--- title: "Nicholas Carlini — author profile and papers" description: "Nicholas Carlini, ETH Zurich: 4 papers on Elamur Research (2018–2023), h-index 48 — affiliations, topics, co-authors and who cites them in our library." canonical: "https://research.elamur.ai/free/en/authors/nicholas-carlini/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/authors/nicholas-carlini/) [home](https://md.research.elamur.ai/free/en/) / [authors](https://md.research.elamur.ai/free/en/authors/) / Nicholas Carlini # Nicholas Carlini 4 papers on this site · 2018–2023 current affiliation [ETH Zurich](https://ror.org/05a28rw58), Zurich, Switzerland; [Google DeepMind (United Kingdom)](https://ror.org/00971b260), London, United Kingdom; [Anthropic (United States)](https://ror.org/056y0v115), San Francisco Nicholas Carlini has 4 papers on this site, in 2018–2023, most of them on [Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/), [Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/); often with [Dawn Song](https://md.research.elamur.ai/free/en/authors/dawn-song/), [Eric Wallace](https://md.research.elamur.ai/free/en/authors/eric-wallace/), [Florian Tramer](https://md.research.elamur.ai/free/en/authors/florian-tramer/). [OpenAlex](https://openalex.org/A5034257647) · [ORCID](https://orcid.org/0000-0002-1463-3461) · [**h-index 48**](https://openalex.org/authors/A5034257647) · [141 works](https://openalex.org/works?filter=author.id:A5034257647) · [22 461 citations](https://openalex.org/works?filter=author.id:A5034257647&sort=cited_by_count:desc) OpenAlex, 2026-10-14 [4 works on this site](https://md.research.elamur.ai/free/en/authors/nicholas-carlini/#papers) · [1 932 citations in our library](https://md.research.elamur.ai/free/en/authors/nicholas-carlini/cited-by/) · 4 more works in our library The profile is the library's match of the name; two people with one name are not always told apart. Elsewhere: [Google Scholar](https://scholar.google.com/citations?view_op=search_authors&mauthors=Nicholas+Carlini) · [Semantic Scholar](https://www.semanticscholar.org/search?q=Nicholas+Carlini) · [dblp](https://dblp.org/search?q=Nicholas+Carlini) · [ACL Anthology](https://aclanthology.org/search/?q=Nicholas+Carlini) ## Affiliations - [Google DeepMind (United Kingdom)](https://ror.org/00971b260) · London, United Kingdom —current · 2023–2026 on 11 papers - [Anthropic (United States)](https://ror.org/056y0v115) · San Francisco —current · 2025–2026 on 5 papers - [ETH Zurich](https://ror.org/05a28rw58) · Zurich, Switzerland —current · 2022–2026 on 5 papers - [Google (United States)](https://ror.org/00njsd438) · Mountain View, United States —2018–2025 on 48 papers - [University of California, Berkeley](https://ror.org/01an7q238) · Berkeley, United States —2012–2018 on 13 papers From the bylines of their papers (OpenAlex, 2026-10-14), ORCID and Wikidata; institutions on papers are matched by machine. 5 more institutions on single bylines are not listed. ## Topics [Language models & pretraining 3](https://md.research.elamur.ai/free/en/topics/language-models/) · [Bias, fairness & safety 1](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) ## Papers The most cited first (OpenAlex and our library). 1. **[Universal and Transferable Adversarial Attacks on Aligned Language Models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/)** *(2023 · 951 citations)* Chatbots fine-tuned for safety are trained to refuse harmful requests. Before this paper, most ways around that refusal were handwritten jailbreaks that broke easily, and automatic prompt search had mostly failed. The authors present Greedy Coordinate Gradient (GCG), an automated attack that learns a short… 2. **[Extracting Training Data from Large Language Models](https://md.research.elamur.ai/free/en/papers/carlini-2020-extracting-training-data-large-language/)** *(2020 · 901 citations)* Large language models are often assumed not to leak their training data, because they are trained on huge deduplicated corpora for few epochs and barely overfit. 3. **[The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks](https://md.research.elamur.ai/free/en/papers/carlini-2018-secret-sharer-evaluating-testing-unintended/)** *(2018 · 668 citations)* Generative sequence models, such as language models behind auto-completion, are often trained on private text. 4. **[Scalable Extraction of Training Data from (Production) Language Models](https://md.research.elamur.ai/free/en/papers/nasr-2023-scalable-extraction-training-data-production/)** *(2023 · 197 citations)* The paper asks how much training data an attacker can actually pull out of a language model without knowing what the model was trained on. ## Also in our library 4 more works of theirs are in our library without a page here yet; they will appear as we publish them. ## Co-authors here 12 of 15 co-authors with a page, the most papers together first. - [Dawn Song](https://md.research.elamur.ai/free/en/authors/dawn-song/) ×2 - [Eric Wallace](https://md.research.elamur.ai/free/en/authors/eric-wallace/) ×2 - [Florian Tramer](https://md.research.elamur.ai/free/en/authors/florian-tramer/) ×2 - [Katherine Lee](https://md.research.elamur.ai/free/en/authors/katherine-lee/) ×2 - [Matthew Jagielski](https://md.research.elamur.ai/free/en/authors/matthew-jagielski/) ×2 - [Milad Nasr](https://md.research.elamur.ai/free/en/authors/milad-nasr/) ×2 - [Ulfar Erlingsson](https://md.research.elamur.ai/free/en/authors/ulfar-erlingsson/) ×2 - [Adam Roberts](https://md.research.elamur.ai/free/en/authors/adam-roberts/) - [Andy Zou](https://md.research.elamur.ai/free/en/authors/andy-zou/) - [Ariel Herbert-Voss](https://md.research.elamur.ai/free/en/authors/ariel-herbert-voss/) - [Christopher A. Choquette-Choo](https://md.research.elamur.ai/free/en/authors/christopher-a-choquette-choo/) - [Colin Raffel](https://md.research.elamur.ai/free/en/authors/colin-raffel/) ## Cited by Papers of our library cite their works 1 932 times (of the 140 884 papers whose bibliographies we read); [120 citing papers with a page here →](https://md.research.elamur.ai/free/en/authors/nicholas-carlini/cited-by/).