang, Anna Dai, Louis DiValentin, Aolin Ding, Amin Hass, Neil Zhenqiang Gong, Yiran Chen, and Hai Helen Li. ModelGuard: Information-theoretic de- fense against model extraction attacks. In33rd USENIX Security Symposium, pages 5305–5322. USENIX Asso- ciation, 2024

    2024

  38. [46]

    Reiter, and Thomas Ristenpart

    Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. Stealing machine learning mod- els via prediction apis. In25th USENIX Security Sympo- sium (USENIX Security 16), pages 601–618. USENIX Association, 2016

    2016

  39. [47]

    Embedding watermarks into deep neu- ral networks

    Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. Embedding watermarks into deep neu- ral networks. InProceedings of the 2017 ACM on In- ternational Conference on Multimedia Retrieval, pages 269–277, 2017

    2017

  40. [48]

    Imitation attacks and defenses for black-box machine translation systems

    Eric Wallace, Mitchell Stern, and Dawn Song. Imitation attacks and defenses for black-box machine translation systems. InProceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, pages 5531–5546, 2020

    2020

  41. [49]

    TIES-merging: Resolving inter- ference when merging models

    Prateek Yadav, Derek Tam, Leshem Choshen, Colin Raf- fel, and Mohit Bansal. TIES-merging: Resolving inter- ference when merging models. InAdvances in Neural Information Processing Systems, volume 36, 2023

    2023

  42. [50]

    Re- thinking white-box watermarks on deep learning models under neural structural obfuscation

    Yifan Yan, Xudong Pan, Mi Zhang, and Min Yang. Re- thinking white-box watermarks on deep learning models under neural structural obfuscation. In32nd USENIX Security Symposium, pages 2347–2364. USENIX Asso- ciation, 2023

    2023

  43. [51]

    Data-Free Model-Related attacks: Unleashing the potential of generative AI

    Dayong Ye, Tianqing Zhu, Shang Wang, Bo Liu, Leo Yu Zhang, Wanlei Zhou, and Yang Zhang. Data-Free Model-Related attacks: Unleashing the potential of generative AI. In34th USENIX Security Symposium (USENIX Security 25), pages 1709–1727, Seattle, W A, August 2025. USENIX Association

    2025

  44. [52]

    Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially private fine-tuning of language models. InInternational Con- ference on Lear...

    2022

  45. [53]

    Bitfit: Simple parameter-efficient fine-tuning for transformer-based masked language-models

    Elad Ben Zaken, Shauli Ravfogel, and Yoav Gold- berg. Bitfit: Simple parameter-efficient fine-tuning for transformer-based masked language-models. InPro- ceedings of the 60th Annual Meeting of the Association for Computational Linguistics, pages 1–9, 2022

    2022

  46. [54]

    REMARK-LLM: A robust and efficient watermarking framework for gener- ative large language models

    Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushanfar. REMARK-LLM: A robust and efficient watermarking framework for gener- ative large language models. In33rd USENIX Security Symposium (USENIX Security 24), pages 1813–1830. USENIX Association, 2024

    2024

  47. [55]

    family-level

    Yuanxin Zhuang, Chuan Shi, Mengmei Zhang, Jinghui Chen, Lingjuan Lyu, Pan Zhou, and Lichao Sun. Unveil- ing the secrets without data: Can graph neural networks be exploited through data-free model extraction attacks? In33rd USENIX Security Symposium, pages 5251–5268. USENIX As...

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.