{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,29]],"date-time":"2026-10-29T22:10:01Z","timestamp":1793311801557,"version":"4.5.0"},"reference-count":110,"publisher":"Springer Science and Business Media LLC","issue":"7","license":[{"start":{"date-parts":[[2025,8,18]],"date-time":"2025-08-18T00:00:00Z","timestamp":1755475200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0"},{"start":{"date-parts":[[2025,8,18]],"date-time":"2025-08-18T00:00:00Z","timestamp":1755475200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0"}],"funder":[{"name":"Startup Fund of Jimei University","award":["ZQ2024014"],"award-info":[{"award-number":["ZQ2024014"]}],"id":[{"id":"https:\/\/ror.org\/03hknyb50","id-type":"ROR","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J. King Saud Univ. Comput. Inf. Sci."],"published-print":{"date-parts":[[2025,9]]},"DOI":"10.1007\/s44443-025-00177-1","type":"journal-article","created":{"date-parts":[[2025,8,18]],"date-time":"2025-08-18T07:59:57Z","timestamp":1755503997000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":43,"title":["A survey on privacy risks and protection in large language models"],"prefix":"10.1007","volume":"37","author":[{"given":"Kang","family":"Chen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiuze","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6717-0950","authenticated-orcid":false,"given":"Yuanguo","family":"Lin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shibo","family":"Feng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Li","family":"Shen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pengcheng","family":"Wu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,8,18]]},"reference":[{"issue":"4","key":"177_CR1","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3214303","volume":"51","author":"A Acar","year":"2018","unstructured":"Acar A, Aksu H, Uluagac AS, Conti M (2018) A survey on homomorphic encryption schemes: Theory and implementation. ACM Comput Surv (Csur) 51(4):1\u201335","journal-title":"ACM Comput Surv (Csur)"},{"key":"177_CR2","unstructured":"Achiam J, Adler S, Agarwal S, Ahmad L, Akkaya I, Aleman FL, Almeida D, Altenschmidt J, Altman S, Anadkat S et\u00a0al (2023) Gpt-4 technical report. arXiv preprint arXiv:2303.08774"},{"issue":"2","key":"177_CR3","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3214262","volume":"2","author":"N Apthorpe","year":"2018","unstructured":"Apthorpe N, Shvartzshnaider Y, Mathur A, Reisman D, Feamster N (2018) Discovering smart home internet of things privacy norms using contextual integrity. Proc ACM Interact Mob Wearable Ubiquit Technol 2(2):1\u201323","journal-title":"Proc ACM Interact Mob Wearable Ubiquit Technol"},{"key":"177_CR4","unstructured":"Bai Y, Pei G, Gu J, Yang Y, Ma X (2024) Special characters attack: Toward scalable training data extraction from large language models. arXiv preprint arXiv:2405.05990"},{"key":"177_CR5","doi-asserted-by":"crossref","unstructured":"Bang Y, Cahyawijaya S, Lee N, Dai W, Su D, Wilie B, Lovenia H,Ji Z, Yu T, Chung W et\u00a0al (2023) A multitask multilingual multimodal evaluation of chatgpt on reasoning hallucination and interactivity. arXiv preprint arXiv:2302.04023","DOI":"10.18653\/v1\/2023.ijcnlp-main.45"},{"key":"177_CR6","unstructured":"Bommasani R, Hudson DA, Adeli E, Altman R, Arora S, Arx S, Bernstein M.S, Bohg J, Bosselut A, Brunskill E et\u00a0al (2021) On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258"},{"key":"177_CR7","doi-asserted-by":"crossref","unstructured":"Boyle E, Gilboa N, Ishai Y (2015) Function secret sharing. In: Annual international conference on the theory and applications of cryptographic techniques, Springer, pp 337\u2013367","DOI":"10.1007\/978-3-662-46803-6_12"},{"key":"177_CR8","unstructured":"Bubeck S, Chadrasekaran V, Eldan R, Gehrke J, Horvitz E, Kamar E, Lee P, Lee YT, Li Y, Lundberg S et\u00a0al (2023) Sparks of artificial general intelligence: Early experiments with gpt-4. ArXiv"},{"key":"177_CR9","unstructured":"Carlini N, Tramer F, Wallace E, Jagielski M, Herbert-Voss A, Lee K, Roberts A, Brown T, Song D, Erlingsson U et\u00a0al (2021) Extracting training data from large language models. In: 30th USENIX security symposium (USENIX Security 21), pp 2633\u20132650"},{"key":"177_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.119785","volume":"223","author":"T Carvalho","year":"2023","unstructured":"Carvalho T, Moniz N, Faria P, Antunes L (2023) Towards a data privacy-predictive performance trade-off. Expert Syst Appl 223:119785","journal-title":"Expert Syst Appl"},{"key":"177_CR11","unstructured":"Chan C, Cheng J, Wang W, Jiang Y, Fang T, Liu X, Song Y (2023) Chatgpt evaluation on sentence level relations: A focus on temporal causal and discourse relations. arXiv preprint arXiv:2304.14827"},{"key":"177_CR12","doi-asserted-by":"publisher","DOI":"10.1016\/j.est.2024.110780","volume":"84","author":"D Chen","year":"2024","unstructured":"Chen D, Zhou X (2024) Attmoe: Attention with mixture of experts for remaining useful life prediction of lithium-ion batteries. J Energy Storage 84:110780","journal-title":"J Energy Storage"},{"key":"177_CR13","doi-asserted-by":"crossref","unstructured":"Chen D, Hong W, Zhou X (2022a) Transformer network for remaining useful life prediction of lithium-ion batteries. IEEE Access 10:19621\u201319628","DOI":"10.1109\/ACCESS.2022.3151975"},{"issue":"4","key":"177_CR14","doi-asserted-by":"publisher","first-page":"42","DOI":"10.1007\/s11280-024-01276-1","volume":"27","author":"J Chen","year":"2024","unstructured":"Chen J, Liu Z, Huang X, Wu C, Liu Q, Jiang G, Pu Y, Lei Y, Chen X, Wang X et al (2024) When large language models meet personalization: Perspectives of challenges and opportunities. World Wide Web 27(4):42","journal-title":"World Wide Web"},{"key":"177_CR15","doi-asserted-by":"crossref","unstructured":"Chen T, Bao H, Huang S, Dong L, Jiao B, Jiang D, Zhou H, Li J, Wei F (2022b) The-x: Privacy-preserving transformer inference with homomorphic encryption. arXiv preprint arXiv:2206.00216","DOI":"10.18653\/v1\/2022.findings-acl.277"},{"key":"177_CR16","unstructured":"Chen H, Chen HH, Sun M, Li K, Chen Z, Wang X (2023a) A verified confidential computing as a service framework for privacy preservation. In: 32nd USENIX security symposium (USENIX Security 23), pp 4733\u20134750 (2023)"},{"key":"177_CR17","unstructured":"Chen C, Feng X, Zhou J, Yin J, Zheng X (2023b) Federated large language model: A position paper. arXiv preprint arXiv:2307.08925"},{"key":"177_CR18","unstructured":"Chen C, He X, Lyu L, Wu F (2021) Killing one bird with two stones: Model extraction and attribute inference attacks against bert-based apis. arXiv preprint arXiv:2105.10909"},{"key":"177_CR19","doi-asserted-by":"crossref","unstructured":"Chu T, Yang M, Laoutaris N, Markopoulou A (2024) Priprune: Quantifying and preserving privacy in pruned federated learning. ACM Trans Model Perform Eval Comput Syst","DOI":"10.1145\/3702241"},{"key":"177_CR20","doi-asserted-by":"crossref","unstructured":"Daftardar A, Reagen B, Garg S (2024) Szkp: A scalable accelerator architecture for zero-knowledge proofs. In: Proceedings of the 2024 international conference on parallel architectures and compilation techniques, pp 271\u2013283","DOI":"10.1145\/3656019.3676898"},{"issue":"6","key":"177_CR21","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3712001","volume":"57","author":"BC Das","year":"2025","unstructured":"Das BC, Amini MH, Wu Y (2025) Security and privacy challenges of large language models: A survey. ACM Comput Surv 57(6):1\u201339","journal-title":"ACM Comput Surv"},{"key":"177_CR22","unstructured":"Dhungana B, Ghimire V, Shrestha\u00a0Lama J, Sadat N, Caporusso N, Doan M (2025) Assessing cybersecurity awareness of ChatGPT\u2019s new memory feature. Presented at posters-at-the-capitol Northern Kentucky University"},{"key":"177_CR23","doi-asserted-by":"crossref","unstructured":"Dong C, Weng J, Liu JN, Zhang Y, Tong Y, Yang A, Cheng Y, Hu S (2022) Fusion: Efficient and secure inference resilient to malicious servers. arXiv preprint arXiv:2205.03040","DOI":"10.14722\/ndss.2023.23199"},{"key":"177_CR24","unstructured":"Duan H, Dziedzic A, Papernot N, Boenisch F (2024a) Flocks of stochastic parrots: Differentially private prompt learning for large language models. Adv Neural Inf Process Syst 36"},{"key":"177_CR25","unstructured":"Duan M, Suri A, Mireshghallah N, Min S, Shi W, Zettlemoyer L, Tsvetkov Y, Choi Y, Evans D, Hajishirzi H (2024b) Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841"},{"key":"177_CR26","doi-asserted-by":"crossref","unstructured":"Endres M, Mannarapotta\u00a0Venugopal A, Tran TS (2022) Synthetic data generation: A comparative study. In: Proceedings of the 26th international database engineered applications symposium, pp 94\u2013102","DOI":"10.1145\/3548785.3548793"},{"key":"177_CR27","doi-asserted-by":"crossref","unstructured":"Esmradi A, Yip DW, Chan CF (2023) A comprehensive survey of attack techniques implementation and mitigation strategies in large language models. In: International conference on ubiquitous security, Springer, pp 76\u201395","DOI":"10.1007\/978-981-97-1274-8_6"},{"key":"177_CR28","doi-asserted-by":"crossref","unstructured":"Fan W, Li H, Deng Z, Wang W, Song Y (2024) Goldcoin: Grounding large language models in privacy laws via contextual integrity theory. arXiv preprint arXiv:2406.11149","DOI":"10.18653\/v1\/2024.emnlp-main.195"},{"key":"177_CR29","first-page":"2021001","volume":"1","author":"D Feng","year":"2022","unstructured":"Feng D, Yang K (2022) Concretely efficient secure multi-party computation protocols: survey and more. Secur Saf 1:2021001","journal-title":"Secur Saf"},{"key":"177_CR30","doi-asserted-by":"crossref","unstructured":"Flemings J, Razaviyayn M, Annavaram M (2024) Differentially private next-token prediction of large language models. arXiv preprint arXiv:2403.15638","DOI":"10.18653\/v1\/2024.naacl-long.247"},{"key":"177_CR31","doi-asserted-by":"crossref","unstructured":"Fredrikson M, Jha S, Ristenpart T (2015) Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp 1322\u20131333","DOI":"10.1145\/2810103.2813677"},{"key":"177_CR32","unstructured":"Fu W, Wang H, Gao C, Liu G, Li Y, Jiang T (2023) Practical membership inference attacks against fine-tuned large language models via self-prompt calibration. arXiv preprint arXiv:2311.06062"},{"key":"177_CR33","unstructured":"Gao X, Zhang L (2023) $$\\{$$PCAT$$\\}$$: Functionality and data stealing from split learning by $$\\{$$Pseudo-Client$$\\}$$ attack. In: 32nd USENIX security symposium (USENIX Security 23), pp 5271\u20135288"},{"issue":"1","key":"177_CR34","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3154793","volume":"21","author":"NZ Gong","year":"2018","unstructured":"Gong NZ, Liu B (2018) Attribute inference attacks in online social networks. ACM Trans Priv Secur (TOPS) 21(1):1\u201330","journal-title":"ACM Trans Priv Secur (TOPS)"},{"key":"177_CR35","doi-asserted-by":"crossref","unstructured":"Goyal S, Hira M, Mishra S, Goyal S, Goel A, Dadu N, DB K, Mehta S, Madaan N (2024) Llmguard: Guarding against unsafe llm behavior. Proceedings of the AAAI conference on artificial intelligence 38:23790\u201323792","DOI":"10.1609\/aaai.v38i21.30566"},{"issue":"14","key":"177_CR36","doi-asserted-by":"publisher","first-page":"2858","DOI":"10.3390\/electronics13142858","volume":"13","author":"J He","year":"2024","unstructured":"He J, Hou G, Jia X, Chen Y, Liao W, Zhou Y, Zhou R (2024) Data stealing attacks against large language models via backdooring. Electron 13(14):2858","journal-title":"Electron"},{"key":"177_CR37","doi-asserted-by":"crossref","unstructured":"Huang W, Wang Y, Cheng A, Zhou A, Yu C, Wang L (2024) A fast performant, secure distributed training framework for large language model. arXiv preprint arXiv:2401.09796","DOI":"10.1109\/ICASSP48485.2024.10446717"},{"key":"177_CR38","doi-asserted-by":"crossref","unstructured":"Hu G, Wu Y, Chen G, Dinh TTA, Ooi BC (2024) Sesemi: Secure serverless model inference on sensitive data. arXiv preprint arXiv:2412.11640","DOI":"10.1109\/ICDE65448.2025.00167"},{"key":"177_CR39","doi-asserted-by":"crossref","unstructured":"Kairouz P, McMahan HB, Avent B, Bellet A, Bennis M, Bhagoji AN, Bonawitz K, Charles Z, Cormode G, Cummings R et\u00a0al (2021) Advances and open problems in federated learning. Found