Pith. sign in

REVIEW 4 major objections 4 minor 55 references

SECNEURON: Reliable and Flexible Abuse Control in Local LLMs via Hybrid Neuron Encryption

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SECNEURON claims that neuron-level encryption plus selective decryption can stop locally deployed LLMs from performing unauthorized tasks, even against a white-box deployer, while keeping authorized task accuracy within 2%.

desk verdict A clever neuron-encryption mechanism for task gating with strong static results, but the certified guarantee depends on an unverified controllability principle and fine-tuning recovery is unaddressed. read the letter →

arxiv 2506.05242 v1 pith:GANLLG53 submitted 2025-06-05 cs.CR

Zhiqiang Wang , Haohua Du , Junyang Wang , Haifeng Sun , Kaiwen Guo , Haikuo Yu , Chao Liu , Xiang-Yang Li This is my paper
classification cs.CR
keywords localLLMdeploymenttask-levelaccesscontrolneuron-levelencryptionselectivedecryptionCP-ABEAES-CTRcollusionresistancetrainingdataextraction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SECNEURON proposes that abuse control for locally deployed LLMs should be baked into the model's weights rather than enforced by prompts, filters, or alignment. The paper's central claim is that encrypting the neurons a task depends on, and handing out decryption keys only for authorized tasks, gives a provable guarantee that an unauthorized deployer cannot make the model perform that task, even with full white-box access. The system also makes permission changes cheap: the model is encrypted once, and an update is only a small key exchange. The experiments show unauthorized task accuracy dropping below 25% or by more than 40% (below 10% for OPT), malicious code generation falling from 59% to 15%, authorized accuracy loss under 2%, PII extraction below 5%, and membership inference near random guessing. If this holds, locally deployed models can be licensed and restricted per task without per-deployer re-encryption or retraining.

What carries the argument

The load-bearing machinery is the combination of a task-specific neuron selector, a two-layer hybrid encryption stack, and a ciphertext-distribution detector. The selector scores each neuron by its mean absolute activation on task $t$ minus $\lambda$ times its largest activation on any other task, and keeps neurons until the cumulative score reaches $\tau$ times the total score. The policy layer encrypts per-subset AES keys under CP-ABE; overlapping neurons get their own subsets, with an OR-node policy so authorized users of any involved task can decrypt them. The execution layer encrypts each neuron's input/output weights and bias with AES-CTR, using the neuron index as the counter. The detector separates decrypted from undecrypted neurons by FLOAT outlier maxima and INT8 histogram variance, letting the partially decrypted model prune everything it could not unlock. The proof's central assumption is Definition 5.1, the Task Controllability Principle, which asserts that such disjoint critical subsets exist; Theorem 3 uses it to rule out collusion through coupled neurons.

What would settle it

For a concrete model, compute each task's minimal critical neuron set by greedy pruning in descending importance order and check pairwise disjointness; if two tasks require the same critical neuron, the Task Controllability Principle fails and the certified claim does not apply to that model.

Watch

Extended reading notes

Core claim

The core discovery is that classic attribute-based access control can be embedded directly into the parameter space of an LLM. For each task in a pre-defined set $\mathcal{T}$, SECNEURON selects about 15% of neurons that are important for that task and unimportant for others, using a penalty-adjusted importance score. It encrypts the weights of those neurons with AES-CTR, and encrypts the AES keys with CP-ABE under an access policy tree whose OR-nodes handle neurons shared between tasks and attribute nodes encode user permissions. A deployer's attributes unlock only the keys of authorized tasks, and a distribution-based detector identifies which neurons were not decrypted so they can be pruned. The paper formalizes the guarantee as the Task Controllability Principle: if each task has a disjoint critical neuron set whose removal alone drops that task below its threshold, then unauthorized tasks are unusable while authorized tasks remain intact, and the scheme is IND-CPA secure and collusion-resistant.

Load-bearing premise

The scheme's certified guarantee rests on the Task Controllability Principle: for every task in the protected set there must be a set of neurons whose removal alone drops that task below its threshold $\delta_t$, and these sets must be disjoint across tasks.

