{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:17:15Z","timestamp":1766441835154,"version":"3.48.0"},"publisher-location":"New York, NY, USA","reference-count":82,"publisher":"ACM","funder":[{"name":"National Natural Science Foundation of China","award":["62206207, 62472345, 62206205"],"award-info":[{"award-number":["62206207, 62472345, 62206205"]}]},{"DOI":"10.13039\/501100017596","name":"Natural Science Basic Research Program of Shaanxi Province","doi-asserted-by":"publisher","award":["2025JC-QYCX-060"],"award-info":[{"award-number":["2025JC-QYCX-060"]}],"id":[{"id":"10.13039\/501100017596","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765223","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:32:38Z","timestamp":1763854358000},"page":"4005-4019","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["PreferCare: Preference Dataset Copyright Protection in LLM Alignment by Watermark Injection and Verification"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4110-2068","authenticated-orcid":false,"given":"Jian","family":"Lou","sequence":"first","affiliation":[{"name":"Sun Yat-sen University, Guangzhou, China and State Key Laboratory of Cryptology, Beijing, 100878, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-5847-3575","authenticated-orcid":false,"given":"Chenyang","family":"Zhang","sequence":"additional","affiliation":[{"name":"Xidian University, Xi'an, China and State Key Laboratory of Cryptology, Beijing, 100878, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5702-5749","authenticated-orcid":false,"given":"Xiaoyu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Xidian University, Xi'an, China and State Key Laboratory of Cryptology, Beijing, 100878, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1852-6364","authenticated-orcid":false,"given":"Kai","family":"Wu","sequence":"additional","affiliation":[{"name":"Xidian University, Xi'an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al.","author":"Achiam Josh","year":"2023","unstructured":"Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al., 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)."},{"key":"e_1_3_2_1_2_1","first-page":"1615","volume-title":"27th USENIX Security Symposium USENIX Security 18)","author":"Adi Yossi","year":"2018","unstructured":"Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. 2018. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX Security Symposium USENIX Security 18). 1615-1631."},{"key":"e_1_3_2_1_3_1","volume-title":"International Conference on Artificial Intelligence and Statistics. PMLR, 4447-4455","author":"Azar Mohammad Gheshlaghi","year":"2024","unstructured":"Mohammad Gheshlaghi Azar, Zhaohan Daniel Guo, Bilal Piot, Remi Munos, Mark Rowland, Michal Valko, and Daniele Calandriello. 2024. A general theoretical paradigm to understand learning from human preferences. In International Conference on Artificial Intelligence and Statistics. PMLR, 4447-4455."},{"key":"e_1_3_2_1_4_1","volume-title":"ProVFL: Property Inference Attacks against Vertical Federated Learning","author":"Bai Li","year":"2025","unstructured":"Li Bai, Xinwei Zhang, Sen Zhang, Qingqing Ye, and Haibo Hu. 2025. ProVFL: Property Inference Attacks against Vertical Federated Learning. IEEE Transactions on Information Forensics and Security (2025)."},{"key":"e_1_3_2_1_5_1","unstructured":"Yuntao Bai Andy Jones Kamal Ndousse Amanda Askell Anna Chen Nova DasSarma Dawn Drain Stanislav Fort Deep Ganguli Tom Henighan et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862 (2022)."},{"key":"e_1_3_2_1_6_1","volume-title":"International Conference on Machine Learning. PMLR, 2397-2430","author":"Biderman Stella","year":"2023","unstructured":"Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O'Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, et al., 2023. Pythia: A suite for analyzing large language models across training and scaling. In International Conference on Machine Learning. PMLR, 2397-2430."