---
title: "SLIM — paper by WU and Cao (2026) — summary and ideas"
description: "Individual data owners usually contribute only a tiny share of an LLM training corpus, so watermarks that require modifying… 54 references."
authors: ["Hengyu WU", "Yang Cao"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.919/"
doi: "10.18653/v1/2026.findings-acl.919"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/wu-2026-slim-stealthy-low-coverage-black/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/wu-2026-slim-stealthy-low-coverage-black/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/50/) / SLIM: Stealthy Low-Coverage Black-Box Watermarking via Latent-Space Confusion Zones

# SLIM: Stealthy Low-Coverage Black-Box Watermarking via Latent-Space Confusion Zones

**Authors:** Hengyu WU and [Yang Cao](https://md.research.elamur.ai/free/en/authors/yang-cao/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.919/) · [PDF](https://aclanthology.org/2026.findings-acl.919.pdf) · [DOI 10.18653/v1/2026.findings-acl.919](https://doi.org/10.18653/v1/2026.findings-acl.919) · [OpenAlex](https://openalex.org/W7166876612)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Individual data owners usually contribute only a tiny share of an LLM training corpus, so watermarks that require modifying large parts of a dataset are of little use to them. Earlier approaches such as WATERFALL, STAMP, TRACE, random character/Unicode insertion, and fictitious knowledge each fall short on at least one of three requirements: low coverage, stealth, or verification with only black-box access. SLIM takes a high-perplexity target sequence and splits it into a prefix and a continuation. It then adds K extra samples, each pairing a paraphrased prefix with a different, topically unrelated continuation. Because semantically close prefixes end up near each other in latent space, training on these samples creates a "Latent-Space Confusion Zone." In that zone, the model's continuations become unstable, and this instability can be detected through hypothesis testing on generated outputs. The authors report reliable detection when only one or a few sequences are watermarked, with preserved model utility, resistance to automated detection, and survival through common post-training. This matters because it makes data-usage verification feasible for individuals working through commercial APIs.

## Key points
- **Target selection:** sequences must exceed a perplexity threshold under a reference LLM, which keeps them rare in real corpora.
- **Prefix/continuation split:** the cut sits at roughly 20% of the sequence length, moved to two words before the nearest sentence boundary.
- **Variant generation:** GPT-5.1 produces both the K prefix paraphrases and the K divergent continuations.
- **Verification:** two statistical strategies are offered, one using a reference model and one that is reference model-free. Both work under strict black-box access.
- **Robustness to post-training:**
  - The watermark stayed detectable after full fine-tuning and LoRA fine-tuning, each run on 200,000 additional sequences.
  - It also survived RLHF on UltraFeedback.
  - LoRA weakened the signal the most, while RLHF barely changed it.
