{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T05:21:50Z","timestamp":1781760110118,"version":"3.54.5"},"publisher-location":"New York, NY, USA","reference-count":53,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,11,21]],"date-time":"2024-11-21T00:00:00Z","timestamp":1732147200000},"content-version":"vor","delay-in-days":372,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF (National Science Foundation)","doi-asserted-by":"publisher","award":["2131910"],"award-info":[{"award-number":["2131910"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,15]]},"DOI":"10.1145\/3576915.3616652","type":"proceedings-article","created":{"date-parts":[[2023,11,21]],"date-time":"2023-11-21T12:35:13Z","timestamp":1700570113000},"page":"1835-1849","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":17,"title":["Stealing the Decoding Algorithms of Language Models"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-7423-6538","authenticated-orcid":false,"given":"Ali","family":"Naseh","sequence":"first","affiliation":[{"name":"University of Massachusetts Amherst, Amherst, MA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6574-0817","authenticated-orcid":false,"given":"Kalpesh","family":"Krishna","sequence":"additional","affiliation":[{"name":"University of Massachusetts Amherst, Amherst, MA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7340-0804","authenticated-orcid":false,"given":"Mohit","family":"Iyyer","sequence":"additional","affiliation":[{"name":"University of Massachusetts Amherst, Amherst, MA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7553-6657","authenticated-orcid":false,"given":"Amir","family":"Houmansadr","sequence":"additional","affiliation":[{"name":"University of Massachusetts Amherst, Amherst, MA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,11,21]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"crossref","unstructured":"David H Ackley Geoffrey E Hinton and Terrence J Sejnowski. 1985. A learning algorithm for boltzmann machines. Cognitive science 9 1 147--169.","DOI":"10.1016\/S0364-0213(85)80012-4"},{"key":"e_1_3_2_1_2_1","unstructured":"Dzmitry Bahdanau Kyunghyun Cho and Yoshua Bengio. 2014. Neural machine translation by jointly learning to align and translate. arXiv preprint arXiv:1409.0473."},{"key":"e_1_3_2_1_3_1","volume-title":"Gptneo: large scale autoregressive language modeling with mesh-tensorflow","author":"Black Sid","year":"2021","unstructured":"Sid Black, Leo Gao, Phil Wang, Connor Leahy, and Stella Biderman. 2022. Gptneo: large scale autoregressive language modeling with mesh-tensorflow, 2021. URL: https:\/\/doi. org\/10.5281\/zenodo, 5297715."},{"key":"e_1_3_2_1_4_1","unstructured":"Tom Brown et al. 2020. Language models are few-shot learners. Advances in neural information processing systems 33 1877--1901."},{"key":"e_1_3_2_1_5_1","volume-title":"8th International Conference on Learning Representations, ICLR 2020","author":"Caccia Massimo","year":"2020","unstructured":"Massimo Caccia, Lucas Caccia, William Fedus, Hugo Larochelle, Joelle Pineau, and Laurent Charlin. 2020. Language gans falling short. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net. https:\/\/openreview.net\/forum?id=BJgza6VtPB."},{"key":"e_1_3_2_1_6_1","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Nicholas","unstructured":"Nicholas Carlini et al. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), 2633--2650."},{"key":"e_1_3_2_1_7_1","unstructured":"Asli Celikyilmaz Elizabeth Clark and Jianfeng Gao. 2020. Evaluation of text generation: a survey. arXiv preprint arXiv:2006.14799."},{"key":"e_1_3_2_1_8_1","unstructured":"Kangjie Chen Yuxian Meng Xiaofei Sun Shangwei Guo Tianwei Zhang Jiwei Li and Chun Fan. 2021. Badpre: task-agnostic backdoor attacks to pre-trained nlp foundation models. arXiv preprint arXiv:2110.02467."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N18-1204"},{"key":"e_1_3_2_1_10_1","unstructured":"Jacob Devlin Ming-Wei Chang Kenton Lee and Kristina Toutanova. 2018. Bert: pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805."},{"key":"e_1_3_2_1_11_1","unstructured":"Yao Dou Maxwell Forbes Rik Koncel-Kedziorski Noah A Smith and Yejin Choi. 2021. Scarecrow: a framework for scrutinizing machine text. arXiv preprint arXiv:2107.01294."},{"key":"e_1_3_2_1_12_1","unstructured":"Angela Fan Mike Lewis and Yann Dauphin. 2018. Hierarchical neural story generation. arXiv preprint arXiv:1805.04833."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"crossref","unstructured":"Jessica Ficler and Yoav Goldberg. 2017. Controlling linguistic style aspects in neural language generation. arXiv preprint arXiv:1707.02633.","DOI":"10.18653\/v1\/W17-4912"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"e_1_3_2_1_15_1","volume-title":"Sid black, laurence golding, travis hoppe, charles foster, jason phang, horace he, anish thite, noa nabeshima, shawn presser, and connor leahy","author":"Gao Leo","year":"2020","unstructured":"Leo Gao and Stella Biderman. 