Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Membership Inference Attack against Long-Context Large Language Models

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that membership in a long-context language model's input context leaks through generation loss and semantic similarity, and that six proposed attacks infer membership accurately, reaching 90.66% F1.

desk verdict A genuinely new MIA setting with a plausible attack family, but the headline F1 rests on a cross-dataset control that may measure domain separation rather than context membership. read the letter →

arxiv 2411.11424 v1 pith:OL4DTGSW submitted 2024-11-18 cs.CL

Zixiong Wang , Gaoyang Liu , Yang Yang , Chen Wang This is my paper · ORCID
classification cs.CL
keywords membershipinferenceattacklong-contextlanguagemodelsprivacyleakagegenerationlosssemanticsimilaritymulti-documentquestionansweringtext-onlycontext
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that long-context language models expose membership information about the documents placed in their context windows. It presents the first membership inference attacks specifically designed for these models, asking whether a given document or sequence was part of the model's input context. The core idea is that an in-context document lowers the model's generation loss and raises the semantic similarity of its continuations, which an attacker can measure by prompting with a snippet of the target document. The authors propose six attack strategies, including text-only versions that require no access to internal probabilities, and report attack F1-scores above 85% across several models and datasets, with a best of 90.66% F1 on Multi-document QA with LongChat-7b-v1.5-32k.

What carries the argument

The load-bearing mechanism is the conditioning contrast between members and non-members in the model's generation behavior. The attacker inserts a snippet of the target document as a completion prompt and measures how well the resulting continuation matches the withheld suffix: low generation loss or high BERTScore/SacreBLEU indicates the document was likely in context. The Meta-Classifier amplifies this by averaging these signals over prefixes of different lengths and training a fully connected layer on the resulting feature vectors, using 1,000 labeled reference samples.

What would settle it

Run the same six attacks with non-members drawn from the same document pool and topic distribution as members, with only context inclusion differing. If attack F1 falls to near chance, the reported leakage is dataset discrimination rather than membership inference.

Watch

Extended reading notes

Core claim

The central discovery is that long-context language models leak membership through their retrieval-and-completion behavior rather than through training-set overfitting. Even though the model is not trained on the documents in its context, when a target document is present the model tends to retrieve it and generate continuations that are more coherent with and semantically closer to that document. The paper shows that this signal can be extracted by splitting a target document into a prefix and suffix, asking the model to complete the prefix, and then measuring the generation loss, BERTScore, or SacreBLEU between the generated continuation and the true suffix. The strongest variant, the Meta-Classifier, combines these scores across multiple split lengths into a feature vector and trains a simple attack model on 1,000 reference samples, reaching attack F1-scores above 90%. Direct yes/no prompts are weaker, below 70% accuracy, because they underuse the model's retrieval capability and suffer from position bias.

Load-bearing premise

The attack's validity rests on the assumption that members and non-members differ only in whether they were placed in the model's context, not in topic or style.