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.2307\/2334029"},{"key":"e_1_3_2_1_8_1","volume-title":"Biomedical visual instruction tuning with clinician preference alignment. Advances in neural information processing systems","author":"Cui Hejie","year":"2024","unstructured":"Hejie Cui, Lingjun Mao, Xin Liang, Jieyu Zhang, Hui Ren, Quanzheng Li, Xiang Li, and Carl Yang. 2024. Biomedical visual instruction tuning with clinician preference alignment. Advances in neural information processing systems, Vol. 37 (2024), 96449-96467."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671458"},{"key":"e_1_3_2_1_10_1","volume-title":"int8 (): 8-bit matrix multiplication for transformers at scale. Advances in neural information processing systems","author":"Dettmers Tim","year":"2022","unstructured":"Tim Dettmers, Mike Lewis, Younes Belkada, and Luke Zettlemoyer. 2022. Gpt3. int8 (): 8-bit matrix multiplication for transformers at scale. Advances in neural information processing systems, Vol. 35 (2022), 30318-30332."},{"key":"e_1_3_2_1_11_1","volume-title":"Qlora: Efficient finetuning of quantized llms. Advances in neural information processing systems","author":"Dettmers Tim","year":"2023","unstructured":"Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. 2023. Qlora: Efficient finetuning of quantized llms. Advances in neural information processing systems, Vol. 36 (2023), 10088-10115."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00025"},{"key":"e_1_3_2_1_13_1","unstructured":"Abhimanyu Dubey Abhinav Jauhri Abhinav Pandey Abhishek Kadian Ahmad Al-Dahle Aiesha Letman Akhil Mathur Alan Schelten Amy Yang Angela Fan et al. 2024. The llama 3 herd of models. arXiv e-prints (2024) arXiv-2407."},{"key":"e_1_3_2_1_14_1","volume-title":"Understanding Dataset Difficulty with V-Usable Information. In International Conference on Machine Learning. PMLR, 5988-6008","author":"Ethayarajh Kawin","year":"2022","unstructured":"Kawin Ethayarajh, Yejin Choi, and Swabha Swayamdipta. 2022. Understanding Dataset Difficulty with V-Usable Information. In International Conference on Machine Learning. PMLR, 5988-6008."},{"key":"e_1_3_2_1_15_1","volume-title":"Kto: Model alignment as prospect theoretic optimization. arXiv preprint arXiv:2402.01306","author":"Ethayarajh Kawin","year":"2024","unstructured":"Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela. 2024. Kto: Model alignment as prospect theoretic optimization. arXiv preprint arXiv:2402.01306 (2024)."},{"key":"e_1_3_2_1_16_1","volume-title":"Proceedings of The 28th International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research","volume":"5229","author":"Feng Qizhang","year":"2025","unstructured":"Qizhang Feng, Siva Rajesh Kasa, SANTHOSH KUMAR KASA, Hyokun Yun, Choon Hui Teo, and Sravan Babu Bodapati. 2025. Exposing Privacy Gaps: Membership Inference Attack on Preference Data for LLM Alignment. In Proceedings of The 28th International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research, Vol. 258), Yingzhen Li, Stephan Mandt, Shipra Agrawal, and Emtiyaz Khan (Eds.). PMLR, 5221-5229."},{"key":"e_1_3_2_1_17_1","volume-title":"International conference on machine learning. PMLR, 1568-1577","author":"Franceschi Luca","year":"2018","unstructured":"Luca Franceschi, Paolo Frasconi, Saverio Salzo, Riccardo Grazzi, and Massimiliano Pontil. 2018. Bilevel programming for hyperparameter optimization and meta-learning. In International conference on machine learning. PMLR, 1568-1577."},{"key":"e_1_3_2_1_18_1","volume-title":"International conference on machine learning. PMLR, 10323-10337","author":"Frantar Elias","year":"2023","unstructured":"Elias Frantar and Dan Alistarh. 2023. Sparsegpt: Massive language models can be accurately pruned in one-shot. In International conference on machine learning. PMLR, 10323-10337."},{"key":"e_1_3_2_1_19_1","volume-title":"Gptq: Accurate post-training quantization for generative pre-trained transformers. arXiv preprint arXiv:2210.17323","author":"Frantar Elias","year":"2022","unstructured":"Elias Frantar, Saleh Ashkboos, Torsten Hoefler, and Dan Alistarh. 