Editorial extensions

If this is right

  • If the central claim holds, a deployer authorized only for a subset of tasks cannot get the model to perform another task, even by removing the framework or using adversarial prompts, because the task-critical neurons remain encrypted and are pruned.
  • Permission updates become a lightweight key exchange (millisecond-level computation and around 694 bytes of transmission) instead of re-encrypting and re-downloading a multi-gigabyte model, so one encrypted artifact can serve many permission levels.
  • The protection extends to training data: unauthorized PII extraction falls below 5% and membership inference collapses to near random guessing, defending data-level abuse as well as task-level abuse.
  • Because the model is encrypted once and decrypted selectively by each deployer, developers avoid maintaining and transmitting multiple task-specific model versions; overhead moves from linear in the number of permission combinations to constant.
  • The scheme transfers across architectures in the evaluation, including OPT, Galactica, and Gemma-2 LLMs and a ViT-Base-Patch16 vision transformer, suggesting it is not tied to a single model family.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the guarantee only covers tasks in the pre-defined set $\mathcal{T}$; unlisted capabilities, or those surviving through common neurons, may stay usable. The paper's own tables show some unauthorized accuracies above 25%, so the 'below 25%' headline is configuration-dependent.
  • Inference: the threat model assumes the deployer uses the delivered model as-is. Because the model is white-box and local, fine-tuning the decrypted weights to re-learn a blocked capability is not covered by the paper's claims.
  • Inference: coarse task boundaries mean blocking 'code' also blocks benign code use, and an authorized task like Math could be redirected to code-like queries in practice.
  • Inference: the Task Controllability Principle is testable. Greedy pruning can reveal whether any two tasks share critical neurons; if they do, Theorem 3's collusion argument for that pair fails.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper presents SECNEURON, a framework for task-level abuse control in locally deployed LLMs. The developer encrypts a selected set of neurons using AES-CTR, manages the AES keys through CP-ABE access policies, and distributes a single encrypted model. Deployers decrypt only the neurons associated with their authorized tasks; the remaining ciphertext neurons are pruned by an adaptive pruner. The paper contributes a task-specific neuron scoring mechanism with a penalty factor, a hybrid hierarchical encryption scheme, a distribution-based detection method for undecrypted neurons, and security theorems (IND-CPA and collusion resistance) stated under the Task Controllability Principle. Experiments on OPT, Galactica, Gemma-2, and ViT-Base report unauthorized task accuracy below 25%, authorized accuracy loss within 2%, and mitigation of PII extraction and membership inference attacks.

Significance. If the claims are correct, SECNEURON offers a practical mechanism for reversible, granular capability control in local LLMs, which would be a meaningful contribution to the security of locally deployed models. The paper includes a substantial implementation and evaluates across multiple model families (OPT-6.7B/30B, Galactica-6.7B/30B, Gemma-2-9B/27B, ViT), with low overhead measurements (millisecond-level key generation, byte-level key exchange). However, the certified security guarantee depends on the unverified Task Controllability Principle and on a static adversarial model; moreover, the empirical results are reported without error bars or seeds, and some key hyperparameters are not specified. The core idea is promising, but the current manuscript does not yet substantiate all of its headline claims.

major comments (4)
  1. [Section III.A, Section I] The threat model defines the deployer as a fully white-box adversary with local control, yet the certified claim in Section I that SECNEURON "can theoretically ensure that it cannot be activated or utilized" is only argued for static inference. The mechanism prunes undecrypted neurons, but a deployer with access to the partially decrypted model (which retains common neurons and authorized-task neurons) can fine-tune the model on public data for an unauthorized task, e.g., Code, to restore the pruned capability. Neither the design nor the limitations in Section VIII address this recovery attack, which is central to the motivating deployer-controlled scenario. The paper should either test fine-tuning recovery and report whether accuracy returns above the threshold delta_t, or explicitly restrict the threat model and soften the guarantee accordingly.
  2. [Section V.A, Section VI] Theorem 3's collusion resistance (case 3) and the overall certified safeguard rely on the Task Controllability Principle (Definition 5.1): for each task t there is a disjoint neuron set S'_t whose removal alone degrades task t below delta_t. The paper asserts that "large-scale LLM architectures allow us to readily pinpoint neuron subsets for each task (comprising approximately 15%)" that satisfy this principle, but no direct measurement is provided. The evaluation in Section VI reports end-task accuracies under the full encryption-plus-pruning mechanism, which does not isolate whether the selected neurons are disjoint, whether their removal alone degrades the target task, or whether the property holds for the specific models and tasks tested. Since this principle is an empirical property of the model and is precisely the property needed for the guarantee, the certified claim is conditional on an unverified assumption. Please add a direct measurement: for each task, identify candidate S'_t, prune only those neurons, and report the resulting performance along with disjointness statistics across tasks.
  3. [Section V.B, V.C, Section X] The security proofs are not rigorous enough to support the paper's certified-security wording. Theorem 2's proof is a generic reduction statement that does not specify how the hybrid construction's key derivation from CP-ABE group elements preserves IND-CPA security, nor does it define the reduction for the AES-CTR component. Theorem 3's proof, case 3, simply invokes the Task Controllability Principle without showing that Algorithm 2 actually produces disjoint neuron sets or that the CP-ABE policy tree prevents colluding users from obtaining keys for those sets. In addition, the proof of Theorem 1 in Section X uses undefined notation C'_t and refers to a "Neuron Isolation Principle" that is never defined (the theorem statement says "Task Controllability Principle"). These gaps matter because the abstract and introduction advertise "certified abuse control." Please make the proofs self-contained and state exactly which assumptions are used in each step.
  4. [Section VI.B, VI.E, Table VII] The empirical evaluation lacks statistical reporting and omits key hyperparameters. Figures 8–13 and Tables IV–VI report no error bars, seed numbers, or number of runs, making it impossible to assess the stability of the headline claims (<25% unauthorized accuracy, <2% authorized loss). The penalty factor lambda in Equation (5) is never assigned a value anywhere in the paper, and the detection thresholds vH and m in Section IV.B are tuned per model (as shown in Table VII) to achieve 100% detection. Without these details, the reported improvements could reflect overfitting to the chosen datasets and models rather than a robust mechanism. Please provide the exact hyperparameters, standard deviations across multiple seeds, and the detection-threshold selection procedure.
minor comments (4)
  1. [Section I] The phrase "instinct capabilities" should be "intrinsic capabilities" to match the terminology used elsewhere in the paper.
  2. [Section X] The proof of Theorem 1 uses the term "Neuron Isolation Principle" while the theorem and Definition 5.1 use "Task Controllability Principle"; this inconsistency should be fixed, and the undefined notation C'_t should be defined before use.
  3. [Table VII] Some range entries are implausible: for VIT the undecrypted FLOAT32 range is reported as [4.936, 3.438], and for Gemma-2 the undecrypted FLOAT32 range is [inf, inf]; these appear to be typographical errors that obscure the claimed separability.
  4. [Algorithm 1] In line 15, the call SECNEURON.encrypt(k, M, n, E2) appears to pass the original model M rather than the partially encrypted model CM that is being computed; this is likely a typo and should be clarified.