Editorial extensions

If this is right

  • An adversary with only black-box text access can infer membership nearly as well as an adversary with token-level probabilities: the Sacre BLEU and BERTScore attacks exceed 85% F1 in text-only scenarios.
  • The Meta-Classifier, combining generation loss, BERTScore, and SacreBLEU across multiple prefix/suffix splits, achieves the highest accuracy on Multi-document QA, showing these signals are complementary.
  • Direct yes/no prompts are the weakest attack form, below 70% accuracy, because single-token answers underuse the model's retrieval capabilities and are influenced by position bias.
  • The leakage is not caused by training-set overfitting: the model reveals membership of documents it only saw in its context during inference.
  • The attack transfers across multiple open-source long-context models and general long-context benchmarks, not just a single model or dataset.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A stricter, untested control would draw non-members from the same document pool and topic distribution as members; if the 90% F1 survives that control, the leakage is truly membership rather than dataset discrimination.
  • The attack's reliance on exact continuation similarity suggests a defense direction: force the model to paraphrase or reason indirectly, or perturb outputs, since the signal depends on lexical and semantic closeness to the gold suffix.
  • If the effect transfers to production retrieval-augmented systems, the same snippet-completion probe could reveal which retrieved documents were in the context, enabling confirmation of sensitive records such as medical histories or personal identities.
  • A natural extension is testing paraphrased target documents: if the attack degrades sharply when lexical overlap is removed, the signal is partly verbatim memorization rather than pure semantic awareness.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes membership inference attacks (MIAs) against long-context language models (LCLMs), aiming to determine whether a given document appears in the model's input context. The authors introduce six attack strategies: Logits Attack, Loss Attack, Meta-Classifier (probability-based), and Inquiry, BERTScore, and SacreBLEU Attacks (text-only). The core intuition is that documents present in the context produce lower generation loss and higher semantic similarity with model continuations when prompted with document snippets. Experiments on Multi-document QA datasets with LongChat-7b-v1.5-32k report high attack F1-scores, e.g., 90.66% for the Meta-Classifier on 30-document QA. The paper claims to present the first MIA targeting LCLM contexts and argues that context integration creates a sensitive repository vulnerable to membership leakage.

Significance. If the reported results are robust, this work addresses an important and underexplored privacy risk of long-context LLMs, which are increasingly used in retrieval-augmented and question-answering systems. The proposed attacks are practical in that several operate text-only without access to model probabilities. The paper also connects membership leakage to the model's retrieval and generation behavior, offering a plausible mechanism. However, the current evaluation has a significant confound in the construction of non-members, and the empirical evidence is presented only for a single model and dataset in the provided text, weakening the strength of the claims until these issues are resolved.

major comments (3)
  1. [Section 4.1, Attack Setting] The non-members are described as 'documents in another dataset,' which creates a domain-shift confound: the attack may be detecting corpus-level differences (topic, style, vocabulary) rather than contextual membership. The reported separation in loss and BERTScore/BLEU could then reflect dataset classification rather than membership leakage. The manuscript does not identify the non-member dataset, characterize its similarity to the member dataset, or provide a same-distribution control where non-members are documents from the same corpus that are simply not placed in the context. This control is essential to support the central claim, because the threat model requires members and non-members to be distinguishable only by their presence in the context. Please add such a control (e.g., holding out same-domain documents as non-members) and report the resulting attack performance.
  2. [Section 3 and Section 4.1] The Loss Attack, BERTScore Attack, and SacreBLEU Attack require a decision threshold to classify a document as member or non-member, but the manuscript does not state how these thresholds are chosen (e.g., fixed percentile, Youden's J, or threshold tuned on the reference set). If the threshold is tuned on the reference set and then applied to the test set, this is legitimate but should be stated; if thresholds are chosen to maximize test-set performance, the reported F1-scores are optimistic. Please report the threshold selection procedure explicitly for each attack.
  3. [Table 1 and Section 4.2] The main results table shows only LongChat-7b-v1.5-32k on Natural Question Multi-Document QA, despite the abstract and Section 4.1 claiming evaluation on multiple LCLMs and tasks (KV-retrieval, LongBench, six models). The full text does not provide results for the other models or tasks, nor error bars or variance across random seeds. The claim that 'extensive experiments' support the conclusions is therefore not verifiable from the manuscript as provided. Please include complete results for all models and datasets, or clearly state that additional results appear in an appendix if it is missing from this version.
minor comments (5)
  1. [Abstract and Section 1] There are several typographical errors, including 'Quesion-answering', 'effiencicy', 'Oringial', 'Attck', 'Scare BLEU', and 'Accrucy'. These should be corrected.
  2. [Section 4.1, Datasets] The description of datasets is minimal: Multi-Document QA and KV-retrieval are attributed to [7], and LongBench to [29], but the number of samples, document lengths, and the identity of the 'another dataset' for non-members are not specified. This information is needed to assess the validity of the evaluation and the potential for dataset-shift effects.
  3. [Section 2.4, System Prompt] The system prompt in Section 2.4 appears to be copied from the 'lost in the middle' benchmark. The manuscript should clarify whether this is the exact prompt used for all models and datasets, or whether prompts were adapted per dataset.
  4. [Section 3, Meta-Classifier] The Meta-Classifier is described as using '2, 4, 6, 8, and 10 pieces' and collecting loss, BERTScore, and BLEU for each, yielding 15 features. The description is clear, but the training details (e.g., optimizer, number of epochs, and whether the attack model is trained once per victim model or per dataset) are omitted and should be included for reproducibility.
  5. [Section 4.2.1] The claim that the Logits and Inquiry attacks suffer from 'position bias' is plausible, but the manuscript does not provide evidence for this interpretation. If this explanation is retained, please support it with an analysis or cite specific prior work beyond [35].

