---
title: "Adaptive Backtracking for Privacy Protection in Large Language"
description: "The authors propose ABack, a training-free decoding method with three steps: An LLM extracts personally identifiable entities… 42 references."
authors: ["Zhihao Yao", "Yuxuan Gu", "Xiachong Feng", "Weitao Ma", "Bo Li", "Xiaocheng Feng", "Bing Qin"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.1857/"
doi: "10.18653/v1/2026.findings-acl.1857"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/yao-2026-adaptive-backtracking-privacy-protection-large/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/yao-2026-adaptive-backtracking-privacy-protection-large/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/21/) / Adaptive Backtracking for Privacy Protection in Large Language Models

# Adaptive Backtracking for Privacy Protection in Large Language Models

**Authors:** Zhihao Yao, [Yuxuan Gu](https://md.research.elamur.ai/free/en/authors/yuxuan-gu/), [Xiachong Feng](https://md.research.elamur.ai/free/en/authors/xiachong-feng/), [Weitao Ma](https://md.research.elamur.ai/free/en/authors/weitao-ma/), [Bo Li](https://md.research.elamur.ai/free/en/authors/bo-li/), [Xiaocheng Feng](https://md.research.elamur.ai/free/en/authors/xiaocheng-feng/) and [Bing Qin](https://md.research.elamur.ai/free/en/authors/bing-qin/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.1857/) · [PDF](https://aclanthology.org/2026.findings-acl.1857.pdf) · [DOI 10.18653/v1/2026.findings-acl.1857](https://doi.org/10.18653/v1/2026.findings-acl.1857) · [OpenAlex](https://openalex.org/W4415192381)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
In retrieval-augmented generation, attackers can write prompts that make an LLM reveal private details from the documents it retrieves. Existing defenses either mask the data before generation, which leaves the model with less useful context, or cut out leaked tokens during decoding. Cutting tokens does not change the model's underlying drive to disclose, so it often leaks again later in the response. The authors propose ABack, a training-free decoding method with three steps:

1. An LLM extracts personally identifiable entities from the retrieved text.
2. Generation is monitored against that entity list.
3. When a leak is caught, the method treats the urge to disclose as a hidden mental state and reasons backward to find where that intention first appeared. It then rewinds to that point and regenerates with explicit awareness of which entities are private.

Because formal privacy datasets are scarce, the authors also release PriGenQA. It is a synthetic question-answering benchmark in which each query carries personal attributes. Under adversarial attacks on both open and closed models, ABack lifts the combined privacy-utility score as much as 14% above the best-performing baseline, with no loss in answer quality. This suggests the usual trade-off between privacy and usefulness can be avoided.

## Key points
- **Two leak detectors:**
  - Hard string matching uses look-ahead: if a token matches the start of a private entity, the next *m* tokens are generated and checked.
  - Soft semantic matching uses bge-large-en-v1.5 cosine similarity with a threshold δ.
- **Backtracking:** The procedure relies on four mental states (from neutral description to disclosed), grounded in Dual-Pathway Behavioral Development Theory. For efficiency, it rewinds a fixed *d* tokens and processes text in units of *l* tokens.
- **Evaluated models:** Qwen2.5, Gemma-2 and Gemini-2.0. Latency stays comparable to the strongest baseline, and results remain stable across hyperparameter settings.
- **Paraphrase attacks:** In tests on Qwen2.5-7B-Instruct, with GPT-5 acting as the inference judge, post-processing defenses collapse. The soft-matching variant of ABack largely contains this kind of leakage.