2022. Gptq: Accurate post-training quantization for generative pre-trained transformers. arXiv preprint arXiv:2210.17323 (2022)."},{"key":"e_1_3_2_1_20_1","unstructured":"Deep Ganguli Liane Lovitt Jackson Kernion Amanda Askell Yuntao Bai Saurav Kadavath Ben Mann Ethan Perez Nicholas Schiefer Kamal Ndousse et al. 2022. Red teaming language models to reduce harms: Methods scaling behaviors and lessons learned. arXiv preprint arXiv:2209.07858 (2022)."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.34740\/KAGGLE\/M\/3301"},{"key":"e_1_3_2_1_22_1","unstructured":"Team GLM Aohan Zeng Bin Xu Bowen Wang Chenhui Zhang Da Yin Diego Rojas Guanyu Feng Hanlin Zhao Hanyu Lai et al. 2024. ChatGLM: A Family of Large Language Models from GLM-130B to GLM-4 All Tools. arXiv preprint arXiv:2406.12793 (2024)."},{"key":"e_1_3_2_1_23_1","volume-title":"Aligning language models with preferences through f-divergence minimization. arXiv preprint arXiv:2302.08215","author":"Go Dongyoung","year":"2023","unstructured":"Dongyoung Go, Tomasz Korbak, Germ\u00e1n Kruszewski, Jos Rozen, Nahyeon Ryu, and Marc Dymetman. 2023. Aligning language models with preferences through f-divergence minimization. arXiv preprint arXiv:2302.08215 (2023)."},{"key":"e_1_3_2_1_24_1","volume-title":"Advances in Neural Information Processing Systems","volume":"36","author":"Guo Junfeng","year":"2024","unstructured":"Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. 2024. Domain watermark: Effective and harmless dataset copyright protection is closed at hand. Advances in Neural Information Processing Systems, Vol. 36 (2024)."},{"key":"e_1_3_2_1_25_1","volume-title":"Introduction to mathematical statistics","author":"Hogg R. V.","year":"2004","unstructured":"R. V. Hogg and Allen T Craig. 2004. Introduction to mathematical statistics. Higher Education Press (2004)."},{"key":"e_1_3_2_1_26_1","volume-title":"Decoding Compressed Trust: Scrutinizing the Trustworthiness of Efficient LLMs Under Compression. In International Conference on Machine Learning. PMLR","author":"Hong Junyuan","year":"2024","unstructured":"Junyuan Hong, Jinhao Duan, Chenhui Zhang, Zhangheng Li, Chulin Xie, Kelsey Lieberman, James Diffenderfer, Brian R Bartoldson, Ajay Kumar Jaiswal, Kaidi Xu, et al., 2024. Decoding Compressed Trust: Scrutinizing the Trustworthiness of Efficient LLMs Under Compression. In International Conference on Machine Learning. PMLR, 18611-18633."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i16.29780"},{"key":"e_1_3_2_1_28_1","first-page":"12080","article-title":"Metapoison: Practical general-purpose clean-label data poisoning","volume":"33","author":"Huang W Ronny","year":"2020","unstructured":"W Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. 2020. Metapoison: Practical general-purpose clean-label data poisoning. Advances in Neural Information Processing Systems, Vol. 33 (2020), 12080-12091.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_29_1","unstructured":"Hakan Inan Kartikeya Upasani Jianfeng Chi Rashi Rungta Krithika Iyer Yuning Mao Michael Tontchev Qing Hu Brian Fuller Davide Testuggine et al. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674 (2023)."},{"key":"e_1_3_2_1_30_1","first-page":"38887","article-title":"The emergence of essential sparsity in large pre-trained models: The weights that matter","volume":"36","author":"Jaiswal Ajay","year":"2023","unstructured":"Ajay Jaiswal, Shiwei Liu, Tianlong Chen, Zhangyang Wang, et al., 2023. The emergence of essential sparsity in large pre-trained models: The weights that matter. Advances in Neural Information Processing Systems, Vol. 36 (2023), 38887-38901.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_31_1","volume-title":"Categorical reparameterization with gumbel-softmax. arXiv preprint arXiv:1611.01144","author":"Jang Eric","year":"2016","unstructured":"Eric Jang, Shixiang Gu, and Ben Poole. 2016. Categorical reparameterization with gumbel-softmax. arXiv preprint arXiv:1611.01144 (2016)."