Circularity Check

1 steps flagged · score 6.0 of 10

The certified abuse-control guarantee is assumed via the Task Controllability Principle, whose key condition is identical to the target capability-limitation property.

  1. self definitional [Section I (certified claim); Section V.A, Definition 5.1; Section V.C, Theorem 3, case 3]
    ""Once a neuron's association with an unauthorized task is explicitly identified, SECNEURON can theoretically ensure that it cannot be activated or utilized, providing a provable safeguard against task abuse." Definition 5.1: "Removing S′t causes the performance of task t to fall below the target threshold: Pt(M \S′t) < δt." Theorem 3 proof: "For 3), due to the Task Controllability Principle, for any task t there must exist a non-overlapping neuron set S′t that cannot be accessed through coupled keys, and S′t is sufficient to render t unusable.""

    The system's target guarantee, Equation (2), is that for every unauthorized task t, Pt(MA) < δt after pruning. Definition 5.1 postulates exactly this: a neuron set S′t whose removal already makes Pt < δt, contained in the selected set. Theorem 3 case 3 then invokes that postulate to conclude the unauthorized task is unusable, and Section I's 'provable safeguard' inherits it. The disjointness condition is also the same disjointness restated by Theorem 1. Thus the central certified guarantee is an assumed premise, not a derived consequence; its conclusion is contained in its definition. Empirical results support the premise post hoc but do not turn the formal claim into a derivation.

full rationale

The cryptographic portions of the security analysis are standard and not circular: Theorem 2 is a textbook IND-CPA reduction to CP-ABE and AES-CTR, and Theorem 3 cases 1 and 2 rely on key independence and CP-ABE security rather than on the target property. The system's empirical evaluation is self-contained and reports genuine measurements against public benchmarks, so the unauthorized-accuracy and PII/MIA numbers are not fitted outputs renamed as predictions. The circularity is confined to the certified-capability claim: Theorem 3's case 3, and by extension the Section I assertion of a 'provable safeguard against task abuse,' depend on the Task Controllability Principle, whose condition 2 is exactly the capability-limitation objective the mechanism is supposed to deliver. The paper states this principle as an axiom and supports it only by the assertion that ~15% neuron subsets can be pinpointed and by later experiments, not by a derivation. Because the conclusion of the security proof is contained in the definition of the principle, the formal guarantee partially reduces to its own input; the independent cryptographic and empirical content prevents this from being a complete collapse, yielding a partial-circularity score of 6.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The mechanism depends on standard cryptographic assumptions plus the domain-specific Task Controllability Principle and a threat model that excludes fine-tuning. The free parameters are empirical tuning knobs that are not fully specified. There are no invented physical or mathematical entities. This ledger shows that the 'certified' guarantee is conditional on assumptions that the paper does not independently verify.