Trends\u00ae Mach Learn 14(1\u20132):1\u2013210","DOI":"10.1561\/2200000083"},{"key":"177_CR40","doi-asserted-by":"publisher","DOI":"10.1016\/j.lindif.2023.102274","volume":"103","author":"E Kasneci","year":"2023","unstructured":"Kasneci E, Se\u00dfler K, K\u00fcchemann S, Bannert M, Dementieva D, Fischer F, Gasser U, Groh G, G\u00fcnnemann S, H\u00fcllermeier E et al (2023) Chatgpt for good? on opportunities and challenges of large language models for education. Learn Individ Differ 103:102274","journal-title":"Learn Individ Differ"},{"key":"177_CR41","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2024.109698","volume":"120","author":"H Kibriya","year":"2024","unstructured":"Kibriya H, Khan WZ, Siddiqa A, Khan MK (2024) Privacy issues in large language models: a survey. Comput Electr Eng 120:109698","journal-title":"Comput Electr Eng"},{"key":"177_CR42","unstructured":"Kim S, Yun S, Lee H, Gubri M, Yoon S, Oh SJ (2024) Propile: Probing privacy leakage in large language models. Adv Neural Inf Process Syst 36"},{"issue":"3","key":"177_CR43","doi-asserted-by":"publisher","first-page":"9","DOI":"10.1109\/MITP.2023.3275489","volume":"25","author":"N Kshetri","year":"2023","unstructured":"Kshetri N (2023) Cybercrime and privacy threats of large language models. IT Prof 25(3):9\u201313","journal-title":"IT Prof"},{"key":"177_CR44","doi-asserted-by":"crossref","unstructured":"Kurita K, Michel P, Neubig G (2020) Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660","DOI":"10.18653\/v1\/2020.acl-main.249"},{"key":"177_CR45","doi-asserted-by":"crossref","unstructured":"Li H, Guo D, Li D, Fan W, Hu Q, Liu X, Chan C, Yao D, Yao Y, Song Y (2023) Privlm-bench: A multi-level privacy evaluation benchmark for language models. arXiv preprint arXiv:2311.04044","DOI":"10.18653\/v1\/2024.acl-long.4"},{"key":"177_CR46","doi-asserted-by":"crossref","unstructured":"Li Q, Hong J, Xie C, Tan J, Xin R, Hou J, Yin X, Wang Z, Hendrycks D, Wang Z et\u00a0al (2024a) Llm-pbe: Assessing data privacy in large language models. arXiv preprint arXiv:2408.12787","DOI":"10.14778\/3681954.3681994"},{"key":"177_CR47","unstructured":"Li Y, Li T, Chen K, Zhang J, Liu S, Wang W, Zhang T, Liu Y (2024b) Badedit: Backdooring large language models by model editing. arXiv preprint arXiv:2403.13355"},{"key":"177_CR48","doi-asserted-by":"crossref","unstructured":"Li L, Song D, Li X, Zeng J, Ma R, Qiu X (2021) Backdoor attacks on pre-trained models by layerwise weight poisoning. arXiv preprint arXiv:2108.13888","DOI":"10.18653\/v1\/2021.emnlp-main.241"},{"key":"177_CR49","unstructured":"Li D, Sun R, Huang Y, Zhong M, Jiang B, Han J, Zhang X, Wang W, Liu H (2025) Preference leakage: A contamination problem in llm-as-a-judge. arXiv preprint arXiv:2502.01534"},{"issue":"1","key":"177_CR50","first-page":"1","volume":"58","author":"Y Liu","year":"2025","unstructured":"Liu Y, Huang J, Li Y, Wang D, Xiao B (2025) Generative AI model privacy: A survey. Artif Intell Rev 58(1):1\u201347","journal-title":"Artif Intell Rev"},{"key":"177_CR51","doi-asserted-by":"crossref","unstructured":"Liu K, Dolan-Gavitt B, Garg S (2018) Fine-pruning: Defending against backdooring attacks on deep neural networks. In: International symposium on research in attacks intrusions and defenses, Springer, pp 273\u2013294","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"177_CR52","doi-asserted-by":"crossref","unstructured":"Luo J, Zhang Y, Zhang Z, Zhang J, Mu X, Wang H, Yu Y, Xu Z (2024) Secformer: Fast and accurate privacy-preserving inference for transformer models via smpc. Findings of the association for computational linguistics ACL 2024:13333\u201313348","DOI":"10.18653\/v1\/2024.findings-acl.790"},{"key":"177_CR53","unstructured":"McMahan B, Moore E, Ramage D, Hampson S, Arcas BA (2017) Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics, PMLR, pp 1273\u20131282"},{"key":"177_CR54","unstructured":"Meisenbacher S, Nandakumar N, Klymenko A, Matthes F (2024) A comparative analysis of word-level metric differential privacy: Benchmarking the privacy-utility trade-off. arXiv preprint arXiv:2404.03324"},{"key":"177_CR55","unstructured":"Mireshghallah