{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T05:05:24Z","timestamp":1750309524449,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":44,"publisher":"ACM","license":[{"start":{"date-parts":[[2025,6,11]],"date-time":"2025-06-11T00:00:00Z","timestamp":1749600000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,6,25]]},"DOI":"10.1145\/3713081.3732931","type":"proceedings-article","created":{"date-parts":[[2025,6,6]],"date-time":"2025-06-06T17:20:36Z","timestamp":1749230436000},"page":"195-199","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Patch the Leak: Strengthening CodeLLMs Against Privacy Extraction Threats"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-9279-3010","authenticated-orcid":false,"given":"Yongjian","family":"Guo","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China"},{"name":"Ant Group, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6305-1740","authenticated-orcid":false,"given":"Wanlun","family":"Ma","sequence":"additional","affiliation":[{"name":"Swinburne University of Technology, Melbourne, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1521-9542","authenticated-orcid":false,"given":"Xi","family":"Xiao","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0655-666X","authenticated-orcid":false,"given":"Sheng","family":"Wen","sequence":"additional","affiliation":[{"name":"Swinburne University of Technology, Melbourne, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5799-5876","authenticated-orcid":false,"given":"Peng","family":"Di","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"},{"name":"UNSW Sydney, Sydney, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0647-4747","authenticated-orcid":false,"given":"Xiaogang","family":"Zhu","sequence":"additional","affiliation":[{"name":"The University of Adelaide, Adelaide, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,6,11]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs. arXiv preprint arXiv:2502.17424","author":"Betley Jan","year":"2025","unstructured":"Jan Betley, Daniel Tan, Niels Warncke, Anna Sztyber-Betley, Xuchan Bao, Mart\u00edn Soto, Nathan Labenz, and Owain Evans. 2025. Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs. arXiv preprint arXiv:2502.17424 (2025)."},{"volume-title":"Accessed","year":"2024","key":"e_1_3_2_1_2_1","unstructured":"bigcode team. 2024. bigcode\/starcoder2-3b. https:\/\/huggingface.co\/bigcode\/starcoder2-3b. Accessed: November 11, 2024."},{"key":"e_1_3_2_1_3_1","unstructured":"Nicholas Carlini Florian Tramer Eric Wallace Matthew Jagielski Ariel Herbert-Voss Katherine Lee Adam Roberts Tom Brown Dawn Song Ulfar Erlingsson et al. 2021. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21). 2633\u20132650."},{"key":"e_1_3_2_1_4_1","volume-title":"International Conference on Machine Learning. PMLR, 3676\u20133713","author":"Carta Thomas","year":"2023","unstructured":"Thomas Carta, Cl\u00e9ment Romac, Thomas Wolf, Sylvain Lamprier, Olivier Sigaud, and Pierre-Yves Oudeyer. 2023. Grounding large language models in interactive environments with online reinforcement learning. In International Conference on Machine Learning. PMLR, 3676\u20133713."},{"key":"e_1_3_2_1_5_1","volume-title":"Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al.","author":"Chen Mark","year":"2021","unstructured":"Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374 (2021)."},{"key":"e_1_3_2_1_6_1","first-page":"1","article-title":"Scaling instruction-finetuned language models","volume":"25","author":"Chung Hyung Won","year":"2024","unstructured":"Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. 