{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,18]],"date-time":"2025-12-18T10:27:36Z","timestamp":1766053656435,"version":"3.48.0"},"reference-count":81,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["52494974"],"award-info":[{"award-number":["52494974"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3640876","type":"journal-article","created":{"date-parts":[[2025,12,5]],"date-time":"2025-12-05T18:37:35Z","timestamp":1764959855000},"page":"12964-12979","source":"Crossref","is-referenced-by-count":0,"title":["Falcon: A Universal Text-Only Membership Inference Attack Framework Against In-Context Learning"],"prefix":"10.1109","volume":"20","author":[{"given":"Haitao","family":"Su","sequence":"first","affiliation":[{"name":"Qiuzhen College, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7857-2936","authenticated-orcid":false,"given":"Yue","family":"Qin","sequence":"additional","affiliation":[{"name":"School of Information, Central University of Finance and Economics, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7286-122X","authenticated-orcid":false,"given":"Zhenhua","family":"Li","sequence":"additional","affiliation":[{"name":"School of Software, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xin","family":"Miao","sequence":"additional","affiliation":[{"name":"School of Software, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1706-6539","authenticated-orcid":false,"given":"Yuan","family":"Zhou","sequence":"additional","affiliation":[{"name":"Department of Mathematical Sciences, Yau Mathematical Sciences Center, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.64"},{"key":"ref2","first-page":"36637","article-title":"The learnability of in-context learning","volume-title":"Proc. 37th Int. Conf. Neural Inf. Process. Syst.","author":"Wies"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.740"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.336"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.54364\/AAIML.2023.1191"},{"key":"ref6","first-page":"49268","article-title":"Privacy auditing with one training run","volume-title":"Proc. 37th Conf. Neural Inf. Process. Syst.","author":"Steinke"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.52202\/079017-4290"},{"key":"ref8","article-title":"Context-aware membership inference attacks against pre-trained large language models","author":"Chang","year":"2024","journal-title":"arXiv:2409.13745"},{"key":"ref9","first-page":"64845","article-title":"Min-k% +: Improved baseline for pre-training data detection from large language models","volume-title":"Proc. 13th Int. Conf. Learn. Represent.","author":"Zhang"},{"key":"ref10","first-page":"51826","article-title":"Detecting pretraining data from large language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Shi"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i26.34939"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.493"},{"key":"ref13","article-title":"Semantic membership inference attack against large language models","volume-title":"arXiv:2406.10218","author":"Mozaffari","year":"2024"},{"key":"ref14","first-page":"1013","article-title":"Con-ReCall: Detecting pre-training data in LLMs via contrastive decoding","volume-title":"Proc. 31st Int. Conf. Comput. Linguistics","author":"Wang"},{"key":"ref15","article-title":"Membership inference attack against long-context large language models","author":"Wang","year":"2024","journal-title":"arXiv:2411.11424"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.300"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690306"},{"volume-title":"NCP\u2014CCE Details","year":"2025","key":"ref18"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.481"},{"key":"ref20","first-page":"2947","article-title":"Intention analysis makes LLMs a good jailbreak defender","volume-title":"Proc. 31st Int. Conf. Comput. Linguistics","author":"Zhang"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3649506"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.2023.03014"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.14778\/3685800.3685838"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3695988"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1108\/IJWIS-12-2023-0256"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.7759\/cureus.39305"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.3934\/math.2024963"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.191"},{"key":"ref29","first-page":"30135","article-title":"Dual operating modes of in-context learning","volume-title":"Proc. ICLR","author":"Lin"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.708"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.795"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671470"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560675"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560684"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2023.3309336"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484575"},{"article-title":"Label-only membership inference attacks","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","author":"Choquette-Choo","key":"ref41"},{"volume-title":"Speech and Language Processing","year":"2009","author":"Jurafsky","key":"ref42"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330885"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417270"},{"key":"ref45","article-title":"Do membership inference attacks work on large language models?","volume-title":"arXiv:2402.07841","author":"Duan","year":"2024"},{"key":"ref46","article-title":"On the privacy risk of in-context learning","author":"Duan","year":"2024","journal-title":"arXiv:2411.10512"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/219717.219748"},{"key":"ref48","first-page":"223","article-title":"Nouvelles recherches sur la distribution florale","volume":"44","author":"Jaccard","year":"1908","journal-title":"Bull. De La Soci\u00e9t\u00e9 Vaudoise Des Sci. Naturelles"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1037\/0278-7393.14.1.54"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/321796.321811"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/0020-0271(73)90043-0"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1410"},{"issue":"4","key":"ref53","first-page":"35","article-title":"Modern information retrieval: A brief overview","volume":"24","author":"Singhal","year":"2001","journal-title":"IEEE Data Eng. Bull."},{"key":"ref54","article-title":"The llama 3 herd of models","author":"Grattafiori","year":"2024","journal-title":"arXiv:2407.21783"},{"key":"ref55","article-title":"Llama 2: Open foundation and fine-tuned chat models","author":"Touvron","year":"2023","journal-title":"arXiv:2307.09288"},{"key":"ref56","article-title":"Qwen2.5 technical report","volume-title":"arXiv:2412.15115","author":"Yang","year":"2024"},{"volume-title":"Un Ministral, Des Ministraux | Mistral AI","year":"2025","key":"ref57"},{"volume-title":"GPT-4o Mini: Advancing Cost-Efficient Intelligence","year":"2025","key":"ref58"},{"volume-title":"New Embedding Models and API Updates","year":"2024","key":"ref59"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.3115\/1072228.1072378"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.3115\/1072133.1072221"},{"key":"ref62","article-title":"GPQA: A graduate-level Google-proof Q&A benchmark","volume-title":"arXiv:2311.12022","author":"Rein","year":"2024"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.297"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3462757.3466088"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1259"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3600006.3613165"},{"volume-title":"Chat Templates for Huggingface Large Language Models","year":"2024","author":"Zheng","key":"ref68"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0067863"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2019.11.004"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref72","article-title":"DeepSeek-r1: Incentivizing reasoning capability in LLMs via reinforcement learning","author":"Guo","year":"2025","journal-title":"arXiv:2501.12948"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.745"},{"key":"ref74","article-title":"Dynamic demonstrations controller for in-context learning","author":"Zhao","year":"2024","journal-title":"arXiv:2310.00385"},{"key":"ref75","article-title":"Long-context LLMs struggle with long in-context learning","author":"Li","year":"2024","journal-title":"arXiv:2404.02060"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00638"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623906"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML64287.2025.00027"},{"volume-title":"Meet the New Notion AI","year":"2025","key":"ref79"},{"volume-title":"Slack AI: AI That Fits in Your Flow of Work","year":"2025","key":"ref80"},{"article-title":"Privacy-preserving in-context learning for large language models","volume-title":"Proc. Twelfth Int. Conf. Learn. Represent.","author":"Panda","key":"ref81"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11278891.pdf?arnumber=11278891","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,18]],"date-time":"2025-12-18T10:24:31Z","timestamp":1766053471000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11278891\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":81,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3640876","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}