Benchmarking Empirical Privacy Protection for Adaptations of Large Language Models
Authors: Bartłomiej Marek
Lorenzo Rossi
Vincent Hanke
Xun Wang
Michael Backes
Franziska Boenisch
Adam Dziedzic
Venue: ICLR 2026 Oral (2026)
Keywords: privacy
llm
adaptations
auditing
differential privacy
Primary area: datasets and benchmarks
TL;DR: DP adaptations of LLMs can leak data in practice, with risk rising as adaptation data becomes closer to the pretraining distribution.

Abstract: Recent work has applied differential privacy (DP) to adapt large language models (LLMs) for sensitive applications, offering theoretical guarantees. However, its practical effectiveness remains unclear, partly due to LLM pretraining, where overlaps and interdependencies with adaptation data can undermine privacy despite DP efforts. To analyze this issue in practice, we investigate privacy risks under DP adaptations in LLMs using state-of-the-art attacks such as robust membership inference and canary data extraction. We benchmark these risks by systematically varying the adaptation data distribution, from exact overlaps with pretraining data, through in-distribution (IID) cases, to entirely out-of-distribution (OOD) examples. Additionally, we evaluate how different adaptation methods and different privacy regimes impact the vulnerability. Our results show that distribution shifts strongly influence privacy vulnerability: the closer the adaptation data is to the pretraining distribution, the higher the practical privacy risk at the same theoretical guarantee, even without direct data overlap. We find that parameter-efficient fine-tuning methods, such as LoRA, achieve the highest empirical privacy protection for OOD data. Our benchmark identifies key factors for achieving practical privacy in DP LLM adaptation, providing actionable insights for deploying customized models in sensitive settings. Looking forward, we propose a structured framework for holistic privacy assessment beyond adaptation privacy, to identify and evaluate risks across the full pretrain-adapt pipeline of LLMs.

Published as a conference paper at ICLR 2026
BENCHMARKING EMPIRICAL PRIVACY PROTECTION FOR ADAPTATIONS OF LARGE LANGUAGE MODELS
Bartiomiej Marek", Lorenzo Rossi', Vincent Hanke, Xun Wang, Michael Backes, Franziska Boenisch, Adam Dziedzic CISPA Helmholtz Center for Information Security
ABSTRACT
Recent work has applied differential privacy (DP) to adapt large language models (LLMs) for sensitive applications, offering theoretical guarantees. However, its practical effectiveness remains unclear, partly due to LLM pretraining, where overlaps and interdependencies with adaptation data can undermine privacy despite DP efforts. To analyze this issue in practice, we investigate privacy risks under DP adaptations in LLMs using state-of-the-art attacks such as robust membership inference and canary data extraction. We benchmark these risks by systematically varying the adaptation data distribution, from exact overlaps with pretraining data, through in-distribution (IID) cases, to entirely out-of-distribution (OOD) examples. Additionally, we evaluate how different adaptation methods and different privacy regimes impact the vulnerability. Our results show that distribution shifts strongly influence privacy vulnerability: the closer the adaptation data is to the pretraining distribution, the higher the practical privacy risk at the same theoretical guarantee, even without direct data overlap. We find that parameter-effictee methods, such as LoRA, achieve the highest empirical privacy protection for OOD data. Our benchmark identifies key factors for achieving practical privacy in DP I.LM adaptation, providing actionable insights for deploying customized models sensitive settings. Looking forward, we propose structured framework for holistic privacy assessment beyond adaptation privacy, to identify and evaluate risks across the full pretrain-adapt pipeline of LLMs.
fine-tuning
INTRODUCTION
The use of pretrained large language models (LLMs) for sensitive downstream tasks, such as medical
decision making, has grown rapidly (Labrak al. 2024 Chen et al.) 2023 Van Veen al.
2024).
To offer protection for the private data used to adapt the LLMs to these sensitive tasks, differential
privacy (DP) Dwork 2006 Dwork al. 2014) has emerged as a gold standard (Yu et al. 202 I
2022 Li et al. 2022 Duan et al.) 2023a; Mchta et al. 2023). However, adapting a pretrained LLM
with DP may not always provide the anticipated privacy protections (Tramèr al., 2024). The
challenge arises from potential overlap or complex interdependencies between data used to pretrain the LLMs and the adaptation dataset. The problem is exacerbated by the fact that for most LLMs, their pretraining datasets are not disclosed (OpenAl 2023 Qwen et al. 2025 Touvron et al. 2023 rendering a structured reasoning of the interdependencies with the private adaptation data impossible.
While prior work has investigated privacy risks stemming from LLM pretraining (Carlini al. 2023b a). post-hoc leakage in non-private adaptations (Zhu et al. 2024). or auditing DP adaptations via synthetic canaries (Panda et al. 2024), we still lack structured understanding of the empirical privacy risks of DP adaptations. This is critical gap. Without a clear understanding of the practical risks, LLM practitioners are left with little guidance on how privately apply LLMs in privacy- sensitive settings, including critical questions like: which adaptation method to use, what pretrained model is best given the private adaptation data, and what privacy levels will be protective enough.
* Equual contribution. For correspondence, please contact Franziska Boenisch (boen schêci wwchhcispp...........o..oo...e.p ses.spaddde... de) and Adam Dziedric (dz i edz cêci spa.ppa..c.. dd).

---

Published as a conference paper at ICLR 2026
To close this gap, we conduct comprehensive benchmark evaluation that sheds light the empirical
leakage introduced by DP adaptations. We evaluate a wide range of private adaptation strategies,
including full and last-layer DP fine-tuning (Li et al.
2022), parameter-efficien fine-tuning (PEFT)
methods such as DP-LoRA (Hu et al., 2022
Yu et al.
2022 DP-Prefix Tuning (Liu et al. 2021 as
well as DP prompting schemes (Duan et al.
2023a).
To assess leakage, we focus on the Robust Mem- bership Inference Attack (RMIA) (Zaritzadeh et al. 2024). which represents the strongest state- of-the-art threat model for auditing LLM pri- vacy, and complement this with data extraction attacks (Tramer et al. 2022 Carlini al. 2021; 2019) to evaluate more severe forms of informa- tion leakage. For the latter, we include canary data into the adaptation set and measure its ex- posure. A general overview of privacy auditing for adapted LLMs is provided in Figure [
Query...
LLM
Answer
Auditor
Adaptation
Pretrained dataset
(e.
Overlap
IID
OOD
Canary
MIA
Private adaptation datasets
We systematically analyze a spectrum of pos-
Figure 1: Setup for Privacy Auditing of private LLM Adaptations.
sible distributions for the adaptation data with
respect to the pretraining ranging from data perfectly overlapping with the pretraining data, over IID scenarios, entirely OOD examples- to understand the possible privacy implications for all setups. Our benchmark spans six datasets drawn from diverse domains, four adaptation methods, and seven pretrained LLMs trained on the Pile dataset (Gao et al. 2020), allowing for complete analysis. These models, of various sizes and architectures, enable comprehensive comparisons across different setups. Furthermore, we include two recent fully open-source models, OLMo IB (Groeneveld et al., (2224)) and OLMo2 IB (OLMo) al., 2024), though the lack of known validation datasets constrains the analysis of these models. We analyze broad spectrum of privacy regimes from no privacy to high privacy, to understand the associated risks. Our study is guided by a central question: What are the empirical privacy risks for the adaptation data that result from DP adaptations?
Looking ahead, we emphasize the need to jointly audit privacy risks from pretraining and adaptation, well their interplay, since LLMs may leak information from either stage. To address this, we propose a new structured framework for holistic privacy assessment across the full pretrain- adapt pipeline. It defines four key audit stages: (1) pretraining. (2) adaptation, (3) their joint interaction, and (4) post-adaptation auditing of pretraining. To formally ground these audits and redefine each stage's membership inference game (Yeom al. 2018 Jayaraman et al. 2020)). We hope this formalization and our practical insights from the benchmark will guide researchers developing future assessments and help practitioners deploy customized LLMs responsibly in sensitive domains.
make them instantiable,
2 BACKGROUND AND RELATED WORK
Differential Privacy. The mathematical framework of DP Dwork 2006) formalizes the intuition that privacy guarantees can be obtained when a randomized mechanism M executed on two neighboring datasets D, D' that differ in only one data point, yields roughly the same result, i.e.,
Pr(M(D) E $] S of Pr(M(D') E 5] +
The privacy parameter specifies how much the result can differ. 8 is the probability of failure to meet that guarantee. There are two canonical algorithms to implement DP guarantees in machine learning (MI.): DPSGD (Differentially Private Stochastic Gradient Descent) (Abadi et al., (016). which extends standard stochastic gradient descent with clipping and noising gradients, and PATE (Private Aggregation of Teacher Ensembles) (Papernot et al. 2017 2018), which an inference time algorithm that privately transfers knowledge from an ensemble of teachers to a public student model.
Private Adaptations of LLMs. LLMs are pretrained on extensive amounts of public data, followed by adaptations to private downstream tasks. The existing methods for private LLM adaptations fall into two categories: (1) private tuing methods, such as PrivateLoRA (Yu et al.) 2022) or PromptDPSGD (Duan al. 2023a), that rely on access the L.M gradients and based on the
2

---

Published as a conference paper at ICLR 2026
DPSGD algorithm, and (2) private in-context learning (ICL) methods, such DP-ICL (Wu et al. 2024) or PromptPATE (Duan et al. 2023a), which require only API (black-box) access to the LLM and are based PATE. See Section A. for details.
Membership Inference Attacks. A membership inference attack (MIA) (Shokri et al. 2017
Zarifzadeh al. 2024 Shi et al., 2024b Carlini al. 2022) aims to determine whether a specific
data point can be identified as part of a model's 's training set. This approach plays a crucial role in
applications ranging from privacy assurance (Steinke et al. [023 Mahloujifar et al. [025 Rossi et al. 2025b) to identifying protected or copyrighted content embedded in pretraining data (Shafran et al. 2021). While most MIA research has focused on supervised learning settings (Carlini al. 2022).
new advancements reveal their broader relevance. Duan et al. (2023b) introduced a discrete-prompt based MIA, disclosing vulnerabilities in proprietary LLMs like GPT-3, which risk leaking private information through prompt-based queries (Duan et al. 2023a). See Section A.2 for an in-depth discussion of the existing attacks.
Canary Exposure and Data Extraction Attacks. An alternative to membership inference attacks (MIAs) for evaluating privacy leakage in machine learning models is to measure the exposure of training data. Given a universe of candidates 24 and an attacker's ' ranking 2 by likelihood of membership, the exposure of target sample 2 is defined as:
exposure(= 2, ?) = log2 [4] loga (rank(z(( 2))
This score is maximal when is ranked most likely and zero when ranked least likely. In a comple- mentary vein, extractability quantifies how readily a model emits a secret string when prompted. A suffix s is said to be extractable with tokens context if there exists some prefix p of length & such that, under greedy decoding, the model outputs s immediately following When is sufficiently long and random, its extractability serves as a practical metric of memorization L.MMs. Further discussion appears in Section A.3
Benchmarking Privacy Vulnerabilities, Zhu et al. | (2024) introduced PrivAuditor, which system- atically and empirically evaluates the privacy leakage from LLM adaptations. In contrast to our work, they focus on non-private adaptations only. Li et al. 2024a) evaluated the privacy leakage of private LLMs adaptations through empirical privacy attacks, such data extraction, MIAs, and cmbedding-level privacy attacks. This benchmark focuses mostly on tradcoff's between privacy and utility, highlighting the complexity of balancing them. Contrary explore the relationship between the pretraining data and the fine-tuning data, LLM-PBE (Li et al., 2024b) empirically evaluates privacy risks throughout the LLM lifecycle, including pretraining, fine-tuning, and querying. Zhou et al. (2025) investigated potential data leakage across widely used software engineering benchmarks.
our work, this work does not
3 EXPERIMENTAL SETUP
We begin by detailing the setup used for our benchmark. Further details are presented in Section B
Models and Pretraining Data. Our work focuses primarily on the Pythia (Biderman et al. 2023
and GPT-Neo (Black et al., 2021) families, both of which were trained on the Pile dataset (Gao
al. 2020). in addition to the newer open-source models, OLMo (Grocneveld al., 2024b) and
OLMo2 (OLMo et al. 2024). To benchmark the effects over various model sizes, we use Pythia 1.4B, Pythia 1B, Pythia 410M, Pythia 160M, Pythia 70M, GPT Neo 1.3B, GPT Neo 125 M. OLMoo IB (Groeneveld et al. 2024b), and OLMo 2 1B (OLMo et al. 2024 The Pile dataset (Gao et al. datasets, including text from sources such
2020) is an 800GB collection of diverse English-languaee as books, academic papers, source code repositories. In all cases where specific model is not explicitly mentioned, we use Pythia IB as the default model.
Adaptation Datasets. We categorize the datasets used in our experiments into in-distribution (IID) and out-of-distribution (OOD), depending on their relationship to the pretraining data. IID datasets
NNte that our analyses cannot be conducted closed models, such as GPT-4 (Achiam et al. 2023 Gemini (Comanici et al.) (025) since 1) their APIs not offer the gradient- adaptation capabilities with differential privacy; 2) it is not possible to perform expressive MIAs since the models do not output detailed token- probaprrbbbblitis//ogggtc and 3) we cannot access information about their training datasets, making it impossible to identify IID and OOD data for our analyses. The last point also discard all only wpen-weights models, such as
Gemma2 (Team et al. 2024 Llama (Grattation al. 2024).
3

---

Published as a conference paper at ICLR 2026
come from the same distribution as the pretraining data, and we identify two cases: one with full overlap between pretraining and adaptation data, where we use data directly from the pretraining set for the adaptations, and one with no overlap, where the data is sourced from the corresponding validation set from the pretraining distribution. We focus on the following Pile subsets for the III) datasets: Bookcorpus2, GitHub, and Enron Emails (Klimt & Yang 2004).
In contrast, OOD datasets are derived from a different distribution and do not overlap with pretraining data. Thus, we choose SAMSum (Gliwa et al.) 2019), and GermanWize (Cohere). To empirically quantify the distributional distances between our adaptation data and the respective adaptation datasets, we first compute sentence embeddings using Sentence- BERT (Reimers) & Gurevych 2019), then measure the Wasserstein dis- tance (Villani 2009 Arjovsky al. 2017) between the pretraining data (all subsets of the Pile) and the respec- tive adaptation dataset in Table I These results validate our dataset classifications: corpus, GitHub, Enron) exhibit low distances, consistent with IID overlapping status, whereas OOD datasets (SAMSum and German exhibit substantially higher distances. Notably, German- Wiki, which consists of German sentences rather than English ones like the other datasets, shows the greatest divergence, confirming its suitability as strongly OOD data for our evaluation. We claborate more on the adaptation datasets in Section B.T
Table 1: Empirical quantification of dataset shift via the Wasserstein distance.
Mean Distance
Min
Dataset
Distance
Bookcorpus2 Train
0.0171
0.0019
Bookcorpus2 Val
0.0193
0.0057
Github Val Enron Val
0.0180
0.0021
0.0202
0.0088
SAMSum
0.0250
0.0192
German
0.0556
0.0520
datasets (Book-
Adaptation Methods. We evaluate different types of adaptations, including fine-tuning of all model parameters (Li et al. 2022). ). or the last layer (i.e., the head), PEFT methods, such as LoRA (Hu et al. 2022; Yu et al. 2022) and Prefix Tuning (Liu et al. 2021 Duan et al. (023a).. Considering a Pythia TB model, we train 1B parameters for Full Frine-Tuning 1M for LORA, 130M for Prefix Tuning, and 100M for last-layer (Head) Fine-TTuning Since membership inference success is highly dependent on the train-test gap, for a fair comparison of the privacy leakage, we ensure similar evaluation perplexities, in particular, similar validation loss values at the end of the adaptation's 's training for specific datasets across adaptation methods, see Section E More details on the adaptation setup are presented in Section B.2
Utility Anlysiis. To assess the utility of our adapted models, in the main paper, we report perplexity and validation loss as proxies to ensure comparability across the wide range of datasets and adaptation settings studied. We additionally report the performance of generated content evaluated on the held-out set of each dataset with the Rouge-1 score and compare this with the perplexity values. The detailed results are displayed in Section E.2 and show that our proxies and the more fine-grained utility metric show the same privacy-utiie trend across the different values. Finally, we also report the utility in loss on DP -unntunnn the adapted model improves on the adaptation task while showing no noticeable performance drop on the out-of-domain datasets.
performance in Section E.3) These results show that, after
Membership Inference Attacks. For MIA, we rely on the strongest ofate-of-the-art attack, RMIA (Robust Membership Inference Attack) (Zarifzadeh et al., (024). We use the offline version because it is more efficient and does not need training customized reference models for each sample, unlike the online version. We leverage single reference model for our experiments, as the authors show strong MIA performance even with a single reference model. Unless explicitly stated, we focus on using a "shadow" model (adaptation), in our case Pythia IB, which is trained in the same way the target model, but on a different split of the same tine-tuning data. We also evaluate the Reference method (Carlini et al. 2021), which calibrates the target model's loss using reference model, and compare against Min-K K% as a reference-less baseline attack. As with RMIA, we report the best AUC from a grid search over Min-K%'s 's parameter K. See Section B.4 for more details on the setup.
Canary Exposure and Data Extraction Attacks. To evaluate memorization, we insert adversarial canaries into a small portion of the adaptation data and estimate their exposure using two approx- imation methods: sampling and distribution modeling. Both approaches perform similarly when using 256 non mommeerrr canaries, and we adopt sampling for efficiency. Moreover, when considering k-extractable memorization, we set k = 10 tokens. See Section (.5) for extraction details.
4

---

Published as a conference paper at ICLR 2026
Table 2: Membership Inference for OOD Adaptations. We audit only the adaptations and assume the same pretrained LLM is used for all adaptations. We present the AUC scores obtained with RMIA for the Pythia IB model adapted on different datasets with E E {0.1,8, 80).
SAMSum
GermanWiki
Average 5 ==
MIA
Adapt.
2=3
Prefix Tuning
1.00
0.62
0.63
1.00
0.61
0.61
1.00
0.63
0.62
LoRA
0.86
0.69
0.50
1.00
0.59
0.66
0.91
0.64
0.58
(shadow)
Fall Fine-
0.59
Head Fine-Tune
1.00
0.98
0.62
1.00
0.76
0.70
1.00
0.87
0.66
Average
0.97
0.78
0.39
1000
0.67
0.63
0.95
0.73
0.61
Prefix Tuning
0.93
0.50
0.51
0.92
0.50
0.50
0.92
0.50
0.50
LoRA
Reference (Pythia 1B)
Full Fine- Tume
0.94
0.51
0.51
0.99
0.51
0.50
0.96
0.51
0.51
Head Fino-Tune
0.97
0.52
0.51
0.98
0.51
0.50
0.97
0.51
0.50
Average
0384
0:31
0.31
0393
0.31
0.30
0.88
0.31
0331
Table 3: Membership Inference for in-distribution (IID) Adaptations using the setup from Table
Dataset
Bookcorpes2 Val
Bookecopus22 Train
Githab Val
Earon Val
Average
MIA
Adapt.
8
0.1
8
0.1
Tuninn
0.89
0.5G
1.000
0.55
LaRA
1.00
0.70
0.52
1.00
0.69
0.53
1.00
0.74
0.52
1.00
0.73
0.52
1:00
0.71
0.52
RMIA (shadow)
Full Fine- Tune
1.00
0.75
0.77
1.00
0.75
0.76
1.00
0.78
0.80
1.00
0.91
0.66
1.00
0.50
0.75
Head Fine Tune
1.00
0.72
0.73
1,00
0.72
0.72
1.00
0.80
0.74
1.00
0.57
0.65
1.00
0.70
0.71
Averuge
1.00
Prolix Taming
0333
0.36
032
0.97
0.30
0.7
0.54
0.96
0.35
0:31
LaRA
0.89
0.52
0.52
0.97
0.51
0.51
0.92
0.51
0.50
0.97
0.55
0.51
0.94
0.52
0.51
Reference (Pythia IB)
Fall Fine-Tumm
1.00
0.54
0.52
1.00
0.54
0.52
0.99
0.54
0.52
0.98
0.59
0.50
0.99
0.55
0.51
Head Fine Tune
0.98
0.57
0.52
1,00
0.56
0.51
0.99
0.50
0.50
0.99
0.58
0.51
Averago
0.5
0.35
0.52
0.35
4 BENCHMARK DESIGN AND EXPERIMENTS
To address benchmark's 's central question: "What are the empirical privacy risks to adaptation data under DP adaptations?" , we break it down into six concrete research questions.
4.1 RQ1: HoW DOES THE RELATIONSHIP (OVERLAPPING, IID, OOD) BETWEEN ADAPTATION AND PRETRAINING DATASETS IMPACT DATA PRIVACY?
Motivation. The pretrain-adua paradigm uses LLMs pretrained on large public datasets, which are then adapted to smaller, often sensitive, private datasets using DP methods. While DP offers formal guarantees, its practical effectiveness under the pretrain-adapy paradigm remains umclear-particule how the relationship and interplay between adaptation and pretraining data (e.g., overlapping, IID, or OOD) influences actual privacy leakage.
Summary of Findings. Our results show that (1) privacy risks increase when the adaptation data distribution closer to the pretraining data, even if there is no direct overlap. (2) Surprisingly, IID data from the pretraining validation set leaks as much as directly overlapping data, underscoring distributional closeness as the main driver risk.
We focus our discussion Pythia- 1B, and further expand the discussion for the other models in Section C. They show that the average AUC is generally higher in IID settings than in OOD in all attacks and adaptations. For instance, looking at RMIA (shadow) using = 8, we observe that the average AUC is between 0.7 and 0.9 in the IID setting, while is between 0.63 and 0.87 for the OOD setting. More detailed analyses for different attack setups and more privacy regimes are depicted in Section C.I We also identify distributional closeness as key risk factor, as overlapping data leaks similarly to IID. Moreover, our results indicate that under both strong attack and in more practical scenarios, moderate privacy regimes (e.g., & 8) still present a real threat of privacy leakage from IID. the other hand, under this regime, privacy leakage in the OOD setting is mostly observed with strong attack. Moreover, Section Figure Segure/]showe @isows over the training epochs the Overlap (Train) and IID data (Val) privacy leakage, and further highlights similar privacy leakage between Overlap and IID data across the whole training run. We also analyze the impact of subset characteristics on privacy leakage in Section
Detailed Results. We present our main results in Table 2 and Table 3
C.3 and we discover that the pretraining dataset size and complexity influence the privacy leakage in the training datasets. We observe that privacy leakage increases with both the size and complexity of the subsets.
5