free parameters (4)
  • tau (neuron selection importance threshold) = not reported (fixed for all tasks in experiments)
    Algorithm 2 selects neurons until the cumulative task-specific score exceeds tau. Table IV notes that a fixed tau was used for all tasks, and Section VIII says tau is set empirically.
  • lambda (penalty factor in task-specific score) = not reported
    Eq. (5) subtracts lambda times the maximum activation importance across other tasks. No value or tuning procedure is given, though lambda controls the decoupling behavior.
  • Detection threshold for INT8 neurons (vH) = not reported
    Undecrypted neuron detection compares histogram variance vH to a threshold. Table VII gives observed ranges for decrypted and undecrypted neurons, but the chosen threshold is not specified.
  • Detection threshold for FLOAT neurons (m) = not reported
    Undecrypted neuron detection compares the maximum input value m to a threshold. Table VII gives observed ranges, but the chosen threshold is not specified.
assumptions (6)
  • standard math CP-ABE is IND-CPA secure and collusion resistant
    Theorem 2 and Theorem 3 rely on the standard security properties of the CP-ABE scheme from [38].
  • standard math AES-CTR is IND-CPA secure
    Theorem 2 relies on AES-CTR being a secure stream cipher, as described in Section II-D.
  • domain assumption Task Controllability Principle holds for the target LLM and task set
    Definition 5.1 asserts the existence of disjoint neuron subsets whose removal disables each task. This is used in Theorem 3 and in the overall claim that encrypting and pruning selected neurons blocks unauthorized tasks. It is asserted but not directly measured.
  • domain assumption Mean absolute activation is a valid measure of neuron importance for task-specific selection
    Eq. (4) uses mean absolute activation, and Section VI-A acknowledges it is 'not necessarily the optimal choice.'
  • domain assumption The deployer adversary does not fine-tune or adapt the partially decrypted model
    The threat model in Section III-A considers white-box access and collusion but not fine-tuning. The claim that unauthorized capabilities cannot be recovered assumes the deployer only uses the model as delivered.
  • domain assumption Ciphertext distribution thresholds generalize across models and are not adversarially manipulated
    Section VI-E reports 100% detection on tested models, but threshold-based detection is a heuristic and could be affected by an adversary who knows the detection rule.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SECNEURON: Reliable and Flexible Abuse Control in Local LLMs via Hybrid Neuron Encryption." pith.science (2026). https://pith.science/paper/GANLLG53

@misc{pith2026250605242,
  author       = {Pith},
  title        = {Pith review of: SECNEURON: Reliable and Flexible Abuse Control in Local LLMs via Hybrid Neuron Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GANLLG53}},
  note         = {Machine review of arXiv:2506.05242}
}
read the original abstract

Large language models (LLMs) with diverse capabilities are increasingly being deployed in local environments, presenting significant security and controllability challenges. These locally deployed LLMs operate outside the direct control of developers, rendering them more susceptible to abuse. Existing mitigation techniques mainly designed for cloud-based LLM services are frequently circumvented or ineffective in deployer-controlled environments. We propose SECNEURON, the first framework that seamlessly embeds classic access control within the intrinsic capabilities of LLMs, achieving reliable, cost-effective, flexible, and certified abuse control for local deployed LLMs. SECNEURON employs neuron-level encryption and selective decryption to dynamically control the task-specific capabilities of LLMs, limiting unauthorized task abuse without compromising others. We first design a task-specific neuron extraction mechanism to decouple logically related neurons and construct a layered policy tree for handling coupled neurons. We then introduce a flexible and efficient hybrid encryption framework for millions of neurons in LLMs. Finally, we developed a distribution-based decrypted neuron detection mechanism on ciphertext to ensure the effectiveness of partially decrypted LLMs. We proved that SECNEURON satisfies IND-CPA Security and Collusion Resistance Security under the Task Controllability Principle. Experiments on various task settings show that SECNEURON limits unauthorized task accuracy to below 25% while keeping authorized accuracy loss with 2%. Using an unauthorized Code task example, the accuracy of abuse-related malicious code generation was reduced from 59% to 15%. SECNEURON also mitigates unauthorized data leakage, reducing PII extraction rates to below 5% and membership inference to random guesses.

Figures

Figures reproduced from arXiv: 2506.05242 by the authors.