  - The authors suggest raising K if heavy post-training is expected.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Institute of Science Tokyo](https://md.research.elamur.ai/free/en/universities/institute-of-science-tokyo/) — University, Tokyo, Japan · 14 works · 20 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [👁️ Computer Vision and Pattern Recognition](https://md.research.elamur.ai/free/en/shelves/computer-science/computer-vision-and-pattern-recognition/) · 3,486 works · [🔌 Hardware and Architecture](https://md.research.elamur.ai/free/en/shelves/computer-science/hardware-and-architecture/) · 167 works

## Cite

Cite as: Hengyu WU and Yang Cao. 2026. SLIM: Stealthy Low-Coverage Black-Box Watermarking via Latent-Space Confusion Zones. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{wu2026slim,
  title = {{SLIM: Stealthy Low-Coverage Black-Box Watermarking via Latent-Space Confusion Zones}},
  author = {Hengyu WU and Yang Cao},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.919},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.919}
}
```

- [← previous SLANG-GraphRAG: Multi-Layered Retrieval with Domain-Specific Knowledge for Low Resource Social Media Conversations](https://md.research.elamur.ai/free/en/papers/wuraola-2026-slang-graphrag-multi-layered-retrieval/)
- [next → SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs](https://md.research.elamur.ai/free/en/papers/zhengxian-2026-slip-soft-label-mechanism-key/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/50/)

## References

54 references, 16 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, page 308–318, New York, NY, USA. Association for Com… [find](https://scholar.google.com/scholar?q=Martin+Abadi%2C+Andy+Chu%2C+Ian+Goodfellow%2C+H%2E+Brendan+McMahan%2C+Ilya+Mironov%2C+Kunal+Talwar%2C+and+Li+Zhang%2E+2016%2E+Deep+learning+with+differential+privacy%2E+In+Proceedings+of+the+2016+ACM+SIGSAC+Conference+on)
2. Antonis Antoniades, Xinyi Wang, Yanai Elazar, Alfonso Amayuelas, Alon Albalak, Kexun Zhang, and William Yang Wang. 2024. Generalization vs. memorization: Tracing language models’ capabilities back to pretraining data. In ICML 2024 Workshop on Foundation Models in the Wild. [find](https://scholar.google.com/scholar?q=Antonis+Antoniades%2C+Xinyi+Wang%2C+Yanai+Elazar%2C+Alfonso+Amayuelas%2C+Alon+Albalak%2C+Kexun+Zhang%2C+and+William+Yang+Wang%2E+2024%2E+Generalization+vs%2E+memorization%3A+Tracing+language+models%E2%80%99+capabilities+back+to+)
3. Buse Gul Atli Tekgul and N. Asokan. 2022. On the effectiveness of dataset watermarking. In Proceedings of the 2022 ACM on International Workshop on Security and Privacy Analytics, IWSPA ’22, page 93–99, New York, NY, USA. Association for Computing Machinery. [find](https://scholar.google.com/scholar?q=Buse+Gul+Atli+Tekgul+and+N%2E+Asokan%2E+2022%2E+On+the+effectiveness+of+dataset+watermarking%2E+In+Proceedings+of+the+2022+ACM+on+International+Workshop+on+Security+and+Privacy+Analytics%2C+IWSPA+%E2%80%9922%2C+page+93%E2%80%939)
4. Stella Biderman, Hailey Schoelkopf, Quentin Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, Aviya Skowron, Lintang Sutawika, and Oskar Van Der Wal. 2023. Pythia: a suite for analyzing large language models across trainin… [find](https://scholar.google.com/scholar?q=Stella+Biderman%2C+Hailey+Schoelkopf%2C+Quentin+Anthony%2C+Herbie+Bradley%2C+Kyle+O%E2%80%99Brien%2C+Eric+Hallahan%2C+Mohammad+Aflah+Khan%2C+Shivanshu+Purohit%2C+USVSN+Sai+Prashanth%2C+Edward+Raff%2C+Aviya+Skowron%2C+Lintang+Sutaw)
5. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. [Language models are few-shot learners](https://md.research.elamur.ai/free/en/papers/brown-2020-language-models-few-shot-learners/). Advances in neural information processing systems, 33:1877–1901.
6. Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. 2022. [Membership inference attacks from first principles](https://md.research.elamur.ai/free/en/papers/carlini-2021-membership-inference-attacks-first-principles/). In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914.
7. Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Xiaodong Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. 2020. [Extracting training data from large language models](https://md.research.elamur.ai/free/en/papers/carlini-2020-extracting-training-data-large-language/). In USENIX Security Symposium.