---

Published as a conference paper at ICLR 2026
SAMSum
GermanWiki
Bookcorpus2 Val
54
53
52
AUC
51
50
49
Epoch
Epach
Epech
OLMa 18
GPT-2
Pythia 160M
Pythia 2,88
GPT Neo 1.38
Pythia 14M
Pretrained (1B)
Pythia 70M
Figure 2: IID data is more susceptible to leakage using the pretrained base model than OOD data. We compare the effectiveness of performing RMIA on fully fine-tuned Pythia IB with s = with different pretrained models as reference models.
4.2 RQ2: WHICH DP ADAPTATION METHOD IS THE MOST PROTECTIVE?
Motivation. known that the type of adaptation significantly impacts the utility of the final model (Zhu et al. 2024). However, different adaptations might also offer disparate empirical protection the same formal privacy guarantee, motivating our empirical comparison.
Summary of Findings. While LoRA provides much better empirical privacy protection in non- private settings compared other adaptations, the differences become more subtle under the DP regime. Despite this, LoRA consistently achieves a relatively low AUC, whereas the other adaptations show varying trends depending on the dataset or privacy budget.
Detailed Results. Specifically, shown in Table for OOD datasets with 8, the most vulnerable adaptations are Full and Head Fine-Ture On the other hand, for IID data, the strongest protection provided by Head Fine-Tune, which is marginally better than LoRA. With stronger privacy guarantees, LoRA is the most private for OOD datasets with an AUC score of 0.58, thus slightly better than Full Fine- Tune. On the other hand, while adapting to the IID dataset, LoRA outperforms other adaptations. Notably, Full Fine- Tune and Head Fine-Ture Tune show much lower privacy protection in these settings.
4.3 RQ3: ARE THE SAME ADAPTATIONS ROBUST AGAINST DATA EXTRACTION?
Motivation. Data extraction attacks are even more severe than MIAs. Therefore, it is crucial to evaluate the protectiveness of DP adaptations against this stronger threat.
Summary of Findings. We find that Prefix Tuning is the most vulnerable adaptation method in this setting. On the other hand, LoRA and Head Fine-Tune in both cases, with and without DP guarantees, exhibit resistance against data extraction.
Detailed Results. We report detailed results in Section C.2 In particular, Table 22 and Table 23 show that for 0.1 the exposure around 1.44, therefore, close to random guessing. We also noticed a limited influence the choice of the canary prefix type. Moreover, the adversarial prefix is the main source of privacy leakage, with the interaction between the prefix and the individual sample playing a smaller role, Figure 10 in Section C.5
4.4 RQ4: HOW IMPORTANT IS THE ATTACKER'S KNOWLEDGE OF THE PRETRAINED MODEL?
Motivation. The attacker's knowledge of the pretrained model plays a crucial role in the success of MIAs, as enables them to select more relevant reference models and non-member data for training, which is one of the main challenges of MIAs (Watson et al. 2022, Carlini et al. 2022). We investigate various setups, including an attacker who has access to shadow model from the same pretraining distribution as the adapted LLM, another model sharing common traits (such as the same data but different architecture or size), and no access to external models. This helps us characterize the landscape of potential real-world risks and setups.
Summary of Findings. The performance of MIAs highly depends on the attacker's 's knowledge the target model and pretraining data. In particular, RMIA performs best when shadow model shares

---

Published as a conference paper at ICLR 2026
architecture, initialization weights, and training data distribution. Meanwhile, RMIA's effectiveness rapidly deteriorates as shadow models are trained on different distributions or architectures. Particu- larly, observe that when shadow model trained on the same distribution of the target model is not available, using the pretrained model is the second-best choice, followed by models of the same family and similar size.
To simulate attackers with various background knowledge, in this setting, we also consider other "shadow" models: Pythia 14M, Pythia 160M, Pythia IB, Pythia 2.8B (Biderman eet al., 2023), GPT-Neox (Black et al.) 202T), OLMo 1B (Groeneveld et al.] 2024a). and GPT- 2 (Radford et al. 2.19). The MIA performance close to random for private adaptations with Furthermore, as shown in Figure 2 while the MIA's performance for Pythia IB is higher on IID data, the choice of reference model has little effect when attacking models adapted on OOD data, even with architectural differences between the model and the reference model i.e. GPT-Neo 1.3B and OLMo 1B. Moreover, as in the other case, Figure 12 (in Section D) shows that the privacy leakage is similar between IID and the corresponding overlapping data. We show further experiments in Section D
Detailed Results.
4.5 RQ5: How DOES ADAPTATION CHANGE THE PRETRAINING DATASET VULNERABILITY?
Motivation. DP adaptations only guarantee protection for the adaptation dataset. Yet, adapting the model to other data, while introducing noise, can also affect the pretraining leakage. This is an impor- tant aspect to study, as also pretraining data can be private (Tramer et al., 2024). e.g., conversations with ChatGPT used to improve the models, or emails used to pretrain Gemini. Therefore, we also empirically investigate how adapting pretrained L.MMs affects the leakage of pretraining data.
Summary of Findings. Our findings show that the choice of adaptation method impacts the privacy of pretraining data. Our evaluation shows that Prefix Tuning reduces the leakage of memorized pretrain- ing data from adapted language models, especially in high-privacy settings. For the other adaptations, this effect is negligible, and the adapted model retains most of the pretraining memorization.
Detailed Results. We evaluate the effect of OOD and IID adaptation data on the leakage of memorized pretraining data from the adapted L.M.. Specifically, as we show in Figure 3 Prefix Tuning significantly reduces leakage, particularly in high-privacy regimes. For the other adaptation methods, the number of memorized samples often remains above 460 samples. For Prefix Tuning, the number of memorized samples is often lower than 460 and goes down to around 430 with 0.1, thus suggesting that adaptation partially mitigates the pretraining memorization.
500
Memorized samples
480
460
460
440
440
420
400
400
0.1
10
100
0.1
10
100
Full fine-tune -- LoRA
Full fine-tune
36 LoRA
Head fine-tune ++ Prefix
Head fine-tune
+ Prefox
(a) Bookcorpus2 Val
(b) SAMSum
Figure 3: Prefix tuning reduces the number of verbatim memorized samples, especially for small & values. We show the result for Pythia IB adapted on Bookcorpus2 val and SAMSum datasets with E {0.1, 3, 8, 50, 100, oo}. We present the x-axis using a log scale.
4.6 RQ6: How DO PRIVACY-UTILITY TRADE-OFFS BEHAVE?
Motivation. We also analyze the different empirical privacy-utility trade-off's that can be achieved by the various adaptation methods under the same theoretical privacy budget. This can guide practitioners in answering the question: "For a given private dataset, model, and adaptation method, if use it. what kind of privacy risks should I expect?" Concretely, we run hyperparameter grid search and report the resulting privacy-utilipy outcomes for Pythia- IB, showing the top four runs for each adaptation method, dataset, and privacy budget.
7

---

Published as a conference paper at ICLR 2026
Summary of Findings. Our experiments show the hyperparameter choice can lead varying levels of utility and privacy risks. Generally, LoRA consistently offers the best crivacy-utllity trade-offs. Specifically, the same utility level, as measured by perplexity, it exhibits lower privacy risks, as indicated by the RMIA AUC.
Detailed Results. The analysis provided in Figure 4 illustrates these differences. For instance, GermanWiki with ε = 8, at perplexity 14.27, LoRÁ exhibits an AUC of 0.77, whereas Full Fine- Tuning perplexity 14.60 has 0.82. Similarly, for GitHub (val), perplexity 4.8. LoRA exhibits an AUC of 0.6, whereas Full Fine-Tuning at the same perplexity has 0.83. These findings align with the trends observed the other experiments. These concrete examples highlight the consistency of LoRA's advantages in reducing privacy risks, while maintaining performance. To further validate our utility results, we evaluated the adapted models on generative tasks based on the Rouge-1 score. Detailed comparison between perplexity and Rouge-1 1 score are shown in Section H.2
Corpuss Itrain)
GitHub
0.7
0.6
0.5
12.5
15.0
6.0
Perplexity
Perplexity
Perplexity
Adaptation
LORA
Full tune
Prefx
Head fine-tune
0.1
Figure 4: Privacy-utility curves for the top perplexityseeletted runs from the Pythia- 1B hyper- parameter search, shown for the chosen adaptation method, dataset, and privacy budget.
5 DISCUSSION OF OUR RESULTS
Our findings reveal a complex interplay between pretraining and adaptation data. This significantly affects the privacy risks under DP adaptations. Below, we discuss the implications of these findings when adapting pretrained LLMs to sensitive domains using DP.
Disparate Leakage Based on Distribution. Our results demonstrate that the distributional closeness between pretraining and adaptation data is key factor influencing empirical privacy leakage under DP. Adaptations using data from the same distribution but not seen during pretraining consistently show the highest vulnerability. This presents the fundamental trade-off: while adapting model already pretrained on similar data is beneficial for utility, it simultaneously increases privacy risk.
Disparate Leakage Based on Adaptation Method. We also observe that not all DP adaptation methods offer equal protection, even when enforcing the same formal level guarantee, expressed in the same This aligns with earlier findings in the non-private regime, where privacy-utility trade-offs differ across methods (Zhu et al. 2024). In our experiments, LoRA appeared most consistently robust against privacy attacks, while Prefix Tuning showed the least vulnerability to extraction attacks. These differences are highly relevant for practice: in addition to choosing methods that optimize downstream performance, practitioners should also consider empirical privacy leakage. The attacks we use in this paper offer way to assess and understand such risks under realistic conditions.
Choosing Privacy Regime. We find that in moderate privacy regimes, e.g., E 8, sensitive adaptation data still experiences significant practical vulnerability against both MIAs and data extraction attacks. This highlights the necessity to perform private LLM adaptations in the high- privacy regime, i.e., with low to achieve practical protection.
Reliance on Accurate Shadow Model. We show that attackers gain a substantial advantage when they have access the original pretrained LLM used during adaptation. Shadow models instantiated with the same pretrained model as the adapted LLM's base consistently achieved higher attack success. This is especially concerning given the rise of adapting publicly available LLMs, which makes strong shadow models easily accessible to adversaries. These findings further underscore the need for stringent privacy settings in DP adaptations.
Towards a Holistic Privacy Auditing for LLMs. Our results suggest that privacy assessments should not treat pretraining and adaptation in isolation. The strong interdependence between these
8

---

Published as a conference paper at ICLR 2026
stages demands holistic analysis. Motivated by this insight, introduce structured framework in the next section that formalizes how privacy assessments and audits under the pretrain- -ddapp paradigm should be conducted. We hope this framework encourages the development of privacy assessment methods that match the complexity of modern private L.M pipelines.
HOLISTIC PRIVACY AUDITS UNDER THE PRETRAIN-ADAPH PARADIGM
6.1 AUDIT STAGES AND ADVERSARY GAMES PRETRAIN-ADAPE PRIVACY AUDITING
While our understanding of empirical privacy risks has grown, more nuanced approaches are needed to address privacy risks LLM adaptation. We therefore formalize a holistic privacy auditing framework for the pretrain-adee adapt paradigm with four stages (see Figure 5): (1) auditing pretraining, (2) auditing adaptation, (3) joint audit of pretraining and adaptations, and (4) post-adaptation auditing
of the pretraining- Based these stages, instantiate the audits and contrast them with standard privacy auditing, modeled as an adversarial game G (Yeom et al., 2018 Jayaraman et al. 2020)
where the task is to guess whether data point x was model's training set.
Pretraining Deta and (x)
Pretralning Data
D
Adaptation Data and D (x)
D
Adaptation Data
Standard Auditing for D vs
Standard Auditing for va B
Auditing for Pretrain-Adapt Paradigm for S, D, and
Figure 5: Stages of Auditing, We analyze four stages of auditing: Auditing Pretraining, 2 Auditing Adaptation, training and Adaptations. Auditing of the Pretraining.
Figure 6: Setup for Joint Adaptation Audit- ing (3). We consider different datasets for pre- training and adaptation and the two separate training stages, distinguishing it from standard ML privacy auditing.
Joint Auditing of Pre- Post-Adaptation
We define the adversarial game G analogous to the one for standard MI., yet take two datasets, the pretraining data, and D the adaptation data into account. Additionally, we denote the pretraining procedure by T and the adaptation by T'. Deviations the original game are marked blue.
1. The challenger samples a -
R {0, 1} and R {0, 1} (where a and are binary variables)
2. The challenger trains a model 0 _ 5, Gp. where 5 = S if 0, otherwise Š = SUU {z}
The challenger adapts 0 such that 6' _ D, where D D if b 0, otherwise D - [x}
The challenger sends to the attacker
5. The attacker guesses à, b A(0,0',z)
Whether the attacker has to guess both à, and what background knowledge they have, i.e., whether they get access both 0 and 6', depends on the auditing stage. We detail the attacker's background knowledge and guesses, formulated as hypotheses with null hypothesis Hy and an alternative hypothesis H., for the four auditing stages from our taxonomy.
(1) Auditing pretraining resembles standard ML auditing, targeting privacy leakage from pretrained models. Differences arise from larger datasets and models, limiting both DP protection efficayy (Car lini et al.) (023b) and applicability of auditing techniques like MIA (Duan et al.) 2024). In this setting, the challenger releases the pretrained model to the attacker. The attacker's goal is to correctly guess whether was in the pretraining data S. Their guesses à, are over the random variable
Ho
HA HA:a=1

---

Published as a conference paper at ICLR 2026
(2) Auditing adaptation detects leakage of the adaptation dataset from adapted LLMs in the pretrain- adapt paradigm. Unlike standard ML audits, adaptations start from a pretrained model rather than random initialization; we assume the same pretrained model for all considered adaptations. The challenger releases only the adapted model 0' to the attacker. The attacker does not know whether t E S and therefore guesses over the random variable b.
Ho b = HA:b=1
(3) Joint Auditing evaluates combined leakage from both pretraining and adaptation datasets in the adapted LLM. Typical preeeeriig approaches involve non-DP-trained LLMs with DP-trained adaptations. In this setting, the challenger releases both the pretrained model f and the adapted f' to the attacker. Depending on the attacker's 's background knowledge, we consider three possible cases.
The attacker knows that it $ 8 guesses
The attacker knows that guesses &
The altacker knows that the target sample either both (peetraining and adaptation sets] ucither them and guesses (a.
Hy : (0.0) = (0.0)
(a.b) = (0.1) Ho (0.b) = (1,0) Hy (n.00 (1,1)
Ro (a. b) (0.0)
Hy (a. M (1.1)
(4) Post-Adaptation Auditing evaluates how (private) adaptations affect the protection of data points used for pretraining, which typically lacks formal guarantees. Changes in model behavior induced by the adaptation, including training noise, may alter the exposure of pretraining data in model predictions. In this setting, the challenger releases both the pretrained 0 and the adapted 0'. It is known that the target sample x & D and the attacker guesses a.
Ho : (a, b) = (0 HA: 6) = (1.0)
In essence, auditing pretraining considers only the pretraining itself. Similarly, auditing the adap- tations considers the adaptations themselves. On the other hand, the joint adaptation reasons about both pretraining and adaptation sets. Finally, the post-adaptation auditing only for the pretraining set, but the applied adaptation influences the auditing.
6.2 PRACTICAL APPLICATION OF HOLISTIC AUDITS
Our new perspective on the pretrain-adan paradigm gives both practitioners and researchers clearer insights into each threat model at its particular stage. Formalizing the auditing setup supports systematic reasoning about privacy risks, thereby clarifying the guarantees that different methods need provide. Therefore, our formalization enables the creation of a unified interface for measuring privacy leakage, regardless of whether its source is pretraining or adaptation data. Moreover, our work demonstrates that looking pretraining and adaptation components separately can lead to a mislcading impression of privacy. The connection between these stages affects privacy leakage, which makes comprehensive auditing essential within pretrain-adape paradigm. We believe that developing and sharing tools that support all stages of privacy assessment, from threat modeling and risk quantification to mitigation, will empower the research community to define risks and reduce privacy risks in practice more effectively.
7 CONCLUSIONS
In this work, we benchmark the practical privacy risks that arise under DP adaptations of LLMs within the pretrain-adapt paradigm. Our comprehensive empirical analysis confirms the theoretical concern that pretraining significantly amplifies the privacy risks associated with the adaptation data. We find that the closeness of adaptation and pretraining data distributions plays critical role: even in the absence of overlap, higher distributional similarity results in increased privacy leakage. Additionally, we observe that the choice of adaptation method impacts privacy leakage, with PEFT methods, such as LoRA, offering significantly lower privacy risks while maintaining strong utility. Furthermore, we show Prefix Tuning can reduce the leakage of pretraining data, likely due to the added input noise during private adaptation. Our findings highlight the need for stringent DP constraints (e.g., < 0.1) to mitigate privacy risks in LLM adaptations effectively. It also motivates the need for holistic privacy assessments under the pretrain- adapt paradigm and takes the first step towards it by formalizing such an assessment over the different stages. This work lays a foundational framework for future research efforts aimed safeguarding privacy within the pretrain-adaph paradigm.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGEMENTS
Franziska Boenisch received funding from the European Research Council (ERC) under the European Union's & Horizon Europe research and innovation programme (grant agreement No 101220235). The project was also supported by the German Federal Ministry of Research, Technology and Space (BMFTR) under funding number 16KTS21 14K. Additionally, we would like acknowledge our sponsors, who support our research with financial and in-kind contributions: OpenAl and R-Research. We also thank members of the SprintML group for their feedback. Responsibility for the content of this publication lies with the authors.
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, llge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In International conference on machine learning, pp. 214-223. PMLR, 2017.
Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O'Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, et al. Pythia: A suite for analyzing large language models across training and scaling. In International Conference on Machine Learning, pp. 2397-2430. PMLR, 2023.
Sid Black, Gao Leo, Phil Wang, Connor Leahy, and Stella Biderman. GPT-Neo: Large Scale Autore- gressive Language Modeling with Mesh- Teash-Tesorflow, March 2021. httlh:tt////ett org/ 10. 0..52211nnodoo 5297715 If you use this software, please cite it using these metadata.
Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. Bad characters: Impercep- tible nip attacks, 2021. URL
abs 21 21062.10600 09898
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernj Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX Security Symposium (USENIX Security 19), pp. 267-284, Santa Clara, CA, August 2019. USENIX As- sociation. ISBN 978-1-939133-00-99 URL https: www.wuuse..e....wwwwwwwwwwwwwwww crg/conferencce/
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In USENIX Security Symposium, 2021. URL
https://arxiv. org/ abs 2012 07805
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 1897-1914. IEEE, 2022.
Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations, 2023a. URI.https: http://ppeeevvvveeeeee net. forum?
Hd=TatRHT 1cK
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 5253-5270, 2023b.
Ting- Yun Chang, Jesse Thomason, and Robin Jia. Do localization methods actually localize memo- rized data in LLMs? a tale of two benchmarks. In Kevin Duh, Helena Gomez, and Steven Bethard (eds.), Proceedings of the 2024 Conference of the North American Chapter of the Association for
11