- **PriGenQA construction:** The benchmark uses LLM-generated, randomized personal data (names, ages, occupations, financial and medical details). It was verified by automated and manual checks to contain no real individuals.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Harbin Institute of Technology](https://md.research.elamur.ai/free/en/universities/harbin-institute-of-technology/) — University, Harbin, China · 185 works · 29,140 citations
- [Harbin Engineering University](https://md.research.elamur.ai/free/en/universities/harbin-engineering-university/) — University, Harbin, China · 3 works · 9 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works

## Cite

Cite as: Zhihao Yao, Yuxuan Gu, Xiachong Feng, Weitao Ma, Bo Li, Xiaocheng Feng and Bing Qin. 2026. Adaptive Backtracking for Privacy Protection in Large Language Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{yao2026adaptive,
  title = {{Adaptive Backtracking for Privacy Protection in Large Language Models}},
  author = {Zhihao Yao, Yuxuan Gu, Xiachong Feng, Weitao Ma, Bo Li, Xiaocheng Feng and Bing Qin},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1857},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1857}
}
```

- [← previous Adaptive and Representative Multi-Interest Modeling for Recommendation with Large Language Model](https://md.research.elamur.ai/free/en/papers/wang-2026-adaptive-representative-multi-interest-modeling/)
- [next → Adaptive CAT-embedded MT for low-memory, low-compute end-user devices](https://md.research.elamur.ai/free/en/papers/sabo-2026-adaptive-cat-embedded-mt-low/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/21/)

## References

42 references, 12 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Christopher M Bishop and Nasser M Nasrabadi. 2006. Pattern recognition and machine learning, volume 4. Springer. [find](https://scholar.google.com/scholar?q=Christopher+M+Bishop+and+Nasser+M+Nasrabadi%2E+2006%2E+Pattern+recognition+and+machine+learning%2C+volume+4%2E+Springer%2E)
2. Jaydeep Borkar. 2023. What can we learn from data leakage and unlearning for law? arXiv preprint arXiv:2307.10476. [find](https://scholar.google.com/scholar?q=Jaydeep+Borkar%2E+2023%2E+What+can+we+learn+from+data+leakage+and+unlearning+for+law%3F+arXiv+preprint+arXiv%3A2307%2E10476%2E)
3. Jingxue Chen, Hang Yan, Zhiyuan Liu, Min Zhang, Hu Xiong, and Shui Yu. 2024. When federated learning meets privacy-preserving computation. ACM Computing Surveys, 56(12):1–36. [find](https://scholar.google.com/scholar?q=Jingxue+Chen%2C+Hang+Yan%2C+Zhiyuan+Liu%2C+Min+Zhang%2C+Hu+Xiong%2C+and+Shui+Yu%2E+2024%2E+When+federated+learning+meets+privacy%2Dpreserving+computation%2E+ACM+Computing+Surveys%2C+56%2812%29%3A1%E2%80%9336%2E)
4. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, and 1 others. 2025. [Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities](https://md.research.elamur.ai/free/en/papers/comanici-2025-gemini-2-5-pushing-frontier/). arX…
5. Lucas BV De Amorim, George DC Cavalcanti, and Rafael MO Cruz. 2023. The choice of scaling technique matters for classification performance. Applied Soft Computing, 133:109924. [find](https://scholar.google.com/scholar?q=Lucas+BV+De+Amorim%2C+George+DC+Cavalcanti%2C+and+Rafael+MO+Cruz%2E+2023%2E+The+choice+of+scaling+technique+matters+for+classification+performance%2E+Applied+Soft+Computing%2C+133%3A109924%2E)
6. Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yixin Dai, Jiawei Sun, Haofen Wang, and Haofen Wang. 2023. [Retrieval-augmented generation for large language models: A survey](https://md.research.elamur.ai/free/en/papers/gao-2023-retrieval-augmented-generation-large-language/). arXiv preprint arXiv:2312.10997, 2(1).
7. Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, and 1 others. 2025. [A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions](https://md.research.elamur.ai/free/en/papers/huang-2023-survey-hallucination-large-language-models/). ACM Transactions on Information Systems,…
8. Yangsibo Huang, Samyak Gupta, Zexuan Zhong, Kai Li, and Danqi Chen. 2023. Privacy implications of retrieval-based language models. arXiv preprint arXiv:2305.14888. [find](https://scholar.google.com/scholar?q=Yangsibo+Huang%2C+Samyak+Gupta%2C+Zexuan+Zhong%2C+Kai+Li%2C+and+Danqi+Chen%2E+2023%2E+Privacy+implications+of+retrieval%2Dbased+language+models%2E+arXiv+preprint+arXiv%3A2305%2E14888%2E)
9. Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William W Cohen, and Xinghua Lu. 2019. [Pubmedqa: A dataset for biomedical research question answering](https://md.research.elamur.ai/free/en/papers/jin-2019-pubmedqa-dataset-biomedical-research-question/). arXiv preprint arXiv:1909.06146.
10. Alan E Kazdin and Jerome Kagan. 1994. Models of dysfunction in developmental psychopathology. Clinical Psychology: Science and Practice, 1(1):35. [find](https://scholar.google.com/scholar?q=Alan+E+Kazdin+and+Jerome+Kagan%2E+1994%2E+Models+of+dysfunction+in+developmental+psychopathology%2E+Clinical+Psychology%3A+Science+and+Practice%2C+1%281%29%3A35%2E)
11. Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. 2023. Propile: Probing privacy leakage in large language models. Advances in Neural Information Processing Systems, 36:20750–20762. [find](https://scholar.google.com/scholar?q=Siwon+Kim%2C+Sangdoo+Yun%2C+Hwaran+Lee%2C+Martin+Gubri%2C+Sungroh+Yoon%2C+and+Seong+Joon+Oh%2E+2023%2E+Propile%3A+Probing+privacy+leakage+in+large+language+models%2E+Advances+in+Neural+Information+Processing+Systems%2C+3)
12. Guangwei Li, Yuansen Zhang, Yinggui Wang, Shoumeng Yan, Lei Wang, and Tao Wei. 2025. Priv-qa: Privacy-preserving question answering for cloud large language models. arXiv preprint arXiv:2502.13564. — [arXiv:2502.13564](https://arxiv.org/abs/2502.13564) [find](https://scholar.google.com/scholar?q=Guangwei+Li%2C+Yuansen+Zhang%2C+Yinggui+Wang%2C+Shoumeng+Yan%2C+Lei+Wang%2C+and+Tao+Wei%2E+2025%2E+Priv%2Dqa%3A+Privacy%2Dpreserving+question+answering+for+cloud+large+language+models%2E+arXiv+preprint+arXiv%3A2502%2E13564%2E+%E2%80%94+)
13. Qinbin Li, Junyuan Hong, Chulin Xie, Jeffrey Tan, Rachel Xin, Junyi Hou, Xavier Yin, Zhun Wang, Dan Hendrycks, Zhangyang Wang, and 1 others. 2024. Llm-pbe: Assessing data privacy in large language models. arXiv preprint arXiv:2408.12787. [find](https://scholar.google.com/scholar?q=Qinbin+Li%2C+Junyuan+Hong%2C+Chulin+Xie%2C+Jeffrey+Tan%2C+Rachel+Xin%2C+Junyi+Hou%2C+Xavier+Yin%2C+Zhun+Wang%2C+Dan+Hendrycks%2C+Zhangyang+Wang%2C+and+1+others%2E+2024%2E+Llm%2Dpbe%3A+Assessing+data+privacy+in+large+language+mod)
14. Qinbin Li, Zeyi Wen, Zhaomin Wu, Sixu Hu, Naibo Wang, Yuan Li, Xu Liu, and Bingsheng He. 2021. A survey on federated learning systems: Vision, hype and reality for data privacy and protection. IEEE Transactions on Knowledge and Data Engineering, 35(4):3347–3366. [find](https://scholar.google.com/scholar?q=Qinbin+Li%2C+Zeyi+Wen%2C+Zhaomin+Wu%2C+Sixu+Hu%2C+Naibo+Wang%2C+Yuan+Li%2C+Xu+Liu%2C+and+Bingsheng+He%2E+2021%2E+A+survey+on+federated+learning+systems%3A+Vision%2C+hype+and+reality+for+data+privacy+and+protection%2E+IEEE+Tr)
15. Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and 1 others. 2023a. [Prompt injection attack against llm-integrated applications](https://md.research.elamur.ai/free/en/papers/liu-2023-prompt-injection-attack-against-llm/). arXiv preprint arXiv:2306.05499.