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attacks are empirical heuristics evaluated on held-out test samples; the main caveat is a cross-dataset non-member confound, which is a benchmark-validity issue rather than a circular reduction.

full rationale

The paper's claimed contributions are empirical attack heuristics, not a derivation that reduces to its own inputs. The Meta-Classifier is trained on membership features (loss, BERTScore, and BLEU) from 1,000 reference samples and evaluated on 1,000 separate test samples (Section 4.1, "Details for Meta-Classifier"), which is standard supervised evaluation rather than fitting-then-predicting the same data. The Loss, BERTScore, and Sacre BLEU attacks directly measure generation coherence or semantic similarity; their success is an empirical finding, not an artifact of definition. The one self-citation, reference [23], appears only in a survey of prior RAG membership inference work and is not load-bearing for the central claim. The main caveat is the attack setting in Section 4.1: "The non-members come from documents in another dataset." If the non-member dataset differs in topic, style, or vocabulary, the reported separation and F1-scores may partly reflect dataset discrimination rather than context-membership leakage. This is a serious evaluation-validity concern, but it is not circularity: membership status is not definitionally equated with the measured feature, and a same-distribution control could in principle distinguish the explanations. No step in the paper reduces, by construction or by self-citation, to the target result, so no circular step meets the quoted-evidence bar.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim rests on the plausibility of retrieval-based leakage and on the experimental setup. The main free parameter is the implicit threshold for loss/similarity attacks, which is not reported. The key domain assumption is that non-members from another dataset are a fair control.

free parameters (3)
  • Number of snippets for Loss Attack = 4 (default)
    Chosen by hand; affects prefix/suffix split and attack performance.
  • Snippet divisions for Meta-Classifier = 2, 4, 6, 8, 10
    Chosen by hand to build 15-dim feature vector.
  • Membership decision threshold for Loss/Bert/BLEU attacks = Not reported
    The paper does not specify how continuous loss/similarity scores are converted to binary membership decisions.
assumptions (3)
  • domain assumption LCLMs retrieve and reason over context documents when prompted with snippets from them
    Stated as the 'basic idea' in Section 1; not proven, but consistent with known retrieval behavior.
  • domain assumption Generation loss and semantic similarity are higher/lower for members vs non-members
    Core hypothesis of the paper; empirically tested but not derived.
  • domain assumption Documents from a different dataset can serve as non-members without confounding
    Assumed in Section 4.1; if violated, reported attack success may be due to dataset/topic differences.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Membership Inference Attack against Long-Context Large Language Models." pith.science (2026). https://pith.science/paper/OL4DTGSW

@misc{pith2026241111424,
  author       = {Pith},
  title        = {Pith review of: Membership Inference Attack against Long-Context Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OL4DTGSW}},
  note         = {Machine review of arXiv:2411.11424}
}
read the original abstract