---

Published as a conference paper at ICLR 2026
Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 3190- 3211. Mexico City, Mexico, June 2024, Association for Computational Linguistics. doi: 10.18653/ v1/2024.naccllong...1 L httpss///aaaaattoooooooooo...//a wttp:///222..aaalla222 .oc.nng.666 176
Zeming Chen, Alejandro Hernández Cano, Angelika Romanou, Antoine Bonnet, Kyle Matoba, Francesco Salvi. Matteo Pagliardini, Simin Fan, Andreas Köpf, Amirkeivan Mohtashami, Alexan- dre Sallinen, Alireza Sakhaeirad, Vinitra Swamy, Igor Krawezuk, Deniz Bayazit, Axel Marmet, Syrielle Montariol, Mary-Anne Hartley, Martin Jaggi, and Antoine Bosselut, Meditron-70b; Scal- ing medical pretraining for large language models, 2023.
2311. 1609
Cohere. Germanwiki dataset. URL httpp://wwgggnggfccccc//ttttts/s
wiki Mikipedia--o 22- 12-de-e-eeee eedeedd ngs
Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv preprint arXiv:2507.06261, 2025.
Haonan Duan, Adam Dziedzic, Nicolas Papernot, and Franziska Boenisch. Flocks of stochastic parrots: Differentially private prompt learning for large language models. In Thirty-seventh Conference on Neural Information Processing Systems (NeurIPS), 2023a.
Haonan Duan, Adam Dziedzic, Mohammad Yaghini, Nicolas Paperno, and Franziska Boenisch. On the privacy risk of in-context learning. In The 61st Anmual Meeting Of The Association For Computational Linguistics, 2023b.
Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hamnaneh Hajishirzi. Do membership inference attacks work on large language models? In First Conference on Language Modeling, 2024. URL https:://ppenreet ew net /fott//ooore forumm d=av0D1 9pSkU
Cynthia Dwork. Differential privacy. In Automata, Languages and Programming: 33rd International Colloquium, ICALP 2006, Venice, Italy, July 10-14 10-14, 2006, Proceedings, Part 11 33, pp. 1-12. Springer, 2006.
Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3 (33-4):21-4400 2014.
Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, Shawn Presser, and Connor Leahy. The Pile: An 800gb dataset of diverse text for language modeling. arXiv preprint arXiv:2101.0000 2020.
Bogdan Gliwa, Iwona Mochol, Maciej Biesek, and Aleksander Wawer. SAMSum corpus: A human- annotated dialogue dataset for abstractive summarization. In Proceedings of the 2nd Workshop on New Frontiers in Summarization, pp. 70-79, Hong Kong, China, November 2019, Association for Computational Lin Linguistics. doi: 10. 108853//1/D11--360 URL URL.ttps::// www www.wb............ org/
antheeogy/D1195400
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, Arun Rao, Aston Zhang, Aurelien Rodriguez, Austen Gregerson, Ava Spataru, Baptiste Roziere, Bethany Biron, Binh Tang, Bobbie Chern, Charlotte Caucheteux, Chaya Nayak, Chloe Bi, Chris Marra, Chris McConnell, Christian Keller, Christophe Touret, Chunyang Wu, Corinne Wong, Cristian Canton Ferrer, Cyrus Nikolaidis, Damien Allonsius, Daniel Song, Danielle Pintz, Danny Livshits, Danny Wyatt, David Esiobu, Dhruv Choudhary, Dhruv Mahajan, Diego Garcia-Olano, Diego Perino, Dieuwke Hupkes, Egor Lakomkin, Ehab AlBadawy, Elina Lobanova, Emily Dinan, Eric Michael Smith, Filip Radenovic, Francisco Guzmán, Frank Zhang, Gabriel Synnaeve, Gabrielle Lee, Georgia Lewis Anderson, Govind Thattai, Graeme Nail, Gregoire Mialon, Guan Pang, Guillem Cucurell, Hailey Nguyen, Hannah Korevaar, Hu Xu, Hugo Touvron, lliyan Zaroy, Imanol Arrieta Ibarra, Isabel Kloumann, Ishan Misra, Ivan Eytimov, Jack Zhang, Jade Copet,
12

---

Published as a conference paper at ICLR 2026
Jaewon Lee, Jan Geffert, Jana Vranes, Jason Park, Jay Mahadeokar, Jeet Shah, Jelmer van der Linde, Jennifer Billock, Jenny Hong, Jenya Lee. Jeremy Fu, Jianfeng Chi, Jianyu Huang, Jiawen Liu, Jie Wang, Jiecao Yu, Joanna Bitton, Joe Spisak, Jongsoo Park, Joseph Rocca, Joshua Johnstun, Joshua Saxe, Junteng Jia, Kalyan Vasuden Alwala, Karthik Prasad, Kartikeya Upasani, Kate Plawiak, Ke Li, Kenneth Heafield Kevin Stone, Khalid El-Arini, Krithika Iyer, Kshitiz Malik, Kuenley Chiu, Kunal Bhalla, Kushal Lakhotia, Lauren Bantala-Yeary, Laurens van der Maaten, Lawrence Chen, Liang Tan, Liz Jenkins, Louis Martin, Lovish Madaan, Lubo Malo, Lukas Blecher, Lukas Landzaat, Luke de Oliveira. Madeline Muzzi, Mahesh Pasupuleti, Mannat Singh, Manohar Paluri, Marcin Kardas, Maria Tsimpoukelli, Mathew Oldham, Mathieu Rita, Maya Pavlova, Melanie Kambadur, Mike Lewis. Min Si, Mitesh Kumar Singh, Mona Hassan, Naman Goyal, Narjes Torabi, Nikolay Bashlykov, Nikolay Bogoychev, Niladri Chatterji, Ning Zhang. Olivier Duchenne, Onur Çelebi, Patrick Alrassy, Pengchuan Zhang. Pengwei Li, Petar Vasic, Peter Weng, Prajjwal Bhargava, Pratik Dubal, Praveen Krishman, Punit Singh Koura, Puxin Xu, Qing Hc, Qingxiao Dong, Ragavan Srinivasan, Raj Ganapathy, Ramon Calderer, Ricardo Silveira Cabral, Robert Stojnic, Roberta Raileanu, Rohan Maheswari, Rohit Girdhar, Rohit Patel, Romain Sauvestre, Ronnie Polidoro, Roshan Sumbaly, Ross Taylor, Ruan Silva, Rui Hou, Rui Wang. Saghar Hosseini, Sahana Chennabasappa, Sanjay Singh, Sean Bell, Seohyun Sonia Kim, Sergey Edunov, Shaoliang Nie, Sharan Narang, Sharath Raparthy, Sheng Shen, Shengye Wan, Shruti Bhosale, Shun Zhang. Simon Vandenhende, Soumya Batra, Spencer Whitman, Sten Sootla, Stephane Collot, Suchin Gururangan, Sydney Borodinsky, Tamar Herman, Tara Fowler, Tarek Sheasha, Thomas Georgiou. Thomas Scialom, Tobias Speckbacher, Todor Mihaylov, Tong Xiao, Ujjwal Karn, Vedanuj Goswami, Vibhor Gupta, Vignesh Ramanathan, Viktor Kerkez, Vincent Gonguet, Virginie Do. Vish Vogeti, Vítor Albiero, Vladan Petrovic, Weiwei Chu, Wenhan Xiong, Wenyin Fu, Whitney Meers, Xavier Martinet, Xiaodong Wang, Xiaofang Wang, Xiaoqing Ellen Tan, Xide Xia, Xinfeng Xie, Xuchao Jia. Xuewei Wang, Yaelle Goldschlag, Yashesh Gaur, Yasmine Babaei, Yi Wen, Yiwen Song, Yuchen Zhang, Yue Li, Yuning Mao. Zacharie Delpierre Coudert, Zheng Yan, Zhengxing Chen, Zoe Papakipos, Aaditya Singh, Aayushi Srivastava, Abha Jain, Adam Kelsey, Adam Shajnfeld, Adithya Gangidi, Adolfo Victoria, Abuva Goldstand, Ajay Menon, Ajay Sharma, Alex Boesenberg, Alexei Baevski, Allie Feinstein, Amanda Kallet, Amit Sangani, Amos Teo, Anam Yunus, Andrei Lupu, Andres A Alvarado, Andrew Caples, Andrew Gu, Andrew Ho, Andrew Poulton, Andrew Ryan, Ankit Ramchandani, Annie Dong, Annie Franco, Anuj Goyal, Aparajita Saraf, Arkabandhu Chowdhury, Ashley Gabriel, Ashwin Bharambe, Assaf Eisenman, Azadeh Yazdan, Beau James, Ben Maurer, Benjamin Leonhardi, Bernie Huang, Beth Loyd, Beto De Paola, Bhargavi Paranjape, Bing Liu, Bo Wu, Boyu Ni, Braden Hancock, Bram Wasti, Brandon Spence, Brani Stojkovic, Brian Gamido, Britt Montalvo, Carl Parker, Carly Burton, Catalina Mejia, Ce Liu, Changhan Wang, Changkyu Kim, Chao Zhou, Chester Hu, Ching-Hssanng Chu, Chris Cai,, Chris Tindal, Christoph Feichtenhofer, Cynthia Gao, Damon Civin, Dana Beaty, Daniel Kreymer, Daniel Li, David Adkins, David Xu, Davide Testuggine, Delia David, Devi Parikh, Diana Liskovich, Didem Foss, Dingkang Wang. Duc Le, Dustin Holland, Edward Dowling, Eissa Jamil, Elaine Montgomery. Elconora Presani, Emily Hahn, Emily Wood, Eric-Tuan Le, Erik Brinkman, Esteban Arcaute, Evan Dunbar, Evan Smothers, Fei Sun, Felix Kreuk, Feng Tian, Filippos Kokkinos, Firat Ozgenel, Francesco Caggioni, Frank Kanayet, Frank Seide, Gabriela Medina Florez, Gabriella Schwarz. Gada Badeer, Georgia Swee, Gil Halper, Grant Herman, Grigory Sizov, Guangyi, Zhang, Guna Lakshminarayanan, Hakan Inan, Hamid Shojanazeri, Han Zou. Hannah Wang. Hanwen Zha, Haroun Habeeb, Harrison Rudolph, Helen Suk. Henry Aspegren, Hunter Goldman, Hongyuan Zhan, Ibrahim Damlaj, Igor Molybog, Igor Tufanov, Ilias Leontiadis, Irina-Elena Veliche, Itai Gat, Jake Weissman, James Geboski, James Kohli, Janice Lam, Japhet Asher, Jean- Baptiste Gaya, Jeff Marcus, Jeff Tang. Jennifer Chan, Jenny Zhen, Jeremy Reizenstein, Jeremy Teboul, Jessica Zhong, Jian Jin, Jingyi Yang, Joe Cummings, Jon Carvill, Jon Shepard, Jonathan McPhie, Jonathan Torres Josh Ginsburg, Junjie Wang, Kai Wu, Kam Hou U, Karan Saxena, Kartikay Khandelwal, Katayoun Zand, Kathy Matosich, Kaushik Veeraraghavan, Kelly Michelena, Keqian Li, Kiran Jagadeesh, Kun Huang, Kunal Chawla, Kyle Huang, Lailin Chen, Lakshya Garg, Lavender A, Leandro Silva, Lee Bell, Lei Zhang, Liangpeng Guo, Licheng Yu, Liron Moshkovich, Luca Wehrstedt, Madian Khabsa, Manav Avalani, Manish Bhatt, Martynas Mankus, Matan Hasson, Matthew Lennie, Matthias Reso, Maxim Groshev, Maxim Naumov, Maya Lathi, Meghan Keneally, Miao Liu, Michael I.. Seltzer, Michal Valko, Michelle Restrepo, Mihir Patel, Mik Vyatskov, Mikayel Samvelyan, Mike Clark, Mike Macey, Mike Wang, Miquel Jubert Hermoso, Mo Metanat, Mohammad Rastegari, Munish Bansal, Nandhini Santhanam, Natascha Parks, Natasha White, Navyata Bawa, Nayan Singhal, Nick Egebo. Nicolas Usunier, Nikhil Mehta, Nikolay Pavlovich Laptev, Ning Dong, Norman Cheng, Oleg Chernoguz, Olivia
13

---

Published as a conference paper at ICLR 2026
Hart, Omkar Salpekar, Ozlem Kalinli, Parkin Kent, Parth Parekh, Paul Saab, Pavan Balaji. Pedro Rittner, Philip Bontrager, Pierre Roux, Piotr Dollar, Polina Zvyagina, Prashant Ratanchandani, Pritish Yuvraj. Qian Liang, Rachad Alao, Rachel Rodriguez, Rafi Ayub, Raghotham Murthy, Raghu Nayani, Rahul Mitra, Rangaprabhu Parthasarathy, Raymond Li, Rebekkah Hogan, Robin Battey, Rocky Wang. Russ Howes, Ruty Rinott, Sachin Mehta, Sachin Siby, Sai Jayesh Bondu, Samyak Datta, Sara Chugh, Sara Hunt, Sargun Dhillon, Sasha Sidorov, Satadru Pan, Saurabh Mahajan, Saurabh Verma, Seiji Yamamoto. Sharadh Ramaswamy, Shaun Lindsay, Shaun Lindsay, Sheng Feng, Shenghao Lin, Shengxin Cindy Zha, Shishir Patil, Shiva Shankar, Shuqiang Zhang, Shuqiang Zhang. Sinong Wang. Sneha Agarwal, Soji Sajuyigbe, Soumith Chintala, Stephanie Max, Stephen Chen, Steve Kehoe, Steve Satterfield, Sudarshan Govindaprasad, Sumit Gupta, Summer Deng, Sungmin Cho, Sunny Virk, Suraj Subramanian, Sy Choudhury, Sydney Goldman, Tal Remez, Tamar Glaser, Tamara Best, Thilo Koehler, Thomas Robinson, Tianhe Li, Tianjun Zhang. Tim Matthews, Timothy Chou, Tzook Shaked, Varun Vontimitta, Victoria Ajayi, Victoria Montanez, Vijai Mohan, Vinay Satish Kumar, Vishal Mangla, Vlad Ionescu, Vlad Poenaru, Vlad Tiberiu Mihailescu, Vladimir Ivanov, Wei Li, Wenchen Wang, Wenwen Jiang, Wes Bouaziz, Will Constable, Xiaocheng Tang, Xiaojian Wu, Xiaolan Wang, Xilun Wu, Xinbo Gao, Yaniv Kleinman, Yanjun Chen, Ye Hu, Ye Jia, Ye Qi, Yenda Li, Yilin Zhang, Ying Zhang, Yossi Adi, Youngjin Nam, Yu, Wang, Yu Zhao, Yuchen Hao, Yundi Qian, Yunlu Li, Yuzi He, Zach Rait, Zachary Vito, Zef Rosnbrick, Zhaoduo Wen, Zhenyu Yang, Zhieii Zhao, and Zhiyu Ma. The llama herd of models, 2024. URL Bttphttps:// arxiv. org/ abs 407 0..4007.1777 21783
Dirk Groeneveld, Iz Beltagy, Evan Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, Ananya Jha, Hamish Ivison, Ian Magnusson, Yizhong Wang, al. Olmo: Accelerating the science of language models. In Proceedings of the 62nd Anmual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). pp. 15789-15809, 2024a.
Dirk Groeneveld, Iz Beltagy, Pete Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, Ananya Harsh Jha, Hamish Ivison, Ian Magnusson, Yizhong Wang. Shane Arora, David Atkinson, Russell Authur, Khyathi Chandu, Arman Cohan, Jennifer Dumas, Yanai Elazar, Yuling Gu, Jack Hessel, Tushar Khot, William Merrill, Jacob Morrison, Niklas Muennighoff, Aakanksha Naik, Crystal Nam, Matthew E. Peters, Valentina Pyatkin, Abhilasha Ravichander, Dustin Schwenk, Saurabh Shah, Will Smith, Nishant Subramani, Mitchell Wortsman, Pradeep Dasigi, Nathan Lambert, Kyle Richardson, Jesse Dodge, Kyle Lo, Luca Soldaini, Noah A. Smith, and Hannaneh Hajishirzi. Olmo: Accelerating the science of language models. Preprint, 2024b.
Vincent Hanke, Tom Blanchard, Franziska Boenisch, Iyiola Emmanuel Olatunji, Michael Backes, and Adam Dziedzic, Open LLMs are necessary for private adaptations and outperform their closed alternatives. In Thirty-eighth Conference Neural Information Processing Systems (NeurIPS), 2024.
Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. International Conference on Learning Representations, 2022. UR..tttpr / ew. new. forum? id=nZeVKeeFFfF)
Matthew Jagielski. A note on interpreting canary exposure. arXiv preprint arXiv:2306.00113,, 2023.
Bargav Jayaraman, Lingxiao Wang, Katherine Knipmeyer, Quanquan Gu, and David Evans. Re- visiting membership inference under realistic assumptions. arXiv preprint 10888, 2020.
Bryan Klimt and Yiming Yang. The enron corpus: A new dataset for email classificattion research. In European Conference on Machine Learning, 2004. URLhttps::/ sewanticscho
Excp/CoxpusDD:2650350
Yanis Labrak, Adrien Bazoge, Emmanuel Morin, Pierre-Antoine Gourraud, Mickael Rouvier, and Richard Dufour. Biomistral: A collection of open-source pretrained large language models for medical domains. arXiv preprint arXiv:2402.10377 2024.
Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficiee prompt tuning. In Proceedings of the 202/ Conference on Empirical Methods in Natural Language
14

