{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T14:52:35Z","timestamp":1785336755480,"version":"3.55.0"},"reference-count":69,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179300","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T17:18:15Z","timestamp":1689959895000},"page":"346-363","source":"Crossref","is-referenced-by-count":131,"title":["Analyzing Leakage of Personally Identifiable Information in Language Models"],"prefix":"10.1109","author":[{"given":"Nils","family":"Lukas","sequence":"first","affiliation":[{"name":"University of Waterloo"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ahmed","family":"Salem","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Robert","family":"Sim","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shruti","family":"Tople","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lukas","family":"Wutschitz","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Santiago","family":"Zanella-B\u00e9guelin","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref2","first-page":"54","article-title":"FLAIR: An easy-to-use framework for state-of-the-art NLP","volume-title":"2019 Conference of the North American Chapter of the ACL (demonstrations)","author":"Akbik"},{"key":"ref3","article-title":"Differential privacy","year":"2022"},{"key":"ref4","volume-title":"Natural language processing with Python: analyzing text with the Natural Language Toolkit","author":"Bird","year":"2009"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3531146.3534642"},{"key":"ref6","first-page":"1877","article-title":"Language models are few-shot learners","volume-title":"Advances in neural information processing systems (NeurIPS)","volume":"33","author":"Brown","year":"2020"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-5602"},{"key":"ref8","first-page":"267","article-title":"The secret sharer: Evaluating and testing unintended memorization in neural networks","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Carlini"},{"key":"ref9","first-page":"2633","article-title":"Extracting training data from large language models","volume-title":"30th USENIX Security Symposium","author":"Carlini"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"ref11","article-title":"Quantifying memorization across neural language models","author":"Carlini","year":"2022"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1424"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330723"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.18653\/vl\/N19-142"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/11761679_29"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/11681878_14"},{"key":"ref17","first-page":"1","article-title":"Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation)","volume":"L 110","year":"2016","journal-title":"Official Journal"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/p18-1082"},{"issue":"120","key":"ref19","first-page":"1","article-title":"Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity","volume":"23","author":"Fedus","year":"2022","journal-title":"Journal of Machine Learning Research"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3357713.3384290"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/1179601.1179615"},{"key":"ref22","article-title":"Efficient adaptation of pretrained transformers for abstractive summarization","author":"Hoang","year":"2019"},{"key":"ref23","article-title":"Training compute-optimal large language models","author":"Hoffmann","year":"2022"},{"key":"ref24","article-title":"spaCy: Industrial-strength natural language processing in Python","author":"Honnibal","year":"2020"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.3115\/1614049.1614064"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.148"},{"key":"ref27","article-title":"Investigating membership inference attacks under data dependencies","author":"Humphries","year":"2020"},{"key":"ref28","article-title":"Training data leakage analysis in language models","author":"Inan","year":"2021"},{"key":"ref29","article-title":"Preventing verbatim memorization in language models gives a false sense of privacy","author":"Ippolito","year":"2022"},{"key":"ref30","article-title":"Membership inference attack susceptibility of clinical language models","author":"Jagannatha","year":"2021"},{"key":"ref31","article-title":"Measuring forgetting of memorized training examples","author":"Jagielski","year":"2022"},{"key":"ref32","article-title":"Combing for credentials: Active pattern extraction from smart reply","author":"Jayaraman","year":"2022"},{"key":"ref33","first-page":"10697","article-title":"Deduplicating training data mitigates privacy risks in language models","volume-title":"39th International Conference on Machine Learning","volume":"162","author":"Kandpal"},{"key":"ref34","first-page":"92","article-title":"Introducing the Enron corpus","volume-title":"International Conference on Email and Anti-Spam, CEAS","volume":"45","author":"Klimt"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/n16-1030"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583199"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.73"},{"key":"ref38","article-title":"Large language models can be strong differentially private learners","volume-title":"10th International Conference on Learning Representations (ICLR)","author":"Li"},{"key":"ref39","article-title":"RoBERTa: A robustly optimized BERT pretraining approach","author":"Liu","year":"2019"},{"key":"ref40","article-title":"Decoupled weight decay regularization","volume-title":"7th International Conference on Learning Representations, ICLR","author":"Loshchilov"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00567"},{"key":"ref42","article-title":"Federated learning with formal differential privacy guarantees","volume-title":"Google, Tech. Rep.","author":"McMahan","year":"2022"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33016834"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.570"},{"key":"ref45","article-title":"Memorization in NLP fine-tuning methods","author":"Mireshghallah","year":"2022"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1075\/li.30.1.03nad"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.416"},{"key":"ref48","article-title":"WebGPT: Browser-assisted question-answering with human feedback","author":"Nakano","year":"2021"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-short.61"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1162\/coli_a_00458"},{"key":"ref51","article-title":"Language models are unsupervised multitask learners","author":"Radford"},{"issue":"140","key":"ref52","first-page":"1","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","volume":"21","author":"Raffel","year":"2020","journal-title":"J. Mach. Learn. Res"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-019-10933-3"},{"key":"ref54","article-title":"Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression","volume-title":"Computer Science Laboratory, SRI International, Tech. Rep.","author":"Samarati","year":"1998"},{"key":"ref55","article-title":"Neural machine translation of rare words with subword units","author":"Sennrich","year":"2015"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.205"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref58","article-title":"Defending against reconstruction attacks with R\u00e9nyi differential privacy","author":"Stock","year":"2022"},{"key":"ref59","first-page":"38274","article-title":"Memorization without overfitting: Analyzing the training dynamics of large language models","volume-title":"Advances in neural information processing systems (NeurIPS)","volume":"35","author":"Tirumala","year":"2022"},{"key":"ref60","article-title":"Are clinical BERT models privacy preserving? The difficulty of extracting patient-condition associations","volume-title":"AAAI 2021 Fall Symposium on Human Partnership with Medical AI: Design, Operationalization, and Ethics (AAAI-HUMAN)","author":"Vakili"},{"key":"ref61","first-page":"4245","article-title":"Downstream task performance of BERT models pre-trained using automatically de-identified clinical data","volume-title":"13th Language Resources and Evaluation Conference, LREC","author":"Vakili"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref63","article-title":"dp-transformers: Training transformer models with differential privacy","author":"Wutschitz"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-191362"},{"key":"ref65","article-title":"Opacus: User-friendly differential privacy library in PyTorch","author":"Yousefpour","year":"2021"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.29012\/jpc.880"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417880"},{"key":"ref68","article-title":"Text revealer: Private text reconstruction via model inversion attacks against transformers","author":"Zhang","year":"2022"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.69"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179300.pdf?arnumber=10179300","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:11:25Z","timestamp":1721452285000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179300\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":69,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179300","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}