N, Kim H, Zhou X, Tsvetkov Y, Sap M, Shokri R, Choi Y (2023) Can llms keep a secret? testing privacy implications of language models via contextual integrity theory. arXiv preprint arXiv:2310.17884"},{"issue":"11","key":"177_CR56","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3670007","volume":"56","author":"F Mo","year":"2024","unstructured":"Mo F, Tarkhani Z, Haddadi H (2024) Machine learning with confidential computing: A systematization of knowledge. ACM Comput Surv 56(11):1\u201340","journal-title":"ACM Comput Surv"},{"issue":"1","key":"177_CR57","doi-asserted-by":"publisher","first-page":"17","DOI":"10.32996\/jcsts.2025.7.1.2","volume":"7","author":"S Nandagopal","year":"2025","unstructured":"Nandagopal S (2025) Securing retrieval-augmented generation pipelines: A comprehensive framework. J Comput Sci Technol Stud 7(1):17\u201329","journal-title":"J Comput Sci Technol Stud"},{"key":"177_CR58","unstructured":"Neel S, Chang P (2023) Privacy issues in large language models: A survey. arXiv preprint arXiv:2312.06717"},{"key":"177_CR59","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103476","volume":"135","author":"OD Okey","year":"2023","unstructured":"Okey OD, Udo EU, Rosa RL, Rodr\u00edguez DZ, Kleinschmidt JH (2023) Investigating chatgpt and cybersecurity: A perspective on topic modeling and sentiment analysis. Comput Secur 135:103476","journal-title":"Comput Secur"},{"key":"177_CR60","first-page":"27730","volume":"35","author":"L Ouyang","year":"2022","unstructured":"Ouyang L, Wu J, Jiang X, Almeida D, Wainwright C, Mishkin P, Zhang C, Agarwal S, Slama K, Ray A et al (2022) Training language models to follow instructions with human feedback. Adv Neural Inf Process Syst 35:27730\u201327744","journal-title":"Adv Neural Inf Process Syst"},{"key":"177_CR61","first-page":"20679","volume":"36","author":"H Peng","year":"2023","unstructured":"Peng H, Ran R, Luo Y, Zhao J, Huang S, Thorat K, Geng T, Wang C, Xu X, Wen W et al (2023) Lingcn: Structural linearized graph convolutional network for homomorphically encrypted inference. Adv Neural Inf Process Syst 36:20679\u201320694","journal-title":"Adv Neural Inf Process Syst"},{"key":"177_CR62","doi-asserted-by":"crossref","unstructured":"Plant R, Giuffrida V, Gkatzia D (2022) You are what you write: Preserving privacy in the era of large language models. arXiv preprint arXiv:2204.09391","DOI":"10.2139\/ssrn.4417900"},{"key":"177_CR63","unstructured":"Qin L, Zhu T, Zhou W, Yu PS (2024) Knowledge distillation in federated learning: A survey on long lasting challenges and new solutions. arXiv preprint arXiv:2406.10861"},{"key":"177_CR64","doi-asserted-by":"crossref","unstructured":"Sabt M, Achemlal M, Bouabdallah A (2015) Trusted execution environment: What it is and what it is not. In: 2015 IEEE Trustcom\/BigDataSE\/Ispa, vol 1. IEEE, pp 57\u201364","DOI":"10.1109\/Trustcom.2015.357"},{"key":"177_CR65","unstructured":"Sha Z, He X, Berrang P, Humbert M, Zhang Y (2022) Fine-tuning is all you need to mitigate backdoor attacks. arXiv preprint arXiv:2212.09067"},{"key":"177_CR66","unstructured":"Sha Z, Zhang Y (2024) Prompt stealing attacks against large language models. arXiv preprint arXiv:2402.12959"},{"key":"177_CR67","unstructured":"Shen H, Gu Z, Hong H, Han W (2025) Pii-bench: Evaluating query-aware privacy protection systems. arXiv preprint arXiv:2502.18545"},{"key":"177_CR68","doi-asserted-by":"crossref","unstructured":"Shokri R, Stronati M, Song C, Shmatikov V (2017) Membership inference attacks against machine learning models. In: 2017 IEEE symposium on security and privacy (SP), IEEE, pp 3\u201318","DOI":"10.1109\/SP.2017.41"},{"key":"177_CR69","unstructured":"Shu Y, Li S, Dong T, Meng Y, Zhu H (2025) Model inversion in split learning for personalized llms: New insights from information bottleneck theory. arXiv preprint arXiv:2501.05965"},{"key":"177_CR70","doi-asserted-by":"crossref","unstructured":"Singhal K, Tu T, Gottweis J, Sayres R, Wulczyn E, Amin M, Hou L, Clark K, Pfohl SR, Cole-Lewis H et\u00a0al (2025) Toward expert-level medical question answering with large language