Figure 1
Figure 1. Workflow of SECNEURON. Developer encrypts their LLM once (One-time Encryption). Different deployers down￾load the same encrypted LLM and dynamically decrypt au￾thorized tasks while restricting unauthorized capabilities to mitigate abuse. (Multi-party Selective Decryption). The devel￾oper maintained and released one single encrypted LLM, while deployers also download it once even if permissions change (One-time Trans… view at source ↗
Figure 2
Figure 2. Pipeline for local deployment of LLMs. S [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Multi-task performance after fine-tuning for Code [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Overview of SECNEURON framework. SECNEURON (blue part) serves as a plug-and-play secure tool in model distribution and local deployment pipeline. When permissions change, developers can adjust the capability of the local LLM by only simple key exchanges (red dotted lin…
Figure 5
Figure 5. Figure 5: Illustration of AES key assignment. Code Health Math Developer Deployer Inst. Hospital Lic. True … … … Neuron-Level Policy User-Level Policy [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Access policy tree for the CP-ABE encryptor, [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: The distribution (WIN ) of encrypted neurons exhibits notable differences compared to original neurons. parameters, we can determine whether it has been decrypted (the same with FLOAT32). INT8. The range of INT8 model parameters lies between [-128, 127] and remains inv…
Figure 8
Figure 8. Figure 8: Effectiveness of Task-Level Capabilities Control: limiting unauthorized tasks while preserving authorized ones. Admin is [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Effectiveness in Preventing Data-Level Abuse. [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 11
Figure 11. Figure 11: Comparison with Naive Pruning TABLE V: Detailed Overhead Measurements for OPT-6.7B. First Deployment Capability Update Computationa Transmission Computational Transmission Encryptor 136.65s 6.4GB + 8.9KB 0.006s 694B T-E Dec. 167.48s 6.4GB + 8.9KB 167.48s 694B C-E Dec.…
Figure 12
Figure 12. Figure 12: Examples of Gemma-2 with unauthorized Code [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]
Figure 13
Figure 13. Figure 13: Effect of Model Architecture and Size. TABLE VI: Effectiveness of Image-based Large models. Permissions List ViT-Base-Patch16 Animals Plants & Land. Food Transportation [✔— ✔— ✔— ✔] 81.79% 84.35% 82.03% 84.51% [✔— ✔— ✘— ✔] 80.69% 84.20% 16.75% 83.69% [✔— ✔— ✔— ✘] 79.1…
Figure 14
Figure 14. Figure 14: Binary storage formats of FLOAT16 and INT8. X. PROOF Proof of THEOREM 5.1. Proof. For a given LLM M and a set of tasks T , satisfying the Neuron Isolation Principle requires: X t∈T |S ′ t | = | [ t∈T S ′ t | ≤ |M| (8) We select the smallest neuron set S min t = arg mi…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

55 extracted references · 35 canonical work pages

  1. [13]

    Dissecting language models: Machine unlearning via selective pruning,

    N. Pochinkov and N. Schoots, “Dissecting language models: Machine unlearning via selective pruning,” 2024. [Online]. Available: https://arxiv.org/abs/2403.01267

    arXiv 2024

  2. [1]

    Toward expert-level medical question answering with large language models,

    K. Singhal, T. Tu, J. Gottweis, R. Sayres, E. Wulczyn, M. Amin, L. Hou, K. Clark, S. R. Pfohl, H. Cole-Lewis et al., “Toward expert-level medical question answering with large language models,” Nature Medicine, pp. 1–8, 2025

    2025

  3. [2]

    LLMs in Mobile Apps: Practices, Challenges, and Opportunities

    K. Hau, S. Hassan, and S. Zhou, “Llms in mobile apps: Practices, challenges, and opportunities,” arXiv preprint arXiv:2502.15908 , 2025

    work page Pith review arXiv 2025

  4. [3]

    Building AI Security: The On-Premise Advan- tage

    Edge Evolve, “Building AI Security: The On-Premise Advan- tage.” https://www.edgeevolve.com/building-ai-security-the-on-premise- advantage/, 2025-03-04

    work page 2025

  5. [4]

    Beyond clouds: Locally runnable llms as a secure solution for ai applications,

    B. P. Kumar and M. S. Ahmed, “Beyond clouds: Locally runnable llms as a secure solution for ai applications,” Digital Society , vol. 3, no. 3, p. 49, 2024

    work page 2024

  6. [5]

    Ai-generated research paper fabrication and plagiarism in the scientific community,

    F. R. Elali and L. N. Rachid, “Ai-generated research paper fabrication and plagiarism in the scientific community,” Patterns, vol. 4, no. 3, p. 100706, 2023. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2666389923000430

    work page 2023

  7. [6]

    How cybercriminals are using chatgpt to build hacking tools and ransomware,

    K. Wiggers, “How cybercriminals are using chatgpt to build hacking tools and ransomware,” VentureBeat, March 2023, accessed on March 21, 2025. [Online]. Available: https://venturebeat.com/security/chatgpt- ransomware-malware/

    work page 2023

  8. [7]