},{"key":"e_1_3_2_1_32_1","volume-title":"Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al.","author":"Jiang Albert Q","year":"2023","unstructured":"Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al., 2023. Mistral 7B. arXiv preprint arXiv:2310.06825 (2023)."},{"key":"e_1_3_2_1_33_1","first-page":"27469","article-title":"Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense","volume":"36","author":"Krishna Kalpesh","year":"2023","unstructured":"Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems, Vol. 36 (2023), 27469-27500.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_34_1","volume-title":"Reformulating unsupervised style transfer as paraphrase generation. arXiv preprint arXiv:2010.05700","author":"Krishna Kalpesh","year":"2020","unstructured":"Kalpesh Krishna, John Wieting, and Mohit Iyyer. 2020. Reformulating unsupervised style transfer as paraphrase generation. arXiv preprint arXiv:2010.05700 (2020)."},{"key":"e_1_3_2_1_35_1","volume-title":"Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660","author":"Kurita Keita","year":"2020","unstructured":"Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660 (2020)."},{"key":"e_1_3_2_1_36_1","volume-title":"Bolin Shen, et al.","author":"Li Lincan","year":"2024","unstructured":"Lincan Li, Jiaqi Li, Catherine Chen, Fred Gui, Hongjia Yang, Chenxiao Yu, Zhengguang Wang, Jianing Cai, Junlong Aaron Zhou, Bolin Shen, et al., 2024a. Political-llm: Large language models in political science. arXiv preprint arXiv:2412.06864 (2024)."},{"key":"e_1_3_2_1_37_1","volume-title":"AnglE-optimized Text Embeddings. arXiv preprint arXiv:2309.12871","author":"Li Xianming","year":"2023","unstructured":"Xianming Li and Jing Li. 2023. AnglE-optimized Text Embeddings. arXiv preprint arXiv:2309.12871 (2023)."},{"key":"e_1_3_2_1_38_1","first-page":"13238","article-title":"Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection","volume":"35","author":"Li Yiming","year":"2022","unstructured":"Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. 2022. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. Advances in Neural Information Processing Systems, Vol. 35 (2022), 13238-13250.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_39_1","volume-title":"Badedit: Backdooring large language models by model editing. arXiv preprint arXiv:2403.13355","author":"Li Yanzhou","year":"2024","unstructured":"Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, and Yang Liu. 2024b. Badedit: Backdooring large language models by model editing. arXiv preprint arXiv:2403.13355 (2024)."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3265535"},{"key":"e_1_3_2_1_41_1","volume-title":"Why are my prompts leaked? unraveling prompt extraction threats in customized large language models. arXiv preprint arXiv:2408.02416","author":"Liang Zi","year":"2024","unstructured":"Zi Liang, Haibo Hu, Qingqing Ye, Yaxin Xiao, and Haoyang Li. 2024. Why are my prompts leaked? unraveling prompt extraction threats in customized large language models. arXiv preprint arXiv:2408.02416 (2024)."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.73"},{"key":"e_1_3_2_1_43_1","unstructured":"Aixin Liu Bei Feng Bing Xue Bingxuan Wang Bochao Wu Chengda Lu Chenggang Zhao Chengqi Deng Chenyu Zhang Chong Ruan et al. 2024. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437 (2024)."},{"key":"e_1_3_2_1_44_1","volume-title":"Evaluating and Aligning Human Economic Risk Preferences in LLMs. arXiv preprint arXiv:2503.06646","author":"Liu Jiaxin","year":"2025","unstructured":"Jiaxin Liu, Yi Yang, and Kar Yan Tam. 2025. Evaluating and Aligning Human Economic Risk Preferences in LLMs. arXiv preprint arXiv:2503.06646 (2025)."},{"key":"e_1_3_2_1_45_1","volume-title":"Watermarking text data on large language models for dataset copyright protection. arXiv preprint arXiv:2305.13257","author":"Liu Yixin","year":"2023","unstructured":"Yixin Liu, Hongsheng Hu, Xuyun Zhang, and Lichao Sun. 2023. Watermarking text data on large language models for dataset copyright protection. arXiv preprint arXiv:2305.13257 (2023)."