8. Zhengyu Chen, Siqi Wang, Teng Xiao, Yudong Wang, Shiqi Chen, Xunliang Cai, Junxian He, and Jingang Wang. 2025. Revisiting scaling laws for language models: The role of data quality and training strategies. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Vo… [find](https://scholar.google.com/scholar?q=Zhengyu+Chen%2C+Siqi+Wang%2C+Teng+Xiao%2C+Yudong+Wang%2C+Shiqi+Chen%2C+Xunliang+Cai%2C+Junxian+He%2C+and+Jingang+Wang%2E+2025%2E+Revisiting+scaling+laws+for+language+models%3A+The+role+of+data+quality+and+training+strate)
9. Sotirios Panagiotis Chytas and Vikas Singh. 2025. Concept attractors in llms and their applications. Preprint, arXiv:2601.11575. — [arXiv:2601.11575](https://arxiv.org/abs/2601.11575) [find](https://scholar.google.com/scholar?q=Sotirios+Panagiotis+Chytas+and+Vikas+Singh%2E+2025%2E+Concept+attractors+in+llms+and+their+applications%2E+Preprint%2C+arXiv%3A2601%2E11575%2E+%E2%80%94+%5BarXiv%3A2601%2E11575%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2601%2E11575%29)
10. Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. [Think you have solved question answering? try arc, the ai2 reasoning challenge](https://md.research.elamur.ai/free/en/papers/clark-2018-think-have-solved-question-answering/). arXiv preprint arXiv:1803.05457.
11. Colin B. Clement, Matthew Bierbaum, Kevin P. O’Keeffe, and Alexander A. Alemi. 2019. On the use of arxiv as a dataset. Preprint, arXiv:1905.00075. — [arXiv:1905.00075](https://arxiv.org/abs/1905.00075) [find](https://scholar.google.com/scholar?q=Colin+B%2E+Clement%2C+Matthew+Bierbaum%2C+Kevin+P%2E+O%E2%80%99Keeffe%2C+and+Alexander+A%2E+Alemi%2E+2019%2E+On+the+use+of+arxiv+as+a+dataset%2E+Preprint%2C+arXiv%3A1905%2E00075%2E+%E2%80%94+%5BarXiv%3A1905%2E00075%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1905%2E00075)
12. Ganqu Cui, Lifan Yuan, Ning Ding, Guanming Yao, Bingxiang He, Wei Zhu, Yuan Ni, Guotong Xie, Ruobing Xie, Yankai Lin, Zhiyuan Liu, and Maosong Sun. 2024. Ultrafeedback: boosting language models with scaled ai feedback. In Proceedings of the 41st International Conference on Machine Learning, ICML’24.… [find](https://scholar.google.com/scholar?q=Ganqu+Cui%2C+Lifan+Yuan%2C+Ning+Ding%2C+Guanming+Yao%2C+Bingxiang+He%2C+Wei+Zhu%2C+Yuan+Ni%2C+Guotong+Xie%2C+Ruobing+Xie%2C+Yankai+Lin%2C+Zhiyuan+Liu%2C+and+Maosong+Sun%2E+2024%2E+Ultrafeedback%3A+boosting+language+models+with+s)
13. Xinyue Cui, Johnny Wei, Swabha Swayamdipta, and Robin Jia. 2025. Robust data watermarking in language models by injecting fictitious knowledge. In Findings of the Association for Computational Linguistics: ACL 2025, pages 14292–14306, Vienna, Austria. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Xinyue+Cui%2C+Johnny+Wei%2C+Swabha+Swayamdipta%2C+and+Robin+Jia%2E+2025%2E+Robust+data+watermarking+in+language+models+by+injecting+fictitious+knowledge%2E+In+Findings+of+the+Association+for+Computational+Linguis)
14. Gonzalo de la Torre-Abaitua, Luis Fernando Lago-Fernández, and David Arroyo. 2021. A compression-based method for detecting anomalies in textual data. Entropy, 23(5):618. [find](https://scholar.google.com/scholar?q=Gonzalo+de+la+Torre%2DAbaitua%2C+Luis+Fernando+Lago%2DFern%C3%A1ndez%2C+and+David+Arroyo%2E+2021%2E+A+compression%2Dbased+method+for+detecting+anomalies+in+textual+data%2E+Entropy%2C+23%285%29%3A618%2E)
15. Jiaxin Fan, Qi Yan, Mohan Li, Guanqun Qu, and Yang Xiao. 2022. A survey on data poisoning attacks and defenses. In 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC), pages 48–55. [find](https://scholar.google.com/scholar?q=Jiaxin+Fan%2C+Qi+Yan%2C+Mohan+Li%2C+Guanqun+Qu%2C+and+Yang+Xiao%2E+2022%2E+A+survey+on+data+poisoning+attacks+and+defenses%2E+In+2022+7th+IEEE+International+Conference+on+Data+Science+in+Cyberspace+%28DSC%29%2C+pages+48%E2%80%93)
16. Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. 2024. Membership inference attacks against fine-tuned large language models via self-prompt calibration. In The Thirty-eighth Annual Conference on Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Wenjie+Fu%2C+Huandong+Wang%2C+Chen+Gao%2C+Guanghua+Liu%2C+Yong+Li%2C+and+Tao+Jiang%2E+2024%2E+Membership+inference+attacks+against+fine%2Dtuned+large+language+models+via+self%2Dprompt+calibration%2E+In+The+Thirty%2Deighth+)
17. Aaron Gokaslan and Vanya Cohen. 2019. Openwebtext corpus. [http://Skylion007.github.io/](http://Skylion007.github.io/) OpenWebTextCorpus. [↗](http://Skylion007.github.io/)
18. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, and 1 others. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). arXiv preprint arXiv:2407.21783.
19. Roee Hendel, Mor Geva, and Amir Globerson. 2023. [In-context learning creates task vectors](https://md.research.elamur.ai/free/en/papers/hendel-2023-context-learning-creates-task-vectors/). In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 9318–9333, Singapore. Association for Computational Linguistics.
20. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2020. [Measuring massive multitask language understanding](https://md.research.elamur.ai/free/en/papers/hendrycks-2020-measuring-massive-multitask-language-understanding/). arXiv preprint arXiv:2009.03300.
21. Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022a. [LoRA: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). In International Conference on Learning Representations.
22. Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S. Yu, and Xuyun Zhang. 2022b. Membership inference attacks on machine learning: A survey. ACM Comput. Surv., 54(11s). [find](https://scholar.google.com/scholar?q=Hongsheng+Hu%2C+Zoran+Salcic%2C+Lichao+Sun%2C+Gillian+Dobbie%2C+Philip+S%2E+Yu%2C+and+Xuyun+Zhang%2E+2022b%2E+Membership+inference+attacks+on+machine+learning%3A+A+survey%2E+ACM+Comput%2E+Surv%2E%2C+54%2811s%29%2E)
23. Hongsheng Hu, Zoran Salčić, Gillian Dobbie, Jinjun Chen, Lichao Sun, and Xuyun Zhang. 2022c. Membership inference via backdooring. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22, pages 3832–3838. International Joint Conferences on Artificial… [find](https://scholar.google.com/scholar?q=Hongsheng+Hu%2C+Zoran+Salc%CC%8Cic%CC%81%2C+Gillian+Dobbie%2C+Jinjun+Chen%2C+Lichao+Sun%2C+and+Xuyun+Zhang%2E+2022c%2E+Membership+inference+via+backdooring%2E+In+Proceedings+of+the+Thirty%2DFirst+International+Joint+Conference+o)
24. Pengrun Huang, Chhavi Yadav, Kamalika Chaudhuri, and Ruihan Wu. 2025. Can we infer confidential properties of training data from llms? arXiv preprint arXiv:2506.10364. — [arXiv:2506.10364](https://arxiv.org/abs/2506.10364) [find](https://scholar.google.com/scholar?q=Pengrun+Huang%2C+Chhavi+Yadav%2C+Kamalika+Chaudhuri%2C+and+Ruihan+Wu%2E+2025%2E+Can+we+infer+confidential+properties+of+training+data+from+llms%3F+arXiv+preprint+arXiv%3A2506%2E10364%2E+%E2%80%94+%5BarXiv%3A2506%2E10364%5D%28https%3A%2F%2Farx)
25. W. Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. 2020. Metapoison: practical general-purpose clean-label data poisoning. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS ’20, Red Hook, NY, USA. Curran Associates Inc. [find](https://scholar.google.com/scholar?q=W%2E+Ronny+Huang%2C+Jonas+Geiping%2C+Liam+Fowl%2C+Gavin+Taylor%2C+and+Tom+Goldstein%2E+2020%2E+Metapoison%3A+practical+general%2Dpurpose+clean%2Dlabel+data+poisoning%2E+In+Proceedings+of+the+34th+International+Conference+o)
26. Minyoung Huh, Brian Cheung, Tongzhou Wang, and Phillip Isola. 2024. Position: [the platonic representation hypothesis](https://md.research.elamur.ai/free/en/papers/huh-2024-platonic-representation-hypothesis/). In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org.
