The DOI matches its Crossref record; 47 of the 47 references it cites were found in a registry or an index.
Information Leakage in Embedding Models
Abstract
Embeddings are functions that map raw input data to low-dimensional vector representations, while preserving important semantic information about the inputs. Pre-training embeddings on a large amount of unlabeled data and fine-tuning them for downstream tasks is now a de facto standard in achieving state of the art learning in many domains.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Training data extraction attacks have until now been limited to small LMs trained on academic datasets under artificial training setups (e.g., for more epochs than typical) [8, 66, 68, 73], or settings where the adversary has a priori knowledge of the secret they want to extract (e.g., a social security number) [8, 27].”
From Extracting Training Data from Large Language Models (2020) · cites this paper as [66]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., & Polosukhin, I. (2017) · arXiv · doi:10.48550/arxiv.1706.03762 · Cited by 120,404
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
Hochreiter, S., & Schmidhuber, J. (1997) · Neural Computation · doi:10.1162/neco.1997.9.8.1735 · Cited by 102,318
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018) · arXiv · doi:10.48550/arxiv.1810.04805 · Cited by 73,173
Distributed Representations of Words and Phrases and their Compositionality
Mikolov, T., Sutskever, I., Chen, K., Corrado, G., & Dean, J. (2013) · arXiv · doi:10.48550/arxiv.1310.4546 · Cited by 24,533
Convolutional Neural Networks for Sentence Classification
Kim, Y. (2014) · Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.3115/v1/d14-1181 · Cited by 14,831
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks
Reimers, N., & Gurevych, I. (2019) · Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP) · doi:10.18653/v1/d19-1410 · Cited by 12,778
node2vec: Scalable Feature Learning for Networks
Grover, A., & Leskovec, J. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939754 · Cited by 10,926
Enriching Word Vectors with Subword Information
Bojanowski, P., Grave, E., Joulin, A., & Mikolov, T. (2017) · Transactions of the Association for Computational Linguistics · doi:10.1162/tacl_a_00051 · Cited by 9,645
Research works printed but not linked: 35
- Alon Uri, 2019, code2vec: Learning distributed representations of code. POPL
- Cer Daniel, 2018, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, et almbox.
- Chi Jianfeng, 2018, Privacy Partitioning: Protecting User Data During the Deep Learning Inference Phase. arXiv preprint
- Chidambaram Muthuraman, 2018, Learning cross-lingual sentence representations via a multi-task dual-encoder model. arXiv preprint
- Choi Edward, 2016, Andy Schuetz, Walter F Stewart, and Jimeng Sun.
- Dolan William B, 2005, International Workshop on Paraphrasing .
- Alexey Dosovitskiy and Thomas Brox. 2016a. Generating images with perceptual similarity metrics based on deep networks. In CVPR . Alexey Dosovitskiy and Thomas Brox. 2016a. Generating images with perceptual similarity metrics based on deep networks. In CVPR .
- Yaroslav Ganin and Victor Lempitsky. 2015. Unsupervised domain adaptation by backpropagation. In ICML . Yaroslav Ganin and Victor Lempitsky. 2015. Unsupervised domain adaptation by backpropagation. In ICML .
- Hannun Awni, 2014, et almbox
- Hayes Jamie, 2019, LOGAN: Membership inference attacks against generative models. PETS
- Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2016. Deep residual learning for image recognition. In CVPR . Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2016. Deep residual learning for image recognition. In CVPR .
- Henderson Matthew, 2017, Efficient natural language response suggestion for smart reply. arXiv preprint
- Kannan Anjuli, 2016, et almbox
- Kingma Diederik P, 2014, Adam: A method for stochastic optimization. arXiv preprint
- Ryan Kiros Yukun Zhu Ruslan R Salakhutdinov Richard Zemel Raquel Urtasun Antonio Torralba and Sanja Fidler. 2015. Skip-thought vectors. In NeurIPS . Ryan Kiros Yukun Zhu Ruslan R Salakhutdinov Richard Zemel Raquel Urtasun Antonio Torralba and Sanja Fidler. 2015. Skip-thought vectors. In NeurIPS .
