{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,24]],"date-time":"2025-11-24T19:58:43Z","timestamp":1764014323826,"version":"3.45.0"},"reference-count":90,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Oracle Laboratories"},{"name":"Assistance of Resources and Services from the National Computational Infrastructure (NCI) through the Australian Government"},{"name":"International Macquarie University Research Excellence Scholarship"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/access.2025.3633551","type":"journal-article","created":{"date-parts":[[2025,11,17]],"date-time":"2025-11-17T18:42:17Z","timestamp":1763404937000},"page":"196024-196039","source":"Crossref","is-referenced-by-count":0,"title":["Empirical Calibration and Metric Differential Privacy in Language Models"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9961-1252","authenticated-orcid":false,"given":"Pedro","family":"Faustini","sequence":"first","affiliation":[{"name":"Macquarie University, Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9212-7839","authenticated-orcid":false,"given":"Natasha","family":"Fernandes","sequence":"additional","affiliation":[{"name":"Macquarie University, Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2405-9838","authenticated-orcid":false,"given":"Annabelle","family":"Mciver","sequence":"additional","affiliation":[{"name":"Macquarie University, Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9908-7182","authenticated-orcid":false,"given":"Mark","family":"Dras","sequence":"additional","affiliation":[{"name":"Macquarie University, Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1561\/9781601988195"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.privatenlp-1.3"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.privatenlp-1.5"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.29012\/jpc.689"},{"key":"ref6","first-page":"1895","article-title":"Evaluating differentially private machine learning in practice","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Jayaraman"},{"key":"ref7","first-page":"22205","article-title":"Auditing differentially private machine learning: How private is private SGD?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Jagielski"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.11"},{"issue":"1","key":"ref9","first-page":"1","article-title":"Concentrated differential privacy","volume":"30","author":"Dwork","year":"2016","journal-title":"Theory Cryptography"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CMI48017.2019.8962136"},{"key":"ref11","first-page":"1964","article-title":"Label-only membership inference attacks","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","author":"Choquette-Choo"},{"key":"ref12","first-page":"1","article-title":"On the importance of difficulty calibration in membership inference attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Watson"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.eacl-main.207"},{"key":"ref14","first-page":"234","article-title":"Using membership inference attacks to evaluate privacy-preserving language modeling fails for pseudonymizing data","volume-title":"Proc. 24th Nordic Conf. Comput. Linguistics (NoDaLiDa)","author":"Vakili"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.496"},{"key":"ref16","first-page":"1","article-title":"Do membership inference attacks work on large language models?","volume-title":"Proc. Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"Duan"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1146\/annurev-statistics-060116-054123"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39077-7_5"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-17138-4_6"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2019.00031"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611977653.ch99"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484734"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1142\/S0218488502001648"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2022.09.004"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3555803"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2024.127663"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3712000"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24178"},{"key":"ref30","first-page":"14747","article-title":"Deep leakage from gradients","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst.","author":"Mu"},{"key":"ref31","article-title":"IDLG: Improved deep leakage from gradients","author":"Zhao","year":"2020","journal-title":"arXiv:2001.02610"},{"key":"ref32","first-page":"1","article-title":"Inverting gradients\u2013how easy is it to break privacy in federated learning?","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","author":"Geiping"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58951-6_27"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/GlobalSIP.2013.6736861"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2014.56"},{"key":"ref36","first-page":"1","article-title":"Differentially private learning needs better features (or much more data)","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Tramer"},{"key":"ref37","first-page":"1","article-title":"Large language models can be strong differentially private learners","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Li"},{"key":"ref38","first-page":"1","article-title":"Unlocking high-accuracy differentially private image classification through scale","volume-title":"Proc. Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"De"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.484"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467268"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3469877.3490594"},{"volume-title":"Language models are unsupervised multitask learners","year":"2019","author":"Radford","key":"ref42"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1810.04805"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.privatenlp-1.1"},{"key":"ref45","first-page":"478","article-title":"Differentially private natural language models: Recent advances and future directions","volume-title":"Proc. Findings Assoc. Comput. Linguistics, EACL","author":"Hu"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-53641-4_24"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.11"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"volume-title":"Learning multiple layers of features from tiny images","year":"2009","author":"Krizhevsky","key":"ref49"},{"issue":"3","key":"ref50","first-page":"45","article-title":"Acquire valued shoppers challenge","volume":"12","author":"Cukierski","year":"2014","journal-title":"J. Marketing Strategies"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3523273"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560675"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.719"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.570"},{"key":"ref55","first-page":"8056","article-title":"Bounding training data reconstruction in private (deep) learning","volume-title":"Proc. 39th Int. Conf. Mach. Learn.","author":"Guo"},{"key":"ref56","first-page":"1","article-title":"Bounding training data reconstruction in DP-SGD","volume-title":"Proc. 37th Int. Conf. Neural Inf. Process. Syst.","author":"Hayes"},{"key":"ref57","first-page":"1720","article-title":"Revealing and protecting labels in distributed training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Dang"},{"key":"ref58","first-page":"8130","article-title":"Recovering private text in federated learning of language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Gupta"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-emnlp.305"},{"key":"ref60","first-page":"1","article-title":"Robbing the fed: Directly obtaining private data in federated learning with modified models","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Fowl"},{"key":"ref61","first-page":"7641","article-title":"LAMP: Extracting text from gradients with language model priors","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Dimitrov"},{"key":"ref62","first-page":"1","article-title":"Decepticons: Corrupted transformers breach privacy in federated learning for language models","volume-title":"Proc. 11th Int. Conf. Learn. Represent.","author":"Fowl"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-demos.6"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.874"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1613\/jair.1.14649"},{"key":"ref66","first-page":"142","article-title":"Learning word vectors for sentiment analysis","volume-title":"Proc. 49th Annu. Meeting Assoc. Comput. Linguistics, Human Lang. Technol.","author":"Maas"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D13-1170"},{"key":"ref68","article-title":"Neural network acceptability judgments","author":"Warstadt","year":"2018","journal-title":"arXiv:1805.12471"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1016\/0005-2795(75)90109-9"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2019.00065"},{"key":"ref71","first-page":"1","article-title":"ML privacy meter: Aiding regulatory compliance by quantifying the privacy risks of machine learning","volume-title":"Proc. Workshop Hot Topics Privacy Enhancing Technol. (HotPETs)","author":"Kumar"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1111\/j.1469-8137.1912.tb05611.x"},{"key":"ref73","first-page":"6381","article-title":"Gradient obfuscation gives a false sense of security in federated learning","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Yue"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3564625.3564628"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-2029"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2023-0070"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.377"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.3115\/1626355.1626389"},{"key":"ref79","first-page":"74","article-title":"ROUGE: A package for automatic evaluation of summaries","volume-title":"Proc. Text Summarization Branches Out","author":"Lin"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.275"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-64221-1_16"},{"issue":"4","key":"ref82","first-page":"234","article-title":"Noise-augmented privacy-preserving empirical risk minimization with dual-purpose regularizer and privacy budget retrieval and recycling","volume":"15","author":"Li","year":"2023","journal-title":"Intell. Comput."},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516735"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3336191.3371856"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-acl.337"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512232"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104035"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-naacl.65"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/WACV51458.2022.00366"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/CSF54842.2022.9919647"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10820123\/11250616.pdf?arnumber=11250616","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,24]],"date-time":"2025-11-24T19:01:36Z","timestamp":1764010896000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11250616\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":90,"URL":"https:\/\/doi.org\/10.1109\/access.2025.3633551","relation":{},"ISSN":["2169-3536"],"issn-type":[{"type":"electronic","value":"2169-3536"}],"subject":[],"published":{"date-parts":[[2025]]}}}