},{"key":"e_1_3_2_1_46_1","volume-title":"The concrete distribution: A continuous relaxation of discrete random variables. arXiv preprint arXiv:1611.00712","author":"Maddison Chris J","year":"2016","unstructured":"Chris J Maddison, Andriy Mnih, and Yee Whye Teh. 2016. The concrete distribution: A continuous relaxation of discrete random variables. arXiv preprint arXiv:1611.00712 (2016)."},{"key":"e_1_3_2_1_47_1","volume-title":"Dataset inference: Ownership resolution in machine learning. arXiv preprint arXiv:2104.10706","author":"Maini Pratyush","year":"2021","unstructured":"Pratyush Maini, Mohammad Yaghini, and Nicolas Papernot. 2021. Dataset inference: Ownership resolution in machine learning. arXiv preprint arXiv:2104.10706 (2021)."},{"key":"e_1_3_2_1_48_1","volume-title":"Text style transfer evaluation using large language models. arXiv preprint arXiv:2308.13577","author":"Ostheimer Phil","year":"2023","unstructured":"Phil Ostheimer, Mayank Nagda, Marius Kloft, and Sophie Fellenz. 2023. Text style transfer evaluation using large language models. arXiv preprint arXiv:2308.13577 (2023)."},{"key":"e_1_3_2_1_49_1","unstructured":"Long Ouyang Jeffrey Wu Xu Jiang Diogo Almeida Carroll Wainwright Pamela Mishkin Chong Zhang Sandhini Agarwal Katarina Slama Alex Ray et al. 2022. Training language models to follow instructions with human feedback. Advances in neural information processing systems Vol. 35 (2022) 27730-27744."},{"key":"e_1_3_2_1_50_1","volume-title":"Hidden killer: Invisible textual backdoor attacks with syntactic trigger. arXiv preprint arXiv:2105.12400","author":"Qi Fanchao","year":"2021","unstructured":"Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. arXiv preprint arXiv:2105.12400 (2021)."},{"key":"e_1_3_2_1_51_1","volume-title":"Advances in Neural Information Processing Systems","volume":"36","author":"Rafailov Rafael","year":"2024","unstructured":"Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2024. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, Vol. 36 (2024)."},{"key":"e_1_3_2_1_52_1","volume-title":"International Conference on Machine Learning. PMLR, 8326-8335","author":"Sablayrolles Alexandre","year":"2020","unstructured":"Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Herv\u00e9 J\u00e9gou. 2020. Radioactive data: tracing through training. In International Conference on Machine Learning. PMLR, 8326-8335."},{"key":"e_1_3_2_1_53_1","volume-title":"Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347","author":"Schulman John","year":"2017","unstructured":"John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347 (2017)."},{"key":"e_1_3_2_1_54_1","volume-title":"The 22nd International Conference on Artificial Intelligence and Statistics. PMLR, 1723-1732","author":"Shaban Amirreza","year":"2019","unstructured":"Amirreza Shaban, Ching-An Cheng, Nathan Hatch, and Byron Boots. 2019. Truncated back-propagation for bilevel optimization. In The 22nd International Conference on Artificial Intelligence and Statistics. PMLR, 1723-1732."},{"key":"e_1_3_2_1_55_1","volume-title":"Advances in Neural Information Processing Systems","volume":"36","author":"Sudhakaran Shyam","year":"2024","unstructured":"Shyam Sudhakaran, Miguel Gonz\u00e1lez-Duque, Matthias Freiberger, Claire Glanois, Elias Najarro, and Sebastian Risi. 2024. Mariogpt: Open-ended text2level generation through large language models. Advances in Neural Information Processing Systems, Vol. 36 (2024)."},{"key":"e_1_3_2_1_56_1","volume-title":"A simple and effective pruning approach for large language models. arXiv preprint arXiv:2306.11695","author":"Sun Mingjie","year":"2023","unstructured":"Mingjie Sun, Zhuang Liu, Anna Bair, and J Zico Kolter. 2023. A simple and effective pruning approach for large language models. arXiv preprint arXiv:2306.11695 (2023)."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/3606274.3606279"},{"key":"e_1_3_2_1_58_1","volume-title":"Qwen2 technical report. arXiv preprint arXiv:2407.10671","author":"Team Qwen","year":"2024","unstructured":"Qwen Team. 2024. Qwen2 technical report. arXiv preprint arXiv:2407.10671 (2024)."