models. Nat Med 1\u20138","DOI":"10.1038\/s41591-024-03423-7"},{"key":"177_CR71","unstructured":"Staab R, Vero M, Balunovi\u0107 M, Vechev M (2023) Beyond memorization: Violating privacy via inference with large language models. arXiv preprint arXiv:2310.07298"},{"key":"177_CR72","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.125348","volume":"260","author":"J Su","year":"2025","unstructured":"Su J, Xu B, Jiang L, Liu H, Chen Y, Li Y et al (2025) Cross-organizational knowledge sharing partner selection based on fogg behavioral model in probabilistic hesitant fuzzy environment. Expert Syst Appl 260:125348","journal-title":"Expert Syst Appl"},{"issue":"4","key":"177_CR73","doi-asserted-by":"publisher","first-page":"198","DOI":"10.1109\/MNET.011.2000473","volume":"35","author":"X Sun","year":"2021","unstructured":"Sun X, Yu FR, Zhang P, Sun Z, Xie W, Peng X (2021) A survey on zero-knowledge proof in blockchain. IEEE Netw 35(4):198\u2013205","journal-title":"IEEE Netw"},{"key":"177_CR74","unstructured":"Sun L, Huang Y, Wang H, Wu S, Zhang Q, Gao C, Huang Y, Lyu W, Zhang Y, Li X et\u00a0al (2024) Trustllm: Trustworthiness in large language models. 3. arXiv preprint arXiv:2401.05561"},{"key":"177_CR75","unstructured":"Sun J, Xu Z, Yin H, Yang D, Xu D, Chen Y, Roth HR (2023) Fedbpt: Efficient federated black-box prompt tuning for large language models. arXiv preprint arXiv:2310.01467"},{"key":"177_CR76","unstructured":"Taori R, Gulrajani I, Zhang T, Dubois Y, Li X, Guestrin C, Liang P, Hashimoto TB (2023) Alpaca: A strong replicable instruction-following model. Stanf Center Res Found Model 3(6):7. https:\/\/crfm.stanford.edu\/2023\/03\/13\/alpaca.html"},{"key":"177_CR77","doi-asserted-by":"crossref","unstructured":"Thomas P, Spielman S, Craswell N, Mitra B (2024) Large language models can accurately predict searcher preferences. In: Proceedings of the 47th international acm sigir conference on research and development in information retrieval, pp 1930\u20131940","DOI":"10.1145\/3626772.3657707"},{"key":"177_CR78","unstructured":"Tong M, Chen K, Qi Y, Zhang J, Zhang W, Yu N (2023) Privinfer: Privacy-preserving inference for black-box large language model. arXiv preprint arXiv:2310.12214"},{"key":"177_CR79","unstructured":"Touvron H, Lavril T, Izacard G, Martinet X, Lachaux MA, Lacroix, T, Rozi\u00e8re B, Goyal N, Hambro E, Azhar F et\u00a0al (2023) Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971"},{"key":"177_CR80","doi-asserted-by":"crossref","unstructured":"Truong JB, Maini P, Walls RJ, Papernot N (2021) Data-free model extraction. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 4771\u20134780","DOI":"10.1109\/CVPR46437.2021.00474"},{"key":"177_CR81","doi-asserted-by":"publisher","first-page":"706","DOI":"10.1049\/blc2.12091","volume":"4","author":"I Ullah","year":"2024","unstructured":"Ullah I, Hassan N, Gill SS, Suleiman B, Ahanger TA, Shah Z, Qadir J, Kanhere SS (2024) Privacy preserving large language models: Chatgpt case study based vision and framework. IET Blockchain 4:706\u2013724","journal-title":"IET Blockchain"},{"key":"177_CR82","unstructured":"Venditti D, Ruzzetti ES, Xompero GA, Giannone C, Favalli A, Romagnoli R, Zanzotto FM (2024) Enhancing data privacy in large language models through private association editing. arXiv preprint arXiv:2406.18221"},{"key":"177_CR83","doi-asserted-by":"crossref","unstructured":"Voigt P, Bussche A (2017) The eu general data protection regulation (gdpr). A Practical Guide 1st Ed, Cham: Springer International Publishing. 