    Code llama: Open foundation models for code,

    B. Rozi `ere, J. Gehring, F. Gloeckle, S. Sootla, I. Gat, X. E. Tan, Y . Adi, J. Liu, R. Sauvestre, T. Remez, J. Rapin, A. Kozhevnikov, I. Evtimov, J. Bitton, M. Bhatt, C. C. Ferrer, A. Grattafiori, W. Xiong, A. D ´efossez, J. Copet, F. Azhar, H. Touvron, L. Martin, N. Usunier, T. Scialom, and G. Synnaeve, “Code llama: Open foundation models for code,” 20...

    arXiv 2024

Show all 55 references
  1. [8]

    Distill gpt-2 story generator,

    isarth, “Distill gpt-2 story generator,” https://huggingface.co/isarth/distill gpt2 story generator/discussions, 2023, accessed: 2025-04-05

    2023

  2. [9]

    Training language models to follow instructions with human feedback,

    L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. L. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray, J. Schulman, J. Hilton, F. Kelton, L. Miller, M. Simens, A. Askell, P. Welinder, P. Christiano, J. Leike, and R. Lowe, “Training language models to follow instructions...

    2022 arXiv

  3. [10]

    Training language models to follow instructions with human feedback,

    ——, “Training language models to follow instructions with human feedback,” in Proceedings of the 36th International Conference on Neural Information Processing Systems , ser. NIPS ’22. Red Hook, NY , USA: Curran Associates Inc., 2022

    2022

  4. [11]

    Deep reinforcement learning from human preferences,

    P. F. Christiano, J. Leike, T. B. Brown, M. Martic, S. Legg, and D. Amodei, “Deep reinforcement learning from human preferences,” in Proceedings of the 31st International Conference on Neural Information Processing Systems , ser. NIPS’17. Red Hook, NY , USA: Curran Associates ...

    2017

  5. [12]

    Fast machine unlearning without retraining through selective synaptic dampening,

    J. Foster, S. Schoepf, and A. Brintrup, “Fast machine unlearning without retraining through selective synaptic dampening,” 2023. [Online]. Available: https://arxiv.org/abs/2308.07707

    2023 arXiv

  6. [14]

    Machine unlearning,

    L. Bourtoule, V . Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, “Machine unlearning,” in 2021 IEEE Symposium on Security and Privacy (SP) , 2021, pp. 141– 159

    2021

  7. [15]

    Watermarking large language models and the generated content: Opportunities and challenges,

    R. Zhang and F. Koushanfar, “Watermarking large language models and the generated content: Opportunities and challenges,” arXiv preprint arXiv:2410.19096, 2024

    2024 arXiv

  8. [16]

    Watermarking techniques for large language models: A survey,

    Y . Liang, J. Xiao, W. Gan, and P. S. Yu, “Watermarking techniques for large language models: A survey,” arXiv preprint arXiv:2409.00089, 2024

    2024 arXiv

  9. [17]

    Mark your llm: Detecting the misuse of open-source large language models via watermarking,

    Y . Xu, A. Liu, X. Hu, L. Wen, and H. Xiong, “Mark your llm: Detecting the misuse of open-source large language models via watermarking,” arXiv preprint arXiv:2503.04636 , 2025

    2025 arXiv

  10. [18]

    Periodic watermarking for copyright protection of large language models in cloud computing security,

    P.-G. Ye, Z. Li, Z. Yang, P. Chen, Z. Zhang, N. Li, and J. Zheng, “Periodic watermarking for copyright protection of large language models in cloud computing security,” Computer Standards & Interfaces, p. 103983, 2025

    2025

  11. [19]

    Defending against alignment- breaking attacks via robustly aligned LLM,

    B. Cao, Y . Cao, L. Lin, and J. Chen, “Defending against alignment- breaking attacks via robustly aligned LLM,” in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , L.-W. Ku, A. Martins, and V . Srikumar, Eds. Ban...

    2024

  12. [20]

    GradSafe: Detecting jailbreak prompts for LLMs via safety-critical gradient analysis,

    Y . Xie, M. Fang, R. Pi, and N. Gong, “GradSafe: Detecting jailbreak prompts for LLMs via safety-critical gradient analysis,” in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , L.-W. Ku, A. Martins, and V . Srik...

    2024

  13. [21]

    Defending large language models against jailbreaking attacks through goal prioritization,

    Z. Zhang, J. Yang, P. Ke, F. Mi, H. Wang, and M. Huang, “Defending large language models against jailbreaking attacks through goal prioritization,” in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , L.-W. Ku, A....

