---
title: "SEAD — paper by Yi et al. (2026) — summary and ideas"
description: "Membership inference attacks (MIAs) test whether a given text was part of a model's training data, which matters for privacy… 65 references."
authors: ["Biao Yi", "Jiahao Li", "Yiming Li", "Yu He", "Baolei Zhang", "Zheli Liu", "Dacheng Tao"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.337/"
doi: "10.18653/v1/2026.findings-acl.337"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/yi-2026-sead-surrogate-free-label-only/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/yi-2026-sead-surrogate-free-label-only/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/49/) / SEAD: A Surrogate-free Label-only Membership Inference Attack against Pre-trained LLMs with Semantic-Aware Density

# SEAD: A Surrogate-free Label-only Membership Inference Attack against Pre-trained LLMs with Semantic-Aware Density

**Authors:** [Biao Yi](https://md.research.elamur.ai/free/en/authors/biao-yi/), [Jiahao Li](https://md.research.elamur.ai/free/en/authors/jiahao-li/), [Yiming Li](https://md.research.elamur.ai/free/en/authors/yiming-li/), [Yu He](https://md.research.elamur.ai/free/en/authors/yu-he/), [Baolei Zhang](https://md.research.elamur.ai/free/en/authors/baolei-zhang/), [Zheli Liu](https://md.research.elamur.ai/free/en/authors/zheli-liu/) and [Dacheng Tao](https://md.research.elamur.ai/free/en/authors/dacheng-tao/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.337/) · [PDF](https://aclanthology.org/2026.findings-acl.337.pdf) · [DOI 10.18653/v1/2026.findings-acl.337](https://doi.org/10.18653/v1/2026.findings-acl.337) · [OpenAlex](https://openalex.org/W7166821102)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Membership inference attacks (MIAs) test whether a given text was part of a model's training data, which matters for privacy audits, copyright checks and verifying machine unlearning. Most attacks on pre-trained LLMs need token probabilities, but many APIs return only generated text. The previous label-only method, PETAL, approximates the target model's probabilities through a public surrogate model. The authors show that this approach depends heavily on which surrogate is chosen and produces large estimation errors.

Their method, SEAD, removes the surrogate. It queries the target model repeatedly and uses Monte Carlo sampling to estimate next-token distributions at each position. It then calculates a semantic-aware density: sampled tokens add probability mass according to how semantically close an NLI model judges them to be to the true token. A perplexity-style score built from these densities is thresholded to decide membership.

On WikiMIA and MIMIR, SEAD beats existing label-only attacks. It can also act as a density estimator inside stronger calibrated attacks such as RECALL.

## Key points
- With newer surrogates such as Qwen2-7B instead of GPT2-XL, PETAL's mean AUROC on Llama models drops from 0.59 to 0.52. The authors call this effect "surrogate memorization bias."
- PETAL's probability estimation error (ℓ1) can exceed 0.2. SEAD needs just 50 samples to cut this error roughly tenfold, and accuracy improves as more samples are drawn (tested from 10 to 130).
- Combined with RECALL, SEAD raises label-only AUROC from 0.63 to 0.75 on Mamba-1.4B and from 0.66 to 0.80 on Pythia-6.9B.
- Additional analyses report the following:
  - NLI-based similarity outperforms cosine similarity.
  - Attack strength holds on paraphrased WikiMIA.
  - SEAD offers a better accuracy–efficiency trade-off than PETAL.
  - In a case study on a closed-source LLM, SEAD again outperforms PETAL.
- The code is released on GitHub (clearloveclearlove/SEAD).