- Lan Zhenzhong, 2019, Albert: A lite bert for self-supervised learning of language representations. arXiv preprint
- Li Meng, 2017, PrivyNet: A Flexible Framework for Privacy-Preserving Deep Neural Network Training. arXiv preprint
- Nasr Milad, 2018, Comprehensive privacy analysis of deep learning: Stand-alone and federated learning under passive and active white-box inference attacks. arXiv preprint
- Olshausen Bruno A, David J Field., 199
- Osia Seyed Ali, 2018, Minos Katevas, Hamed Haddadi, and Hamid RR Rabiee.
- Pan Xudong, 2020, Privacy Risks of General-Purpose Language Models. In 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 1314--1331
- Pennington Jeffrey, 2014, Glove: Global vectors for word representation. In EMNLP .
- Radford Alec, 2019, Language models are unsupervised multitask learners. arXiv preprint
- Rajkomar Alvin, 2018, et almbox
- 2016, arXiv preprint
- Ruder Sebastian, 2016, Character-level and multi-channel convolutional neural networks for large-scale authorship attribution. arXiv preprint
- Salem Ahmed, 2018, Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint
- Sankararaman Sriram, 2009, Genomic privacy and limits of individual detection in a pool. Nature genetics
- Song Congzheng, 2019, 2019 b. Overlearning Reveals Sensitive Attributes. arXiv preprint
- Sean Welleck Zixin Yao Yu Gai Jialin Mao Zheng Zhang and Kyunghyun Cho. 2018. Loss functions for multiset prediction. In NeurIPS . Sean Welleck Zixin Yao Yu Gai Jialin Mao Zheng Zhang and Kyunghyun Cho. 2018. Loss functions for multiset prediction. In NeurIPS .
- Wiebe Janyce, 2005, Annotating expressions of opinions and emotions in language. Language resources and evaluation
- Qizhe Xie Zihang Dai Yulun Du Eduard Hovy and Graham Neubig. 2017. Controllable invariance through adversarial feature learning. In NeurIPS . Qizhe Xie Zihang Dai Yulun Du Eduard Hovy and Graham Neubig. 2017. Controllable invariance through adversarial feature learning. In NeurIPS .
- Yang Yinfei, 2018, Learning semantic textual similarity from conversations. arXiv preprint
- Yang Zhilin, 2019, XLNet: Generalized Autoregressive Pretraining for Language Understanding. arXiv preprint
- Chiyuan Zhang Samy Bengio Moritz Hardt Benjamin Recht and Oriol Vinyals. 2017. Understanding deep learning requires rethinking generalization. In ICLR . Chiyuan Zhang Samy Bengio Moritz Hardt Benjamin Recht and Oriol Vinyals. 2017. Understanding deep learning requires rethinking generalization. In ICLR .
Cited by
A survey on large language model (LLM) security and privacy: The Good, The Bad, and The Ugly
Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., & Zhang, Y. (2024) · High-Confidence Computing · doi:10.1016/j.hcc.2024.100211 · Cited by 1,083
Extracting Training Data from Large Language Models
Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., et al. (2020) · arXiv · doi:10.48550/arxiv.2012.07805 · Cited by 727
A Survey of Privacy Attacks in Machine Learning
Rigaki, M., & Garcia, S. (2024) · ACM Computing Surveys · doi:10.1145/3624010 · Cited by 285
AI agents under threat: A survey of key security challenges and future pathways
Deng, Z., Guo, Y., Han, C., Ma, W., Xiong, J., Wen, S., & Xiang, Y. (2025) · ACM Computing Surveys · doi:10.1145/3716628 · Cited by 210
What Does it Mean for a Language Model to Preserve Privacy?
Brown, H., Lee, K., Mireshghallah, F., Shokri, R., & Tramèr, F. (2022) · 2022 ACM Conference on Fairness Accountability and Transparency · doi:10.1145/3531146.3534642 · Cited by 165
Metadata
- Authors
- Song, C., & Raghunathan, A.
- Affiliations
- Cornell University & Google Brain, New York, NY, USA
- Facebook & Google Brain, Melon Park, CA, USA
- Venue
- Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2020-10-30
- Pages
- 377-390
- Cited by
- 175
- References
- 47
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Information Leakage in Embedding Models. https://app.cochat.ai/papers/10.1145/3372297.3417270
- The paper
- Song, C., & Raghunathan, A. (2020). Information Leakage in Embedding Models. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. https://doi.org/10.1145/3372297.3417270
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
