{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:02:11Z","timestamp":1782975731509,"version":"3.54.5"},"reference-count":68,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00205","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"2366-2384","source":"Crossref","is-referenced-by-count":0,"title":["Toward Efficient Membership Inference Attacks Against Federated Large Language Models: A Projection Residual Approach"],"prefix":"10.1109","author":[{"given":"Guilin","family":"Deng","sequence":"first","affiliation":[{"name":"Computer Science and Technology, National University of Defense Technology,Changsha,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Silong","family":"Chen","sequence":"additional","affiliation":[{"name":"Computer Science and Technology, National University of Defense Technology,Changsha,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuchuan","family":"Luo","sequence":"additional","affiliation":[{"name":"Computer Science and Technology, National University of Defense Technology,Changsha,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yi","family":"Liu","sequence":"additional","affiliation":[{"name":"City University of Hong Kong,Hong Kong,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Songlei","family":"Wang","sequence":"additional","affiliation":[{"name":"Shenzhen University,Shenzhen,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiping","family":"Cai","sequence":"additional","affiliation":[{"name":"Computer Science and Technology, National University of Defense Technology,Changsha,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lin","family":"Liu","sequence":"additional","affiliation":[{"name":"Computer Science and Technology, National University of Defense Technology,Changsha,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaohua","family":"Jia","sequence":"additional","affiliation":[{"name":"City University of Hong Kong,Hong Kong,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shaojing","family":"Fu","sequence":"additional","affiliation":[{"name":"Computer Science and Technology, National University of Defense Technology,Changsha,China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"issue":"8","key":"ref1","first-page":"9","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford","year":"2019","journal-title":"OpenAI blog"},{"key":"ref2","article-title":"Bert: Pretraining of deep bidirectional transformers for language understanding","volume-title":"Proc. of NAACL","author":"Devlin"},{"key":"ref3","author":"Jauhri","year":"2024","journal-title":"The llama 3 herd of models"},{"key":"ref4","article-title":"Qwen2. 5-omni technical report","author":"Xu","year":"2025","journal-title":"arXiv preprint"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i10.29007"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3570361.3592505"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671573"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1080\/1097198X.2019.1569186"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671582"},{"key":"ref10","article-title":"The future of large language model pre-training is federated","author":"Sani","year":"2024","journal-title":"arXiv preprint"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.303"},{"key":"ref12","article-title":"Dual-personalizing adapter for federated foundation models","volume-title":"Proc. of NeurIPS","author":"Long"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.eacl-main.39"},{"key":"ref14","article-title":"Dp-dylora: Fine-tuning transformer-based models ondevice under differentially private federated learning using dynamic low-rank adaptation","author":"Xu","year":"2024","journal-title":"arXiv preprint"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88483-3_4"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1038\/s41746-024-01126-4"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.193"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2023\/393"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CloudCom59040.2023.00062"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3639478.3643533"},{"key":"ref21","article-title":"Code summarization without direct access to code-towards exploring federated 11 ms for software engineering","volume-title":"Proc. of EASE","author":"Kumar"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D13-1170"},{"issue":"4","key":"ref23","article-title":"Learning multiple layers of features from tiny images","volume":"1","author":"Krizhevsky","year":"2009","journal-title":"Handbook of Systemic Autoimmune Diseases"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179463"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP60621.2024.00012"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560684"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.3390\/info14110620"},{"key":"ref28","article-title":"Efficient privacy auditing in federated learning","volume-title":"Proc. of USENIX Security","author":"Chang"},{"key":"ref29","article-title":"Towards label-only membership inference attack against pre-trained large language models","volume-title":"Proc. of USENIX Security","author":"He"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-18523-6_14"},{"key":"ref31","article-title":"Defending membership inference attacks via privacy-aware sparsity tuning","author":"Hu","year":"2024","journal-title":"arXiv preprint"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref33","article-title":"Effective passive membership inference attacks in federated learning against overparameterized models","volume-title":"Proc. of ICLR","author":"Li"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00290"},{"key":"ref35","article-title":"Yelp dataset challenge: Review rating prediction","author":"Asghar","year":"2016","journal-title":"arXiv preprint"},{"key":"ref36","article-title":"Learning word vectors for sentiment analysis","volume-title":"Proc. of ACL","author":"Maas"},{"key":"ref37","article-title":"Communication-efficient learning of deep networks from decentralized data","volume-title":"Proc. of AISTATS","author":"McMahan"},{"key":"ref38","article-title":"Save it all: Enabling full parameter tuning for federated large language models via cycle black gradient descent","volume":"abs\/2406.11187","author":"Wang","year":"2024","journal-title":"ArXiv"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10097124"},{"key":"ref40","article-title":"Parameter-efficient transfer learning for nlp","volume-title":"Proc. of ICML","author":"Houlsby"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.488"},{"key":"ref42","article-title":"Ptuning: Prompt tuning can be comparable to fine-tuning across scales and tasks","volume-title":"Proc. of ACL","author":"Liu"},{"key":"ref43","article-title":"How to combine membership-inference attacks on multiple updated models","volume":"abs\/2205.06369","author":"Jagielski","year":"2022","journal-title":"ArXiv"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690292"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.01922"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3326230"},{"key":"ref48","article-title":"Analysis of privacy leakage in federated large language models","volume-title":"Proc. of AISTATS","author":"Vu"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2787"},{"key":"ref50","article-title":"Qwen2 technical report","author":"Team","year":"2024","journal-title":"arXiv preprint"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3578356.3592575"},{"key":"ref52","article-title":"{FwdLLM}: Efficient federated finetuning of large language models with perturbed inferences","volume-title":"Proc. of USENIX ATC","author":"Xu"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2026.230661"},{"key":"ref54","article-title":"Seqmia: Sequential-metric based membership inference attack","volume-title":"Proc. of CCS","author":"Hao"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690316"},{"key":"ref56","article-title":"Enhanced label-only membership inference attacks with fewer queries","volume-title":"Proc. of USENIX Security","author":"Li"},{"key":"ref57","article-title":"A framework for evaluating gradient leakage attacks in federated learning","volume-title":"ArXiv","volume":"abs\/2004.10397","author":"Wei"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_2"},{"key":"ref59","article-title":"Opacus: User-friendly differential privacy library in PyTorch","author":"Yousefpour","year":"2021","journal-title":"arXiv preprint"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3510033"},{"key":"ref61","article-title":"Qa-lora: Quantization-aware low-rank adaptation of large language models","volume-title":"Proc. of ICLR","author":"Xu"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-97-7707-5_28"},{"key":"ref63","article-title":"Fdlora: Personalized federated learning of large language model via dual lora tuning","author":"Qi","year":"2024","journal-title":"arXiv preprint"},{"key":"ref64","article-title":"Federated finetuning of large language models under heterogeneous tasks and client resources","volume-title":"Proc. of NeurIPS","author":"Bai"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3642970.3655834"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3704633"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583542"},{"key":"ref68","article-title":"Systematic evaluation of privacy risks of machine learning models","volume-title":"Proc. of USENIX Security","author":"Song"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573564.pdf?arnumber=11573564","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:31:16Z","timestamp":1782970276000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573564\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":68,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00205","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}