    2024

  14. [22]

    Choose your neuron: Incorporating domain knowledge through neuron-importance,

    R. R. Selvaraju, P. Chattopadhyay, M. Elhoseiny, T. Sharma, D. Batra, D. Parikh, and S. Lee, “Choose your neuron: Incorporating domain knowledge through neuron-importance,” in Proceedings of the European Conference on Computer Vision (ECCV) , September 2018

    2018

  15. [23]

    Understanding indi- vidual neuron importance using information theory,

    K. Liu, R. A. Amjad, and B. C. Geiger, “Understanding indi- vidual neuron importance using information theory,” arXiv preprint arXiv:1804.06679, vol. 19, pp. 5171–5180, 2018

    2018 arXiv

  16. [24]

    Does large language model contain task-specific neurons?

    R. Song, S. He, S. Jiang, Y . Xian, S. Gao, K. Liu, and Z. Yu, “Does large language model contain task-specific neurons?” in Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 2024, pp. 7101–7113

    2024

  17. [25]

    Darknetz: towards model privacy at the edge using trusted execution environments,

    F. Mo, A. S. Shamsabadi, K. Katevas, S. Demetriou, I. Leontiadis, A. Cavallaro, and H. Haddadi, “Darknetz: towards model privacy at the edge using trusted execution environments,” in Proceedings of the 18th International Conference on Mobile Systems, Applications, and Services...

    2020

  18. [26]

    (2024) Host llm in gpu tee

    Phala Network. (2024) Host llm in gpu tee. Phala Network Docs. [Online]. Available: https://docs.phala.network/llm-in-gpu-tee/llm-in-tee

    2024

  19. [27]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,” 2023. [Online]. Available: https://arxiv.org/abs/1910.10683

    2023 arXiv

  20. [28]

    Multitask learning,

    R. Caruana, “Multitask learning,” Machine learning, vol. 28, pp. 41–75, 1997

    1997

  21. [29]

    Enron email dataset,

    W. W. Cohen, “Enron email dataset,” 2015. [Online]. Available: https://www.cs.cmu.edu/ enron/

    2015

  22. [30]

    Jailbroken: how does llm safety training fail?

    A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: how does llm safety training fail?” in Proceedings of the 37th International Conference on Neural Information Processing Systems , ser. NIPS ’23. Red Hook, NY , USA: Curran Associates Inc., 2023

    2023

  23. [31]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” 2023. [Online]. Available: https://arxiv.org/abs/2307.15043

    2023 arXiv

  24. [32]

    Surrogateprompt: Bypassing the safety filter of text-to-image models via substitution,

    Z. Ba, J. Zhong, J. Lei, P. Cheng, Q. Wang, Z. Qin, Z. Wang, and K. Ren, “Surrogateprompt: Bypassing the safety filter of text-to-image models via substitution,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’24. New York...

    2024

  25. [33]

    Dawn: Dynamic adversarial watermarking of neural networks,

    S. Szyller, B. G. Atli, S. Marchal, and N. Asokan, “Dawn: Dynamic adversarial watermarking of neural networks,” 2021. [Online]. Available: https://arxiv.org/abs/1906.00830

    2021 arXiv

  26. [34]

    Deepsigns: A generic watermarking framework for ip protection of deep learning models,

    B. D. Rouhani, H. Chen, and F. Koushanfar, “Deepsigns: A generic watermarking framework for ip protection of deep learning models,” arXiv preprint arXiv:1804.00750 , 2018

    2018 arXiv

  27. [35]

    Blackmarks: Black- box multibit watermarking for deep neural networks,

    H. Chen, B. D. Rouhani, and F. Koushanfar, “Blackmarks: Black- box multibit watermarking for deep neural networks,” arXiv preprint arXiv:1904.00344, 2019

    1904 arXiv

  28. [36]

    Adversarial watermarking transformer: Towards tracing text provenance with data hiding,

    S. Abdelnabi and M. Fritz, “Adversarial watermarking transformer: Towards tracing text provenance with data hiding,” in 2021 IEEE Symposium on Security and Privacy (SP) . IEEE, 2021, pp. 121–140

    2021

  29. [37]

    Do not write that jailbreak paper,

    J. Rando, “Do not write that jailbreak paper,” in The Fourth Blogpost Track at ICLR 2025 , 2025. [Online]. Available: https://openreview.net/forum?id=TbN25IjHyC

    2025

  30. [38]

    Ciphertext-policy attribute- based encryption,

    J. Bethencourt, A. Sahai, and B. Waters, “Ciphertext-policy attribute- based encryption,” in 2007 IEEE Symposium on Security and Privacy (SP ’07), 2007, pp. 321–334

    2007

  31. [39]

    Fast, compact, and expressive attribute-based encryption,

    J. Tomida, Y . Kawahara, and R. Nishimaki, “Fast, compact, and expressive attribute-based encryption,” Cryptology ePrint Archive, Paper 2019/966, 2019. [Online]. Available: https://eprint.iacr.org/2019/966