2024. Scaling instruction-finetuned language models. Journal of Machine Learning Research 25, 70 (2024), 1\u201353.","journal-title":"Journal of Machine Learning Research"},{"volume-title":"Accessed","year":"2024","key":"e_1_3_2_1_7_1","unstructured":"codefuse-ai team. 2024. codefuse-ai\/CodeFuse-13B. https:\/\/huggingface.co\/codefuse-ai\/CodeFuse-13B. Accessed: November 12, 2024."},{"volume-title":"Accessed","year":"2024","key":"e_1_3_2_1_8_1","unstructured":"codeparrot team. 2024. codeparrot\/codeparrot. https:\/\/huggingface.co\/codeparrot\/codeparrot. Accessed: November 11, 2024."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3716628"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616592"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"crossref","unstructured":"Yichen Gong Delong Ran Xinlei He Tianshuo Cong Anyu Wang and Xiaoyun Wang. 2025. Safety Misalignment Against Large Language Models. (2025).","DOI":"10.14722\/ndss.2025.241089"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i22.34568"},{"volume-title":"Accessed","year":"2024","key":"e_1_3_2_1_13_1","unstructured":"Google. 2024. google\/codegemma-7b. https:\/\/huggingface.co\/google\/codegemma-7b. Accessed: November 11, 2024."},{"key":"e_1_3_2_1_14_1","unstructured":"Aaron Grattafiori Abhimanyu Dubey Abhinav Jauhri Abhinav Pandey Abhishek Kadian Ahmad Al-Dahle Aiesha Letman Akhil Mathur Alan Schelten Alex Vaughan et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024)."},{"key":"e_1_3_2_1_15_1","volume-title":"Codebreaker: Dynamic Extraction Attacks on Code Language Models. In 2025 IEEE Symposium on Security and Privacy (SP). IEEE.","author":"Han Changzhou","year":"2025","unstructured":"Changzhou Han, Zehang Deng,Wanlun Ma, Xiaogang Zhu, Minhui Xue, Tianqing Zhu, Sheng Wen, and Yang Xiang. 2025. Codebreaker: Dynamic Extraction Attacks on Code Language Models. In 2025 IEEE Symposium on Security and Privacy (SP). IEEE."},{"key":"e_1_3_2_1_16_1","first-page":"88236","article-title":"Finding nemo: Localizing neurons responsible for memorization in diffusion models","volume":"37","author":"Hintersdorf Dominik","year":"2024","unstructured":"Dominik Hintersdorf, Lukas Struppek, Kristian Kersting, Adam Dziedzic, and Franziska Boenisch. 2024. Finding nemo: Localizing neurons responsible for memorization in diffusion models. Advances in Neural Information Processing Systems 37 (2024), 88236\u201388278.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_17_1","first-page":"3","article-title":"Lora: Low-rank adaptation of large language models","volume":"1","author":"Hu Edward J","year":"2022","unstructured":"Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. 2022. Lora: Low-rank adaptation of large language models. ICLR 1, 2 (2022), 3.","journal-title":"ICLR"},{"key":"e_1_3_2_1_18_1","unstructured":"Hakan Inan Kartikeya Upasani Jianfeng Chi Rashi Rungta Krithika Iyer Yuning Mao Michael Tontchev Qing Hu Brian Fuller Davide Testuggine et al. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674 (2023)."},{"key":"e_1_3_2_1_19_1","volume-title":"Multi-step jailbreaking privacy attacks on chatgpt. arXiv preprint arXiv:2304.05197","author":"Li Haoran","year":"2023","unstructured":"Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song. 2023. Multi-step jailbreaking privacy attacks on chatgpt. arXiv preprint arXiv:2304.05197 (2023)."},{"key":"e_1_3_2_1_20_1","volume-title":"Federico Cassano, Joel Lamy-Poirier, Nouamane Tazi, Ao Tang, Dmytro Pykhtar, Jiawei Liu, Yuxiang Wei, et al.","author":"Lozhkov Anton","year":"2024","unstructured":"Anton Lozhkov, Raymond Li, Loubna Ben Allal, Federico Cassano, Joel Lamy-Poirier, Nouamane Tazi, Ao Tang, Dmytro Pykhtar, Jiawei Liu, Yuxiang Wei, et al. 2024. Starcoder 2 and the stack v2: The next generation. arXiv preprint arXiv:2402.19173 (2024)."