10(3152676):10\u20135555","DOI":"10.1007\/978-3-319-57959-7"},{"key":"177_CR84","first-page":"131197","volume":"37","author":"JT Wang","year":"2025","unstructured":"Wang JT, Wu T, Song D, Mittal P, Jia R (2025) Greats: Online selection of high-quality data for llm training in every iteration. Adv Neural Inf Process Syst 37:131197\u2013131223","journal-title":"Adv Neural Inf Process Syst"},{"key":"177_CR85","unstructured":"Wang J, Hu X, Hou W, Chen H, Zheng R, Wang Y, Yang L, Huang H, Ye W, Geng X et\u00a0al (2023) On the robustness of chatgpt: An adversarial and out-of-distribution perspective. arXiv preprint arXiv:2302.12095"},{"key":"177_CR86","doi-asserted-by":"crossref","unstructured":"Wang S, Zhu T, Liu B, Ding M, Guo X, Ye D, Zhou W, Yu PS (2024) Unique security and privacy threats of large language model: A comprehensive survey. arXiv preprint arXiv:2406.07973","DOI":"10.1145\/3764113"},{"key":"177_CR87","unstructured":"Wu J, Chen S, Yang Y, Li Y, Hou S, Jing R, Wang Z, Chen W, Tian Z (2024) Feddtpt: Federated discrete and transferable prompt tuning for black-box large language models. arXiv preprint arXiv:2411.00985"},{"key":"177_CR88","doi-asserted-by":"crossref","unstructured":"Wu Y, Roesner F, Kohno T, Zhang N, Iqbal U (2024) Secgpt: An execution isolation architecture for llm-based systems. arXiv e-prints 2403","DOI":"10.14722\/ndss.2025.241131"},{"key":"177_CR89","doi-asserted-by":"crossref","unstructured":"Xia L, Fan J, Parlikad A, Huang X, Zheng P (2024) Unlocking large language model power in industry: Privacy-preserving collaborative creation of knowledge graph. IEEE Trans Big Data","DOI":"10.1109\/TBDATA.2024.3522814"},{"key":"177_CR90","doi-asserted-by":"crossref","unstructured":"Xiao Y, Jin Y, Bai Y, Wu Y, Yang X, Luo X, Yu W, Zhao X, Liu Y, Gu Q et\u00a0al (2023) Privacymind: large language models can be contextual privacy protection learners. arXiv preprint arXiv:2310.02469","DOI":"10.18653\/v1\/2024.emnlp-main.785"},{"key":"177_CR91","doi-asserted-by":"crossref","unstructured":"Xu Q, Tao G, Honorio J, Liu Y, An S, Shen G, Cheng S, Zhang X (2023) Medic: Remove model backdoors via importance driven cloning. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 20485\u201320494","DOI":"10.1109\/CVPR52729.2023.01962"},{"key":"177_CR92","unstructured":"Yang Y (2022) Holistic risk assessment of inference attacks in machine learning. arXiv preprint arXiv:2212.10628"},{"key":"177_CR93","doi-asserted-by":"crossref","unstructured":"Yan B, Li K, Xu M, Dong Y, Zhang Y, Ren Z, Cheng X (2024) On protecting the data privacy of large language models (llms): A survey. arXiv preprint arXiv:2403.05156","DOI":"10.1109\/ICMC60390.2024.00008"},{"key":"177_CR94","doi-asserted-by":"crossref","unstructured":"Yao Y, Duan J, Xu K, Cai Y, Sun Z, Zhang Y (2024) A survey on large language model (llm) security and privacy: The good the bad and the ugly. High-Confidence Comput 100211","DOI":"10.1016\/j.hcc.2024.100211"},{"key":"177_CR95","unstructured":"Yao Y, Wang F, Ravi S, Chen M (2024) Privacy-preserving language model inference with instance obfuscation. arXiv preprint arXiv:2402.08227"},{"key":"177_CR96","unstructured":"Ye W, Ou M, Li T, Ma X, Yanggong Y, Wu S, Fu J, Chen G, Wang H, Zhao J et\u00a0al (2023) Assessing hidden risks of llms: an empirical study on robustness consistency and credibility. arXiv preprint arXiv:2305.10235"},{"issue":"4","key":"177_CR97","doi-asserted-by":"publisher","first-page":"2555","DOI":"10.1109\/JIOT.2021.3089713","volume":"9","author":"X Yuan","year":"2021","unstructured":"Yuan X, Ma X, Zhang L, Fang Y, Wu D (2021) Beyond class-level privacy leakage: Breaking record-level privacy in federated learning. IEEE Internet Things J 9(4):2555\u20132565","journal-title":"IEEE Internet Things J"},{"key":"177_CR98","first-page":"25769","volume":"39","author":"H Yuan","year":"2025","unstructured":"Yuan H, Jin Z, Cao P, Chen Y, Liu K, Zhao J (2025) Towards robust knowledge unlearning: An adversarial framework for assessing and improving unlearning robustness in large language models. Proc AAAI Conf Artif Intell 39:25769\u201325777","journal-title":"Proc AAAI Conf Artif Intell"},{"key":"177_CR99","unstructured":"Yu D, Naik S, Backurs A, Gopi S, Inan HA, Kamath G, Kulkarni J, Lee YT, Manoel A, Wutschitz L et\u00a0al (2021) Differentially private fine-tuning of language models. arXiv preprint arXiv:2110.06500"},{"key":"177_CR100","doi-asserted-by":"crossref","unstructured":"Zamfirescu-Pereira J, Wong RY, Hartmann B, Yang Q (2023) Why johnny can\u2019t prompt: how non-ai experts try (and fail) to design llm prompts. In: Proceedings of the 2023 CHI conference on human factors in computing systems, pp 