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Nanyang Technological University](https://md.research.elamur.ai/free/en/universities/nanyang-technological-university/) — University, Singapore, Singapore · 184 works · 27,484 citations
- [Zhejiang University](https://md.research.elamur.ai/free/en/universities/zhejiang-university/) — University, Hangzhou, China · 224 works · 13,587 citations
- [Xi'an Jiaotong University](https://md.research.elamur.ai/free/en/universities/xi-an-jiaotong-university/) — University, Xi'an, China · 42 works · 36,431 citations
- [Nankai University](https://md.research.elamur.ai/free/en/universities/nankai-university/) — University, Tianjin, China · 36 works · 762 citations

📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works

## Cite

Cite as: Biao Yi, Jiahao Li, Yiming Li, Yu He, Baolei Zhang, Zheli Liu and Dacheng Tao. 2026. SEAD: A Surrogate-free Label-only Membership Inference Attack against Pre-trained LLMs with Semantic-Aware Density. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{yi2026sead,
  title = {{SEAD: A Surrogate-free Label-only Membership Inference Attack against Pre-trained LLMs with Semantic-Aware Density}},
  author = {Biao Yi, Jiahao Li, Yiming Li, Yu He, Baolei Zhang, Zheli Liu and Dacheng Tao},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.337},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.337}
}
```

- [← previous SEA-SafeguardBench: Culturally Grounded Safety Benchmark for Southeast Asian Languages](https://md.research.elamur.ai/free/en/papers/tasawong-2026-sea-safeguardbench-culturally-grounded-safety/)
- [next → SEARCH-R: Structured Entity-Aware Retrieval with Chain-of-Reasoning Navigator for Multi-hop Question Answering](https://md.research.elamur.ai/free/en/papers/yuqing-2026-search-r-structured-entity-aware/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/49/)

## References

65 references, 19 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Ebtesam Almazrouei, Hamza Alobeidli, Abdulaziz Alshamsi, Alessandro Cappelli, Ruxandra Cojocaru, Mérouane Debbah, Étienne Goffinet, Daniel Hesslow, Julien Launay, Quentin Malartic, Daniele Mazzotta, Badreddine Noune, Baptiste Pannier, and Guilherme Penedo. 2023. [The falcon series of open language mo…](https://md.research.elamur.ai/free/en/papers/almazrouei-2023-falcon-series-open-language-models/)
2. Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, and 1 others. 2023. Pythia: A suite for analyzing large language models across training and scaling. In ICML. [find](https://scholar.google.com/scholar?q=Stella+Biderman%2C+Hailey+Schoelkopf%2C+Quentin+Gregory+Anthony%2C+Herbie+Bradley%2C+Kyle+O%E2%80%99Brien%2C+Eric+Hallahan%2C+Mohammad+Aflah+Khan%2C+Shivanshu+Purohit%2C+USVSN+Sai+Prashanth%2C+Edward+Raff%2C+and+1+others%2E+2023%2E+)
3. Christopher M. Bishop. 2006. Pattern Recognition and Machine Learning. Information Science and Statistics. Springer. [find](https://scholar.google.com/scholar?q=Christopher+M%2E+Bishop%2E+2006%2E+Pattern+Recognition+and+Machine+Learning%2E+Information+Science+and+Statistics%2E+Springer%2E)
4. Sid Black, Stella Biderman, Eric Hallahan, Quentin Anthony, Leo Gao, Laurence Golding, Horace He, Connor Leahy, Kyle McDonell, Jason Phang, Michael Pieler, USVSN Sai Prashanth, Shivanshu Purohit, Laria Reynolds, Jonathan Tow, Ben Wang, and Samuel Weinbach. 2022. [Gpt-neox-20b: An open-source autoregr…](https://md.research.elamur.ai/free/en/papers/black-2022-gpt-neox-20b-open-source/)
5. Jinwen He, Yiyang Lu, Zijin Lin, Kai Chen, and Yue Zhao. 2025a. Privacyxray: Detecting privacy breaches in llms through semantic consistency and probability certainty. arXiv preprint arXiv:2506.19563. — [arXiv:2506.19563](https://arxiv.org/abs/2506.19563) [find](https://scholar.google.com/scholar?q=Jinwen+He%2C+Yiyang+Lu%2C+Zijin+Lin%2C+Kai+Chen%2C+and+Yue+Zhao%2E+2025a%2E+Privacyxray%3A+Detecting+privacy+breaches+in+llms+through+semantic+consistency+and+probability+certainty%2E+arXiv+preprint+arXiv%3A2506%2E19563%2E)
6. Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP). [find](https://scholar.google.com/scholar?q=Lucas+Bourtoule%2C+Varun+Chandrasekaran%2C+Christopher+A+Choquette%2DChoo%2C+Hengrui+Jia%2C+Adelin+Travers%2C+Baiwu+Zhang%2C+David+Lie%2C+and+Nicolas+Papernot%2E+2021%2E+Machine+unlearning%2E+In+2021+IEEE+Symposium+on+Secu)
7. Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. 2021. [Deberta: Decoding-enhanced bert with disentangled attention](https://md.research.elamur.ai/free/en/papers/he-2020-deberta-decoding-enhanced-bert-disentangled/). In ICLR.
8. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. [Language models are few-shot learners](https://md.research.elamur.ai/free/en/papers/brown-2020-language-models-few-shot-learners/). NeurIPS.
9. Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022. [Membership inference attacks from first principles](https://md.research.elamur.ai/free/en/papers/carlini-2021-membership-inference-attacks-first-principles/). In 2022 IEEE Symposium on Security and Privacy (SP).
10. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, and 1 others. 2021. [Extracting training data from large language models](https://md.research.elamur.ai/free/en/papers/carlini-2020-extracting-training-data-large-language/). In 30th USENIX Security Symposium (USENIX Security 21).
11. Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. 2021. Label-only membership inference attacks. In ICML. [find](https://scholar.google.com/scholar?q=Christopher+A+Choquette%2DChoo%2C+Florian+Tramer%2C+Nicholas+Carlini%2C+and+Nicolas+Papernot%2E+2021%2E+Label%2Donly+membership+inference+attacks%2E+In+ICML%2E)
12. Debeshee Das, Jie Zhang, and Florian Tramèr. 2025. Blind baselines beat membership inference attacks for foundation models. arXiv preprint arXiv:2406.16201. — [arXiv:2406.16201](https://arxiv.org/abs/2406.16201) [find](https://scholar.google.com/scholar?q=Debeshee+Das%2C+Jie+Zhang%2C+and+Florian+Tram%C3%A8r%2E+2025%2E+Blind+baselines+beat+membership+inference+attacks+for+foundation+models%2E+arXiv+preprint+arXiv%3A2406%2E16201%2E+%E2%80%94+%5BarXiv%3A2406%2E16201%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F)
13. Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. 2024. [Do membership inference attacks work on large language models?](https://md.research.elamur.ai/free/en/papers/duan-2024-membership-inference-attacks-work-large/) arXiv:2402.07841.
14. Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. 2025. Mia-tuner: Adapting large language models as pre-training text detector. In AAAI. [find](https://scholar.google.com/scholar?q=Wenjie+Fu%2C+Huandong+Wang%2C+Chen+Gao%2C+Guanghua+Liu%2C+Yong+Li%2C+and+Tao+Jiang%2E+2025%2E+Mia%2Dtuner%3A+Adapting+large+language+models+as+pre%2Dtraining+text+detector%2E+In+AAAI%2E)
15. Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, Shawn Presser, and Connor Leahy. 2021. The pile: An 800gb dataset of diverse text for language modeling. arXiv preprint arXiv:2101.00027. [find](https://scholar.google.com/scholar?q=Leo+Gao%2C+Stella+Biderman%2C+Sid+Black%2C+Laurence+Golding%2C+Travis+Hoppe%2C+Charles+Foster%2C+Jason+Phang%2C+Horace+He%2C+Anish+Thite%2C+Noa+Nabeshima%2C+Shawn+Presser%2C+and+Connor+Leahy%2E+2021%2E+The+pile%3A+An+800gb+datas)
16. Jianing Geng, Biao Yi, Zekun Fei, Tongxi Wu, Lihai Nie, and Zheli Liu. 2025. When safety detectors aren’t enough: A stealthy and effective jailbreak attack on llms via steganographic techniques. arXiv preprint arXiv:2505.16765. — [arXiv:2505.16765](https://arxiv.org/abs/2505.16765) [find](https://scholar.google.com/scholar?q=Jianing+Geng%2C+Biao+Yi%2C+Zekun+Fei%2C+Tongxi+Wu%2C+Lihai+Nie%2C+and+Zheli+Liu%2E+2025%2E+When+safety+detectors+aren%E2%80%99t+enough%3A+A+stealthy+and+effective+jailbreak+attack+on+llms+via+steganographic+techniques%2E+arXiv)
17. Albert Gu and Tri Dao. 2023. Mamba: Linear-time sequence modeling with selective state spaces. arXiv:2312.00752. [find](https://scholar.google.com/scholar?q=Albert+Gu+and+Tri+Dao%2E+2023%2E+Mamba%3A+Linear%2Dtime+sequence+modeling+with+selective+state+spaces%2E+arXiv%3A2312%2E00752%2E)
18. Yu He, Boheng Li, Liu Liu, Zhongjie Ba, Wei Dong, Yiming Li, Zhan Qin, Kui Ren, and Chun Chen. 2025b. Towards label-only membership inference attack against pre-trained large language models. In USENIX security symposium (USENIX Security). [find](https://scholar.google.com/scholar?q=Yu+He%2C+Boheng+Li%2C+Liu+Liu%2C+Zhongjie+Ba%2C+Wei+Dong%2C+Yiming+Li%2C+Zhan+Qin%2C+Kui+Ren%2C+and+Chun+Chen%2E+2025b%2E+Towards+label%2Donly+membership+inference+attack+against+pre%2Dtrained+large+language+models%2E+In+USENI)