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2024.3367737"},{"volume-title":"Accessed","year":"2024","key":"e_1_3_2_1_22_1","unstructured":"Microsoft. 2024. Microsoft Presidio. https:\/\/microsoft.github.io\/presidio\/. Accessed: October 25, 2024."},{"key":"e_1_3_2_1_23_1","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Niu Liang","year":"2023","unstructured":"Liang Niu, Shujaat Mirza, Zayd Maradni, and Christina P\u00f6pper. 2023. {CodexLeaks}: Privacy leaks from code generation language models in {GitHub} copilot. In 32nd USENIX Security Symposium (USENIX Security 23). 2133\u20132150."},{"key":"e_1_3_2_1_24_1","volume-title":"Accessed","author":"AI.","year":"2024","unstructured":"OpenAI. 2024. GPT-3.5-Turbo Fine-Tuning and API Updates. https:\/\/openai.com\/index\/gpt-3-5-turbo-fine-tuning-and-api-updates\/. Accessed: November 13, 2024."},{"key":"e_1_3_2_1_25_1","volume-title":"Accessed","author":"AI.","year":"2024","unstructured":"OpenAI. 2024. GPT-4o System Card. https:\/\/openai.com\/index\/gpt-4o-system-card\/. Accessed: November 13, 2024."},{"key":"e_1_3_2_1_26_1","unstructured":"Long Ouyang Jeffrey Wu Xu Jiang Diogo Almeida Carroll Wainwright Pamela Mishkin Chong Zhang Sandhini Agarwal Katarina Slama Alex Ray et al. 2022. Training language models to follow instructions with human feedback. Advances in neural information processing systems 35 (2022) 27730\u201327744."},{"key":"e_1_3_2_1_27_1","volume-title":"Reconstruction of Differentially Private Text Sanitization via Large Language Models. arXiv preprint arXiv:2410.12443","author":"Pang Shuchao","year":"2024","unstructured":"Shuchao Pang, Zhigang Lu, Haichen Wang, Peng Fu, Yongbin Zhou, Minhui Xue, and Bo Li. 2024. Reconstruction of Differentially Private Text Sanitization via Large Language Models. arXiv preprint arXiv:2410.12443 (2024)."},{"key":"e_1_3_2_1_28_1","first-page":"53728","article-title":"Direct preference optimization: Your language model is secretly a reward model","volume":"36","author":"Rafailov Rafael","year":"2023","unstructured":"Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems 36 (2023), 53728\u201353741.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_29_1","volume-title":"Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, et al.","author":"Roziere Baptiste","year":"2023","unstructured":"Baptiste Roziere, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, et al. 2023. Code llama: Open foundation models for code. arXiv preprint arXiv:2308.12950 (2023)."},{"key":"e_1_3_2_1_30_1","volume-title":"Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300","author":"Shao Zhihong","year":"2024","unstructured":"Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Y Wu, et al. 2024. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300 (2024)."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i17.29865"},{"key":"e_1_3_2_1_32_1","unstructured":"Alexandra Souly Qingyuan Lu Dillon Bowen Tu Trinh Elvis Hsieh Sana Pandey Pieter Abbeel Justin Svegliato Scott Emmons Olivia Watkins et al. 2024. A strongreject for empty jailbreaks. arXiv preprint arXiv:2402.10260 (2024)."},{"key":"e_1_3_2_1_33_1","unstructured":"Stardustsky. [n. d.]. SaiDict. https:\/\/github.com\/Stardustsky\/SaiDict Accessed: 2024-11-12."},{"key":"e_1_3_2_1_34_1","volume-title":"True knowledge comes from practice: Aligning llms with embodied environments via reinforcement learning. arXiv preprint arXiv:2401.14151","author":"Tan Weihao","year":"2024","unstructured":"Weihao Tan, Wentao Zhang, Shanqi Liu, Longtao Zheng, Xinrun Wang, and Bo An. 2024. True knowledge comes from practice: Aligning llms with embodied environments via reinforcement learning. arXiv preprint arXiv:2401.14151 (2024)."