16. Yisu Liu, Jinyang An, Wanqian Zhang, Dayan Wu, Jingzi Gu, Zheng Lin, and Weiping Wang. 2024. Disrupting diffusion: Token-level attention erasure attack against diffusion-based customization. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 3587–3596. [find](https://scholar.google.com/scholar?q=Yisu+Liu%2C+Jinyang+An%2C+Wanqian+Zhang%2C+Dayan+Wu%2C+Jingzi+Gu%2C+Zheng+Lin%2C+and+Weiping+Wang%2E+2024%2E+Disrupting+diffusion%3A+Token%2Dlevel+attention+erasure+attack+against+diffusion%2Dbased+customization%2E+In+Procee)
17. Zhenzhen Liu, Chao Wan, Varsha Kishore, Jin Peng Zhou, Minmin Chen, and Kilian Q Weinberger. 2023b. Correction with backtracking reduces hallucination in summarization. arXiv preprint arXiv:2310.16176. — [arXiv:2310.16176](https://arxiv.org/abs/2310.16176) [find](https://scholar.google.com/scholar?q=Zhenzhen+Liu%2C+Chao+Wan%2C+Varsha+Kishore%2C+Jin+Peng+Zhou%2C+Minmin+Chen%2C+and+Kilian+Q+Weinberger%2E+2023b%2E+Correction+with+backtracking+reduces+hallucination+in+summarization%2E+arXiv+preprint+arXiv%3A2310%2E16176)
18. Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. 2023. [Analyzing leakage of personally identifiable information in language models](https://md.research.elamur.ai/free/en/papers/lukas-2023-analyzing-leakage-personally-identifiable-information/). In 2023 IEEE Symposium on Security and Privacy (SP), pages 346–363. IEEE.
19. Stephen Meisenbacher, Alexandra Klymenko, and Florian Matthes. 2025. Llm-as-a-judge for privacy evaluation? exploring the alignment of human and llm perceptions of privacy in textual data. In Proceedings of the 2025 Workshop on Human-Centered AI Privacy and Security, pages 126–138. [find](https://scholar.google.com/scholar?q=Stephen+Meisenbacher%2C+Alexandra+Klymenko%2C+and+Florian+Matthes%2E+2025%2E+Llm%2Das%2Da%2Djudge+for+privacy+evaluation%3F+exploring+the+alignment+of+human+and+llm+perceptions+of+privacy+in+textual+data%2E+In+Proceedi)
20. Fábio Perez and Ian Ribeiro. 2022. [Ignore previous prompt: Attack techniques for language models](https://md.research.elamur.ai/free/en/papers/perez-2022-ignore-previous-prompt-attack-techniques/). arXiv preprint arXiv:2211.09527.