27. Matthew Jagielski, Alina Oprea, Battista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. 2018. Manipulating machine learning: Poisoning attacks and countermeasures for regression learning. In 2018 IEEE Symposium on Security and Privacy (SP), pages 19– 35. [find](https://scholar.google.com/scholar?q=Matthew+Jagielski%2C+Alina+Oprea%2C+Battista+Biggio%2C+Chang+Liu%2C+Cristina+Nita%2DRotaru%2C+and+Bo+Li%2E+2018%2E+Manipulating+machine+learning%3A+Poisoning+attacks+and+countermeasures+for+regression+learning%2E+In+2018)
28. Nikola Jovanović, Robin Staab, and Martin Vechev. 2024. Watermark stealing in large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org. [find](https://scholar.google.com/scholar?q=Nikola+Jovanovic%CC%81%2C+Robin+Staab%2C+and+Martin+Vechev%2E+2024%2E+Watermark+stealing+in+large+language+models%2E+In+Proceedings+of+the+41st+International+Conference+on+Machine+Learning%2C+ICML%E2%80%9924%2E+JMLR%2Eorg%2E)
29. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. [A watermark for large language models](https://md.research.elamur.ai/free/en/papers/kirchenbauer-2023-watermark-large-language-models/). In International Conference on Machine Learning.
30. Michal Kosinski, David Stillwell, and Thore Graepel. 2013. Private traits and attributes are predictable from digital records of human behavior. Proceedings of the National Academy of Sciences, 110(15):5802– 5805. [find](https://scholar.google.com/scholar?q=Michal+Kosinski%2C+David+Stillwell%2C+and+Thore+Graepel%2E+2013%2E+Private+traits+and+attributes+are+predictable+from+digital+records+of+human+behavior%2E+Proceedings+of+the+National+Academy+of+Sciences%2C+110%2815)
31. Gregory Kang Ruey Lau, Xinyuan Niu, Hieu Dao, Jiangwei Chen, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. 2024. Waterfall: Scalable framework for robust text watermarking and provenance for LLMs. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 20432–20… [find](https://scholar.google.com/scholar?q=Gregory+Kang+Ruey+Lau%2C+Xinyuan+Niu%2C+Hieu+Dao%2C+Jiangwei+Chen%2C+Chuan%2DSheng+Foo%2C+and+Bryan+Kian+Hsiang+Low%2E+2024%2E+Waterfall%3A+Scalable+framework+for+robust+text+watermarking+and+provenance+for+LLMs%2E+In+Pr)
32. Zeyu Michael Li, Hung Anh Vu, Damilola Awofisayo, and Emily Wenger. 2025. Exploring causes of representational similarity in machine learning models. arXiv preprint arXiv:2505.13899. — [arXiv:2505.13899](https://arxiv.org/abs/2505.13899) [find](https://scholar.google.com/scholar?q=Zeyu+Michael+Li%2C+Hung+Anh+Vu%2C+Damilola+Awofisayo%2C+and+Emily+Wenger%2E+2025%2E+Exploring+causes+of+representational+similarity+in+machine+learning+models%2E+arXiv+preprint+arXiv%3A2505%2E13899%2E+%E2%80%94+%5BarXiv%3A2505%2E138)
33. Yang Liu, Jiahuan Cao, Chongyu Liu, Kai Ding, and Lianwen Jin. 2025. Datasets for large language models: A comprehensive survey. Artificial Intelligence Review, 58(12). [find](https://scholar.google.com/scholar?q=Yang+Liu%2C+Jiahuan+Cao%2C+Chongyu+Liu%2C+Kai+Ding%2C+and+Lianwen+Jin%2E+2025%2E+Datasets+for+large+language+models%3A+A+comprehensive+survey%2E+Artificial+Intelligence+Review%2C+58%2812%29%2E)
34. Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. 2024. LLM dataset inference: Did you train on my dataset? In The Thirty-eighth Annual Conference on Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Pratyush+Maini%2C+Hengrui+Jia%2C+Nicolas+Papernot%2C+and+Adam+Dziedzic%2E+2024%2E+LLM+dataset+inference%3A+Did+you+train+on+my+dataset%3F+In+The+Thirty%2Deighth+Annual+Conference+on+Neural+Information+Processing+Syst)
35. Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schölkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. 2023. [Membership inference attacks against language models via neighbourhood comparison](https://md.research.elamur.ai/free/en/papers/mattern-2023-membership-inference-attacks-against-language/). In Findings of the Association for Computational Linguistics: ACL 2023, pages 11330– 113…
36. Hamidah Oderinwale and Anna Kazlauskas. 2025. The economics of ai training data: A research agenda. arXiv preprint arXiv:2510.24990. — [arXiv:2510.24990](https://arxiv.org/abs/2510.24990) [find](https://scholar.google.com/scholar?q=Hamidah+Oderinwale+and+Anna+Kazlauskas%2E+2025%2E+The+economics+of+ai+training+data%3A+A+research+agenda%2E+arXiv+preprint+arXiv%3A2510%2E24990%2E+%E2%80%94+%5BarXiv%3A2510%2E24990%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2510%2E24990%29)
37. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. [Train…](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/)
38. Alicia Parrish, Angelica Chen, Nikita Nangia, Vishakh Padmakumar, Jason Phang, Jana Thompson, Phu Mon Htut, and Samuel Bowman. 2022. [Bbq: A hand-built bias benchmark for question answering](https://md.research.elamur.ai/free/en/papers/parrish-2022-bbq-hand-built-bias-benchmark/). In Findings of the Association for Computational Linguistics: ACL 2022, pages 2086–2105.
39. Robi Rahman and David Owen. 2024. The size of datasets used to train language models doubles approximately every six months. Accessed: 2025-12-02. [find](https://scholar.google.com/scholar?q=Robi+Rahman+and+David+Owen%2E+2024%2E+The+size+of+datasets+used+to+train+language+models+doubles+approximately+every+six+months%2E+Accessed%3A+2025%2D12%2D02%2E)
40. Saksham Rastogi, Pratyush Maini, and Danish Pruthi. 2025. STAMP your content: Proving dataset membership via watermarked rephrasings. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Saksham+Rastogi%2C+Pratyush+Maini%2C+and+Danish+Pruthi%2E+2025%2E+STAMP+your+content%3A+Proving+dataset+membership+via+watermarked+rephrasings%2E+In+Forty%2Dsecond+International+Conference+on+Machine+Learning%2E)
41. Jie Ren, Kangrui Chen, Chen Chen, Vikash Sehwag, Yue Xing, Jiliang Tang, and Lingjuan Lyu. 2025. Self-comparison for dataset-level membership inference in large (vision-)language model. In Proceedings of the ACM on Web Conference 2025, WWW ’25, page 910–920, New York, NY, USA. Association for Comput… [find](https://scholar.google.com/scholar?q=Jie+Ren%2C+Kangrui+Chen%2C+Chen+Chen%2C+Vikash+Sehwag%2C+Yue+Xing%2C+Jiliang+Tang%2C+and+Lingjuan+Lyu%2E+2025%2E+Self%2Dcomparison+for+dataset%2Dlevel+membership+inference+in+large+%28vision%2D%29language+model%2E+In+Proceedings)
42. Aaditya Singh, Adam Fry, Adam Perelman, Adam Tart, Adi Ganesh, Ahmed El-Kishky, Aidan McLaughlin, Aiden Low, AJ Ostrow, Akhila Ananthram, and 1 others. 2025. [Openai gpt-5 system card](https://md.research.elamur.ai/free/en/papers/singh-2025-openai-gpt-5-system-card/). arXiv preprint arXiv:2601.03267.