Recent advances in Large Language Models (LLMs) have enabled them to overcome their context window limitations, and demonstrate exceptional retrieval and reasoning capacities on longer context. Quesion-answering systems augmented with Long-Context Language Models (LCLMs) can automatically search massive external data and incorporate it into their contexts, enabling faithful predictions and reducing issues such as hallucinations and knowledge staleness. Existing studies targeting LCLMs mainly concentrate on addressing the so-called lost-in-the-middle problem or improving the inference effiencicy, leaving their privacy risks largely unexplored. In this paper, we aim to bridge this gap and argue that integrating all information into the long context makes it a repository of sensitive information, which often contains private data such as medical records or personal identities. We further investigate the membership privacy within LCLMs external context, with the aim of determining whether a given document or sequence is included in the LCLMs context. Our basic idea is that if a document lies in the context, it will exhibit a low generation loss or a high degree of semantic similarity to the contents generated by LCLMs. We for the first time propose six membership inference attack (MIA) strategies tailored for LCLMs and conduct extensive experiments on various popular models. Empirical results demonstrate that our attacks can accurately infer membership status in most cases, e.g., 90.66% attack F1-score on Multi-document QA datasets with LongChat-7b-v1.5-32k, highlighting significant risks of membership leakage within LCLMs input contexts. Furthermore, we examine the underlying reasons why LCLMs are susceptible to revealing such membership information.

Figures

Figures reproduced from arXiv: 2411.11424 by the authors.

Figure 1
Figure 1. Density distributions of members v.s. non-members on several metrics. We leverage LongChat-7b-v1.5-32k [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation

    cs.CR 2025-02 conditional novelty 6.0 of 10

    A membership inference attack on RAG systems crafts natural yes/no questions from a target document to detect its presence in the datastore, achieving high AUC while evading guardrail detectors.

Reference graph

Works this paper leans on

35 extracted references · 12 canonical work pages · cited by 1 Pith paper

  1. [1]

    Phi-3 technical report: A highly capable language model locally on your phone,

    M. Abdin, J. Aneja, H. Awadalla, A. Awadallah, A. A. Awan, N. Bach, A. Bahree, A. Bakhtiari, J. Bao, H. Behl et al., “Phi-3 technical report: A highly capable language model locally on your phone,” arXiv preprint arXiv:2404.14219, 2024

    arXiv 2024

  2. [2]

    Yi: Open foundation models by 01. ai,

    A. Young, B. Chen, C. Li, C. Huang, G. Zhang, G. Zhang, H. Li, J. Zhu, J. Chen, J. Chang et al., “Yi: Open foundation models by 01. ai,” arXiv preprint arXiv:2403.04652, 2024

    arXiv 2024

  3. [3]

    World model on million-length video and language with ringattention,

    H. Liu, W. Yan, M. Zaharia, and P. Abbeel, “World model on million-length video and language with ringattention,” arXiv preprint arXiv:2402.08268, 2024

    arXiv 2024

  4. [4]

    Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context,

    G. Team, P. Georgiev, V . I. Lei, R. Burnell, L. Bai, A. Gulati, G. Tanzer, D. Vincent, Z. Pan, S. Wanget al., “Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context,” arXiv preprint arXiv:2403.05530, 2024

    arXiv 2024

  5. [5]

    Large language models can be easily distracted by irrelevant context,

    F. Shi, X. Chen, K. Misra, N. Scales, D. Dohan, E. H. Chi, N. Schärli, and D. Zhou, “Large language models can be easily distracted by irrelevant context,” in International Conference on Machine Learning . PMLR, 2023, pp. 31 210–31 227

    2023

  6. [6]

    Long-context llms struggle with long in-context learning,

    T. Li, G. Zhang, Q. D. Do, X. Yue, and W. Chen, “Long-context llms struggle with long in-context learning,” arXiv preprint arXiv:2404.02060, 2024

    arXiv 2024

  7. [7]

    Lost in the middle: How language models use long contexts,

    N. F. Liu, K. Lin, J. Hewitt, A. Paranjape, M. Bevilacqua, F. Petroni, and P. Liang, “Lost in the middle: How language models use long contexts,” in Proceedings of ACL, 2024

    work page 2024

  8. [8]

    H2o: Heavy-hitter oracle for efficient generative inference of large language models,

