The paper introduces Sparse One-hot Discrete Adam (SODA), a white‑box search algorithm that can reconstruct textual inputs from partial knowledge of a language model’s output logits. SODA can recover natural sequences of up to 17 tokens with no false positives, outperforming prior methods by a factor of four in exact‑match reconstruction. The authors demonstrate that input length and vocabulary size are more critical to inversion difficulty than model size, and provide proof‑of‑concept security applications, including recovering backdoor triggers and personally identifiable information from a poisoned LLM and synthetic user‑chatbot interactions.
arXiv:2607. 29378v1 Announce Type: cross Abstract: Large language models (LLMs) generate text by auto-regressively sampling the next token.
arXiv:2607. 00852v1 Announce Type: cross Abstract: This work studies the hidden-state inversion problem: recovering the original input token sequence of a decoder-only language model from its last-layer hidden states.
arXiv:2610.31995v1 Announce Type: cross Abstract: As large language models (LLMs) face growing demands for data removal driven by regulatory compliance, copyright concerns, and privacy protection, ap...
The paper introduces Rep2Text, a method that reconstructs text from a single hidden representation of a large language model. Experiments show that for short passages (~16 words) about half the words can be recovered while preserving overall meaning, and even longer texts retain recoverable main ideas. These results suggest that hidden representations encode more information than previously thought, raising concerns about privacy.
arXiv:2608.29943v1 Announce Type: new Abstract: Large language models (LLMs) can memorize sensitive information, raising serious privacy concerns. Machine unlearning offers a potential solution to re...
The paper introduces PropMe, a framework that evaluates both the capability of large language models (LLMs) to reproduce training data via prefix attacks and their natural propensity to do so without adversarial prompting. Using SimpleTrace to compare every generation against the full indexed training corpus, the authors test models such as Comma, DFM Decoder, and OLMo3 32B across datasets like Common Pile, Dynaword, and Dolma3. Results show that natural sentence prompts produce less training text than prefix attacks, but unprompted or single-word prompts can reproduce as much or more, often involving duplicated licenses, code, and templates; continual pre‑training only modestly reduces verbatim reproduction.
The paper examines how supervised fine-tuning (SFT) of large language models can leak personally identifiable information (PII) when the fine-tuning data contains user-provided sensitive details. It introduces COVA, a coverage-aware decoding algorithm that improves targeted PII reconstruction from SFT models, especially when an adversary has limited contextual knowledge about a target. Experiments on medical and legal Q&A datasets show that even small proprietary SFT datasets can lead to significant privacy leakage via PII reconstruction.
arXiv:2605.21856v2 Announce Type: replace-cross Abstract: Large language models (LLMs) have demonstrated impressive reasoning abilities across a wide range of tasks, but data contamination undermines...
TextCloak is a reinforcement‑learning driven framework that generates unlearnable examples (UEs) to protect textual data from unauthorized fine‑tuning of large language models (LLMs). It transforms clean text into perturbations that preserve meaning and naturalness while degrading the utility of models trained on them. Experiments on six datasets and nine LLMs show that TextCloak consistently impairs unauthorized fine‑tuning and remains robust across different architectures, training settings, and adaptive attacks.
arXiv:2610.27653v1 Announce Type: cross Abstract: Watermarking has emerged as a key tool for identifying text generated by large language models (LLMs), with current schemes embedding statistical sig...
arXiv:2608. 20055v1 Announce Type: cross Abstract: Hidden chain-of-thought (CoT) traces, especially those from frontier proprietary large reasoning models (LRMs), are valuable model assets.
arXiv:2610.09941v1 Announce Type: new Abstract: Large vision-language models (LVLMs) are increasingly deployed in safety-critical applications, yet they remain vulnerable to backdoor attacks. Defendi...