21. Zhenting Qi, Hanlin Zhang, Eric Xing, Sham Kakade, and Himabindu Lakkaraju. 2024. Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems. arXiv preprint arXiv:2402.17840. — [arXiv:2402.17840](https://arxiv.org/abs/2402.17840) [find](https://scholar.google.com/scholar?q=Zhenting+Qi%2C+Hanlin+Zhang%2C+Eric+Xing%2C+Sham+Kakade%2C+and+Himabindu+Lakkaraju%2E+2024%2E+Follow+my+instruction+and+spill+the+beans%3A+Scalable+data+extraction+from+retrieval%2Daugmented+generation+systems%2E+arXiv)
22. Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, and 25 others. 2025. Qwen2.5 technical report. Preprint, arXiv:2412.15115. [find](https://scholar.google.com/scholar?q=Qwen%2C+%3A%2C+An+Yang%2C+Baosong+Yang%2C+Beichen+Zhang%2C+Binyuan+Hui%2C+Bo+Zheng%2C+Bowen+Yu%2C+Chengyuan+Li%2C+Dayiheng+Liu%2C+Fei+Huang%2C+Haoran+Wei%2C+Huan+Lin%2C+Jian+Yang%2C+Jianhong+Tu%2C+Jianwei+Zhang%2C+Jianxin+Yang%2C+Jiaxi+)
23. Bilgehan Sel, Dingcheng Li, Phillip Wallis, Vaishakh Keshava, Ming Jin, and Siddhartha Reddy Jonnalagadda. 2025. Backtracking for safety. arXiv preprint arXiv:2503.08919. — [arXiv:2503.08919](https://arxiv.org/abs/2503.08919) [find](https://scholar.google.com/scholar?q=Bilgehan+Sel%2C+Dingcheng+Li%2C+Phillip+Wallis%2C+Vaishakh+Keshava%2C+Ming+Jin%2C+and+Siddhartha+Reddy+Jonnalagadda%2E+2025%2E+Backtracking+for+safety%2E+arXiv+preprint+arXiv%3A2503%2E08919%2E+%E2%80%94+%5BarXiv%3A2503%2E08919%5D%28https%3A%2F%2F)
24. Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Yang Wu, and 1 others. 2024. [Deepseekmath: Pushing the limits of mathematical reasoning in open language models](https://md.research.elamur.ai/free/en/papers/shao-2024-deepseekmath-pushing-limits-mathematical-reasoning/). arXiv preprint arXiv:2402.03300.
25. Li Siyan, Vethavikashini Chithrra Raghuram, Omar Khattab, Julia Hirschberg, and Zhou Yu. 2024. Papillon: Privacy preservation from internet-based and local language model ensembles. arXiv preprint arXiv:2410.17127. [find](https://scholar.google.com/scholar?q=Li+Siyan%2C+Vethavikashini+Chithrra+Raghuram%2C+Omar+Khattab%2C+Julia+Hirschberg%2C+and+Zhou+Yu%2E+2024%2E+Papillon%3A+Privacy+preservation+from+internet%2Dbased+and+local+language+model+ensembles%2E+arXiv+preprint+arX)
26. Panjun Sun, Shigen Shen, Yi Wan, Zongda Wu, Zhaoxi Fang, and Xiao-zhi Gao. 2024. A survey of iot privacy security: Architecture, technology, challenges, and trends. IEEE internet of things journal, 11(21):34567–34591. [find](https://scholar.google.com/scholar?q=Panjun+Sun%2C+Shigen+Shen%2C+Yi+Wan%2C+Zongda+Wu%2C+Zhaoxi+Fang%2C+and+Xiao%2Dzhi+Gao%2E+2024%2E+A+survey+of+iot+privacy+security%3A+Architecture%2C+technology%2C+challenges%2C+and+trends%2E+IEEE+internet+of+things+journal%2C+11)
27. Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, and 1 others. 2024. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118. [find](https://scholar.google.com/scholar?q=Gemma+Team%2C+Morgane+Riviere%2C+Shreya+Pathak%2C+Pier+Giuseppe+Sessa%2C+Cassidy+Hardin%2C+Surya+Bhupatiraju%2C+L%C3%A9onard+Hussenot%2C+Thomas+Mesnard%2C+Bobak+Shahriari%2C+Alexandre+Ram%C3%A9%2C+and+1+others%2E+2024%2E+Gemma+2%3A+Impr)
28. Rongsheng Wang. 2023. Healthcaremagic-100ken. [https://huggingface.co/datasets/](https://huggingface.co/datasets/) wangrongsheng/HealthCareMagic-100k-en. [↗](https://huggingface.co/datasets/)