19. Ruihan Hu, Yu-Ming Shang, Jiankun Peng, Wei Luo, Yazhe Wang, and Xi Zhang. 2025. Automated detection of pre-training text in black-box llms. In IJCAI. [find](https://scholar.google.com/scholar?q=Ruihan+Hu%2C+Yu%2DMing+Shang%2C+Jiankun+Peng%2C+Wei+Luo%2C+Yazhe+Wang%2C+and+Xi+Zhang%2E+2025%2E+Automated+detection+of+pre%2Dtraining+text+in+black%2Dbox+llms%2E+In+IJCAI%2E)
20. Zhiheng Huang, Yannan Liu, Daojing He, and Yu Li. 2025. Df-mia: A distribution-free membership inference attack on fine-tuned large language models. In AAAI. [find](https://scholar.google.com/scholar?q=Zhiheng+Huang%2C+Yannan+Liu%2C+Daojing+He%2C+and+Yu+Li%2E+2025%2E+Df%2Dmia%3A+A+distribution%2Dfree+membership+inference+attack+on+fine%2Dtuned+large+language+models%2E+In+AAAI%2E)
21. Shotaro Ishihara. 2023. Training data extraction from pre-trained language models: A survey. In The Third Workshop on Trustworthy Natural Language Processing. [find](https://scholar.google.com/scholar?q=Shotaro+Ishihara%2E+2023%2E+Training+data+extraction+from+pre%2Dtrained+language+models%3A+A+survey%2E+In+The+Third+Workshop+on+Trustworthy+Natural+Language+Processing%2E)
22. Gyuwan Kim, Yang Li, Evangelia Spiliopoulou, Jie Ma, Miguel Ballesteros, and William Yang Wang. 2024. [Detecting training data of large language models via expectation maximization](https://md.research.elamur.ai/free/en/papers/kim-2026-detecting-training-data-large-language/). arXiv preprint arXiv:2410.07582.
23. Klas Leino and Matt Fredrikson. 2020. Stolen memories: Leveraging model memorization for calibrated {White-Box} membership inference. In 29th USENIX security symposium (USENIX Security 20). [find](https://scholar.google.com/scholar?q=Klas+Leino+and+Matt+Fredrikson%2E+2020%2E+Stolen+memories%3A+Leveraging+model+memorization+for+calibrated+%7BWhite%2DBox%7D+membership+inference%2E+In+29th+USENIX+security+symposium+%28USENIX+Security+20%29%2E)
24. Marvin Li, Jason Wang, Jeffrey G. Wang, and Seth Neel. 2023. Mope: Model perturbation based privacy attacks on language models. In EMNLP. [find](https://scholar.google.com/scholar?q=Marvin+Li%2C+Jason+Wang%2C+Jeffrey+G%2E+Wang%2C+and+Seth+Neel%2E+2023%2E+Mope%3A+Model+perturbation+based+privacy+attacks+on+language+models%2E+In+EMNLP%2E)
25. Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2024. Backdoor learning: A survey. IEEE Trans. Neural Networks Learn. Syst. [find](https://scholar.google.com/scholar?q=Yiming+Li%2C+Yong+Jiang%2C+Zhifeng+Li%2C+and+Shu%2DTao+Xia%2E+2024%2E+Backdoor+learning%3A+A+survey%2E+IEEE+Trans%2E+Neural+Networks+Learn%2E+Syst%2E)
26. Zheng Li and Yang Zhang. 2021. Membership leakage in label-only exposures. In CCS. [find](https://scholar.google.com/scholar?q=Zheng+Li+and+Yang+Zhang%2E+2021%2E+Membership+leakage+in+label%2Donly+exposures%2E+In+CCS%2E)
27. Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. 2024. LLM dataset inference: Did you train on my dataset? In NeurIPS. [find](https://scholar.google.com/scholar?q=Pratyush+Maini%2C+Hengrui+Jia%2C+Nicolas+Papernot%2C+and+Adam+Dziedzic%2E+2024%2E+LLM+dataset+inference%3A+Did+you+train+on+my+dataset%3F+In+NeurIPS%2E)
28. Disha Makhija, Manoj Ghuhan Arivazhagan, Vinayshekhar Bannihatti Kumar, and Rashmi Gangadharaiah. 2025. [Neural breadcrumbs: Membership inference attacks on llms through hidden state and attention pattern analysis](https://md.research.elamur.ai/free/en/papers/makhija-2026-neural-breadcrumbs-membership-inference-attacks/). arXiv preprint arXiv:2509.05449.
29. Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. 2023. [Membership inference attacks against language models via neighbourhood comparison](https://md.research.elamur.ai/free/en/papers/mattern-2023-membership-inference-attacks-against-language/). In Findings of ACL.
30. Matthieu Meeus, Shubham Jain, Marek Rei, and Yves-Alexandre de Montjoye. 2024a. Did the neurons read your book? document-level membership inference for large language models. In USENIX Security. [find](https://scholar.google.com/scholar?q=Matthieu+Meeus%2C+Shubham+Jain%2C+Marek+Rei%2C+and+Yves%2DAlexandre+de+Montjoye%2E+2024a%2E+Did+the+neurons+read+your+book%3F+document%2Dlevel+membership+inference+for+large+language+models%2E+In+USENIX+Security%2E)
31. Matthieu Meeus, Shubham Jain, Marek Rei, and Yves-Alexandre de Montjoye. 2024b. Inherent challenges of post-hoc membership inference for large language models. arXiv preprint arXiv:2406.17975. — [arXiv:2406.17975](https://arxiv.org/abs/2406.17975) [find](https://scholar.google.com/scholar?q=Matthieu+Meeus%2C+Shubham+Jain%2C+Marek+Rei%2C+and+Yves%2DAlexandre+de+Montjoye%2E+2024b%2E+Inherent+challenges+of+post%2Dhoc+membership+inference+for+large+language+models%2E+arXiv+preprint+arXiv%3A2406%2E17975%2E+%E2%80%94+%5BarXi)
32. Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. 2022. [Quantifying privacy risks of masked language models using membership inference attacks](https://md.research.elamur.ai/free/en/papers/mireshghallah-2022-quantifying-privacy-risks-masked-language/). In EMNLP.
33. Hamid Mozaffari and Virendra J. Marathe. 2024. Semantic membership inference attack against large language models. arXiv preprint arXiv:2406.10218. — [arXiv:2406.10218](https://arxiv.org/abs/2406.10218) [find](https://scholar.google.com/scholar?q=Hamid+Mozaffari+and+Virendra+J%2E+Marathe%2E+2024%2E+Semantic+membership+inference+attack+against+large+language+models%2E+arXiv+preprint+arXiv%3A2406%2E10218%2E+%E2%80%94+%5BarXiv%3A2406%2E10218%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2406%2E1021)
34. Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP). [find](https://scholar.google.com/scholar?q=Milad+Nasr%2C+Reza+Shokri%2C+and+Amir+Houmansadr%2E+2019%2E+Comprehensive+privacy+analysis+of+deep+learning%3A+Passive+and+active+white%2Dbox+inference+attacks+against+centralized+and+federated+learning%2E+In+2019+)
35. Ashwinee Panda, Xinyu Tang, Christopher A. Choquette-Choo, Milad Nasr, and Prateek Mittal. 2025. Privacy auditing of large language models. In ICLR. [find](https://scholar.google.com/scholar?q=Ashwinee+Panda%2C+Xinyu+Tang%2C+Christopher+A%2E+Choquette%2DChoo%2C+Milad+Nasr%2C+and+Prateek+Mittal%2E+2025%2E+Privacy+auditing+of+large+language+models%2E+In+ICLR%2E)
36. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2024. [Fine-tuning aligned language models compromises safety, even when users do not intend to!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/) In ICLR.
37. Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, and 1 others. 2019. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9. [find](https://scholar.google.com/scholar?q=Alec+Radford%2C+Jeffrey+Wu%2C+Rewon+Child%2C+David+Luan%2C+Dario+Amodei%2C+Ilya+Sutskever%2C+and+1+others%2E+2019%2E+Language+models+are+unsupervised+multitask+learners%2E+OpenAI+blog%2C+1%288%29%3A9%2E)
38. Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. 2019. White-box vs black-box: Bayes optimal strategies for membership inference. In ICML. [find](https://scholar.google.com/scholar?q=Alexandre+Sablayrolles%2C+Matthijs+Douze%2C+Cordelia+Schmid%2C+Yann+Ollivier%2C+and+Herv%C3%A9+J%C3%A9gou%2E+2019%2E+White%2Dbox+vs+black%2Dbox%3A+Bayes+optimal+strategies+for+membership+inference%2E+In+ICML%2E)
39. Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2019. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In NDSS. [find](https://scholar.google.com/scholar?q=Ahmed+Salem%2C+Yang+Zhang%2C+Mathias+Humbert%2C+Pascal+Berrang%2C+Mario+Fritz%2C+and+Michael+Backes%2E+2019%2E+Ml%2Dleaks%3A+Model+and+data+independent+membership+inference+attacks+and+defenses+on+machine+learning+mode)
40. Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. 2024. Detecting pretraining data from large language models. In ICLR. [find](https://scholar.google.com/scholar?q=Weijia+Shi%2C+Anirudh+Ajith%2C+Mengzhou+Xia%2C+Yangsibo+Huang%2C+Daogao+Liu%2C+Terra+Blevins%2C+Danqi+Chen%2C+and+Luke+Zettlemoyer%2E+2024%2E+Detecting+pretraining+data+from+large+language+models%2E+In+ICLR%2E)
41. Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, and 1 others. 2024. Gemma 2: Improving open language models at a practical size. arXiv:2408.00118. [find](https://scholar.google.com/scholar?q=Gemma+Team%2C+Morgane+Riviere%2C+Shreya+Pathak%2C+Pier+Giuseppe+Sessa%2C+Cassidy+Hardin%2C+Surya+Bhupatiraju%2C+L%C3%A9onard+Hussenot%2C+Thomas+Mesnard%2C+Bobak+Shahriari%2C+Alexandre+Ram%C3%A9%2C+and+1+others%2E+2024%2E+Gemma+2%3A+Impr)
42. Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, and 1 others. 2023. [Llama: Open and efficient foundation language models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-open-efficient-foundation-language/). arXiv:2302.13971.
43. Priyan Vaithilingam, Tianyi Zhang, and Elena L Glassman. 2022. Expectation vs. experience: Evaluating the usability of code generation tools powered by large language models. In Chi conference on human factors in computing systems extended abstracts. [find](https://scholar.google.com/scholar?q=Priyan+Vaithilingam%2C+Tianyi+Zhang%2C+and+Elena+L+Glassman%2E+2022%2E+Expectation+vs%2E+experience%3A+Evaluating+the+usability+of+code+generation+tools+powered+by+large+language+models%2E+In+Chi+conference+on+huma)
44. Cheng Wang, Yiwei Wang, Bryan Hooi, Yujun Cai, Nanyun Peng, and Kai-Wei Chang. 2025. Con-recall: Detecting pre-training data in llms via contrastive decoding. In COLING. [find](https://scholar.google.com/scholar?q=Cheng+Wang%2C+Yiwei+Wang%2C+Bryan+Hooi%2C+Yujun+Cai%2C+Nanyun+Peng%2C+and+Kai%2DWei+Chang%2E+2025%2E+Con%2Drecall%3A+Detecting+pre%2Dtraining+data+in+llms+via+contrastive+decoding%2E+In+COLING%2E)
45. Lauren Watson, Chuan Guo, Graham Cormode, and Alexandre Sablayrolles. 2021. On the importance of difficulty calibration in membership inference attacks. In ICLR. [find](https://scholar.google.com/scholar?q=Lauren+Watson%2C+Chuan+Guo%2C+Graham+Cormode%2C+and+Alexandre+Sablayrolles%2E+2021%2E+On+the+importance+of+difficulty+calibration+in+membership+inference+attacks%2E+In+ICLR%2E)
46. Yutong Wu, Han Qiu, Shangwei Guo, Jiwei Li, and Tianwei Zhang. 2024. You only query once: An efficient label-only membership inference attack. In ICLR. [find](https://scholar.google.com/scholar?q=Yutong+Wu%2C+Han+Qiu%2C+Shangwei+Guo%2C+Jiwei+Li%2C+and+Tianwei+Zhang%2E+2024%2E+You+only+query+once%3A+An+efficient+label%2Donly+membership+inference+attack%2E+In+ICLR%2E)
47. Roy Xie, Junlin Wang, Ruomin Huang, Minxing Zhang, Rong Ge, Jian Pei, Neil Zhenqiang Gong, and Bhuwan Dhingra. 2024. ReCaLL: Membership inference via relative conditional log-likelihoods. In EMNLP. [find](https://scholar.google.com/scholar?q=Roy+Xie%2C+Junlin+Wang%2C+Ruomin+Huang%2C+Minxing+Zhang%2C+Rong+Ge%2C+Jian+Pei%2C+Neil+Zhenqiang+Gong%2C+and+Bhuwan+Dhingra%2E+2024%2E+ReCaLL%3A+Membership+inference+via+relative+conditional+log%2Dlikelihoods%2E+In+EMNLP%2E)
48. An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, and 1 others. 2024. Qwen2 technical report. arXiv:2407.10671. [find](https://scholar.google.com/scholar?q=An+Yang%2C+Baosong+Yang%2C+Binyuan+Hui%2C+Bo+Zheng%2C+Bowen+Yu%2C+Chang+Zhou%2C+Chengpeng+Li%2C+Chengyuan+Li%2C+Dayiheng+Liu%2C+Fei+Huang%2C+and+1+others%2E+2024%2E+Qwen2+technical+report%2E+arXiv%3A2407%2E10671%2E)
49. Yuanshun Yao, Xiaojun Xu, and Yang Liu. 2024. [Large language model unlearning](https://md.research.elamur.ai/free/en/papers/yao-2023-large-language-model-unlearning/). In NeurIPS.
50. Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. 2022. Enhanced membership inference attacks against machine learning models. In CCS. [find](https://scholar.google.com/scholar?q=Jiayuan+Ye%2C+Aadyaa+Maddi%2C+Sasi+Kumar+Murakonda%2C+Vincent+Bindschaedler%2C+and+Reza+Shokri%2E+2022%2E+Enhanced+membership+inference+attacks+against+machine+learning+models%2E+In+CCS%2E)
51. Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. [Membership inference attacks against machine learning models](https://md.research.elamur.ai/free/en/papers/shokri-2016-membership-inference-attacks-against-machine/). In 2017 IEEE symposium on security and privacy (SP).
52. Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018. [Privacy risk in machine learning: Analyzing the connection to overfitting](https://md.research.elamur.ai/free/en/papers/yeom-2017-privacy-risk-machine-learning-analyzing/). In 2018 IEEE 31st computer security foundations symposium (CSF).
53. Hongyi Tang, Zhihao Zhu, and Yi Yang. 2025. Identifying pre-training data in llms: A neuron activation-based detection framework. arXiv preprint arXiv:2507.16414. [find](https://scholar.google.com/scholar?q=Hongyi+Tang%2C+Zhihao+Zhu%2C+and+Yi+Yang%2E+2025%2E+Identifying+pre%2Dtraining+data+in+llms%3A+A+neuron+activation%2Dbased+detection+framework%2E+arXiv+preprint+arXiv%3A2507%2E16414%2E)
54. Biao Yi, Sishuo Chen, Yiming Li, Tong Li, Baolei Zhang, and Zheli Liu. 2024. Badacts: A universal backdoor defense in the activation space. In Findings of ACL. [find](https://scholar.google.com/scholar?q=Biao+Yi%2C+Sishuo+Chen%2C+Yiming+Li%2C+Tong+Li%2C+Baolei+Zhang%2C+and+Zheli+Liu%2E+2024%2E+Badacts%3A+A+universal+backdoor+defense+in+the+activation+space%2E+In+Findings+of+ACL%2E)
55. Biao Yi, Zekun Fei, Jianing Geng, Tong Li, Lihai Nie, Zheli Liu, and Yiming Li. 2025a. Badreasoner: Planting tunable overthinking backdoors into large reasoning models for fun or profit. arXiv preprint arXiv:2507.18305. — [arXiv:2507.18305](https://arxiv.org/abs/2507.18305) [find](https://scholar.google.com/scholar?q=Biao+Yi%2C+Zekun+Fei%2C+Jianing+Geng%2C+Tong+Li%2C+Lihai+Nie%2C+Zheli+Liu%2C+and+Yiming+Li%2E+2025a%2E+Badreasoner%3A+Planting+tunable+overthinking+backdoors+into+large+reasoning+models+for+fun+or+profit%2E+arXiv+preprin)
56. Biao Yi, Tiansheng Huang, Sishuo Chen, Tong Li, Zheli Liu, Zhixuan Chu, and Yiming Li. 2025b. Probe before you talk: Towards black-box defense against backdoor unalignment for large language models. In ICLR. [find](https://scholar.google.com/scholar?q=Biao+Yi%2C+Tiansheng+Huang%2C+Sishuo+Chen%2C+Tong+Li%2C+Zheli+Liu%2C+Zhixuan+Chu%2C+and+Yiming+Li%2E+2025b%2E+Probe+before+you+talk%3A+Towards+black%2Dbox+defense+against+backdoor+unalignment+for+large+language+models%2E+I)
57. Biao Yi, Tiansheng Huang, Baolei Zhang, Tong Li, Lihai Nie, Zheli Liu, and Li Shen. 2025c. [CTRAP: embedding collapse trap to safeguard large language models from harmful fine-tuning](https://md.research.elamur.ai/free/en/papers/yi-2026-ctrap-embedding-collapse-trap-safeguard/). arXiv preprint arXiv:2505.16559.