---

Published as a conference paper at ICLR 2026
Processing, November 2021. URL htt////tts////alaatooooooooo///o
243
Haoran Li, Dadi Guo, Donghao Li, Wei Fan, Qi Hu, Xin Liu, Chunkit Chan, Duanyi Yao, Yuan Yao, and Yangqiu Song. PrivLM- A multi-level privacy evaluation benchmark for language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 54-73, Bangkok, Thailand, August 2024a. Association for Computational Linguisties. doi: 10. 18653/1/2004.ac--logg.... URL https: /atps::/aclaantholl.o.
Qinbin Li, Junyuan Hong, Chulin Xie, Jeffrey Tan, Rachel Xin, Junyi Hou, Xavier Yin, Zhun Wang, Dan Hendrycks, Zhangyang Wang. Bo Li, Bingsheng He, and Dawn Song. Lim-pbe: Assessing data privacy in large language models, 2024b. URL httthhht///axxx
org/ 2408 12787
Xiang Lisa Li and Percy Liang, Prefix-tuning: Optimizing continuous prompts for generation. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli (eds.), Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Pupers), pp. 4582-4597, Online, August 2021. Association for Computational Linguistics. doi: 10. 10.18853/v112022 aaclooog....1-- URL hhtttss//accaaatt http://aaaaaalllooooo/ wrg.y.org//22. aal- 353
Xuechen Li. Florian Tramer, Percy Liang. and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In International Conference on Learning Representations. 2022. /ttttts://opeereeeeeee wwwp:/ewwwwwww..eeeeeooeeeeeeeee wtt.://ooooommmmmommurre
Xiao Liu, Kaixuan Ji, Yicheng Fu, Weng Lam Tam, Zhengxiao Du, Zhilin Yang, and Jie Tang. P-mning v2: Prompt tuning can be comparable to fine-tuning universally across scales and tasks. arXiv preprint arXhv:2110.07600 2021.
Xiao Liu, Kaixuan Ji, Yicheng Fu, Weng Tam, Zhengxiao Du, Zhilin Yang, and Jie Tang. P-tuning: Prompt tuning can be comparable to fine-tuning across scales and tasks. In Proceedings of the 60th Anmual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pp. 61-68, Dublin, Ireland, May 2022, Association for Computational Linguistics. doi: 18.53v3//v1/ 2022.ac1-short.. URL https: http://ccaaathooooooo org.2022 short..
Saeed Mahloujifar, Luca Melis, and Kamalika Chaudhuri. Auditing f-differential privacy in one run. In secood International Conference on Machine Learning. 2025.
Harsh Mehta, Walid Krichene, Abhradeep Guha Thakurta, Alexey Kurakin, and Ashok Cutkosky. Differentially private image classification from features. Transactions on Machine Learning Rexearch, 2023.
Team OLMo, Pete Walsh, Luca Soldaini, Dirk Groeneveld, Kyle Lo, Shane Arora, Akshita Bhagia, Yuling Gu, Shengyi Huang, Matt Jordan, Nathan Lambert, Dustin Schwenk, Oyvind Tafjord, Taira Anderson, David Atkinson, Faeze Brahman, Christopher Clark. Pradcep Dasigi, Nouha Dziri, Michal Guerquin, Hamish Ivison, Pang Wei Koh, Jiacheng Liu, Saumya Malik, William Merrill, Lester James V. Miranda, Jacob Morrison, Tyler Murray, Crystal Nam, Valentina Pyatkin, Aman Rangapur, Michael Schmitz, Sam Skjonsberg, David Wadden, Christopher Wilhelm, Michael Wilson, Luke Zeulemoyer, Ali Farhadi, Noah A. Smith, and Hannanch Hajishirzi. 2 olmo 2 furious. 2024. URL htRp: arxiv orq/ abs/ /000/5511111 00656
OpenAI. Gpt-4 technical report, 2023.
Ashwinee Panda, Xinyu Tang, Milad Nasr, Christopher A. Choquette-Chor and Prateek Mittal. Privacy auditing large language models. ICML 2024 Next Generation of Al Safety Workshop, 2024.
Nicolas Papernot, Martín Abadi, Úlfar Erlingsson, Ian J. Goodfellow, and Kunal Talwar. Semi- supervised knowledge transfer for deep learning from private training data. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Confer- ence Track Proceedings, 2017.
15

---

Published as a conference paper at ICLR 2026
Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Úlfar Erlingsson. Scalable private learning with PATE. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings, 2018
Martin Pawelezyk, Himabindu Lakkaraju, and Seth Neel. On the privacy risks of algorithmic recourse. In International Conference on Artificial Intelligence and Statistics, pp. 9680-9696. PMLR, 2023.
Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang. Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang. Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang. Le Yu, Mei Li, Mingfeng Xue, Pei Zhang, Qin Zhu, Rui Men, Runji Lin, Tianhao Li, Tianyi Tang, Tingyu Xia, Xingzhang Ren, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang. Yu Wan, Yuqiong Liu, Zeyu Cui, Zhenru Zhang, and Zihan Qiu. Qwen2.5 technical report, 2025. URL https:// /ttp:///axivv.// org. abs 2412.4122.. 15115
Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. 2019.
Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese nert-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, 11 2019. htRthtt:://// http://axxvvv.r.ggo
908
10084
Lorenzo Rossi, Michael Aemi, Jie Zhang, and Florian Tramèr. Membership inference attacks on sequence models. In 2025 IEEE Security and Privacy Workshops (SPW). pp. 98-110. IEEE, 2025a.
Lorenzo Rossi, Bartlomiej Marek, Franziska Boenisch, and Adam Dziedzic. Privacy auditing for large language models with natural identifiers. In ICLR 2025 Workshop on Navigating and Addressing Data Problems for Foundation Models, 2025b. URL htttps::/openzeview. net/ forum?
Idd=wdclVfoth
Avital Shafran, Shmuel Peleg, and Yedid Hoshen. Membership inference attacks are casier on difficult problems. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 14820-14829, October 2021.
Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. In The Twelfth International Conference Learning Representations, 2024a. URL
net/forue ftte/forum?idd 2 3MQuNs
Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models, 2024b. URL
aittss:/aarxe
wttpg//b////....oo///ooo/ 16789
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
Thomas Steinke, Milad Nasr, and Matthew Jagielski. Privacy auditing with one (1) training run. In Thirty-seventh Conference Neural Information Processing Systems, 2023. URL https
//openreview.o net. ffoo:/ommmmmm pppenveiieew.ee//fooorod1/2231.
Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, Johan Ferret, Peter Liu, Pouya Tafti, Abe Friesen, Michelle Casbon, Sabela Ramos, Ravin Kumar, Charline Le Lan, Sammy Jerome, Anton Tsitsulin, Nino Vieillard, Piotr Stanczyk. Sertan Girgin, Nikola Momchev, Matt Hoffman, Shantanu Thakoor, Jean-Bastien Grill, Behnam Neyshabur, Olivier Bachem, Alanna Walton, Aliaksei Severyn, Alicia Parrish, Aliya Ahmad, Allen Hutchison, Alvin Abdagic. Amanda Carl, Amy Shen, Andy Brock, Andy Coenen, Anthony Laforge, Antonia Paterson, Ben Bastian, Bilal Piot, Bo Wu, Brandon Royal, Charlie Chen, Chintu Kumar, Chris Perry, Chris Welty, Christopher A. Choquette- Danila Sinopalnikov, David Weinberger,
16

---

Published as a conference paper at ICLR 2026
Dimple Vijaykumar, Dominika Rogozińiska, Dustin Herbison, Elisa Bandy, Emma Wang, Eric Noland, Erica Moreira, Evan Senter, Evgenii Eltyshev, Francesco Visin, Gabriel Rasskin, Gary Wei, Glenn Cameron, Gus Martins, Hadi Hashemi, Hanna Slimezak-Plucinsker Harleen Batra, Harsh Dhand, Ivan Nardini, Jacinda Mein, Jack Zhou, James Svensson, Jeff Stanway, Jetha Chan, Jin Peng Zhou, Joana Carrasqueira, Joana Iljazi, Jocelyn Becker, Joe Fernande7, Joost van Amersfoort, Josh Gordon, Josh Lipschultz, Josh Newlan, Ju yeong Ji, Kareem Mohamed, Kartikeya Badola, Kat Black, Katie Millican, Keelin McDonell, Kelvin Nguyen, Kiranbir Sodhia, Kish Greene, Lars Lowe Sjoesund, Lauren Usui, Laurent Sifre. Lena Heuermann, Leticia Lago, Lilly McNealus, Livio Baldini Soares, Logan Kilpatrick, Lucas Dixon, Luciano Martins, Machel Reid, Manvinder Singh, Mark Iverson, Martin Görner, Mat Velloso, Mateo Wirth, Matt Davidow, Matt Miller, Matthew Rahtz, Matthew Watson, Meg Risdal, Mehran Kazemi, Michael Moynihan, Ming Zhang, Minsuk Kahng, Minwoo Park, Mofi Rahman, Mohit Khatwani, Natalie Dao. Nenshad Bardoliwalla. Nesh Devanathan, Neta Dumai, Nilay Chauhan, Oscar Wahltinez, Pankil Botarda, Parker Barnes, Paul Barham, Paul Michel, Pengchong Jin, Petko Georgiev, Phil Culliton, Pradeep Kuppala, Ramona Comanescu, Ramona Merhej, Reena Jana, Reza Ardeshir Rokni, Rishabh Agarwal, Ryan Mullins, Samaneh Saadat, Sara Mc Carthy, Sarah Cogan, Sarah Perrin, Sébastien M. R. Arnold, Sebastian Krause, Shengyang Dai. Shruti Garg. Shruti Sheth, Sue Ronstrom, Susan Chan, Timothy Jordan, Ting Yu, Tom Eccles, Tom Hennigan, Tomas Kocisky, Tulsee Doshi, Vihan Jain, Vikas Yadav, Vilobh Meshram, Vishal Dharmadhikari, Warren Barkley, Wei Wei, Wenming Ye, Woohyun Han, Woosuk Kwon, Xiang Xu, Zhe Shen, Zhitao Gong. Zichuan Wei, Victor Cotruta, Phoebe Kirk. Anand Rao, Minh Giang, Ludovic Peran, Tris Warkentin, Eli Collins, Joelle Barral, Zoubin Ghahramani, Raia Hadsell, D. Sculley, Jeanine Banks, Anea Dragan, Slav Petrov, Oriol Vinyals, Jeff Dean, Demis Hassabis, Koray Kavukcuoglu, Clement Farabet, Elena Buchatskaya, Sebastian Borgeaud, Noah Fiedel, Armand Joulin, Kathleen Kenealy, Robert Dadashi, and Alek Andreev. Gemma 2: Improving open language models at a practical size, 2024. URL https: http:///xxxxvv../..aa.. org/ httpg//b//22400 2408 00118
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13977 2023.
Florian Tramèr, Reza Shokri, Ayrton San Joaquin, Hoang Le, Matthew Jagielski, Sanghyun Hong. and Nicholas Carlini. Truth serum: Poisoning machine learning models to reveal their secrets. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp. 1779-2792, 2022.
Florian Tramer, Gautam Kamath, and Nicholas Carlini. Position: Considerations for differentially private learning with large-scale public pretraining. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (eds.), Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pp. 48453 48467. PMLR, 21-27 Jul 2024. URL mlr. www.s/resss.... 2tttess/233//tramee2222 html
Dave Van Veen, Cara Van Uden, Louis Blankemeier, Jean-Benoi Delbrouck, Asad Aali, Christian Bluethgen, Anuj Pareek, Malgorzata Polacin, Eduardo Pontes Reis, Anna Seehofnerová, et al. Adapted large language models can outperform medical experts in clinical text summarization. Nature medicine, 30(4):1134-1)
2024.
Cédric Villani. Optimal transport: old and new, volume 338. Springer Science & Business Media, 2009.
Lauren Watson, Chuan Guo, Graham Cormode, and Alexandre Sablayrolles. On the importance of difficulty calibration in membership inference attacks. In International Conference on Learning Representations, 2022. htttts://
Tong Wu, Ashwinee Panda, Jiachen T. Wang, and Prateek Mittal. Privacy-preserving in-context learning for large language models. In The Twelfth International Conference on Learning Repre- sentations, 2024. URL URL httlhttp/////
net/ htt////ouummdddddmmm XPPJ11EEV
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF). pp. 288- IEFF, 2018.
17

---

Published as a conference paper at ICLR 2026
Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie- Yan Liu. Large scale private learning via low-rank reparametrization. Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 122088 PMLR, 18-24 Jul 2021. URL hRRLhttts////poceeeeet ngs. mlr (eess/v139/y22111 hhmml
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang Differentially private fine-tuning of language models. In International Conference on Learning Representations, 2022. URL https::::: //tptppee///ppeneeeeeee.e..
Sujjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-cost high- powerr membership inference attacks, 2024. URL http::
Xin Zhou, Martin Weyssow, Ratnadira Widyasari, Ting Zhang, Junda He, Yunbo Lyu, Jianming Chang, Beiqi Zhang, Dan Huang, and David Lo. Lessleak-bench: A first investigation of data leakage in llms across 83 software engineering benchmarks. arXiv preprint arXiv:2502.06215, 2025.
Derui Zhu, Dingfan Chen, Xiongfei Wu, Jiahui Geng, Zhuo Li, Jens Grossklags, and Lei Ma. Privauditor: Benchmarking data protection vulnerabilities in Ilm adaptation techniques. In Advances in Neural Information Processing Systems, volume 37, 2024. URL https///ppceuuuss..eerrrrceeaeep fiwes/
httpp///eppppeeeeae/////ee//e//e /024///r222///1eee 12b1 oraa::/cccccaaa.ee554445aaeeeeer and Benchma a rks
Track.pdff
18

---

Published as a conference paper at ICLR 2026
A BACKGROUND
A.1 PRIVATE LLM ADAPTATIONS
Differentially Private Stochastic Gradient Descent (DP-SGD) (Abadi et al. 2016) is a widely used method for incorporating DP into deep learning. However, while applied to NLP tasks, DP-SGD can exhibit several limitations, particularly in model utility, increased memory usage, or slower convergence during training. These limitations motivate the exploration of alternative DP adaptation techniques.
Full DP Fine- Tumeng.unng. One approach to differentially private (DP) adaptation is to fine-tune the entire model using the DP-SGD algorithm (Abadi al. 2016 Li et al. 2022] Yu al. 2022). This method updates all model parameters while ensuring that each gradient step satisfies DP guarantees through gradient clipping and noise addition. Full-model DP fine-tuning provides high adaptability and task-specific performance. However, it is computationally expensive and memory-intensive. especially for large language models (LLMs), due to the need to compute, clip, and perturb gradients for all layers (Li et al. 2022).
DP Head Fine-Tuning. An alternative strategy is to fine-tune only the final layer (often called the classification or task-specific "head") of the model using DP-SGD. This significantly reduces the number of trainable parameters, leading to lower memory usage and faster training. Despite its simplicity, DP Head Fine- Fine-Tuning can still achieve competitive performance on certain tasks while providing formal privacy guarantees. However, its adaptability limited, particularly when deeper model layers need task adjustments.
DP low-rank adaptation (LoRA). LoRA (Hu et al. 2022) is an efficient technique for adapting
LLMs that introduces low-rank matrices into each layer of frozen pretrained model. Instead of updating the full weight matrix W e Rddi LoRA learns low-rank approximation A
AB, where E Rdxr, B E Rixk and r < min(d. d,, k). The adapted weights become W" = W + AA, with only A and B being trainable. DP LoRA (Yu et al. (021) extends this approach by applying DP-SGD to the low-rank parameters. This ensures that the adaptation remains sivecc-preeseving. making LoRA suitable for sensitive-data applications with formal DP guarantees.
DP Prompting. Introducing small set of additional parameters, typically under 1% of the LLM's total parameters, DP Prompting applies these only within the model's 's input space. These parameters may be added the level of token embeddings (soft prompts (Liu et al. 202 2022 or to all
(attention) layers of the LLM (prefix-tuning (Lester et al. 202 Li & Liang] (021 Duan et al.
(2023a) proposed PromptDPSGD, which adapts the DP-SGD algorithm (Abadi al. 2016 for use with soft prompts.
A.2 MIAS
The following section provides more detailed description of MIAs used in our benchmark.
Min-K %. Min-K% (Shi et al., 2024a) is a recently proposed black-box MIA for large language models. The intuition is that unseen sample is likely have low-probability tokens. The MIA score is defined as
Min (x =
S
FIES
where S is the set of K% tokens with the smallest loss.
Reference. This approach (Carlini al. 2021) reference model to calibrate the MI score as follows
L(x(0)
Ref(#)
L(x)0
where [xx(f) indicates the loss of the target sample x on the model é. 8 represents the reference model used.
19

---

Published as a conference paper at ICLR 2026
Robust Membership inference attack (RMIA), RMIA outperforms previous methods by optimizing the null hypothesis and using a reference model along with population data, requiring only one reference (shadow) model a time, unlike previous methods (Carlini et al. 2022] Rossi al. 2025a Pawelczyk et al., 2023) which required hundreds. RMIA has two hyperparameters, a threshold 7 and scaling factor a. The adapted RMIA score (Equation (5)) calculation for LLMs for text generation is based on comparing loss values rather than output probabilities. For this reason, we have to, instead of comparing prediction probabilities or logits, compare the loss of the target data point against the loss of reference models on population data (Equation (6) and flip to minority voting approach, where the decision is based on how much lower the loss of the target data compared to the population data.
ScoreMIA Pr (LRo(I,22) 2 2)
(5)
LRo(2,2) [(0|z)) L(0lz)
(6)
A.3 CANARY EXPOSURE AND DATA EXTRACTION ATTACKS
Following Carlini et al. )019);; Tramer et al. (2022), let U be the universe of candidate samples and let 2 be the attacker's is ranking of u by model-assignes likelihood. For target 2 E U,
exposure 2, 2) loga [2/] log, (rank(2;;;)) 2))
This metric ranges from 0 (least likely) to loga [24] (most likely). To compute it efficiently when (4] large, one can use: (1) sampling, which estimates exposure on random subset of U1 or (2) distri- bution modeling, which approximates the distribution of model scores (e.g. via skewed normal) to interpolate ranks. The expected exposure of an unmemorized canary In2 Rs 1.44 (Jagielski 2023). Complementing exposure- sssseure-based metrics, Carlini et al. (202aa) introduce contextual extraction framework to assess memorization and data extraction attacks. Let f be a generative model and a secret suffix. We say is extractable with i tokens of context if there exists prefix p of length such that, under greedy decoding,
f(p) [p s].
When s is long and random, its successful extraction indicates memorization. One can vary k to characterize how much context the model needs before regurgitating s verbatim.
B ADDITIONAL. DETAILS ON THE SETUP
B. DATASETS
For the IID datasets, we focus on the following Pile subsets: Bookcorpus2, consisting of publicly avail- able books, GitHub, a set of open-source code repositories, and Enron Emails (Klimt & Yang 2004). collection of various emails. The OOD datasets we choose for our experiments are: SAMSum (Gliaa dialogue summarization dataset, and German Wiki (Cohere), a
ctt al. 2019), an large set of German Wikipedia entries. These OOD datasets were selected because of their different degrees of variation from the original distribution of the Pile dataset. Although SAMSum shares the same language (English), its general dialogue format, followed by the dialogue summary, is not present in the pretraining set. German Wiki, on the other hand, presents wide syntactic and lexical variation from the pretraining dataset.
B.2 ADAPTATIONS
We focus on four types of adaptations: Prefix Tuning, LoRA, Full Fine-Tune, and Head Fine-Tune. We train all the models using Adam with the privatization gradient method of DP-SGD (Abadi et al.) 2016). For the Adam optimizer, we use the default HuggingFace hyperparameters except for the learning rate. For Prefix Tuning, we fix prefix length of 64, while for LoRA, a rank r = 8 and
16. For DP-SGD, following existing work (Li et al. 2022). set the gradient clipping value to 0.1. Moreover, in all settings, we consider sentence-level DP. meaning that we concatenate all strings in the dataset and split them into 256 token chunks, corresponding to sentence-level privacy.
20

---

Published as a conference paper at ICLR 2026
B.3 HYPERPARAMETERS
For each task, model, and privacy budget, we performed a hyperparameter optimization using random search strategy. Specifically, explored the following ranges:
Learning Rate: x 10 10-6.0..0000 x 10 1x 10 10 5 x 10 1081000
10 10
1 10
10 10-3:
Number of training epochs: 2, 5, 10, 15, 16, 20,30,00000 30,
Batch size: 4, 8, 16, 32, 64;
Our objective during hyperparameter search is to ensure comparable evaluation perplexities, specifi- cally targeting similar validation loss values after adaptation training across different methods for specific datasets.
B.4 MIA
The adopted offline mode (see Algorithm shrinks from the need retrain reference models per query, thus relying on pretrained LLMs, which are computationally expensive to train. For most experiments, we used just one reference model (A: = 1), thus demonstrating the power RMIA attack and highlighting data leakage, especially from pretrained data. For ablation on the RMIA hyperparameters choice, see Figure 14 in Section H
Algorithm MIA score calculation with offline RMIA (Zarizzadeh et al. (024) adapted to LLMs.
Input: k reference models θ, target sample x, threshold 7, scaling factor a, population dataset r, Output: SCOreMIa (z; 0)
1: Randomly choose subset Z from the population dataset
2: C+0
3: C(x)oUT f Coree ((x)0')
4: L(x) - (11 + (a)(()) (1 a))
5: Ratio, + L(x10)
L(x)
6: for each sample in Z do
7: [(=) + 1 Eoreo ((2(0')
8: Ratio, [(3)
[(a
9: if /Ratio//Raioo <y then
10: C+ +
11: end
12:
end for
13: return ScoreMIA (x; +- 2
B.5 CANARY EXPOSURE
We add adversarial prefix to p 1% of the adaptation data. If not specified otherwise, set the number of canary tokens to k = 10 and the canary prefix length / = 10. To measure exposure, we generate 256 new canary prefixes from the same canary type and prepend them the target sample whose exposure we want to measure. The resulting 256 samples can be considered as a form of non-members. On expectation, all canary prefixes are equally (un)likely. However, if the model is more confident about the one prefix it saw during adaptation than it is about the other 256 prefixes, it means that the model must have memorized this prefix and that it was part of the adaptation data. Given that there are two ways of approximating exposure (sampling and distribution modeling) as discussed in Section we assess both of them to find whether one approach is more suitable. This ablation in Figure 13 Section shows that the two approximations perform similarly when using 256 non-member canaries. In our experiments, we evaluated using sampling as an approximation since it computationally cheaper.
Canary Types. The random canary prefix the simplest type of canary prefix, and it composed of completely random tokens sampled uniformly from the token universe T. The common and
21