43. Changtian Song, Dongdong Zhao, and Jianwen Xiang. 2024. Not all tokens are equal: Membership inference attacks against fine-tuned language models. 2024 Annual Computer Security Applications Conference (ACSAC), pages 31–45. [find](https://scholar.google.com/scholar?q=Changtian+Song%2C+Dongdong+Zhao%2C+and+Jianwen+Xiang%2E+2024%2E+Not+all+tokens+are+equal%3A+Membership+inference+attacks+against+fine%2Dtuned+language+models%2E+2024+Annual+Computer+Security+Applications+Conference)
44. Nishant Subramani, Sasha Luccioni, Jesse Dodge, and Margaret Mitchell. 2023. Detecting personal information in training corpora: an analysis. In Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing (TrustNLP 2023), pages 208– 220. [find](https://scholar.google.com/scholar?q=Nishant+Subramani%2C+Sasha+Luccioni%2C+Jesse+Dodge%2C+and+Margaret+Mitchell%2E+2023%2E+Detecting+personal+information+in+training+corpora%3A+an+analysis%2E+In+Proceedings+of+the+3rd+Workshop+on+Trustworthy+Natural+)
45. Daochen Zha, Zaid Pervaiz Bhat, Kwei-Herng Lai, Fan Yang, Zhimeng Jiang, Shaochen Zhong, and Xia Hu. 2025. Data-centric artificial intelligence: A survey. ACM Comput. Surv., 57(5). [find](https://scholar.google.com/scholar?q=Daochen+Zha%2C+Zaid+Pervaiz+Bhat%2C+Kwei%2DHerng+Lai%2C+Fan+Yang%2C+Zhimeng+Jiang%2C+Shaochen+Zhong%2C+and+Xia+Hu%2E+2025%2E+Data%2Dcentric+artificial+intelligence%3A+A+survey%2E+ACM+Comput%2E+Surv%2E%2C+57%285%29%2E)
46. Jingqi Zhang, Ruibo Chen, Yingqing Yang, Peihua Mai, Heng Huang, and Yan Pang. 2025. Leave no trace: Black-box detection of copyrighted dataset usage in large language models via watermarking. arXiv preprint arXiv:2510.02962. — [arXiv:2510.02962](https://arxiv.org/abs/2510.02962) [find](https://scholar.google.com/scholar?q=Jingqi+Zhang%2C+Ruibo+Chen%2C+Yingqing+Yang%2C+Peihua+Mai%2C+Heng+Huang%2C+and+Yan+Pang%2E+2025%2E+Leave+no+trace%3A+Black%2Dbox+detection+of+copyrighted+dataset+usage+in+large+language+models+via+watermarking%2E+arXiv+p)
47. Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi. 2020. Bertscore: Evaluating text generation with bert. In International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Tianyi+Zhang%2C+Varsha+Kishore%2C+Felix+Wu%2C+Kilian+Q%2E+Weinberger%2C+and+Yoav+Artzi%2E+2020%2E+Bertscore%3A+Evaluating+text+generation+with+bert%2E+In+International+Conference+on+Learning+Representations%2E)
48. Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, and 1 others. 2025. Gemma 3 technical report. arXiv preprint arXiv:2503.19786. [find](https://scholar.google.com/scholar?q=Gemma+Team%2C+Aishwarya+Kamath%2C+Johan+Ferret%2C+Shreya+Pathak%2C+Nino+Vieillard%2C+Ramona+Merhej%2C+Sarah+Perrin%2C+Tatiana+Matejovicova%2C+Alexandre+Ram%C3%A9%2C+Morgane+Rivi%C3%A8re%2C+and+1+others%2E+2025%2E+Gemma+3+technical+rep)
49. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Ł ukasz Kaiser, and Illia Polosukhin. 2017. [Attention is all you need](https://md.research.elamur.ai/free/en/papers/vaswani-2017-attention-all-need/). In Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc.