2020. Sid black, laurence golding, travis hoppe, charles foster, jason phang, horace he, anish thite, noa nabeshima, shawn presser, and connor leahy. 2020. the pile: an 800gb dataset of diverse text for language modeling. arXiv preprint arXiv:2101.00027."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"crossref","unstructured":"Sebastian Gehrmann Elizabeth Clark and Thibault Sellam. 2022. Repairing the cracked foundation: a survey of obstacles in evaluation practices for generated text. arXiv preprint arXiv:2202.06935.","DOI":"10.1613\/jair.1.13715"},{"key":"e_1_3_2_1_17_1","unstructured":"Alex Graves. 2013. Generating sequences with recurrent neural networks. arXiv preprint arXiv:1308.0850."},{"key":"e_1_3_2_1_18_1","unstructured":"Tianyu Gu Brendan Dolan-Gavitt and Siddharth Garg. 2017. Badnets: identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"crossref","unstructured":"Tatsunori B Hashimoto Hugh Zhang and Percy Liang. 2019. Unifying human and statistical evaluation for natural language generation. arXiv preprint arXiv:1904.02792.","DOI":"10.18653\/v1\/N19-1169"},{"key":"e_1_3_2_1_20_1","unstructured":"Xuanli He Lingjuan Lyu Qiongkai Xu and Lichao Sun. 2021. Model extraction and adversarial transferability your bert is vulnerable! arXiv preprint arXiv:2103.10013."},{"key":"e_1_3_2_1_21_1","unstructured":"Ari Holtzman Jan Buys Li Du Maxwell Forbes and Yejin Choi. 2019. The curious case of neural text degeneration. arXiv preprint arXiv:1904.09751."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Ari Holtzman Jan Buys Maxwell Forbes Antoine Bosselut David Golub and Yejin Choi. 2018. Learning to write with cooperative discriminators. arXiv preprint arXiv:1805.06087.","DOI":"10.18653\/v1\/P18-1152"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"crossref","unstructured":"Kalpesh Krishna Yapei Chang John Wieting and Mohit Iyyer. 2022. Rankgen: improving text generation with large ranking models. arXiv preprint arXiv:2205.09726.","DOI":"10.18653\/v1\/2022.emnlp-main.15"},{"key":"e_1_3_2_1_24_1","volume-title":"International Conference on Learning Representations.","author":"Krishna Kalpesh","year":"2020","unstructured":"Kalpesh Krishna, Gaurav Singh Tomar, Ankur P Parikh, Nicolas Papernot, and Mohit Iyyer. 2020. Thieves on sesame street! model extraction of bert-based apis. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"crossref","unstructured":"Solomon Kullback and Richard A Leibler. 1951. On information and sufficiency. The annals of mathematical statistics 22 1 79--86.","DOI":"10.1214\/aoms\/1177729694"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"crossref","unstructured":"Linyang Li Demin Song Xiaonan Li Jiehang Zeng Ruotian Ma and Xipeng Qiu. 2021. Backdoor attacks on pre-trained models by layerwise weight poisoning. arXiv preprint arXiv:2108.13888.","DOI":"10.18653\/v1\/2021.emnlp-main.241"},{"key":"e_1_3_2_1_27_1","unstructured":"Lingjuan Lyu Xuanli He Fangzhao Wu and Lichao Sun. 2021. Killing two birds with one stone: stealing model and inferring attribute from bert-based apis. arXiv preprint arXiv:2105.10909."},{"key":"e_1_3_2_1_28_1","unstructured":"Saeed Mahloujifar Huseyin A Inan Melissa Chase Esha Ghosh and Marcello Hasegawa. 2021. Membership inference on word embedding and beyond. arXiv preprint arXiv:2106.11384."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1951.10500769"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3287560.3287562"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"crossref","unstructured":"Ramesh Nallapati Bowen Zhou Caglar Gulcehre Bing Xiang et al. 2016. Abstractive text summarization using sequence-to-sequence rnns and beyond. arXiv preprint arXiv:1602.06023.","DOI":"10.18653\/v1\/K16-1028"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"crossref","unstructured":"Ali Naseh Kalpesh Krishna Mohit Iyyer and Amir Houmansadr. 2023. Stealing the decoding algorithms of language models. (2023). arXiv: 2303.04729 [cs.LG].","DOI":"10.1145\/3576915.3616652"},{"key":"e_1_3_2_1_33_1","unstructured":"Erik Nijkamp Bo Pang Hiroaki Hayashi Lifu Tu Huan Wang Yingbo Zhou Silvio Savarese and Caiming Xiong. 2022. A conversational paradigm for program synthesis. arXiv preprint arXiv:2203.13474."},{"key":"e_1_3_2_1_34_1","volume-title":"International Conference on Learning Representations.","author":"Oh Seong Joon","year":"2018","unstructured":"Seong Joon Oh, Max Augustin, Mario Fritz, and Bernt Schiele. 2018. Towards reverse-engineering black-box neural networks. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"e_1_3_2_1_36_1","first-page":"4816","article-title":"Mauve: measuring the gap between neural text and human text using divergence frontiers","volume":"34","author":"Pillutla Krishna","year":"2021","unstructured":"Krishna Pillutla, Swabha Swayamdipta, Rowan Zellers, John Thickstun, Sean Welleck, Yejin Choi, and Zaid Harchaoui. 2021. Mauve: measuring the gap between neural text and human text using divergence frontiers. Advances in Neural Information Processing Systems, 34, 4816--4828.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_37_1","unstructured":"Alec Radford Jeffrey Wu Rewon Child David Luan Dario Amodei Ilya Sutskever et al. 2019. Language models are unsupervised multitask learners. OpenAI blog 1 8 9."},{"key":"e_1_3_2_1_38_1","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","volume":"21","author":"Raffel Colin","year":"2020","unstructured":"Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, Peter J Liu, et al. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res., 21, 140, 1--67.","journal-title":"J. Mach. Learn. Res."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/K19-1079"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Louis Shao Stephan Gouws Denny Britz Anna Goldie Brian Strope and Ray Kurzweil. 2017. Generating high-quality and informative conversation responses with sequence-to-sequence models. In https:\/\/arxiv.org\/abs\/1701.03 185.","DOI":"10.18653\/v1\/D17-1235"},{"key":"e_1_3_2_1_41_1","volume-title":"NeurIPS 2021 Workshop Privacy in Machine Learning.","author":"Shejwalkar Virat","year":"2021","unstructured":"Virat Shejwalkar, Huseyin A Inan, Amir Houmansadr, and Robert Sim. 2021. Membership inference attacks against nlp classification models. In NeurIPS 2021 Workshop Privacy in Machine Learning."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"crossref","unstructured":"Lujia Shen Shouling Ji Xuhong Zhang Jinfeng Li Jing Chen Jie Shi Chengfang Fang Jianwei Yin and Ting Wang. 2021. Backdoor pre-trained models can transfer to all. arXiv preprint arXiv:2111.00197.","DOI":"10.1145\/3460120.3485370"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475591"},{"key":"e_1_3_2_1_45_1","volume-title":"25th USENIX security symposium (USENIX Security 16), 601--618.","author":"Tram\u00e8r Florian","unstructured":"Florian Tram\u00e8r, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction {apis}. In 25th USENIX security symposium (USENIX Security 16), 601--618."},{"key":"e_1_3_2_1_46_1","unstructured":"Ashish Vaswani Noam Shazeer Niki Parmar Jakob Uszkoreit Llion Jones Aidan N. Gomez Lukasz Kaiser and Illia Polosukhin. 2017. Attention is all you need. In https:\/\/arxiv.org\/pdf\/1706.03762.pdf."},{"key":"e_1_3_2_1_47_1","unstructured":"Ashwin K Vijayakumar Michael Cogswell Ramprasath R Selvaraju Qing Sun Stefan Lee David Crandall and Dhruv Batra. 2016. Diverse beam search: decoding diverse solutions from neural sequence models. arXiv preprint arXiv:1610.02424."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"crossref","unstructured":"Eric Wallace Mitchell Stern and Dawn Song. 2020. Imitation attacks and defenses for black-box machine translation systems. arXiv preprint arXiv:2004.15015.","DOI":"10.18653\/v1\/2020.emnlp-main.446"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"e_1_3_2_1_50_1","unstructured":"Ziqi Yang Ee-Chien Chang and Zhenkai Liang. 2019. Adversarial neural network inversion via auxiliary knowledge alignment. arXiv preprint arXiv:1902.08552."},{"key":"e_1_3_2_1_51_1","unstructured":"Susan Zhang et al. 2022. Opt: open pre-trained transformer language models. arXiv preprint arXiv:2205.01068."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00022"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"crossref","unstructured":"Ming Zhong Pengfei Liu Yiran Chen Danqing Wang Xipeng Qiu and Xuan-jing Huang. 2020. Extractive summarization as text matching. arXiv preprint arXiv:2004.08795.","DOI":"10.18653\/v1\/2020.acl-main.552"}],"event":{"name":"CCS '23: ACM SIGSAC Conference on Computer and Communications Security","location":"Copenhagen Denmark","acronym":"CCS '23","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3576915.3616652","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3576915.3616652","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3576915.3616652","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T01:47:04Z","timestamp":1755740824000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3576915.3616652"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,15]]},"references-count":53,"alternative-id":["10.1145\/3576915.3616652","10.1145\/3576915"],"URL":"https:\/\/doi.org\/10.1145\/3576915.3616652","relation":{},"subject":[],"published":{"date-parts":[[2023,11,15]]},"assertion":[{"value":"2023-11-21","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}