---

Published as a conference paper at ICLR 2026
prefixes comprise the most and least frequently occurring tokens, respectively, excluding special tokens e.g. padding and end-of-string tokens. We count the total number of token occurrences in the adaptation dataset to measure the frequencies. Then, choose the top & tokens from a list sorted in descending order for common tokens and ascending order for rare tokens. Note that, for both common and rare, each adaptation dataset naturally has its set of distinct prefix tokens. We also select the random tokens independently over each adaptation dataset for symmetry. The invisible canary prefix utilizes imperceptible Unicode symbols or space-like tokens, such zero-width spaces or werth non-joiners, which are nearly undetectable by humans, thus incorporating the design approach known from other adversarial attacks (Boucher et al.] 2021). Compared to the other canary types, the set of tokens is the same for each dataset. Again, we randomly sample &: imperceptible symbols to prepend as a canary prefix.
Canary Adaptation Set Generation. Algorithm 2 describes the procedure construct the adapta- tion dataset with canary prefixes. Note that (ancat(a.b) concatenates two strings, and the tokens universe T represents the of all tokens accepted by the LLM. We prepend the canaries to a small fraction p of the adaptation dataset prior to performing the adaptation. To each selected sample, we add tokens, randomly drawn with replacement from the respective k canaries the canary prefix sets. We do not combine tokens from our four different types of canary prefixes and consider each separately.
Algorithm 2 Adding canary prefixes to the adaptation dataset.
Input: adaptation dataset, canary prefix type, canary prefix length, number selected canaries, canary prefix probability, 7 token universe.
Output: D modified adaptation dataset
I: if "random" then
C <- Randomly sample tokens from
3: else i = "rare" then
4: C' + Select the k least frequent tokens from D
5: else if "common" then
C' Select the most firqueent tokens from D
7: clse = "invisible" then
8: C' + Randomly sample k invisible tokens from T
9: end if
10: Do. D. Randomly split D) in two datasets each
sample is with probability p Dr
11: Di ()
12: for each sample
Di do y + Sample with replacement tokens from C'
14: D1 + D, U (concat (y,
15: end for
16: return Do U 51
B.6 EXTRACTABLE MEMORIZATION
Another privacy concern shown in prior work (Carlini et al., 2023a) the memorization of samples during pretraining of an LLM. We analyze how adaptations can reduce the effect of memorizing pretraining data. The definition of a memorized sample follows k-extractability (Carlini et al. (202a)). Here, we have prompt of length & and a suffix If a model given prompt p generates exactly the sequence consisting of p and s concatenated is memorized.
We report the number of identified memorized samples for each Pile subset and Pythia 1B in Table 40 (Section G). Furthermore, we also rely on samples from the Pile reported as memorized in Pythia 2.8B by prior work (Chang al. 2024). This set of memorized samples consists of 505 sequences, and we refer to as Mem Pile.
B.7 COMPUTIONAL SETUP
We conduct most of our experiments on a single 40GB NVIDIA A100 GPU. However, for larger models, we utilized single NVIDIA A100 80GB Tensor Core GPU. The training time of the
22

---

Published as a conference paper at ICLR 2026
adaptations varies depending the applied adaptation method, the model size, the hyperparameters, and whether DP is applied.
C ADDITIONAL EXPERIMENTAL RESULTS
C.I MIAS
Table 4 and Table 5 present the MIA performance OOD and IID datasets for the Pythia 1B model.
We repeat these experiments with other models from the Pythia (Biderman et al. (2023 and GPT
Neo (Black al.
[021) families to broaden our study. Our findings include results for Pythia 1.4B
(Table Table 7). Pythia 410M (Table 8 Table 9), Pythia 160M (Table TO Table I1. Pythia 70M
(Table Table 13}. GPT-Neo 1.3B (Table 14 Table 15), and GPT-Neo T25M T6 17p
Our results indicate a privacy risk while adapting LLMs, and an attacker has advantages such as architectural knowledge, direct data access, and an exact understanding of the data split, thus allowing for powerful attack vector. LoRA and Prefix are consistently less vulnerable to MIA among most of the evaluated models and datasets than Full Fine- Tue-Tuning and Head-Fine- Fine-Tuning.
We also conduct additional experiments on OLMo 1B (Groeneveld et al. 2024a) and OLMo-2-0422 IB (OLMo et al., (204)). Since these models were trained on Dolma and Dolmino, respectively, and neither of them provides a validation set, our experiments are limited to overlap (using the known train data) and OOD scenarios using German Wiki (Cohere) and SAMSum (Gliwa et al. (019), which were not part of the training data. Our results presented in Table 18 Table show consistent trends with the ones we reported for the other models, especially when the adaptation data distribution is close the pretraining data. The privacy risks increase when the adaptation data is closer to the pretraining distribution.
Overall, we observe similar pattern between Pythia 1B and the other evaluated models. For instance, for Pythia 41 410M (Table 8 Table 9), looking at RMIA (shadow) using e = 8, we observe that the average AUC is 0.83, while for III it is 0.9. Similarly, for Pythia 160M (Table TO Table TT). the average AUC is 0.71 for OOD and 0.81 for IID data. These results follow our general trend that IID data taken from the pretraining validation set leaks just as much data that directly overlaps, thus suggesting distributional closeness as the determining factor of privacy risk. Occasionally, we observe an anomaly, like the AUC for SAMSum in Table being better under a privacy regime (E 8) than without privacy protection. This behavior is consequence of the fact that the loss is higher for the 8 = oc than for e = 8. We prioritize having similar loss values across different adaptations for the given dataset and privacy budget. However, in some cases, the span of hyperparameters is too large to ensure that we have a similar loss across different E values.
Going further, we also evaluate protection under varying privacy budgets, specifically {0.1, 0.5, 1, 3, 83. As illustrated in Figure 7 effective defense against privacy attacks, such as MIA, even for OOD data, requires tight privacy bound of 0.1 for all adaptation strategies evaluated.
C.2 EXPOSURE
Table 22 and Table 23 show the exposure performance of the four types of canary prefixes. With canary exposure, we do not use any shadow or reference models. Therefore, the results are often close to random guessing when using DP for LLM adaptations. However, the results for canary exposure are still much higher than for Mi, the closest MIA method executed with the same assumptions.
C.3 INFLUENCE OF SUBSET SIZE AND COMPLEXITY
We evaluate how subset characteristics, specifically size and complexity (as measured by the perplexity in Table 2 the original publication on the Pile (Gao et al. 2020)), affect privacy leakage. Specifically, for this experiment, we use train subsets and adapt Pythia IB privately with 8. As shown in Figure X, the analysis suggests that privacy leakage in datasets influenced both by dataset size and the inherent complexity diversity within the data. For instance, the largest subset with the CC dataset incurs the highest privacy leakage. likely due to its significant volume and potentially diverse content (with perplexity of around 0.7). The other large and complex subsets, like ArXiv (a
23

---

Published as a conference paper at ICLR 2026
Proffx Tuning
Full Fine tune Head Fine tine
Turing
FJll Fic tunc Head Fine tune
Profix Profix Tuning
Full Finc tune Head Fine tune
-10 LORA
*
LORA
-10 LORA
Bookcorpus2 Val
(b) Bookcorpus Train
(c) Github Val
1.2
2.-
3.0
01
3.0
01
24
-4- Prafix Tuning
Full Finestuee
-4- Prefi luning
Full Fine-ture
Prafi Juring
Full Finectune
(d) Enron Val
(c) SamSum
(f) German Wiki
Figure 7: Membership Inference for Adaptations over Various Privacy Regimes. We audit the adaptations on the same pretrained LLM. We present the AUC scores obtained with RMIA for the Pythia IB model adapted on different datasets with E E {0.1, 1,3,5, x.).
Table 4: Membership Inference for OOD Adaptations. We audit only the adaptations and assume the same pretrained L.LM is used for all adaptations. We present the AUC scores obtained with reference, and Min-K's K% MIAs for the Pythia IB model adapted on different datasets with E E {0.1, 8, o.).
GermanWali
Adaptation
0.1
Pictic
1700
0752
01:3
111
1151
[151
1.00
0355
17E2
LeRt
0.86
0.69
0.50
1.00
01.9
0.66
0.93
0.64
0.58
RMIA (shodow))
Fine-Tue
1.00
0.42
0.6
1.00
11:11
11.5
1,001
0.77
0.59
Heal Fis:-Tun
1.00
0.98
0.62
1,00
0.76
0.70
1.00
0.87
0.56
Aweagg
0.97
0.78
0.59
1.00
1167
0.61
0.98
0.75
0.61
Paanee liming
039
0.11
0.1
039
0107
6330
0.66
RMIA (Pythix
0.96
Heal Fire
0.97
0.97
0.51
0.92
(130
Poofit Turing
0.8
0.50
0.51
0.92
1150
0.50
0.92
0.50
0.50
LeitA
0.11
0.51
0.51
U382
11.53
11.51
0.66
0.51
0:51
Refesence (Pythia IB)
Full Fine Tune
0.94
0.51
0.51
0.99
0.51
0.50
0.96
0.51
0.51
Heal Fase Tune
0.97
0.52
0.51
0.95
0.51
0.50
0.97
0.51
0.50
Anrzaro
0.31
0.11
0091
631
0:11
Tuning
Min
Pull Fine Tune
0.8
0.86
Head Fine
038
0.89
0.50
Averaze
0.77
0.51
0.50
0.77
0.50
0.51
0.77
0.51
0.50
perplexity of around 0.77), also have high leakage levels. For ArXiv, compared Freelaw (which is similar in size but less diverse, with perplexity of around 0.6), ArXiv's diversity increases leakage, as more unique samples may need be memorized. Finally, much smaller and more structured subsets like Europarl (with a perplexity of 0.75) and Enron Emails (the smallest subset) exhibit the least leakage, likely due to limited diversity and lower complexity.
C.4 PER-EPOCH LOSS
We compare the development of AUC scores during training on IID and overlap data, as shown in Figure These results display the AUC score at each epoch during training. To better compare IIII and overlap data, we adjust the x-axis to represent the loss difference at each training step, calculated as the initial pretraining loss minus the adapted loss at the current training step. This calibration the x-axis allows us to compare the two dataset types more precisely. With this setup, we evaluate two subsets of the Pile pretraining set: GitHub and Bookcorpus2. First, the figures indicate that further adapting model on IID data does not significantly improve its performance loss decreasing by only a maximum of 0.015 (GitHub with Full Fine- Tune). However, the observed increase in AUC score throughout training shows that the model does learn from the adaptation data.
that data, with the
24

---

Published as a conference paper at ICLR 2026
Table Membership Inference for in-distribution (IID) Adaptations. We use the same setup as in Table
Beckearpuct
Arweage
MIA
Adaptasten
0.1
-.1LL
0.1.
123
0330
1035
1330
1123
233
133
1315
1153
110
1110
1.35
1:00
[030
1335
XMIA (kadoo))
Flae- Tane
1.30
0.73
04.31
1.00
5.76
1
0.76
0.50
1.40
0.91
0.66
1.50
0:35
Hoal Fase Vlase
1481
0.72
0433
1.00
0.72
0.72
1
0.90
0.36
1140
0.51
0.63
1.00
15200
0.21
Sovrnge
0971
0336
103
1339
1337
133
1335
0236
0152
2356
0154
0331
1333
0351
LeBA
1987
0.52
1432
0.56
0331
351
0.51
0.50
2.16
0.35
0.51
0,93
[U92
0.51
(yynk
Hoal Paa-
609
0.57
0682
0.50
0.51
(69)
0.65
0.52
1.00
0.54
0.50
0.51
1054
035
1032
0176
1033
231
1035
0:30
13:1
2150
0136
1031
1327
1033
033
Lotk
0.99
0.52
0452
0.59
0.31
0.50
2077
0.55
0.51
Referzax (Pydia 15)
Pal. Plac- Yaae
1,00
0.54
1432
1.00
0.34
3.2
(190
0.56
0.52
2.16
0.55
0.50
0.99
051
1035
033
1032
1033
109
0.36
0033
2056
0.35
0330
103
031
Paots Tznna
1079
031
1030
0:10
1831
230
1033
10:1
2300
011
1:32
101
031
Piac- Yand
0.27
0.51
0.5
5.30
6.82
0.52
0.76
0.51
0.51
031
Hoal Frac- Ttane
0225
051
065
0.2
0.39
351
0664
6.5
0.35
3.00
0.5
0.51
0.59
091
031
Rovrage
Table 6: Membership Inference for OOD Adaptations using Pythia 1.4B. We present the AUC scores obtained with reference, and Min-K% MIAs for the Pythia 1.4B model adapted on different datasets with {0.1, oo).
Dataset
Samsum
German Wiki
Averuge
Adaptation
8ig
D.1g
no
Pretix
0.58
0.77
0.34
1:00
0.85
0.36
0.79
0.81
0.35
LoRA
0.53
0.79
0.51
1.00
0.82
0.64
0.76
0.81
0.58
RMIA (shadow)
Fine-Tune
0.99
1.00
1.00
0.90
Head Fine-Tune
0.95
1.00
0.85
1.00
0.90
0.89
0.97
0.95
0.87
Average
0.76
0.94
0.63
1.00
0.89
0.75
0.88
0.89
0.69
Pretix
0.52
0.52
0.51
0.2
0.53
0.50
0.72
0.53
0.51
0.97
0.50
RMIA (Pythia IB)
Fall Tune
1.00
0.52
0.50
1.00
0.58
0.51
1.00
0.55
0.51
Head Fine-
0.51
0.56
0.51
0.92
0.61
0.52
0.71
0.59
0.51
Average
0.63
0.54
0.50
0.55
0,56
0.79
0.55
0.93
LoRA
0.50
0.53
0.50
0.98
0.51
0.49
0.74
0.52
0.49
Reference (Pychin IB)
Fall Tune
1.00
0.52
0.50
1.00
0.59
0.51
1,00
0.55
0.51
Head Fine-Tune
Average
0.3
0.5
0.30
0.55
Prott
0.52
0.51
0.31
0.70
0.53
0.30
0.61
0.32
0.31
LRRA
0.50
0.52
0.50
0.79
0.52
0.51
0.65
0.52
0.51
Min-K%
Fime-Tune
0.52
Head Fine-Tune
0.51
0.3
0.51
0.74
0.55
0.52
0.62
0.54
0.52
Average
0.55
0.52
0.31
0.00
0.53
0.31
0.72
0.31
0.31
Table 7: Membership Inference for IID Adaptations using Pythia 1.4B, We present the AUC scores obtained with reference, and Min-K% MIAs for the Pythia 1.4B model adapted on different datasets with {0.1, 8, oo}.
Dataset Pile Bookeorpus2
Pali Bonkcorpus2 Train
Pile Github Val
Pile Faaren Val
Average
MIA
Adaptation
0.1
0.1
-0.1
S
Prolix
0.35
LokA
0.96
0.51
0.74
0.588
0.52
1.00
0.97
0.53
1,30
0.67
0.58
RMTA (shadow)
Full Fine-Tim
0.98
0.71
0.99
0.99
0.70
1.00
0.99
1.80
0.99
0.99
0.69
Head Fine-Tune
1.00
1.00
0.72
1.00
1,00
0.69
1.00
1,30
0.71
1,30
1.00
0.64
1.00
1.00
0.69
Average
0.99
0.92
0.62
0.93
0.92
0.62
1.00
0.89
0.63
1.00
0.93
0.63
0.98
0.91
0.62
Prelix
0.79
0.32
0.31
0335
0.32
0.31
0.76
0.51
0.51
0.78
0.31
0.31
0.79
0.32
0.31
aRA
0.56
0.58
0.51
0.50
0.59
0.51
0.90
0.57
0.52
0.97
0.50
0.51
0.73
0.58
0.51
RMIA (Pythia 18)
Pull Fine-Tune
0.64
0.65
0.50
0.51
Fine-Tume
0.79
Average
0.64
0.30
0.57
0.31
Prelix
0.80
0.52
0.51
0.86
0.52
0.31
0.76
0.50
0.50
0.77
0.49
0.50
0.30
0.51
0.30
LoRA
0.57
0.58
0.51
0.29
0.59
0.51
0.92
0.55
0.50
0.96
0.60
0.50
0.73
0.5%
0.51
Reference (Pythi IB)
Full Fine- Tome
0.64
0.58
0.51
0.65
0.57
0.49
0.98
0.53
0.50
0.99
0.58
0.51
0.81
0.56
0.50
Head Fine Tune
0,80
0.64
0.51
0.54
0.64
0.50
0.91
0.67
0.51
0.99
0.65
0.50
0.81
0.65
0.50
Average
0.70
0.58
0.51
0.84
0.58
0.30
0.89
0.56
0.50
0,93
0.58
0.30
0.79
0.58
0.30
LoRA
0.50
0.50
0.52
0.52
0.52
0.56
0.51
0.83
lead Fine-Tume
0.57
0.53
0.69
0.51
0.53
0.50
0.61
0.54
0.5)
0,90
0.53
0.51
0.64
0.53
0.51
Average
0.35
0.32
0.50
0.33
0.32
0.30
L164
0.54
0.52
0.75
0.32
031
0.01
0.2
0.31
C.5 PREFIX EXPOSURE
To investigate the source of privacy leakage we present exposure observed with canary prefixes of varying lengths, after adapting Pythia IB to the GitHub Val dataset with oc. Figure 10 show the
25