1\u201321","DOI":"10.1145\/3544548.3581388"},{"issue":"1","key":"177_CR101","first-page":"49","volume":"16","author":"TL \u017barski","year":"2025","unstructured":"\u017barski TL, Janicki A (2025) Enhancing privacy while preserving context in text transformations by large language models. Inf 16(1):49","journal-title":"Inf"},{"key":"177_CR102","unstructured":"Zhang R, Hidano S, Koushanfar F (2022) Text revealer: Private text reconstruction via model inversion attacks against transformers. arXiv preprint arXiv:2209.10505"},{"key":"177_CR103","doi-asserted-by":"crossref","unstructured":"Zhang Y, Jia R, Pei H, Wang W, Li B, Song D (2020) The secret revealer: Generative model-inversion attacks against deep neural networks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 253\u2013261","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"177_CR104","doi-asserted-by":"crossref","unstructured":"Zhang Z, Ren X, Su Q, Sun X, He B (2021) Neural network surgery: Injecting data patterns into pre-trained models with minimal instance-wise side effects. In: Proceedings of the 2021 conference of the north american chapter of the association for computational linguistics: human language technologies, pp 5453\u20135466","DOI":"10.18653\/v1\/2021.naacl-main.430"},{"key":"#cr-split#-177_CR105.1","unstructured":"Zhao BZH, Agrawal A, Coburn C, Asghar HJ, Bhaskar R, Kaafar MA, Webb D, Dickinson P (2021) On the"},{"key":"#cr-split#-177_CR105.2","doi-asserted-by":"crossref","unstructured":"(in) feasibility of attribute inference attacks on machine learning models. In: 2021 IEEE european symposium on security and privacy (EuroS &P), IEEE, pp 232-251","DOI":"10.1109\/EuroSP51992.2021.00025"},{"key":"177_CR106","doi-asserted-by":"crossref","unstructured":"Zhao H, Du W, Li F, Li P, Liu G (2023) Fedprompt: Communication-efficient and privacy-preserving prompt tuning in federated learning. In: ICASSP 2023-2023 IEEE international conference on acoustics speech and signal processing (ICASSP), IEEE, pp 1\u20135","DOI":"10.1109\/ICASSP49357.2023.10095356"},{"key":"177_CR107","doi-asserted-by":"publisher","first-page":"1556","DOI":"10.1162\/tacl_a_00704","volume":"12","author":"X Zhu","year":"2024","unstructured":"Zhu X, Li J, Liu Y, Ma C, Wang W (2024) A survey on model compression for large language models. Trans Assoc Comput Linguist 12:1556\u20131577","journal-title":"Trans Assoc Comput Linguist"},{"key":"177_CR108","doi-asserted-by":"crossref","unstructured":"Zhu J, Hou R, Wang X, Wang W, Cao J, Zhao B, Wang Z, Zhang Y, Ying J, Zhang L et\u00a0al (2020) Enabling rack-scale confidential computing using heterogeneous trusted execution environment. In: 2020 IEEE symposium on security and privacy (SP), IEEE, pp 1450\u20131465","DOI":"10.1109\/SP40000.2020.00054"},{"key":"177_CR109","doi-asserted-by":"crossref","unstructured":"Zhu M, Wei S, Shen L, Fan Y, Wu B (2023) Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In: Proceedings of the IEEE\/CVF international conference on computer vision, pp 4466\u20134477","DOI":"10.1109\/ICCV51070.2023.00412"}],"container-title":["Journal of King Saud University Computer and Information Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s44443-025-00177-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s44443-025-00177-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s44443-025-00177-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,17]],"date-time":"2025-09-17T12:45:47Z","timestamp":1758113147000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s44443-025-00177-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,18]]},"references-count":110,"journal-issue":{"issue":"7","published-print":{"date-parts":[[2025,9]]}},"alternative-id":["177"],"URL":"https:\/\/doi.org\/10.1007\/s44443-025-00177-1","relation":{},"ISSN":["1319-1578","2213-1248"],"issn-type":[{"value":"1319-1578","type":"print"},{"value":"2213-1248","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,8,18]]},"assertion":[{"value":"9 April 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 July 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"18 August 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"163"}}