    Z. Zhang, Y . Sheng, T. Zhou, T. Chen, L. Zheng, R. Cai, Z. Song, Y . Tian, C. Ré, C. Barrett et al. , “H2o: Heavy-hitter oracle for efficient generative inference of large language models,”Advances in Neural Information Processing Systems, vol. 36, pp. 34 661–34 710, 2023

    work page 2023

Show all 35 references
  1. [9]

    Snapkv: Llm knows what you are looking for before generation,

    Y . Li, Y . Huang, B. Yang, B. Venkitesh, A. Locatelli, H. Ye, T. Cai, P. Lewis, and D. Chen, “Snapkv: Llm knows what you are looking for before generation,” arXiv preprint arXiv:2404.14469, 2024

    2024 arXiv

  2. [10]

    Discovering the gems in early layers: Accelerating long-context llms with 1000x input token reduction,

    Z. Shi, Y . Ming, X.-P. Nguyen, Y . Liang, and S. Joty, “Discovering the gems in early layers: Accelerating long-context llms with 1000x input token reduction,” arXiv preprint arXiv:2409.17422, 2024

    2024 arXiv

  3. [11]

    Membership inference attacks against language models via neighbourhood comparison,

    J. Mattern, F. Mireshghallah, Z. Jin, B. Schoelkopf, M. Sachan, and T. Berg-Kirkpatrick, “Membership inference attacks against language models via neighbourhood comparison,” inProceedings of ACL, 2023, pp. 11 330–11 343

    2023

  4. [12]

    Detecting pretraining data from large language models,

    W. Shi, A. Ajith, M. Xia, Y . Huang, D. Liu, T. Blevins, D. Chen, and L. Zettlemoyer, “Detecting pretraining data from large language models,” in Proceedings of ICLR, 2023

    2023

  5. [13]

    Practical membership inference attacks against large-scale multi-modal models: A pilot study,

    M. Ko, M. Jin, C. Wang, and R. Jia, “Practical membership inference attacks against large-scale multi-modal models: A pilot study,” in Proceedings of ICCV, 2023, pp. 4848–4858

    2023

  6. [14]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar et al., “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  7. [15]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale et al., “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288 , 2023

    2023 arXiv

  8. [16]

    Dense passage retrieval for open-domain question answering,

    V . Karpukhin, B. O˘guz, S. Min, P. Lewis, L. Wu, S. Edunov, D. Chen, and W.-t. Yih, “Dense passage retrieval for open-domain question answering,” arXiv preprint arXiv:2004.04906, 2020

    2004 arXiv

  9. [17]

    Is sparse attention more interpretable?

    C. Meister, S. Lazov, I. Augenstein, and R. Cotterell, “Is sparse attention more interpretable?” arXiv preprint arXiv:2106.01087, 2021

    2021 arXiv

  10. [18]

    Longnet: Scaling transformers to 1,000,000,000 tokens,

    J. Ding, S. Ma, L. Dong, X. Zhang, S. Huang, W. Wang, N. Zheng, and F. Wei, “Longnet: Scaling transformers to 1,000,000,000 tokens,” arXiv preprint arXiv:2307.02486, 2023

    2023 arXiv

  11. [19]

    Train short, test long: Attention with linear biases enables input length extrapolation,

    O. Press, N. A. Smith, and M. Lewis, “Train short, test long: Attention with linear biases enables input length extrapolation,” arXiv preprint arXiv:2108.12409, 2021

    2021 arXiv

  12. [20]

    Longrope: Extending llm context window beyond 2 million tokens,

    Y . Ding, L. L. Zhang, C. Zhang, Y . Xu, N. Shang, J. Xu, F. Yang, and M. Yang, “Longrope: Extending llm context window beyond 2 million tokens,” arXiv preprint arXiv:2402.13753, 2024

    2024 arXiv

  13. [21]

    Attention is all you need,

    A. Vaswani, “Attention is all you need,” Advances in Neural Information Processing Systems , 2017

    2017

  14. [22]

    Quantifying privacy risks of masked language models using membership inference attacks,