---

Published as a conference paper at ICLR 2026
Table Membership Inference for OOD Adaptations using Pythia 410M. We present the AUC scores obtained with reference, and Min-K% MIAs for the Pythia 410M model adapted on different datasets with & {0.1, o.).
Dalasel
Samsuum
German
Wiki
Average
MIA
Adaptation
2c = 8
0.1
oc c
S = 0.1
00 S
0.1
Prefix
0.87
0.67
0.51
0.901
0.66
0.50
0.88
0.67
0:51
LoRA
RMIA (shadow)
Fine-Tine
0.99
0.8
0.52
1.00
1.00
0.53
1.00
0.99
Head Fine-Tunee
1.00
0.76
0.76
0.94
1,00
0.82
0.97
0.88
0.79
Average
095
0.76
0.38
0.89
0.91
0.60
0.92
0.83
0.39
0.51
LoRA
0.52
0.50
0.52
0.51
0.56
0.50
0.51
0.53
0.51
RMIA (Pythia 1B)
Full Fine-Tune
0.80
0.55
0.50
0.93
0.58
0.51
0.86
0.56
0.50
Head Fine Fine-Tune
0.50
0.50
0.50
0.51
0.62
0.51
0.66
0.56
0.51
Average
0.63
0.30
Frehx
0.54
0.52
0.51
0.57
0.50
0.48
0.55
0.51
0.49
LoRA
0.52
0.19
0.51
0.50
0.55
0.48
0.51
0.52
0.49
Reference (Pychia 18
Full Fine-Tune
0.79
0.55
0.50
0.92
0.56
0.49
0.85
0.55
0.49
Head Tone
0.51
0.49
Average
0.66
0.51
0.51
0.63
0.56
0,18
0.64
0.51
0.19
Prefix
0.52
0.51
0.51
0.54
0.52
0.51
0.53
0.52
0.51
LoRA
0.50
0.51
0.52
0.54
0.51
0.51
0.52
0.51
Min-K's
Fine-Thnee
0.50
0.79
0.52
0.53
0.51
Head Fine: Tune
0.69
0.50
0.50
0.52
0.56
0.52
0.60
0.53
0.51
Average
0.60
0.51
0.51
0.59
0.54
0.51
0.60
0.53
0.51
Table 9: Membership Inference for IID Adaptations using Pythia 410M We present the AUC scores obtained with reference, and Min-K% MIAs for the Pythia 410M model adapted on different datasets with {0.1, c.
Dataset Pile Bookeorpus2
ValiPlie Bookcorpus2 Train
Github
Pile Euren
MIA
Adaptattion
0.1
Se
Pictis
033
0.65
0.36
1357
0.56)
0.80
0.67
LoRA
0.72
0.91
0.58
0.73
0.89
0.57
0.74
0.92
0.51
0.74
0.98
0.57
0.73
0.92
0.56
RMIA (shadow)
Pall Tine-Tinne
1,00
1,00
0.50
1.00
1,30
0.57
1.00
0.98
0.51
0:99
0.98
0.06
1.00
0.59
0.58
Head Fine-Tune
0.96
1,00
0.74
0.96
1,00
0.69
1.00
1,00
0.62
1.30
1,00
0.72
0.98
1.00
0.69
Average
0,87
0.89
0.62
0.39
1.800
0.59
083
0.30
11.4
0.91
01300
0163
0138
0.90
0.39
Prefix
0.56
0.51
0.51
0.56
0.52
0.52
0.53
0.52
0.51
0.53
0.51
0.51
0.51
0.52
0,51
0.50
0.50
0.51
0.51
0.54
RMLA (Pythia IB)
0.93
0.51
0.55
0.52
0.57
0.51
Head Fine-Tine
0.51
0.62
0.50
0.51
0.90
0.59
0.52
0.91
0.44
0.60
0.51
Average
0.62
0.57
0.50
0.63
0.57
0.51
0.71
0.55
0.51
0.89
0.54
0.50
0.56
0.56
0.51
Piclis
03.56
0.31
0.51
0355
0.57
0.51
0331
0.30
01.2
0.52
0.50
0.40
0.54
11.1
0.50
LoRA
0.51
0.55
0.51
0.51
0.54
0.51
0.50
0.52
0.49
0.67
0.52
0.50
0.50
0.53
0.50
Reference (Pythia 1B)
Pull Fine- Tune
0.91
0.57
0.50
0.93
0.58
0.51
0.88
0.53
11.49
0,80
01.52
0.49
01.58
0.55
0.50
Head Fine-Ture
0.51
0.62
0.51
0.51
0.82
0.52
0.87
0.59
0.50
0.88
0.58
0.49
0.70
0.60
0.51
Piclix
0.32
0.51
0.1
0.50
0.52
LoRA
0.50
0.51
0.50
0.50
0.52
0.50
0.51
0.54
0.51
0.50
0.51
0.52
0.51
Min K%
Pull Fine- Tune
0.82
0.52
0.50
0.80
0.83
0.50
0.74
0.56
0.52
0.75
0.54
0.49
0.78
0.54
0.50
Howd Fine-Tune
0.50
0.53
0.49
0.50
0.53
0.51
0.62
0.53
0.51
0.68
0.52
0.50
0.57
0.53
0.50
Average
0.58
0.52
0.50
0.58
0.52
0.31
0.60
0.51
0.51
0.51
0.52
0.31
0.59
0.52
0.31
Table 10: Membership Inference for OOD Adaptations using Pythia 160M. We present the AUC scores obtained with reference, and Min-K% MIAs for the Pythia 160M model adapted on different datasets with {0.1, 8, 00).
Dataset
Samsum
German Wiki
Averuge
MIA
Adaptation
Fretix
0.55
0.35
0.32
0.56
0.62
0.53
0.56
0.37
0.33
LoRA
0.78
0.61
0.55
0.62
0.57
0.59
0.70
0.59
0.57
RMIA (shadow)
Fall Fine-Tune
1.00
0.74
0.61
0.90
0.99
0.65
0.95
0.86
0.63
Head Fine-Tinee
1.00
0.89
0.73
0.96
0.75
0.77
0.88
0.75
Average
033
0369
0.60
0.76
0.75
0.64
0.80
0.71
0.02
Pretix
0.51
0.51
0.50
0.51
0.51
0.51
0.51
0.51
0.50
ARR
0.50
RMIA (Pythia 1B)
Fine-
0.50
0.52
0.50
0.66
Head Fine-Tune
0.69
0.51
0.50
0.52
0.51
0.52
0.60
0.51
0.51
Average
043
0.51
0.50
0.1
0132
0.31
0.57
0.51
0.50
0.5]
0.30
LoRA
0.51
0.50
0.51
0.49
0.49
0.49
0.50
0.50
0.50
Reference (Pychia IB
Fall Tune
0.79
0.52
0.50
0.50
0.53
0.19
0.65
0.52
0.19
Head Fine- Tone
0.69
0.51
0.50
0.50
0.49
0.50
0.60
0.50
0.50
Average
0.30
Preix
0.51
0.51
0.51
0.52
0.52
0.51
0.51
0.51
0.51
LoRA
0.51
0.50
0.50
0.51
0.51
0.51
0.51
0.51
0.51
Min-K%
Full Tune
0.71
0.52
0.50
0.52
0.53
0.51
0.61
0.52
0.51
Head Tine-Tone
0.52
0.52
Average
0.59
0.51
0.50
0.22
0.22
0.51
0.55
0.51
0.51
26

---

Published as a conference paper at ICLR 2026
Table 11: Membership Inference for IID Adaptations using Pythia 160M. We present the AUC scores obtained with reference, and Min-K K% MIAs for the Pythia 160M model adapted on different datasets with & {0.1, }.).
Dataset Pile Bookeorpus]
Vale Bookearpuc2 Train
Pile Github
Euren
Average
MIA
Adaptation
0.1
Prafix
0.61
0.72
0.53
0.61
0.71
0.54
0.57
0.67
0.51
0.56
0.75
0.54
0.61
0.71
0.35
LoRA
0.82
0.60
0.54
0.85
0.70
0.55
0.80
0.82
0.53
0.91
0.61
0.53
0.54
0.71
0.54
RMIA (shadow)
Full Fine- Tune
1.00
0.89
0.58
0.89
0.93
0.56
1.00
0.95
0.56
1.00
0.97
0.52
0.97
0.94
0.55
Head Pine-Tune
1,00
0.74
0.75
1,00
0,99
0.72
1.00
0.99
0.62
1.30
0.30
0.70
1,00
0.87
0,70
0.86
0.74
0.50
0.85
0.85
0.39
0.86
0.86
0.55
0.89
0.78
0.59
0.81
0.58
Pictix
0.50
0.52
01:53
0.31
LoRA
0,50
0.51
0.51
0.50
RMLA (Pythia IB)
Fine- Tune
1.00
0.53
1350
0.52
0.54
0.50
0.52
0.99
0.50
0.53
0.51
Head Fine Tune
0.71
0.50
0.50
0.74
0.56
0.51
0.67
0.55
0.51
0.78
0.50
0.50
0.73
0.53
0.51
Avesage
0068
0.31
11300
0337
D133
0.51
0064
0.52
0135
0.50
0.51
0.35
0.25
0.52
0.31
Prefia
0.50
0.51
0.50
0.52
0.52
0.52
0.50
0.50
0.50
0.50
0.50
0.50
0.51
0.51
0.50
1 aRRAA
0.51
0.50
0.50
0.52
0.52
0.51
0.50
0.51
0.50
0:49
0.49
0.49
0.50
0.50
0.50
Reference (Pythia IB)
Full Fine Tune
1.00
0.53
0.50
0.52
0.53
0.51
0.81
0.52
0.50
0.96
0.50
0.52
0.50
Head Fine-Tune
0.69
0.55
0.51
0.64
0.54
0.50
0.52
Average
0.52
0.67
Protix
0.50
0.50
0.50
0:11
0.51
0.11
0.52
0.42
0.51
0.50
0.50
0:51
0.51
LoRA
0.50
0.50
0.50
0.51
0.51
0.50
0.52
0.52
0.51
0.50
0.50
0.50
0.51
0.50
0.50
Min-K%
Pall Fine- Tune
0.96
0.51
0.50
0.51
0.51
0.50
0.67
0.52
0.52
0:93
0.52
0.51
0.77
0.52
0.50
Head Fine-Tune
0.62
0.50
0.50
0.62
0.52
0.51
0.60
0.53
0.51
0.72
0.50
0.50
0.64
0.51
0.50
Average
0.64
0.50
0.50
0.34
0.31
031
0.38
0.52
0.51
0.56
0.50
0.50
0161
031
0.50
Table 12: Membership Inference for OOD Adaptations using Pythia 70M. We present the AUC scores obtained with reference, and Min-K% MIAs for the Pythia 70M model adapted on different datasets with {0.1, 8, oo).
Dataset
Samsuu
German Wiki
Average
MIA
Adaptation
x
Prefix
0.33
0.62
0.51
0.50
0.63
0.56
0.57
0.63
0.33
LoRA
0.68
0.58
0.55
0.59
0.61
0.57
0.63
0.59
0.56
RMIA (shadow)
Pall Tine-Tune
0.88
0.92
0.63
0.98
0.97
0.71
0.98
0.94
0.67
Head Tune
0.93
0.73
0.95
0.93
0.77
0.97
0.93
0.75
Average
0.81
0.76
0.61
0.78
0.78
0.65
0.79
0.77
0.63
Piefix
0.51
0.31
0.51
0.50
0.31
0.50
0.51
0.51
0.51
0.51
RMIA (Pythia 1B)
Fine-Thiee
0.2
0.53
0.52
0.53
0.55
0.50
0.53
0.54
0.51
Head Fine-Tune
0.67
0.54
0.50
0.52
0.54
0.51
0.59
0.51
0.51
Average
033
0.52
0.31
0.51
0.33
0.31
0.53
0.33
0.31
0.51
LoRA
0.51
0.51
0.52
0.50
0.50
0.50
0.50
0.51
0.51
Reference (Pythin 18)
Full Fine-Tune
0.52
0.53
0.52
0.51
0.53
0.49
0.52
0.53
0.51
Head Tune
0.67
0.55
0.51
0.50
0.52
0.50
0.59
0.53
0.50
Average
0.30
Prefix
0.51
0.51
0.50
0.51
0.52
0.51
0.51
0.51
0.51
LoRA
0.51
0.50
0.51
0.52
0.52
0.52
0.51
0.51
0.51
Min-K'
Fall Fine-Tune
0.52
0.51
0.53
0.54
0.52
0.52
0.53
0.51
Head Tone
0.53
0.52
Average
0.51
0.52
0.50
0.52
0.53
0.52
0.53
0.32
0.51
Table 13: Membership Inference for IID Adaptations using Pythia 70M. We present the AUC scores obtained with reference, and Min-K% MIAs for the Pythia 70M model adapted on different datasets with & E {0.1, 8, oo).
Dataset Pile Bookcorpus2
ValiPile Bookcorpus2 Irain
Pile Github Val
Pile Euren Val
Average
MIA
Aduptation
0c = z 01.1
= 8 == 0.1
oc = 8
= 0.1
Do c S
0.1
20 = & 0.1
Frelix
0.63
0.56
0.50
0.50
0.55
0.32
0.37
0.75
0.56
0.85
0.72
0.33
0.61
0.70
0.35
LoRA
0.57
0,80
0.81
0.55
0.84
0.85
0.50
RMIA (shadoo)
Full Fine-Tune
0.99
1.00
0.90
0.95
Head Fine-Tune
0.97
0.34
0.72
1.80
0.95
0.70
1.00
0.98
0.76
1.80
0.97
0.76
0.99
0.96
0.73
Average
0.79
0.85
0.59
0.85
0.54
0.59
0.85
0.88
0.51
0.87
0.83
0.59
0.54
0.54
0.60
Telik
0.30
0.30
0.30
0.31
0.32
0.31
0.31
0.51
0.5
0.50
0.30
0.30
0.31
0.1
0.31
aRA
0.50
0.50
0.50
0.51
0.51
0.51
0.51
0.51
0.51
0.50
0.50
0.49
0.51
0.51
0.50
RMIA (Pythia 1B)
Full Finc- Tune
0.52
0.52
0.50
0.53
0.53
0.51
0.87
0.52
0.51
0.51
01.52
0.50
(161
0.52
0.51
Head Time
0.51
0.52
0.50
0.69
0.54
0.50
0.64
0.55
0.51
0.73
0.52
0.50
0.64
0.53
0.50
Piclis
0.50
0.51
0.51
0.50
LaRA
0.50
0.51
0.50
0.51
0.51
0.50
0.50
0.49
0.50
0.511
Reference (Pychia IB
Full Fine- Tune
0.52
0.52
0.50
0.52
0.53
0.51
0.81
0.51
0.50
0.50
0.51
0.49
0.50
0.52
0.50
Head Pine Tune
0.51
0,52
0.50
0.66
0.54
0.51
0.60)
0.54
0.50
0.57
0.51
0.48
0.61
0.53
0.50
Average
0.51
0.51
0.50
0.55
0.52
0.31
0.60
0.51
0.50
0.54
0.50
0.49
0.55
0.51
0.50
Piclix
0.30
0.50
1.49
0331
1131
0.51
0.52
0.52
11.32
0.52
0152
0132
11.1
0.11
0.31
1 LoRA
0.49
0.50
0.50
0.51
0.51
0.51
0.52
0.52
0.52
0.51
0.51
0.51
0.51
0.51
0.51
Min K%
Fine Tune
0.50
0.51
0.52
0.52
0.51
0.75
0.53
0.52
0.52
0.51
0.52
Head Fine-
0.50
0.51
0.62
0.55
0.76
0.53
Avesage
0.50
0.50
0.49
0.54
0.22
0.1
0.60
0.55
0.22
0.58
0.1
0.55
0.2
0.31
exposure when only considering the first N tokens. This highlights that the prefix itself is the main source of privacy leakage.
27

---

Published as a conference paper at ICLR 2026
Table 14: Membership Inference for OOD Adaptations using GPT-Neo 1.3B. We present the AUC scores obtained with reference, and Min-K% MIAs for the GPT-Neo 1 1.3B model adapted on different datasets with E {0.1,8, 00).
Dalasel
Samsuum
German Wiki
Average
MIA
Adaptation
8
0.1
oc c
S = 0.1 c 00 Se 0.1
Pretix
0.50
0.51
0.50
0.98
0.50
0.51
0.74
0.50
0:51
LoRA
0.50
RMIA (shadow)
Fine-Tine
1:00
1.00
0.80
1.00
1.000
0.83
1.000
1.800
Head Fine-Tume
093
1.00
0.81
0.93
1,00
0.85
0.93
1.00
0.83
Average
074
0.84
0.66
0.85
0.85
0.68
0.80
0.34
0.67
LoRA
0.50
0.50
0.50
0.51
0.52
0.51
0.51
0.51
0.51
RMIA (Pythia 1B)
Full Fine-Tune
0.58
0.56
0.51
0.74
0.63
0.51
0.66
0.60
0.51
Head Fine Fine-Tune
0.50
0.55
0.50
0.51
0.60
0.51
0.51
0.58
0.51
Average
0.61
Frehx
0.50
0.49
0.49
0.82
0.48
0.47
0.56
0.49
0.48
LoRA
0.19
0,51
0.49
0.51
0.52
0.51
0.50
0.52
0.50
Reference (Pychia 18
Full Fine-Tune
0.59
0.57
0.49
0.74
0.61
0.49
0.66
0.59
0.19
Head Tune
0.51
0.50
Average
0.52
0.53
0.49
0.59
0.55
0.19
0.56
0.51
0.19
Prefi
0.52
0.50
0.50
0.65
0.50
0.51
0.58
0.50
0:51
LoRA
0.51
0.51
0.52
0.53
0.52
0.52
0.52
0.52
Min-K's
Fine-Thine
0.51
0.59
0.57
0.53
0.56
Head Fine: Tune
0.51
0.54
0.51
0.53
0.56
0.52
0.52
0.55
0.52
Average
0.52
0.52
0.51
0.57
0.54
0.52
0.55
0.53
0.51
Table 15: Membership Inference for IID Adaptations using GPT-Neo 1.3B. We present the AUC
scores obtained with reference, and Min-K% MIAs for the GPT-Neo 1.3B model adapted on different datasets with {0.1, c...
Dataset Pile Bookeorpus2
ValiPlie Bookcorpus2 Irain
Github
Pile Euren
MIA
Adaptatiion
0.1
Pictis
0.51
0:25
13.1
0.500
0.51
0.79
0.55
LoRA
0.53
0.81
0.52
0.54
0.81
0.51
0.55
0.89
0.50
0.57
0.54
0.62
0.55
0.79
0.5d
RMIA (shadow)
Pall Fine- Tune
1.00
1,30
0.65
1.00
1,30
0.64
1.00
0.71
0.75
1,30
1.00
0.02
1.00
0.93
0.67
Head Fine-Tune
0.96
1,00
0.70
1.00
1,00
0.70
1.00
1,00
0.87
1,30
1.00
0.65
0.59
1.00
0.73
Average
0.78
0.83
1550
0.83
0.83
0.59
087
0.78
11,66
0.84
01300
0161
(133
031
0.61
Prefix
0.51
0.51
0.51
0.76
0.51
0.30
0.68
0.50
0.51
0,80
0.57
0.56
0.89
0.52
0,52
0.50
0.53
RMLA (Pythia IB)
0.72
0.51
0.54
0.53
0.57
0.53
Head Fine-Tine
0.52
0.60
1,00
0.63
0.51
0.61
0.53
0.98
0.57
0.62
0.58
Average
0.56
0.56
0.51
0.74
0.56
0.51
0.77
0.55
0.52
0.76
0.61
0.57
0.71
0.57
0.53
Piclis
0331
0.31
0.57
0.72
0.51
0.50
[161
0.45
0.A5
0.74
0.44
0.41
0.65
11:48
0.48
LoRA
0.51
0.53
0.51
0.48
0.69
0.48
0.51
0.51
0.48
0.58
0.59
0.58
0.52
0.53
0.51
Reference (Pythia 1B)
Pull Fine- Tune
0.72
0,62
0.52
0.71
0.62
0.51
0.89
0.50
01500
0.74
0165
0.56
0..7
0.60
0.52
Head Fine-Ture
0.52
0.61
0.51
1.00
0.82
0.51
0.97
0.61
0.51
0.98
0.66
0.57
0.87
0.63
0.53
Piclix
0.30
0.85
0.30
0.52
0.53
0.77
0.52
LoRA
0.50
0.50
0.50
0.50
0.50
0.50
0.52
0.54
0.53
0.57
0.57
0.53
0.52
Min K
Pall Fine- Tune
0.56
0.54
0.50
0.54
0.54
0.50
0.62
0.54
0.53
0.50
0.59
0.56
0.57
0.5
0.52
Howd Fine-Tune
0.50
0.52
0.49
0.91
0.53
0.50
0.74
0.54
0.53
0.87
0.59
0.57
0.76
0.55
0.52
Average
0.51
0.52
0.50
0.65
0.52
0.30
0.61
0.51
0.53
0.70
0.58
0.36
0.63
0.51
0.32
Table 16: Membership Inference for OOD Adaptations using GPT-Neo 125M. We present the AUC scores obtained with reference, and Min-K% 4%%% MIAs for the GPT-Neo 125M model adapted on different datasets with e {0.1, o0).
Datasel
Samsum
German Wiki
Averuge
Adaptation
Fretix
0.68
0.51
0.50
0.73
0.51
0.52
0.70
0.51
0.31
I. LoRA
0.84
0.63
0.59
0.51
0.50
0.50
0.67
0.56
0:55
RMIA (shadow)
Fall Fine-Tune
1.00
0.99
0.72
1.00
0.52
0.79
1.00
0.75
0.75
Head Fine-Tine
1.00
0.94
0.79
1.00
1400
0.87
1,00)
0.97
0383
Average
0.88
0.77
0.65
031
0.63
0.67
0.84
0.20
0.66
Pretix
0.52
0.51
0.51
0.55
0.50
0.30
0.54
0.50
0.30
0.51
0.50
0.50
0.50
RMIA (Pythia 1B)
Fine-Timm
1.00
0.50
1.00
Head Fine-Tune
1.00
0.51
0.50
0.54
0.57
0.51
0.77
0.54
0.51
Average
0776
0.52
0.51
0.3
0132
0.30
0170
0.52
0.31
LoRA
0.51
0.51
0.51
0.49
0.49
0.49
0.50
0.50
0.50
Reference (Pychia IB
Fall Tune
1.00
0.53
0.50
1.00
0.49
0.19
1.00
0.51
0.50
Head Tone
1.00
0.51
0.50
0.53
0.55
0.19
0.76
0.53
0.50
Average
0.63
Preix
0.34
0.51
0.51
0.55
0.50
0.49
0.54
0.50
0.50
LoRA
0.51
0.51
0.51
0.52
0.52
0.52
0.52
0.52
0.52
Min-K%
Full Tune
1.00
0.53
0.52
1.00
0.52
0.52
1.00
0.53
0.52
Head Tine-Tone
0.51
0.54
0.52
Average
0.76
0.52
0.51
0.65
0.22
0.51
0.71
0.52
0.51
28