50. Wenhui Wang, Furu Wei, Li Dong, Hangbo Bao, Nan Yang, and Ming Zhou. 2020. Minilm: Deep self-attention distillation for task-agnostic compression of pre-trained transformers. Advances in neural information processing systems, 33:5776–5788. [find](https://scholar.google.com/scholar?q=Wenhui+Wang%2C+Furu+Wei%2C+Li+Dong%2C+Hangbo+Bao%2C+Nan+Yang%2C+and+Ming+Zhou%2E+2020%2E+Minilm%3A+Deep+self%2Dattention+distillation+for+task%2Dagnostic+compression+of+pre%2Dtrained+transformers%2E+Advances+in+neural+inform)
51. Zhibo Wang, Jingjing Ma, Xue Wang, Jiahui Hu, Zhan Qin, and Kui Ren. 2022. Threats to training: A survey of poisoning attacks and defenses on machine learning systems. ACM Comput. Surv., 55(7). [find](https://scholar.google.com/scholar?q=Zhibo+Wang%2C+Jingjing+Ma%2C+Xue+Wang%2C+Jiahui+Hu%2C+Zhan+Qin%2C+and+Kui+Ren%2E+2022%2E+Threats+to+training%3A+A+survey+of+poisoning+attacks+and+defenses+on+machine+learning+systems%2E+ACM+Comput%2E+Surv%2E%2C+55%287%29%2E)
52. Johnny Wei, Ryan Wang, and Robin Jia. 2024. Proving membership in LLM pretraining data via data watermarks. In Findings of the Association for Computational Linguistics: ACL 2024, pages 13306–13320, Bangkok, Thailand. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Johnny+Wei%2C+Ryan+Wang%2C+and+Robin+Jia%2E+2024%2E+Proving+membership+in+LLM+pretraining+data+via+data+watermarks%2E+In+Findings+of+the+Association+for+Computational+Linguistics%3A+ACL+2024%2C+pages+13306%E2%80%9313320%2C+B)
53. Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018. [Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting](https://md.research.elamur.ai/free/en/papers/yeom-2017-privacy-risk-machine-learning-analyzing/) . In 2018 IEEE 31st Computer Security Foundations Symposium (CSF), pages 268–282, Los Alamitos, CA, USA. IEEE Computer Society.
54. Xiao Yu, Zexian Zhang, Feifei Niu, Xing Hu, Xin Xia, and John Grundy. 2024. What makes a high-quality training dataset for large language models: A practitioners’ perspective. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, ASE ’24, page 656–668, New Y… [find](https://scholar.google.com/scholar?q=Xiao+Yu%2C+Zexian+Zhang%2C+Feifei+Niu%2C+Xing+Hu%2C+Xin+Xia%2C+and+John+Grundy%2E+2024%2E+What+makes+a+high%2Dquality+training+dataset+for+large+language+models%3A+A+practitioners%E2%80%99+perspective%2E+In+Proceedings+of+the+39)

*Updated 2 November 2026*