},{"key":"e_1_3_2_1_59_1","volume-title":"Divide the gradient by a running average of its recent magnitude. coursera: Neural networks for machine learning. Technical report","author":"Tieleman Tijmen","year":"2017","unstructured":"Tijmen Tieleman and G Hinton. 2017. Divide the gradient by a running average of its recent magnitude. coursera: Neural networks for machine learning. Technical report (2017)."},{"key":"e_1_3_2_1_60_1","unstructured":"Hugo Touvron Louis Martin Kevin Stone Peter Albert Amjad Almahairi Yasmine Babaei Nikolay Bashlykov Soumya Batra Prajjwal Bhargava Shruti Bhosale et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 (2023)."},{"key":"e_1_3_2_1_61_1","volume-title":"Two tales of persona in llms: A survey of role-playing and personalization. arXiv preprint arXiv:2406.01171","author":"Tseng Yu-Min","year":"2024","unstructured":"Yu-Min Tseng, Yu-Chao Huang, Teng-Yun Hsiao, Wei-Lin Chen, Chao-Wei Huang, Yu Meng, and Yun-Nung Chen. 2024. Two tales of persona in llms: A survey of role-playing and personalization. arXiv preprint arXiv:2406.01171 (2024)."},{"key":"e_1_3_2_1_62_1","volume-title":"Denny Zhou, et al.","author":"Wei Jason","year":"2022","unstructured":"Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al., 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, Vol. 35 (2022), 24824-24837."},{"key":"e_1_3_2_1_63_1","unstructured":"Laura Weidinger John Mellor Maribeth Rauh Conor Griffin Jonathan Uesato Po-Sen Huang Myra Cheng Mia Glaese Borja Balle Atoosa Kasirzadeh et al. 2021. Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359 (2021)."},{"key":"e_1_3_2_1_64_1","volume-title":"Gradient-based language model red teaming. arXiv preprint arXiv:2401.16656","author":"Wichers Nevan","year":"2024","unstructured":"Nevan Wichers, Carson Denison, and Ahmad Beirami. 2024. Gradient-based language model red teaming. arXiv preprint arXiv:2401.16656 (2024)."},{"key":"e_1_3_2_1_65_1","volume-title":"\u03b2 -DPO: Direct Preference Optimization with Dynamic \u03b2. arXiv preprint arXiv:2407.08639","author":"Wu Junkang","year":"2024","unstructured":"Junkang Wu, Yuexiang Xie, Zhengyi Yang, Jiancan Wu, Jinyang Gao, Bolin Ding, Xiang Wang, and Xiangnan He. 2024c. \u03b2 -DPO: Direct Preference Optimization with Dynamic \u03b2. arXiv preprint arXiv:2407.08639 (2024)."},{"key":"e_1_3_2_1_66_1","first-page":"140175","article-title":"Rapid plug-in defenders","volume":"37","author":"Wu Kai","year":"2024","unstructured":"Kai Wu, Jian Lou, Xiaoyu Zhang, Handing Wang, Jing Liu, et al., 2024a. Rapid plug-in defenders. Advances in Neural Information Processing Systems, Vol. 37 (2024), 140175-140198.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_67_1","volume-title":"European Conference on Computer Vision. Springer, 186-203","author":"Wu Shuchi","year":"2024","unstructured":"Shuchi Wu, Chuan Ma, Kang Wei, Xiaogang Xu, Ming Ding, Yuwen Qian, Di Xiao, and Tao Xiang. 2024b. Refine, Discriminate and Align: Stealing Encoders via Sample-Wise Prototypes and Multi-relational Extraction. In European Conference on Computer Vision. Springer, 186-203."},{"key":"e_1_3_2_1_68_1","volume-title":"Badchain: Backdoor chain-of-thought prompting for large language models. arXiv preprint arXiv:2401.12242","author":"Xiang Zhen","year":"2024","unstructured":"Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. 2024. Badchain: Backdoor chain-of-thought prompting for large language models. arXiv preprint arXiv:2401.12242 (2024)."},{"key":"e_1_3_2_1_69_1","volume-title":"Amr Sharaf, and Hany Hassan Awadalla.","author":"Xu Haoran","year":"2023","unstructured":"Haoran Xu, Young Jin Kim, Amr Sharaf, and Hany Hassan Awadalla. 2023. A paradigm shift in machine translation: Boosting translation performance of large language models. arXiv preprint arXiv:2309.11674 (2023)."},{"key":"e_1_3_2_1_70_1","volume-title":"Exploring the universal vulnerability of prompt-based learning paradigm. arXiv preprint arXiv:2204.05239","author":"Xu Lei","year":"2022","unstructured":"Lei Xu, Yangyi Chen, Ganqu Cui, Hongcheng Gao, and Zhiyuan Liu. 2022. Exploring the universal vulnerability of prompt-based learning paradigm. arXiv preprint arXiv:2204.05239 (2022)."