    2019

  32. [40]

    Advanced encryption standard,

    D. Selent, “Advanced encryption standard,” Rivier Academic Journal , vol. 6, no. 2, pp. 1–14, 2010

    2010

  33. [41]

    Report on the development of the advanced encryption standard (aes),

    J. Nechvatal, E. Barker, L. Bassham, W. Burr, M. Dworkin, J. Foti, and E. Roback, “Report on the development of the advanced encryption standard (aes),” Journal of research of the National Institute of Standards and Technology, vol. 106, no. 3, p. 511, 2001

    2001

  34. [42]

    Scaling up membership inference: When and how attacks succeed on large language models,

    H. Puerto, M. Gubri, S. Yun, and S. J. Oh, “Scaling up membership inference: When and how attacks succeed on large language models,”

  35. [43]

    Analyzing leakage of personally identifiable information in language models,

    N. Lukas, A. Salem, R. Sim, S. Tople, L. Wutschitz, and S. Zanella-B ´eguelin, “Analyzing leakage of personally identifiable information in language models,” in 2023 IEEE Symposium on Security and Privacy , IEEE. IEEE Computer Society, May 2023, pp. 346–363. [Online]. Avail- a...

    2023

  36. [44]

    Movement pruning: adaptive sparsity by fine-tuning,

    V . Sanh, T. Wolf, and A. M. Rush, “Movement pruning: adaptive sparsity by fine-tuning,” in Proceedings of the 34th International Conference on Neural Information Processing Systems, ser. NIPS ’20. Red Hook, NY , USA: Curran Associates Inc., 2020

    2020

  37. [45]

    Michel, O

    P. Michel, O. Levy, and G. Neubig, Are sixteen heads really better than one? Red Hook, NY , USA: Curran Associates Inc., 2019

    2019

  38. [46]

    Train large, then compress: rethinking model size for ef- ficient training and inference of transformers,

    Z. Li, E. Wallace, S. Shen, K. Lin, K. Keutzer, D. Klein, and J. E. Gonzalez, “Train large, then compress: rethinking model size for ef- ficient training and inference of transformers,” in Proceedings of the 37th International Conference on Machine Learning , ser. ICML’20. JML...

    2020

  39. [47]

    Charm: A framework for rapidly prototyping cryptosystems,

    J. A. Akinyele, C. Garman, I. Miers, M. W. Pagano, M. Rushanan, M. Green, and A. D. Rubin, “Charm: A framework for rapidly prototyping cryptosystems,” 2025, available at https://github.com/JHUISI/charm. [Online]. Available: https://github.com/JHUISI/charm

    2025

  40. [48]

    Crypto: Simple symmet- ric gpg file encryption and decryption,

    C. Simpkins and C. Russ, “Crypto: Simple symmet- ric gpg file encryption and decryption,” 2025, available at https://github.com/chrissimpkins/crypto. [Online]. Available: https://github.com/chrissimpkins/crypto

    2025

  41. [49]

    Cython: C-extensions for python,

    S. Behnel, R. Bradshaw, D. Woods, M. Valo, and L. Dalc ´ın, “Cython: C-extensions for python,” https://cython.org/, 2024, an optimising static compiler for both the Python programming language and the extended Cython programming language

    2024

  42. [50]

    Opt: Open pre-trained transformer language models,

    S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, C. Dewan, M. Diab, X. Li, X. V . Lin, T. Mihaylov, M. Ott, S. Shleifer, K. Shuster, D. Simig, P. S. Koura, A. Sridhar, T. Wang, and L. Zettlemoyer, “Opt: Open pre-trained transformer language models,”

  43. [51]

    Galactica: A large language model for science,

    R. Taylor, M. Kardas, G. Cucurull, T. Scialom, A. Hartshorn, E. Saravia, A. Poulton, V . Kerkez, and R. Stojnic, “Galactica: A large language model for science,” 2022. [Online]. Available: https://arxiv.org/abs/2211.09085

    2022 arXiv

  44. [52]

    Gemma 2: Improving open language models at a practical size,

    G. Team, M. Riviere, S. Pathak, and et al., “Gemma 2: Improving open language models at a practical size,” 2024. [Online]. Available: https://arxiv.org/abs/2408.00118

    2024 arXiv

  45. [53]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” 2021. [Online]. Available: https://arxi...

    2021 arXiv

  46. [2022]

    Available: https://arxiv.org/abs/2205.01068

    [Online]. Available: https://arxiv.org/abs/2205.01068

    arXiv

  47. [2024]

    Available: https://arxiv.org/abs/2411.00154

    [Online]. Available: https://arxiv.org/abs/2411.00154

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.