    F. Mireshghallah, K. Goyal, A. Uniyal, T. Berg-Kirkpatrick, and R. Shokri, “Quantifying privacy risks of masked language models using membership inference attacks,” arXiv preprint arXiv:2203.03929, 2022

    2022 arXiv

  15. [23]

    Seeing is believing: Black-box membership inference attacks against retrieval augmented generation,

    Y . Li, G. Liu, Y . Yang, and C. Wang, “Seeing is believing: Black-box membership inference attacks against retrieval augmented generation,” arXiv e-prints, pp. arXiv–2406, 2024. 6 A PREPRINT - NOVEMBER 19, 2024

    2024

  16. [24]

    Is my data in your retrieval database? membership inference attacks against retrieval augmented generation,

    M. Anderson, G. Amit, and A. Goldsteen, “Is my data in your retrieval database? membership inference attacks against retrieval augmented generation,” arXiv preprint arXiv:2405.20446, 2024

    2024 arXiv

  17. [25]

    Membership inference attacks against in-context learning,

    R. Wen, Z. Li, M. Backes, and Y . Zhang, “Membership inference attacks against in-context learning,” arXiv preprint arXiv:2409.01380, 2024

    2024 arXiv

  18. [26]

    Insights into llm long-context failures: When transformers know but don’t tell,

    M. Gao, T. Lu, K. Yu, A. Byerly, and D. Khashabi, “Insights into llm long-context failures: When transformers know but don’t tell,” in Findings of the Association for Computational Linguistics: EMNLP 2024 , 2024, pp. 7611–7625

    2024

  19. [27]

    Bertscore: Evaluating text generation with bert,

    T. Zhang, V . Kishore, F. Wu, K. Q. Weinberger, and Y . Artzi, “Bertscore: Evaluating text generation with bert,” in Proceedings of ICLR, 2020

    2020

  20. [28]

    A call for clarity in reporting bleu scores,

    M. Post, “A call for clarity in reporting bleu scores,” in Proceedings of WMT, 2018, pp. 186–191

    2018

  21. [29]

    Longbench: A bilingual, multitask benchmark for long context understanding,

    Y . Bai, X. Lv, J. Zhang, H. Lyu, J. Tang, Z. Huang, Z. Du, X. Liu, A. Zeng, L. Hou, Y . Dong, J. Tang, and J. Li, “Longbench: A bilingual, multitask benchmark for long context understanding,” arXiv preprint arXiv:2308.14508, 2023

    2023 arXiv

  22. [30]

    How long can context length of open-source llms truly promise?

    D. Li, R. Shao, A. Xie, Y . Sheng, L. Zheng, J. Gonzalez, I. Stoica, X. Ma, and H. Zhang, “How long can context length of open-source llms truly promise?” in NeurIPS 2023 Workshop on Instruction Tuning and Instruction F ollowing, 2023

    2023

  23. [31]

    Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality,

    W.-L. Chiang, Z. Li, Z. Lin, Y . Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y . Zhuang, J. E. Gonzalezet al., “Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality,” See https://vicuna. lmsys. org (accessed 14 April 2023) , vol. 2, no. 3, p. 6, 2023

    2023

  24. [32]

    Mistral 7b,

    A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. d. l. Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier et al., “Mistral 7b,” arXiv preprint arXiv:2310.06825, 2023

    2023 arXiv

  25. [33]

    Gemma: Open models based on gemini research and technology,

    G. Team, T. Mesnard, C. Hardin, R. Dadashi, S. Bhupatiraju, S. Pathak, L. Sifre, M. Rivière, M. S. Kale, J. Love et al., “Gemma: Open models based on gemini research and technology,” arXiv preprint arXiv:2403.08295, 2024

    2024 arXiv

  26. [34]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  27. [35]

    Eliminating position bias of language models: A mechanistic approach,

    Z. Wang, H. Zhang, X. Li, K.-H. Huang, C. Han, S. Ji, S. M. Kakade, H. Peng, and H. Ji, “Eliminating position bias of language models: A mechanistic approach,” arXiv preprint arXiv:2407.01100, 2024. 7

    2024 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.