},{"key":"e_1_3_2_1_71_1","volume-title":"Promptcare: Prompt copyright protection by watermark injection and verification.","author":"Yao Hongwei","year":"2024","unstructured":"Hongwei Yao, Jian Lou, Zhan Qin, and Kui Ren. 2024. Promptcare: Prompt copyright protection by watermark injection and verification. (2024), 845-861."},{"key":"e_1_3_2_1_72_1","volume-title":"Yi: Open foundation models by 01. ai. arXiv preprint arXiv:2403.04652","author":"Young Alex","year":"2024","unstructured":"Alex Young, Bei Chen, Chao Li, Chengen Huang, Ge Zhang, Guanwei Zhang, Heng Li, Jiangcheng Zhu, Jianqun Chen, Jing Chang, et al., 2024. Yi: Open foundation models by 01. ai. arXiv preprint arXiv:2403.04652 (2024)."},{"key":"e_1_3_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.240798"},{"key":"e_1_3_2_1_74_1","volume-title":"Xi Victoria Lin, et al","author":"Zhang Susan","year":"2022","unstructured":"Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al., 2022. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068 (2022)."},{"key":"e_1_3_2_1_75_1","volume-title":"Sinno Jialin Pan, and Lidong Bing","author":"Zhang Wenxuan","year":"2023","unstructured":"Wenxuan Zhang, Yue Deng, Bing Liu, Sinno Jialin Pan, and Lidong Bing. 2023a. Sentiment analysis in the era of large language models: A reality check. arXiv preprint arXiv:2305.15005 (2023)."},{"key":"e_1_3_2_1_76_1","volume-title":"Purifier: Plug-and-play Backdoor Mitigation for Pre-trained Models via Activation Alignment","author":"Zhang Xiaoyu","year":"2025","unstructured":"Xiaoyu Zhang, Yulin Jin, Haoyu Tong, Jian Lou, Kai Wu, and Xiaofeng Chen. 2025a. Purifier: Plug-and-play Backdoor Mitigation for Pre-trained Models via Activation Alignment. IEEE Transactions on Multimedia (2025)."},{"key":"e_1_3_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3348204"},{"key":"e_1_3_2_1_78_1","volume-title":"Zeroth-Order Federated Private Tuning for Pretrained Large Language Models. In Australasian Conference on Information Security and Privacy. Springer, 285-306","author":"Zhang Xiaoyu","year":"2025","unstructured":"Xiaoyu Zhang, Yong Lin, Meixia Miao, Jian Lou, Jin Li, and Xiaofeng Chen. 2025b. Zeroth-Order Federated Private Tuning for Pretrained Large Language Models. In Australasian Conference on Information Security and Privacy. Springer, 285-306."},{"key":"e_1_3_2_1_79_1","volume-title":"Duplexguard: safeguarding deletion right in machine unlearning via duplex watermarking","author":"Zhang Xiaoyu","year":"2024","unstructured":"Xiaoyu Zhang, Chenyang Zhang, Jian Lou, Kai Wu, Zilong Wang, and Xiaofeng Chen. 2024b. Duplexguard: safeguarding deletion right in machine unlearning via duplex watermarking. IEEE Transactions on Dependable and Secure Computing (2024)."},{"key":"e_1_3_2_1_80_1","volume-title":"Can You Repeat That? Defending against Jailbreaks via Repetition. arXiv preprint arXiv:2405.07932","author":"Zhang Ziyang","year":"2024","unstructured":"Ziyang Zhang, Qizhen Zhang, and Jakob Foerster. 2024a. PARDEN, Can You Repeat That? Defending against Jailbreaks via Repetition. arXiv preprint arXiv:2405.07932 (2024)."},{"key":"e_1_3_2_1_81_1","volume-title":"Advances in Neural Information Processing Systems","volume":"36","author":"Zheng Lianmin","year":"2024","unstructured":"Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al., 2024a. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, Vol. 36 (2024)."},{"key":"e_1_3_2_1_82_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690373"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Taipei Taiwan","acronym":"CCS '25"},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765223","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:13:34Z","timestamp":1766441614000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765223"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":82,"alternative-id":["10.1145\/3719027.3765223","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765223","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}