},{"key":"e_1_3_2_1_35_1","volume-title":"Accessed","author":"CodeLlama","year":"2024","unstructured":"CodeLlama team. 2024. codellama\/CodeLlama-7b-hf. https:\/\/huggingface.co\/codellama\/CodeLlama-7b-hf. Accessed: November 11, 2024."},{"key":"e_1_3_2_1_36_1","unstructured":"Qwen Team. 2024. Qwen2.5: A Party of Foundation Models. https:\/\/qwenlm.github.io\/blog\/qwen2.5\/"},{"key":"e_1_3_2_1_37_1","volume-title":"Do-Not-Answer: Evaluating Safeguards in LLMs. In Findings of the Association for Computational Linguistics: EACL 2024","author":"Wang Yuxia","year":"2024","unstructured":"Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin. 2024. Do-Not-Answer: Evaluating Safeguards in LLMs. In Findings of the Association for Computational Linguistics: EACL 2024, Yvette Graham and Matthew Purver (Eds.). Association for Computational Linguistics, St. Julian's, Malta, 896\u2013911. https:\/\/aclanthology.org\/2024.findings-eacl.61"},{"key":"e_1_3_2_1_38_1","volume-title":"Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387","author":"Wei Zeming","year":"2023","unstructured":"Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. 2023. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387 (2023)."},{"key":"e_1_3_2_1_39_1","unstructured":"Wikipedia. [n. d.]. List of most popular given names. https:\/\/en.wikipedia.org\/wiki\/List_of_most_popular_given_names Accessed: 2024-11-12."},{"key":"e_1_3_2_1_40_1","unstructured":"Wikipedia. [n. d.]. \"zh.wikipedia.org \". https:\/\/zh.wikipedia.org\/wiki\/%E6%9C%80%E5%B8%B8%E8%A6%8B%E5%90%8D%E5%AD%97%E5%88%97%E8%A1%A8 Accessed: 2024-11-12."},{"key":"e_1_3_2_1_41_1","volume-title":"Robust Utility-Preserving Text Anonymization Based on Large Language Models. arXiv preprint arXiv:2407.11770","author":"Yang Tianyu","year":"2024","unstructured":"Tianyu Yang, Xiaodan Zhu, and Iryna Gurevych. 2024. Robust Utility-Preserving Text Anonymization Based on Large Language Models. arXiv preprint arXiv:2407.11770 (2024)."},{"key":"e_1_3_2_1_42_1","volume-title":"Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253","author":"Yu Jiahao","year":"2023","unstructured":"Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253 (2023)."},{"key":"e_1_3_2_1_43_1","volume-title":"Bertscore: Evaluating text generation with bert. arXiv preprint arXiv:1904.09675","author":"Zhang Tianyi","year":"2019","unstructured":"Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. 2019. Bertscore: Evaluating text generation with bert. arXiv preprint arXiv:1904.09675 (2019)."},{"key":"e_1_3_2_1_44_1","volume-title":"Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043","author":"Zou Andy","year":"2023","unstructured":"Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023)."}],"event":{"name":"ISSTA Companion '25: 34th ACM SIGSOFT International Symposium on Software Testing and Analysis","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"],"location":"Clarion Hotel Trondheim Trondheim Norway","acronym":"ISSTA Companion '25"},"container-title":["Proceedings of the 34th ACM SIGSOFT International Symposium on Software Testing and Analysis"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3713081.3732931","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:09Z","timestamp":1750295889000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3713081.3732931"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,11]]},"references-count":44,"alternative-id":["10.1145\/3713081.3732931","10.1145\/3713081"],"URL":"https:\/\/doi.org\/10.1145\/3713081.3732931","relation":{},"subject":[],"published":{"date-parts":[[2025,6,11]]},"assertion":[{"value":"2025-06-11","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}