58. Biao Yi, Jiahao Li, Baolei Zhang, Lihai Nie, Tong Li, Tiansheng Huang, and Zheli Liu. 2025d. Gradient surgery for safe LLM fine-tuning. arXiv preprint arXiv:2508.07172. — [arXiv:2508.07172](https://arxiv.org/abs/2508.07172) [find](https://scholar.google.com/scholar?q=Biao+Yi%2C+Jiahao+Li%2C+Baolei+Zhang%2C+Lihai+Nie%2C+Tong+Li%2C+Tiansheng+Huang%2C+and+Zheli+Liu%2E+2025d%2E+Gradient+surgery+for+safe+LLM+fine%2Dtuning%2E+arXiv+preprint+arXiv%3A2508%2E07172%2E+%E2%80%94+%5BarXiv%3A2508%2E07172%5D%28https%3A%2F%2Far)
59. Hengxiang Zhang, Songxin Zhang, Bingyi Jing, and Hongxin Wei. 2025a. Fine-tuning can help detect pre-training data from large language models. In ICLR. [find](https://scholar.google.com/scholar?q=Hengxiang+Zhang%2C+Songxin+Zhang%2C+Bingyi+Jing%2C+and+Hongxin+Wei%2E+2025a%2E+Fine%2Dtuning+can+help+detect+pre%2Dtraining+data+from+large+language+models%2E+In+ICLR%2E)
60. Jie Zhang, Debeshee Das, Gautam Kamath, and Florian Tramèr. 2025b. Position: Membership inference attacks cannot prove that a model was trained on your data. In SaTML. [find](https://scholar.google.com/scholar?q=Jie+Zhang%2C+Debeshee+Das%2C+Gautam+Kamath%2C+and+Florian+Tram%C3%A8r%2E+2025b%2E+Position%3A+Membership+inference+attacks+cannot+prove+that+a+model+was+trained+on+your+data%2E+In+SaTML%2E)
61. Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Frank Yang, and Hai Li. 2025c. Min-k%++: Improved baseline for pre-training data detection from large language models. In ICLR. [find](https://scholar.google.com/scholar?q=Jingyang+Zhang%2C+Jingwei+Sun%2C+Eric+Yeats%2C+Yang+Ouyang%2C+Martin+Kuo%2C+Jianyi+Zhang%2C+Hao+Frank+Yang%2C+and+Hai+Li%2E+2025c%2E+Min%2Dk%25%2B%2B%3A+Improved+baseline+for+pre%2Dtraining+data+detection+from+large+language+model)
62. Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona T. Diab, Xian Li, Xi Victoria Lin, Todor Mihaylov, Myle Ott, Sam Shleifer, Kurt Shuster, Daniel Simig, Punit Singh Koura, Anjali Sridhar, Tianlu Wang, and Luke Zettlemoyer. 2022. [OPT: open pre-t…](https://md.research.elamur.ai/free/en/papers/zhang-2022-opt-open-pre-trained-transformer/)
63. Weichao Zhang, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Yixing Fan, and Xueqi Cheng. 2024. Pre-training data detection for large language models: A divergence-based calibration method. In EMNLP. [find](https://scholar.google.com/scholar?q=Weichao+Zhang%2C+Ruqing+Zhang%2C+Jiafeng+Guo%2C+Maarten+de+Rijke%2C+Yixing+Fan%2C+and+Xueqi+Cheng%2E+2024%2E+Pre%2Dtraining+data+detection+for+large+language+models%3A+A+divergence%2Dbased+calibration+method%2E+In+EMNLP%2E)
64. Baohang Zhou, Zezhong Wang, Lingzhi Wang, Hongru Wang, Ying Zhang, Kehui Song, Xuhui Sui, and Kam-Fai Wong. 2024. DPDLLM: A black-box framework for detecting pre-training data from large language models. In Findings of ACL. [find](https://scholar.google.com/scholar?q=Baohang+Zhou%2C+Zezhong+Wang%2C+Lingzhi+Wang%2C+Hongru+Wang%2C+Ying+Zhang%2C+Kehui+Song%2C+Xuhui+Sui%2C+and+Kam%2DFai+Wong%2E+2024%2E+DPDLLM%3A+A+black%2Dbox+framework+for+detecting+pre%2Dtraining+data+from+large+language+mode)
65. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv:2307.15043.

*Updated 2 November 2026*