29. Yujing Wang, Hainan Zhang, Liang Pang, Yongxin Tong, Binghui Guo, Hongwei Zheng, and Zhiming Zheng. 2025. Learning to erase private knowledge from multi-documents for retrieval-augmented large language models. arXiv preprint arXiv:2504.09910. — [arXiv:2504.09910](https://arxiv.org/abs/2504.09910) [find](https://scholar.google.com/scholar?q=Yujing+Wang%2C+Hainan+Zhang%2C+Liang+Pang%2C+Yongxin+Tong%2C+Binghui+Guo%2C+Hongwei+Zheng%2C+and+Zhiming+Zheng%2E+2025%2E+Learning+to+erase+private+knowledge+from+multi%2Ddocuments+for+retrieval%2Daugmented+large+languag)
30. Kaiyan Zhang, Jianyu Wang, Ermo Hua, Biqing Qi, Ning Ding, and Bowen Zhou. 2024a. Cogenesis: A framework collaborating large and small language models for secure context-aware instruction following. arXiv preprint arXiv:2403.03129. [find](https://scholar.google.com/scholar?q=Kaiyan+Zhang%2C+Jianyu+Wang%2C+Ermo+Hua%2C+Biqing+Qi%2C+Ning+Ding%2C+and+Bowen+Zhou%2E+2024a%2E+Cogenesis%3A+A+framework+collaborating+large+and+small+language+models+for+secure+context%2Daware+instruction+following%2E+a)
31. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, and 1 others. 2022. [Chain-of-thought prompting elicits reasoning in large language models](https://md.research.elamur.ai/free/en/papers/wei-2022-chain-thought-prompting-elicits-reasoning/). Advances in neural information processing systems, 35:24824– 24837.
32. Yiming Zhang, Jianfeng Chi, Hailey Nguyen, Kartikeya Upasani, Daniel M Bikel, Jason Weston, and Eric Michael Smith. 2024b. Backtracking improves generation safety. arXiv preprint arXiv:2409.14586. — [arXiv:2409.14586](https://arxiv.org/abs/2409.14586) [find](https://scholar.google.com/scholar?q=Yiming+Zhang%2C+Jianfeng+Chi%2C+Hailey+Nguyen%2C+Kartikeya+Upasani%2C+Daniel+M+Bikel%2C+Jason+Weston%2C+and+Eric+Michael+Smith%2E+2024b%2E+Backtracking+improves+generation+safety%2E+arXiv+preprint+arXiv%3A2409%2E14586%2E+%E2%80%94+%5B)
33. Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong. 2025a. [A survey on llm-generated text detection: Necessity, methods, and future directions](https://md.research.elamur.ai/free/en/papers/wu-2025-survey-llm-generated-text-detection/). Computational Linguistics, 51(1):275–338.
34. Tsung-Han Wu, Heekyung Lee, Jiaxin Ge, Joseph E Gonzalez, Trevor Darrell, and David M Chan. 2025b. Generate, but verify: Reducing hallucination in vision-language models with retrospective resampling. arXiv preprint arXiv:2504.13169. [find](https://scholar.google.com/scholar?q=Tsung%2DHan+Wu%2C+Heekyung+Lee%2C+Jiaxin+Ge%2C+Joseph+E+Gonzalez%2C+Trevor+Darrell%2C+and+David+M+Chan%2E+2025b%2E+Generate%2C+but+verify%3A+Reducing+hallucination+in+vision%2Dlanguage+models+with+retrospective+resampling%2E)
35. Ying Zhao, Jia Tina Du, and Jinjun Chen. 2024. Scenario-based adaptations of differential privacy: a technical survey. ACM Computing Surveys, 56(8):1– 39. [find](https://scholar.google.com/scholar?q=Ying+Zhao%2C+Jia+Tina+Du%2C+and+Jinjun+Chen%2E+2024%2E+Scenario%2Dbased+adaptations+of+differential+privacy%3A+a+technical+survey%2E+ACM+Computing+Surveys%2C+56%288%29%3A1%E2%80%93+39%2E)
36. Yuan Zhou, Zhuo Zhang, and Xiangyu Zhang. 2025. Exploiting the shadows: Unveiling privacy leaks through lower-ranked tokens in large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8376–8386. [find](https://scholar.google.com/scholar?q=Yuan+Zhou%2C+Zhuo+Zhang%2C+and+Xiangyu+Zhang%2E+2025%2E+Exploiting+the+shadows%3A+Unveiling+privacy+leaks+through+lower%2Dranked+tokens+in+large+language+models%2E+In+Proceedings+of+the+63rd+Annual+Meeting+of+the+A)
37. Yangzhen Wu, Zhiqing Sun, Shanda Li, Sean Welleck, and Yiming Yang. 2024. [Inference scaling laws: An empirical analysis of compute-optimal inference for problem-solving with language models](https://md.research.elamur.ai/free/en/papers/wu-2024-inference-scaling-laws-empirical-analysis/). arXiv preprint arXiv:2408.00724.
38. Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, and Xiuzhen Cheng. 2025. On protecting the data privacy of large language models (llms) and llm agents: A literature review. High-Confidence Computing, page 100300. [find](https://scholar.google.com/scholar?q=Biwei+Yan%2C+Kun+Li%2C+Minghui+Xu%2C+Yueyan+Dong%2C+Yue+Zhang%2C+Zhaochun+Ren%2C+and+Xiuzhen+Cheng%2E+2025%2E+On+protecting+the+data+privacy+of+large+language+models+%28llms%29+and+llm+agents%3A+A+literature+review%2E+High%2DC)
39. Xiao-Wen Yang, Xuan-Yi Zhu, Wen-Da Wei, Ding-Chu Zhang, Jie-Jing Shao, Zhi Zhou, Lan-Zhe Guo, and Yu-Feng Li. 2025. Step back to leap forward: Self-backtracking for boosting reasoning of language models. arXiv preprint arXiv:2502.04404. — [arXiv:2502.04404](https://arxiv.org/abs/2502.04404) [find](https://scholar.google.com/scholar?q=Xiao%2DWen+Yang%2C+Xuan%2DYi+Zhu%2C+Wen%2DDa+Wei%2C+Ding%2DChu+Zhang%2C+Jie%2DJing+Shao%2C+Zhi+Zhou%2C+Lan%2DZhe+Guo%2C+and+Yu%2DFeng+Li%2E+2025%2E+Step+back+to+leap+forward%3A+Self%2Dbacktracking+for+boosting+reasoning+of+language+mode)
40. Shenglai Zeng, Jiankun Zhang, Pengfei He, Jie Ren, Tianqi Zheng, Hanqing Lu, Han Xu, Hui Liu, Yue Xing, and Jiliang Tang. 2024a. Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data. arXiv preprint arXiv:2406.14773. [find](https://scholar.google.com/scholar?q=Shenglai+Zeng%2C+Jiankun+Zhang%2C+Pengfei+He%2C+Jie+Ren%2C+Tianqi+Zheng%2C+Hanqing+Lu%2C+Han+Xu%2C+Hui+Liu%2C+Yue+Xing%2C+and+Jiliang+Tang%2E+2024a%2E+Mitigating+the+privacy+issues+in+retrieval%2Daugmented+generation+%28rag%29+v)
41. Shenglai Zeng, Jiankun Zhang, Pengfei He, Yue Xing, Yiding Liu, Han Xu, Jie Ren, Shuaiqiang Wang, Dawei Yin, Yi Chang, and 1 others. 2024b. The good and the bad: Exploring privacy issues in retrieval-augmented generation (rag). arXiv preprint arXiv:2402.16893. [find](https://scholar.google.com/scholar?q=Shenglai+Zeng%2C+Jiankun+Zhang%2C+Pengfei+He%2C+Yue+Xing%2C+Yiding+Liu%2C+Han+Xu%2C+Jie+Ren%2C+Shuaiqiang+Wang%2C+Dawei+Yin%2C+Yi+Chang%2C+and+1+others%2E+2024b%2E+The+good+and+the+bad%3A+Exploring+privacy+issues+in+retrieval%2D)
42. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024c. [How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lo…

*Updated 2 November 2026*