---

Published as a conference paper at ICLR 2026
Table 17: Membership Inference for IID Adaptations using GPT-Neo 125M. We present the AUC scores obtained with reference, and Min-K% MIAs for the GPT-Neo 125M model adapted on different datasets with E {0.1, 8, oo}.
Dataset Pile Bookeorpus2
Pale Bookeerpuc2 Train
Github
Euron
Adaptation
0.1
Prefix
0.68
0.52
0.51
0.52
0.53
0.51
0.27
0.50
0.50
0.26
0.57
0.53
0.68
0.53
0.51
LoRA
0.52
0.51
0.50
1.00
0.51
0.51
1.00
0.50
0.51
1,30
0.50
0.50
0.88
0.51
0.50
RMIA (shadow)
Full Fine- Tune
1.00
0.51
0.55
1.00
0.97
0.38
0.98
0.97
0.68
1.00
0.98
0.66
1.00
0.86
0.65
Head Pine-Tune
1.00
1,00
1.70
1,00
1,30
0.66
0.96
1.00
0.87
1.30
1,00
0.70
0.59
1.00
0.74
0.80
0.50
0.88
0.75
0.57
0.55
0.74
0.64
0.94
0.76
0.00
0.72
0.60
0351
0.55
LoRA
0.51
RMLA (Pythia IB)
Fine- Tune
1.00
1.80
0.52
0.54
0.53
1,30
0.56
Head Fine Tune
1,00
0.55
0.50
1,00
0.57
0.51
0.95
0.57
0.53
1,00
0.59
0.56
0.99
0.57
0.52
Average
0.75
0.32
11.00
0387
D133
0..1
0.72
0.54
11333
0.366
0.57
01.56
0.300
0.54
0.52
Prefia
0.52
0,51
0.51
00.52
0.51
0.50
0.50
0.48
0.48
0.55
0.43
0.43
0.52
0.48
0.48
aRRAA
0.51
0.51
0.51
0.92
0.51
0.51
0.70
0.50
0.50
0.67
0.53
0.53
0.75
0.51
0.51
Reference (Pythia IB)
Full Fine Tune
1.00
0.51
0.51
1,00
0.54
0.52
0.58
0.52
0.49
1,00
0.56
0.55
0.53
0.52
Head Fine-Tune
1.00
1.00
0.51
0.56
Average
Protix
0.55
0.50
0.52
0.51
0.50
0.54
0.33
0.56
0.54
LoRA
0.50
0.50
0.50
0.70
0.50
0.50
0.60
0.52
0.52
0.74
0.56
0.56
0.63
0.52
0.92
Min-K%
Pall Fine- Tune
1.00
0.50
0.50
1.000
0.53
0.51
0.80
0.55
0.53
1,00
0.58
0.56
0.95
0.54
0.53
Head Fine-Tune
1.00
0.52
0.50
1.00
0.53
0.50
0.94
0.55
0.53
1,00
0.58
0.56
0.98
0.55
0.52
Average
0.75
0.50
0.50
0.00
0.52
031
0.72
0.54
0.33
0.8
0.56
0.55
0.78
0.3
0.52
Table 18: Membership Inference for OOD Adaptations using Olmo 2 0425 1B. We present the AUC scores obtained with reference, and Min-K% MIAs for the Olmo 0425 1B model adapted on different datasets with {0.1, 8, oo).
Dataset
Samsum
German Wiki
Average &
MIA
Adaptation
0.1
ope 8 -0
0.1
Prefi
0:95
0.83
0.58
0.95
0.37
0.54
0.56
0.85
1155
LoKA
0.87
0.93
0.68
0.97
0.55
0.76
0.92
0:94
0.72
RMIA (shadow)
Full fine-tune
1.00
0.61
0.58
1.00
0.80
0.57
1.00
0.90
0.58
Head fine-tuee
0:99
0.79
0.63
0.99
0.77
0.90
0.99
0.57
0.60
Ansagge
1:04
0385
1722
0096
1135
01.70
1136
ITBS
Pizli
0.54
0.52
0:30
0.60
0133
03.50
11.57
0.53
11:00
LoKA
0.51
0.52
0.50
0.55
0.56
0.51
0.54
0.54
0.50
RMIA (Olmo 2 0425 (B)
Full fixe-tnne
0.98
0.50
0.50
1,00
0.53
0.51
0.89
0.53
0.50
Hexd fine-tuee
0.58
0.50
0.50
0.80
0.52
0.51
0.59
0.51
0.50
Ansage
1151
03.11
11:00
0167
11:34
13:51
11/86
11:1
Piali
B:54
0.52
0130
0350
0154
03.50
11:57
0.53
1150
LRRA
0.51
0.52
0.50
0.57
0.56
0.51
0..54
0.54
0.50
Reference (Oimo 0428 18x Full fixe-tune
0.79
0.51
0.50
1,00
0.53
0.50
0.89
0.53
0.50
Head fine-ture
0.61
0.50
0.50
0.66
0.52
0.51
0.64
0.51
0.50
Aserge
0.61
0.51
0.56
0.7
0.54
0.50
0.66
0.33
1.50
Pialis
B.32
0.:1
0:30
0.5
0152
0.51
11.22
0.51
1151
LRRA
0.50
0.51
0.50
0.52
0.52
0.51
0.51
0.51
0.51
Min-KS
Full lise-tune
0.67
0.50
0.50
0.75
0.51
0.51
0.71
0.51
1.50
Head fine sane
0.56
0.50
0.50
0.60
0.51
0.51
0.58
0.51
1.51
Averge
0.56
0.50
0.50
0.00
0.52
0.51
0.58
0.51
0.50
Table 19: Membership Inference for IID Adaptations using Olmo 2 0425 1B. We present the AUC scores obtained with reference, and Min-K% MIAs for the Olmo 2 0425 1B model adapted on different datasets with E (0.1,8, 8, oo}.
Dutaset
Adaptation
Pretix
0:55
0.39
0.63
LakA
0.93
0.30
0.57
RMIA (chadow)
fine tume
1:00
0.91
0.63
Head line tuse
0.92
0.90
0.70
Avenge
0.56
1038
0.03
Pictix
0.50
01.5g
0.51
LoRA
0.55
0.56
0.53
RMIA (Clmno 2 0425 1B)
Full line tune
0.87
0.56
0.51
Head fino-tume
0.62
0.64
0.51
Average
0.65
11.5%
0.55
Przlix
0.59
11.66
0.52
LaKA
0.55
0.56
0.53
Reforence (Olmo 2 0425 (B) Full fine-ture
0.86
0.56
0.51
Head fine tune
0.65
0.63
0.51
Tvernge
0.67
0138
0.32
FFztix
0.51
0130
0.30
LoRA
0.51
1150
0.51
Min 8%
Full line: tune
0.58
0150
0.50
Head fine tune
0.56
0.51
0.51
Average
6.33
0.50
0.90
29

---

Published as a conference paper at ICLR 2026
Table 20: Membership Inference for OOD Adaptations using Olmo 1B. We present the AUC scores obtained with reference, and Min-K K% MIAs for the Olmo 1B model adapted on different datasets with & {0.1, oo).
Dattaset
Samsuna
Germaa Wiki
Average
Adaptation
Profix
003
0.95
0.57
LoRA
0.38
0.97
0.69
1.00
0.98
0.73
0.99
0.98
0.71
RMIA (shadow)
Full lime tune
1.00
1.00
0.78
1.00
0.87
0.58
1,00
0.94
0.68
Head fine tune
0.58
0.78
0.50
0.98
0.73
0.76
0.38
0.76
0.63
Average
0.99
0.92
0.67
100
0.89
0.80
1,30
0.30
0.68
Pizfix
0.74
LoRA
RMIA (Olmo 1B)
Full tune
0.54
1.00
0.52
Heaa fine tune
0.59
0.50
0.50
0.78
0.53
0.50
0.73
0.52
0.50
Average
0.20
0.53
0.51
0.29
0.36
0.51
0.75
0.54
0.31
Profix
0.59
0.52
0.51
0.75
0.56
0.50
0.87
0.54
0.50
LoRA
0.53
0.53
0.51
0.65
0.59
0.50
0.59
0.56
0.50
Reference (Olmo ID
Full fine tune
0.99
0.54
1.00
0.54
0.52
0.99
0.54
0.51
Head
0.50
0.50
Average
FizEx
032
0.51
LoRA
0.51
0.52
0.50
0.51
0.52
0.51
0.53
0.52
0.51
Min-K%
Full nise tune
0.54
0.52
0.50
0.58
0.51
0.51
0.56
0.52
0.51
Head fine-tune
0.65
0.50
0.50
0.56
0.51
0.51
0.53
0.51
0.51
Average
0.36
0.31
0.30
0.30
0.32
0.51
0:34
0.22
031
Table 21: Membership Inference for IID Adaptations using Olmo 1B, We present the AUC scores obtained with reference, and Min-K% MIAs for the Olmo 1B model adapted different datasets with 6 E {0.1, 8, 20).
Dataset
Dolmino Wiki
MIA
Adaptation
8
01.
Prefix
0.54
LoRA
RMIA (shadow)
Full fine tune
0.98
0.93
0.61
Head fine tume
0.90
0.90
0.60
Prefix
LoRA
0.55
0.56
0.50
RMIA (Olmo IB)
Full fine tune
0.87
0.56
0.51
Head line-tume
0.62
0.64
0.51
Average
Preix
0.59
0.56
0.52
LoRA
0.55
0.56
0.51
Reference (Olmo 1B) Full lino-tune
0.86
0.56
0.51
Head fine-tune
0.51
Average
0.38
0.3
Piclis
U.31
0.30
0.50
LoRA
0.50
0.50
0.50
Min-K%
Full
0.50
0.51
Average
0.33 0.50
0.30
Table 22: Canary Exposure for OOD Datasets. Prefix Tuning and Full Fine Fine-Tuning adaptation methods have a higher exposure OOD datasets than the other adaptation approaches like LoRA and Head Fine-Tuning. We audit only the adaptations and assume the same pretrained LLM used for all adaptations. We present the exposure scores obtained using the model loss for the Pythia IB model adapted to different OOD datasets with E E f0.1, 8, oc). The exposure differs between the adaptations only for xa and approaches random guessing (values close to 1.44) for {0.1, 8).
SAMSum
Garman Wik!
Awerage
Cnnryy Prafic Type
Adaptation Tininy
LaRA
1.85
1.26
2.50
1.59
Raaden
Full Fiee Time
6.91
1.77
1.25
5.76
1.43
1.43
6.35
1.00
1.59
Hoal Tise
1.88
1.75
1.77
4.44
1.43
1.42
3.16
1.50
1.59
Averago
133
5722
1332
2:11
332
131
LaKA
1.54
1.50
1.52
2,47
1.50
1.30
2.11
2.60
1,00
Vine
1
1.83
1.83
4.21
3.36
Sostute
1.20
1.30
1:31
1:33
3.20
1.50
Frezs Venasa
735
1377
1X11
1711
2117
-:2
6:25
2377
2:17
Ladkk
2.00
2.37
1,91
1.54
Hoal Fine-laee
3.05
1.55
1.06
3:30
1:34
1.76
3.15
1.53
1,80
Anstrae
471
196
154
2:33
1:35
1:27
435
-200
175
FJRA
182
1.01
3.54
1:44
1.40
1.16
1.40
Fall Tiae Teme
8m
1.9
1728
6,67
1:08
1:45
6:81
1.67
1.99
Houl Tiae-Tere
1.77
1.90
1.66
1:49
1.45
4.78
1.50
Aprraga
30

---

Published as a conference paper at ICLR 2026
Table 23: Canary Exposure for IID Datasets. We use the same setup in Table 22 and observe the same trends, with higher privacy leakage for Prefix tuning and Full Fine-Tuning than for LoRA and Head Fine-Tume -unnng.
Detasit
Bellooppe Val
Redkeppe Trai
Gilted Val
Parns Vel
Sireege
$33
271
132
3.30
1.41
1.23
2.19
1.8
0.5
Realen
6.99
2/4
4.38
5.83
1.55
1.8
535
2/01
2.0
3.35
6.54
1.20
4.2
1.53
Bolk
1.50
1.90
113
6.13
1.15
1338
131
1.54
244
1.35
3.55
Run
633
1.58
4.00
676
1.55
1.30
1.53
1.51
133
181
1.3
Lata
101
1.00
135
1.75
2.15
1324
13:00
1.1
1.08
1.00
Hed Frem
1.4
1.01
133
1.03
1.30
1.44
1.15
6457
1.00
1.77
770
110
130
6311
111
1:3
1:30
1113
139
173
Inat:
8.0
830
1.52
1.30
133
3:21
6015
0.50
1.85
1.23
3.55
475
438
130
-20
133
230
130
1112
3.11
125
200
Size of Subset
100
50
0.63
0.64
0.65
0.66
0.67
AUC
anxiv
X freelaw
openwebtext2
bookcorpus2
github
philpapers
books3
gutenberg
stackexchange
hackernews
ubuntu
enron
math
uspto
europarl
opensubtitles
wikipedia
Figure 8: Subset Size and Complexity. The effect of the pretraining data subsets' size and complexity on the incurred privacy leakage from the corresponding LLM adaptations. We evaluate the leakage using AUC and the Pythia BB adapted with 8.
C.6 COMPUTATIONAL COST ANALYSIS
To provide practical guidance on the computational efficiency of different adaptation methods, similarly to (Hanke et al. 2024), we measured the training time for each method on Pythia 1B under DP across all datasets. Since we use consistent data sizes and training epochs across all epsilon values, the reported training times are representative of the private training cost for each method. The results are listed Table
Table 24: Training Time (minutes) for Different Adaptation Methods on Pythia 1B. All methods trained under differential privacy.
Adaapaation Prenix
Dataset
SAMSum
German Wiki
Boskcorpus2 Val
Bookcoepust Train
Vil Gitbabb
Finc-tune
1ead Fine tuze
3.25
33
3.5
The results show clear efficiency differences: Head Fine-tune is the fastest (3.2-4.7 minutes), followed by LoRA (5.0-15.5 minutes), Prefix Tuning (16-18 18 minutes), and Full Fine-tune (18.2-20 minutes). Combining these cost measurements with our privacy and utility analysis (RQ6), LoRA provides the best overall tradeoff: it achieves strong empirical privacy protection, maintains competitive utility, and requires moderate computational cost, significantly more efficient than Full Fine-tune while offering better privacy than Head Fine-tune.
31

---

Published as a conference paper at ICLR 2026
3.0
0.
0.5
Los Diferaxe
Pffcrence
Loos Deference
Loos Diforence
(a) GitHuu
(b) Bookcorpus2
Figure 9: Overlap and IID data show the same amount of privacy leakage across training. The x-axis shows the difference between the initial pretrained loss and the evaluation loss. The y-axis represents the AUC score. We adapt Pythia IB with 8.
Exposure
3
2 2000
60
100
60
80
Sequence Length
Sequence Length
Full fine-tune
LoRA
Full fine-tune
LoRA
(a) Adversarial prefix length 10
(b) Adversarial prefix length 32
Figure 10: The privacy leakage comes mostly from the adversarial prefix and much less from the interaction between the prefix and the sample. We present the exposure when considering different lengths of canary prefixes after adapting Pythia IB on Github Val. The evaluation was done for = DC.
D INFLUENCE OF THE ATTACKER'S KNOWLEDGE
We can observe how impactful an attacker's knowledge about the target model and its pertaining data is. Specifically, under moderate privacy regimes (i.e., 8), RMIA (shadow) consistently achieves the best performance among models and datasets, as indicated in Table Table 17 However, the effectiveness of MIAs quickly drops off when we move more realistic scenarios, such as using pretrained model as shadow model or having no shadow models available at all.
To model attackers with varying levels of background knowledge, we use range of shadow models, including Pythia 14M, Pythia 100M, Pythia IB, Pythia 2.8B (Biderman et al.) (023). GPT-neox (Black) al. 202T). OLMo IB (Groeneveld et al.) 2024a). and GPT-2 (Radford al. 2019). Therefore, we can simulate various attacker capabilities and assess their impact on RMIA'S e effectiveness. As we can see Figure [T the choice of reference model has a small impact when attacking models fine-tuned on OOD data, even when architectural differences exist, such as between GPT-Neo 1.3B and OLMo IB. On the other hand, the MIA achieves higher success rates on IID data when targeting the Pythia 1B model.
Additionally, Figure 12 illustrates the performance of various potential reference models over time. We consistently observe the significant impact of knowing the target model's architecture, especially when the target and shadow models share the same architecture. The only exception to this pattern appears in of the OOD datasets, SAMSum.
32

---

Published as a conference paper at ICLR 2026
(a) SAMSum 20)
Bookcorpus2 Val (e 00)
A-M
SAMSum (c
(d) Bookcorpus2 Val 8)
Figure 11: Using at least one shadow model is crucial for RMIA, particularly for differentially private adaptations. We present the AUC using RMIA with different types of shadow models after adapting Pythia IB on Bookcorpus2 Val and SAMSum. The evaluation was done for e = {8, oo).
E LOSS VALUES
E. INITIAL LOss OF THE LLM
Table 25 shows the loss at initialization for each dataset for the pretrained model and for model adapted with an untrained Prefix Tuning.
Table 25: Initial Losses for the Pythia 1B model on different datasets. Standard refers to the model with default initialization, whereas Prefix refers to prepending an untrained Prefix Tuning to the hidden states.
Adsptation
Dataset
SAMSum
GermanWiki
Bookcorpas) Val
Bookcorpus2 Train
Gittlub Vil
Enron Val
0
0
Standard
2.747
3,011
2,997 3.534
1.539
2,388
Prolia Tuning
3.529
3.062
Table 26: Validation loss values for the Pythia 1B model on different adaptation datasets.
Bedkooppa2
Boskmmpe
Eacca
TilE
2311
170
2200
250
2003
$100
13730
1227
2257
2112
2213
2.8
1.34
1.00
4889
100
2.300
7,881
3770
2136
E.2 FINAL LOss AND UTILITY OF THE LLM
Table 26 shows the final loss on the validation set. The hyperparameters are chosen to have similar loss between different adaptations using the same dataset and E. We also present the loss for all other models in Tables 27 to 31 In Tables 33 to 38 we show that loss is an effective universal proxy for LLM utility. As evidence, present Rouge-1 (R1) and perplexity for Pythia 1B adapted each dataset. Since lower loss directly indicates higher utility, the reported loss reliably reflects model performance.
E.3 OUT-OF-DOMATE UTILITY
We also investigate the out-of-domain utility of adapted models. The evaluation should show how much of information not part of the adaptation set is influenced model is fine-tuned with DP. Our evaluations done for 8 and PB all datasets. The experiment done by
33

---

Published as a conference paper at ICLR 2026
62.5
60.0
52.5
50.0
Epach
Epoch
GLMo 1B
-.. Pythia 14M
Pythia 2.88
OLMo 18
Pythia 14M
Pyttia 2.88
GPT-Neo 1.38
Pythia 160M
Pythia 70M
GPT-Neo 1.38
Pythia 160M
PytNi 70M
GPT-2
Pretrained (1B)
GPT-2
Pretrained
(a) Bookcorpus2 Val
(b) Bookcorpus2 Train
60
58
56
AUC
50
48
Epoch
Epoch
GLMo 18
--- Pythia 14M
Pythia 2.88
OLMo 18
Pythia 14M
Pythia 2.88
GPT Nea 1.38
Pythia 160M
Pythia 70M
GPT-Neo 1.38
Pythia 160M
Pythi 70M
GPT-2
Pretr Pretrained Airrained (1B)
GPT-2
Pretrained (18)
(c) Enron Val
(d) Github Val
$2.5
56
51.5
$1.0
AUC
54
50.0
50
10 Epoch
10 Epoch
20
OLMo 16
-.- Pythia 14M
Pythia 2.88
OLMo 18
Pythia 14M
Pyttia 2.86
Neo 1.38
Pythia 160M
Pythia 70M
GPT-Neo 1.38
Pythia 160M
Pythia 70M
GPT-2
Pretrained (1B)
GPT:2
Protrained (18)
(e) SAMSum
(f) German Wiki
Figure 12: Further analysis of the effectiveness RMIA with pretrained models as a reference model. As extension of Figure 2 we fully fine-tuned Pythia IB with 8 using three additional IID datasets: Bookcorpus2 Train, GitHub Train, and GitHub Val.
34

---

Published as a conference paper at ICLR 2026
Table 27: Validation loss values for the Pythia 1.4B model on different adaptation datasets.
Duiteet
Samvezea
Germon Will
Tnolicerpnt:
Bookceepac2 Trals
Roornn Vol
8.1
Padis
8366
4.51
2.555
5:366
3-01
5857
3,37
1.562
2.56
1,00
2
2.913
Fall famo
2779
2.63
2338
2438
2,899
2.95
1885
3.85
3855
1,80
1487
3.90
468
1.500
1584
3.389
23833
2.313
3.00
2.866
1008
2483
2.33
3.88
2.891
3.23
3.94
3.20
1.500
1877
2389
2831
2.547
Table 28: Validation loss values for the Pythia 410M model on different adaptation datasets.
Dutaett
Sunweze
Germon Will
Toolcceppnt
Bookceepac2 Trals
Vol
Kournn Voll
0.1
2337
1313
7327
33397
X333
4:013
1783
4-702
21100
1-700
1-101
319%
3315
Fall famo
2.415
1,00
1.80
2892
3.84
10.00
1.00
3,97
3.905
1.85
1466
3.55
1881
1.708
8616
2.455
3315
5.8
3483
3013
8383
2877
1322
1846
1129
3438
3733
1406
3-40
4002
1721
2880
2383
Table 29: Validation loss values for the Pythia 160M model on different adaptation datasets.
Adaptation
Dataett
Sunpars
Geranas Wai
Beadccepas) Vol
Booksegann Teais
Gilbab Val
Euroo Vall
0.1
0.1
3,315
1,35
2313
13T1
1238
X37
330
1201
3.003
2311
1338
1178
14t
3339
31133
Fall
2488
6300
1062
3385
3554
4.34
1.6
3882
3442
1.50
1003
1200
3583
3.344
3332
Had Faan Aene
2880
1883
1455
34.
3485
488
1a0
3417
3.90
1439
1.99
1.801
2111
2312
1467
108
1004
3.68
Table 30: Validation loss values for the Pythia 70M model on different adaptation datasets.
Adaptation
Dutantt
SunDars
Germna Wai
Boddccepend Vol
Booderegani Teais
Gitbab Val
Euroo Voll
0.1
0.1
23333
1520
+20
4351
30711
X30
$158
33330
8:171
21004
1111
3:13
Tall
3330
1.850
1828
3882
4.138
4.333
3,906
3.800
40355
1207
33581
4.001
3.402
3.74
3.425
3.597
3.992
Had Fic- k000
1:108
136
4.888
3997
4.00
4.348
1.19
53455
5,991
1.665
1966
3,802
3.413
1.115
1.60
3514
31337
4.307
Table 31: Validation loss values for the GPT-Neo 1.3B model on different adaptation datasets.
Akkgtution
Dataet
German
Budiccrpac
Beoknoppec Train
Val
Fouue Val
Pedls
1S54
12,00
1.955
12500
15.10
5.005
11.000
12:002
4.90
12.119
12:802
2,00
11.50
11.90
4.5
12,000
12.23)
Fall enae
3.44
2,00
3.78
3.58
3.00
6335
3383
3.500
4.300
3331
3.50
4.388
3.866
8.471
3471
3344
5.655
3,500
2447
2.80
6.336
3.389
111
X150
3759
730
335
355
3.705
4.755
Table 32: Validation loss values for the GPT-Neo 125M model on different adaptation datasets.
Adaptttiinn
Hasicoopac
Benkeorpen
1.m.
LoRA
3.044
1,770
1873
3343
1711
3.0
1.991
3440
3.504
1/93
3-402
1466
1.585
1.500
3.766
3.57
3,755
Full Enciaac
6927
1513
115
1.00
160
1.05
5355
4355
1438
4.80
1454
1761
3.955
370
7308
631
432
7981
100
480
0.50
3.20
687
7.88
1287
4322
4276
3137
6,110
Table 33: Performance metrics comparison for Pythia 1B model adapted to SAMSum with different
adaptation methods.
Adaptation
Metric
Score
Perplesity
Pretix Toming
4309
12.52
8.306
8.895
14.801
LoKA
44.00
28.44
17.58
N.279
8.806
10.890
Full Fine Time
44.33
38.81
21.47
8,070
8,794
13,882
Head Fisc- Tune
31.25
26.51
15.34
9.584
10.038
14.708
Average
40.7
8.500
9.148
adapting the model with each dataset, and subsequently evaluating the loss of every other dataset, that is considered out-of-domain. The results can be seen Tables 33al to 39d The rows of the tables show the dataset used for adaptation, and the columns the dataset used for evaluation. We report the loss values here. Overall, the results demonstrate that the DP adaptations improve performance on the target (source) datasets, with only minimal effect on utility for of tasks. We the highest variance in the results for Prefix-tuning. This is due to the higher perturbation introduced through the prefix in the hidden-space.
35

---

Published as a conference paper at ICLR 2026
Table 34: Performance metries comparison for Pythia IB model adapted GermanWike with different adaptation methods.
Adaptation
Metrie
Ronge- Store
Perplesity
0..
N
11.1
Pretix Timing
14.13
10.95
9.32
13.305
15,456
17.082
LoRA
14.19
13.171
15.441
Pull Fine- Tine
14.97
12.337
Fire- Tume
14.70
13.118
15.343
Average
14.30
12.7
11.7
12.93
15.379
16.219
Table 35: Performance metries comparison for Pythia IB model adapted to Bookcorpus2 Train with different adaptation methods.
Adaptation
Metric
Ronge= Store
Perplesity
11.1
Predix Timing
22.50
19.125
Hull Fine Tine
20.40
18.09
17:93
18.803
20,065
20.655
Hoad Fine-Tune
18.18
18.05
18.01
19.067
20.227
78.191
Average
2091
17.85
17.30
19.111
20.116
24,093
Table 36: Performance metrics comparison for Pythia IB model adapted to Bookcorpus2 Val with different adaptation methods.
Adaptation
Metric
Rouge-1
Perplesity
Freiix Teming
21.45
17.43
14.76
20.025
19,965
29.656
LoRA
20.44
17.48
17.33
19,668
20.126
20.146
Full Fine: Tine
18:56
17.10
17.02
19.258
19,955
20.491
Head Fino-Tume
17.09
17.33
17.31
19.414
20.136
27.994
1939
19.001
20.051
Table 37: Performance metrics comparison for Pythia IB model adapted to Github Val with different adaptation methods.
Adaptation
Rouge-I Score
Perplexity e-8
0..1
oc
0.1
Picix Tuning
26338
26.72
13.49
4,34%
4.745
7,759
LoRA
24.79
29.93
29.52
4,749
4.816
4.749
Full Fine-Tune
20.5
Average
27.63
25.31
2533
4,8%0
4.792
3,786
Table 38: Performance metrics comparison for Pythia 1B model adapted to Enron Val with different adaptation methods.
Adaptation
Metric
Rouge-1 Score
Pesplesity
0.1
0.1
Timing
2132
20.125
Full Fine-Time
Head Uine Tune
21.05
19.75
19.22
11.123
11,056
12,629
Average
2065
19.85
18.06
10.907
11.001
13.745
F EXPOSURE ESTIMATION
There are two common ways to estimate the exposure (Carlini et al. 2019): (1) by sampling and (2) by distribution modeling. Figure 13 shows that the two approximations non-member samples. To statistically show the correlation, we use the Pearson correlation test, where the null hypothesis is that the distributions underlying the samples uncorrelated and normally distributed. The data yields an extremely small palue,, indicating a strong linear correlation between the two approximation methods.
similar when using 256
36

---

Published as a conference paper at ICLR 2026
Table 39: Out-of-Domain Performance Pythia-IB adapted with = 8 and reported the loss. The rows of the tables show the dataset used for adaptation, and the columns the dataset used for evaluation.
aa Prefix Tuning
Train
Frod
SAMBhm (U0B)
GermanWikd (OUD)
Bookcerpud Val (ID)
Beskerepaac Train (Overlap)
Gilbub Val (II))
Earen Val
113)
Benkerpuu (1B
199)
3.55
2393
1.921
1.855
1.447
Beskeurus Trai (hhorlap)
4868
1764
1000
19944
1880
2,000
Val (II)
2,907
5/38
2.46
No Adaytatiion
2747
27732
3011
3.917
1,50
2,388
(b) LoRA
Train
SAMSum (000)
Tookeorpud Val (tb)
Bankcopucc Train
Gitbab Nat
Taran Val
SAMiuu (OOD)
4.62
3730
3010
1/004
2.5%6
Beokoopps2 (Ttb)
144
2.732
3.07
2.956
2.585
Bechompacc Train (Overlap))
146
1.733
3,000
1/11
1.538
3.58
Galub (tt)
147
2731
1011
1.997
1.572
3.587
Adtaptations
2233
3001
1997
1.30
2,086
(c) Full Fine-Tume
Iraiin
SAMSun
GermanWkii
Bookceepud (ID)
Brekespaa2
Gitbab Val
235T
2735
2005
12311
1:51
2.72
Germant
2.50
Beskoweyac Train (Overlap)
2345
1234
3
1,955
1.537
2,347
Galbab Val (UD)
344
1231
3,00
1995
1.566
2.505
3753
1011
3.917
1.550
3.588
(d) Head Vine-Tune
Train
Frol
SAMSem (UDD))
GermanWild (OUD)
Boskcrrpud Val (ID)
Beskerepuct
Gitbab Vat (IID)
Enren
S3385m
Hinkkropuc Val (Tt))
3747
3.54
3.947
1.55
Benkourucc Train (hwrlap))
2347
3.333
1011
3
1.570
1001
(tt))
3751
1011
1.556
No Adaptatios
2347
2.732
3.011
1.91
1.50
23355
6
Sampling
Model Exposure
y=0.99x0.01 value: 4.16c
Figure 13: The two ways to approximate the exposure are similar. The relation between the model exposure and sampling exposure. The p-value related the Pearson correlation test.
G MEMORIZATION OF THE PRETRAINED MODEL
Table 40 shows the number of memorized samples the pretrained model.
Table 40: Set of memorized samples identified from the subsets of the Pile dataset.
Subset
GitHub
Bookcorpusz
Karon
ArXiv
CC
KuroPPrl
Freelaw
USPTO
Wildpedia
Momerized Samples
192
18
2
37

---

Published as a conference paper at ICLR 2026
H RMIA HYPERPARAMETERS
We focus on the importance of y, as a has a much more limited effect, and we set to O. Figure [4 shows the importance and y and suggests that y is often the best choice. We omit for simplicity, but a similar trend can be observed for the other settings.
I BROADER IMPACT
Recognizing a potential underestimation of privacy risks in adapted LLMs due to insufficient empirical analysis of the combined effects of pretraining and adaptation, we conduct a rigorous benchmark. Our work offers impact by providing the community with clear guidance on privacy-preserving strategies, suitable adaptation techniques, thus contributing to more privacy-awar adapting LLMs.
1.0
0.9
AUC
0.7
0.6
0.5
10a
101
10a
107
tune fine-tune
fine tune-tune
(a) 8.0
Figure 14: 1 is a strong baseline. We present the AUC using RMIA with different types of values of y after adapting Pythia IB on SAMSum. The evaluation was done for {8, 20).
Furthermore, holistic privacy auditing framework in the pretrain- paradigm stands out by providing comprehensive privacy assessment across the entire pipeline rather than isolated stages. Previous methods focus the separated stages, thus overlooking interactions that can influence the data leakage. Our approach equips practitioners with the tools to trace privacy risks across a model's lifecycle. Let's consider case with the LLM adapted to the medical domain with private data from one hospital. An individual finds their data can be extracted, raising the question: "Does the leakage come from the pretraining data, the hospital's 's fine-tur fine-tuning data, or both?" Traditional auditing frameworks fail to cover cases where data appears in both stages or becomes extractable only after adaptation. However, by framing each audit as an adversarial game, our framework quantifies and localizes privacy risks, thus offering reproducible evaluations across models and datasets.
J LIMITATIONS
This work focuses solely on auditing the private adaptations and leakage from pretraining data after adaptations. However, as we show, for holistic privacy auditing under the pretrain-adapt paradigm, we need ways to audit all process stages (jointly). We also focus only subset of models, particularly leaving out state-of-the-art closed models, such as GPT-4, given that they cannot easily be adapted with DP as of the current API specification.
38


Reviews:
[{"review_id": "gyMwLNgVIY", "reviewer": "Reviewer_61VY", "summary": "This work tests how well Differential Privacy (DP) protects sensitive information when adapting Large Language Models (LLMs) to new data. The authors evaluate a variety of DP adaptation methods including Prefix Tuning, LoRA, Full Fine-Tune, and Head Fine-Tune. They evaluate if they can identify (membership inference attack) or extract (data extraction attacks) specific data used during adaptation. They test this for 4 different types of data: overlapping data, in distribution data, out of distribution data and canary data (only used for extraction). They evaluate seven pretrained models such as Pythia, GPT-Neo and OLMo that are all trained on the Pile dataset. The authors provide 5 interesting insights from these experiments such as\n- Higher privacy regime is required for data closer to the pretraining distribution for similar empirical privacy.\n- Efficient methods like LoRA generally offer better privacy than full fine-tuning\n- Common privacy settings (like $\\epsilon=8$) aren't strong enough to stop powerful attacks\n- The performance of MIAs highly depends on the attacker’s knowledge of the target model and pretraining data\n\nFinally, the authors also provide a new way to holistically audit the privacy of pretraining and private adaptation together.", "questions": "- Could the authors clarify measure the distributional closeness of the OOD vs IID datasets used?\n- This might be a stretch but I think it might be interesting to compare a DP pretrained model like VaultGemma in this comparison as well. It is recently released and the dataset is not publicly known but it might be a nice addition to this analysis.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "- The paper evaluates a common paradigm of adapting non-privately pretrained LLMs with sensitive data using privacy preserving mechanisms.\n- Very systematic evaluation of empirical privacy risks when varying different parameters like distance of private data from pretraining, type of adaptation and attacker knowledge.\n- Covers a large number of models and adaptation mechanisms.", "weaknesses": "- Only 2 epsilons are evaluated, 0.1 which is considered very private and 8 which is considered pretty large. Would be nice to also have something in the middle.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5T9ynFc9Un", "reviewer": "Reviewer_DyRT", "summary": "This paper examines how well differential privacy protects sensitive data during large language model adaptation. It studies privacy risks under various data relationships, including overlapping, in-distribution, and out-of-distribution cases, and across several adaptation methods such as full fine-tuning, LoRA, and prefix tuning. The findings show that privacy leakage increases when adaptation data closely matches pretraining data, even without direct overlap, while LoRA offers the strongest empirical protection for out-of-distribution data. The authors also propose a holistic privacy auditing framework that evaluates risks throughout the entire lifecycle of an LLM from pretraining to adaptation to ensure responsible use in sensitive domains", "questions": "please see above", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper provides a thorough empirical evaluation across multiple datasets, adaptation methods, and privacy regimes, offering one of the most systematic analyses of differential privacy in LLM adaptations.\n\n2. The introduction of a structured framework for auditing privacy across pretraining and adaptation stages is a novel and forward-looking contribution, addressing a key gap in existing LLM privacy research.\n\n3. The work directly informs real-world use of LLMs in sensitive domains, helping bridge the gap between theoretical guarantees of differential privacy and practical, empirically validated protection.", "weaknesses": "1. The most contradictory finding concerns Prefix Tuning: in data extraction attacks against adaptation data (RQ3), it was found to be the most vulnerable method. However, regarding the \"forgetting\" effect on pretraining data (RQ5), it suddenly became the most effective, showing the least leakage. The paper points out these phenomena but does not deeply explain why this trade-off exists. This makes the question of \"which method should practitioners choose?\" very ambiguous.\n2. The paper's core finding is that \"distributional closeness is the main driver of risk\". However, the paper's definition of \"closeness\" is purely categorical, namely \"Overlap, IID, and OOD. This categorization is very coarse. The paper provides no quantitative metrics (e.g., Wasserstein distance or KL divergence using word embeddings) to measure the actual distributional distance between the pretraining and adaptation data. This makes the core conclusion, while intuitive, methodologically less rigorous. In practical applications, if two datasets are not clearly IID or OOD, the paper's conclusions are difficult to apply for guidance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Aoc0xovaUt", "reviewer": "Reviewer_ZdyA", "summary": "This work studies privacy risks under DP adaptations in LLMs, using robust membership interference and canary data extraction. They study the effects of overlaps and interdependencies of the pretraining data with the adaptation data, using exact overlaps, in-distribution data and out-of-distribution data. They also study the vulnerability for different adaptation methods and different privacy regimes. The authors find that the data distribution strongly affects the privacy vulnerability, and that parameter-efficient fine-tuning methods, such as LoRA, achieve the highest empirical privacy protection for OOD data.", "questions": "- How could this work apply to closed-source models? Are there any tools or insights from this work that could apply there?\n- Are there explanations on why different adaptation methods perform better than others?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- This work studies a comprehensive range of datasets, adaptation methods, and different LLMs with a range of sizes.\n- The authors run experiments on a range of IID and OOD datasets, and are able to show empirical trends on how the IID settings have higher privacy vulnerabilities than OOD settings.\n- This work is highly relevant to practical applications using DP with LLMs.", "weaknesses": "- The experiments could be run on a wider range of privacy parameters (the authors only use $\\epsilon=0.1, 8$ and the nonprivate setting).\n- The authors discuss the privacy-utility tradeoffs for the different methods in the appendix. However, this is quite an important topic and I think it is worth moving this to the main paper. Similarly, it would also be useful to include some discussion on the costs of the different methods and the tradeoffs with privacy and utility.\n- The authors propose a new framework for holistic privacy assessment using adversarial games, but it would help to give examples to demonstrate how this framework would help in practice.\n- This work only focuses on open-source models, and it is unclear how to generalize the results to close-source models where the pretraining data distribution is not known.\n- The work is empirical and does not give any theoretical explanations, for instance on why some adaptations have lower vulnerability than others.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "BZ3eKazKLW", "reviewer": "Reviewer_hzjs", "summary": "This paper presents a comprehensive benchmark to quantify and compare the empirical privacy protection abilities of large language models with differential privacy guarantees. The proposed benchmark leverages robust membership inference and canary data extraction to investigate the potential privacy risks. Unlike prior works, the benchmark considers data distributions of adaptation data and pretraining data. Both in-distribution cases and out-of-distribution examples are carefully studied. Moreover, the benchmark covers various LLMs, adaptation methods, privacy budgets and datasets to perform extensive evaluations. Experimental results show insights on several research questions.", "questions": "1. How do the authors justify using perplexity and validation loss as sufficient indicators of model utility under differential privacy? Have the authors explored fine-tuning under DP constraints to assess out-of-domain task utility?\n\n2. How do the authors expect their findings to scale with larger models such as OLMo 2 7B or Qwen2.5/3 architectures?\n\n3. Could the authors define “holistic privacy audits” more precisely? How does it differ from existing auditing frameworks?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The paper is well written with clear motivations. The empirical privacy risk assessment is an important task for DP-protected LLMs.\n\n2. The paper systematically studies the relationship between the pretraining data and the fine-tuning data (adaptation data). Different datasets are considered for both in-domain and out-of-domain setups.\n\n3. Comprehensive experiments are conducted with new robust MIA attacks and exposures.", "weaknesses": "1. My major concern is the evaluation of the utility part. According to the paper, only C.6 and E.2 discuss the privacy-utility tradeoff. Yet, utility is crucial when using various $\\epsilon$, under a strict budget $\\epsilon = 0.1$, if the model cannot handle the downstream tasks at all, DP tuning will be meaningless. However, the paper only evaluates perplexity and validation loss as the utility indicator. Such utility metrics are not feasible or representative of the utility performance. A more comprehensive utility evaluation should be properly studied.\n\n2. The evaluated LLMs are rather small-scale and outdated. I would encourage OLMo 2 7B to study how the size of LLMs affects privacy performance.\n\n3. Clarity regarding section 6. I am quite confused about the privacy auditing mentioned here. I think more background and explanations on holistic audits would be helpful to understand this section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Oral)