What Gradients Add to Text Leakage in Split Language Models, Counted per Token and per Document

Split-language-model gradients boost token recovery to 97.38% and document reconstruction to 37.77%, so split traffic requires per-token and per-document leakage reporting.

Georgios Politis, Evangelos Pappas

Published Oct 2, 2026 · ▲ 8 on Hugging Face

Protecting Privacy in Multimodal Large Language Models with MLLMU-Bench

MLLMU-Bench evaluates privacy risks in multimodal large language models via standardized leakage and inference benchmarks.

Zheyuan Liu, Guangyao Dou, Mengzhao Jia, Zhaoxuan Tan and 3 more

Published 2025 · 5 citations

Verification of Machine Unlearning is Fragile

Verification of machine unlearning is fragile because model providers can circumvent verification strategies and retain supposedly unlearned data.

Binchi Zhang, Zihan Chen, Cong Shen, Jundong Li

Published Aug 1, 2024 · 0 citations

On the Price of Privacy for Language Identification and Generation

Xiaoyu Li, Andi Han, Jiaojiao Jiang, Junbin Gao

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Privacy Meets Hierarchy: Differentially Private Distributed Trilevel Learning

Yang Jiao, Kai Yang

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

DP-EGGROLL: Centered Fitness-Vector Privatization for Backprop-Free Differentially Private Optimization

David T Zagardo

Paris Poster Session 4, Thu, Dec 10, 5:30 PM–7:30 PM, Paris Poster Hall · Published 2026

I2V-DETACH: Source Grounding Detachment for Unauthorized Image-to-Video Generation

Chanhui Lee, Yeonghwan Song, Yewon Kang, Jeany Son

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Tail Wags the Model: Generalization and Membership Privacy Trade-offs of Sharpness-Aware Minimization

Young In Kim, Rajiv Khanna

Atlanta Poster Session 3, Thu, Dec 10, 10:00 AM–1:00 PM, Hall C1 · Published 2026

GraphIP–Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

Kaixiang Zhao, Bolin Shen, Yuyang Dai, Shayok Chakraborty and 1 more

Atlanta Poster Session 3, Thu, Dec 10, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Privacy-Preserving Retrieval-Augmented Generation with Plausible Deniability

Wenxuan Bao, Shan Jin, Vincent Bindschaedler, Yiwei Cai

Atlanta Poster Session 1, Wed, Dec 9, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Optimal Rates for Adaptive Private $k$-PCA

Johanna Düngler, Amartya Sanyal

Paris Poster Session 4, Thu, Dec 10, 5:30 PM–7:30 PM, Paris Poster Hall · Published 2026

Benchmarking Membership Privacy Risks in Preference-Based LLM Post-Training

Lorenzo Rossi, Kaif Shaikh, Franziska Boenisch, Adam Dziedzic

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Auditing Privacy Leakage in Tabular Foundation Model Embeddings

Xun Wang, Adam Dziedzic, Michael Backes, Franziska Boenisch

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Guarding the Life Code: Preserving Membership Privacy in Genomic Foundation Models

Xinyu Zhao, Jinhao Duan, Zhen Tan, Tianlong Chen

Atlanta Poster Session 6, Fri, Dec 11, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Ask in the Crowd: Differentially Private LLM Inference via Dummy-Augmented Shuffling

Zhihao Liu, Zixiong Guo, Shuo Shao, Yu He and 4 more

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

How Private is Private? A Comparative Study for Face De-Identification

Hui Wei, Hao Yu, Hui Kuurila-Zhang, Guoying Zhao

Sydney Poster Session 2, Tue, Dec 8, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

LDPCache: Locally Differentially Private Multi-Query Processing with Cache Optimization for Large Language Models

Haoqiang Shi, Ning Wang, Chuan He, Qian Ma and 4 more

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Towards Hyperparameter Transfer for Differentially Private Optimization

Tianze Wang, Zhiqi Bu, Linjun Zhang

Atlanta Poster Session 2, Wed, Dec 9, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Auditing Single-Query Recoverability in Self-Supervised Representations

zirui wang, Guangqiang He, PangWu, Peng Wang and 4 more

Sydney Poster Session 2, Tue, Dec 8, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Personalized Safety in Federated Fine-Tuning of Large Language Models

Tianzhe Xiao, Gaozhuo Liu, Yichen Li, Haozhao Wang and 3 more

Paris Poster Session 4, Thu, Dec 10, 5:30 PM–7:30 PM, Paris Poster Hall · Published 2026

EntiRE: Invariant Learning for Robust Concept Erasure in Text-to-Image Generative Models

Fengyuan Yu, Yuyuan Li, XiaoHua Feng, Li Zhang and 4 more

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

The Price of Locality in Label Privacy: Optimal Rates for Classification and Regression

Zongrui Zou, Mina Dalirrooyfard, Jingcheng Liu, Jalaj Upadhyay

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

On Differential Private $\ell_1$, $\ell_2$ and $\ell_p^p$ Distance Queries

Erzhi Liu, Jerry Yao-Chieh Hu, Alex Reneau, Zhao Song and 1 more

Sydney Poster Session 2, Tue, Dec 8, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

A Private Empirical Defense Against Privacy Audits

Saloni Modi, Srivi Balaji, Yusong Zhu, Gautam Kamath and 1 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Budget-Conditioned Clipping Policies for Differentially Private Federated Learning

Hao Zhou, SiQi Cai, Hua Dai, Letian Sha and 2 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

MUTE: Multi-Level Alignment Uncoupling Against Talking-Head Exploitation for Voice Protection

Donghyun Kim, Jin Hong, seungmin Kim, Dain Kim and 2 more

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Position: LLM Privacy Requires a Lifecycle-Wide Approach

Niloofar Mireshghallah, Tianshi Li

Atlanta Poster Session 4, Thu, Dec 10, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Don't Deploy Fine-Tuned Genomic Foundation Models Without Privacy Evaluation: Reconstruction Vulnerability Is Unpredictable Without Empirical Measurement

Reem Al-Saidi, Erman Ayday, Ziad Kobti

Atlanta Poster Session 5, Fri, Dec 11, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Inference for Many Quantiles under Local Differential Privacy

Qirui Hu, Yi Liu

Atlanta Poster Session 1, Wed, Dec 9, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Felid: A Flexible and Efficient Design for Transformer Fine-Tuning over Encrypted Data

Linru Zhang, Jun J Sim, Xiangning Wang, Jiahao Zhong and 10 more

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Shared-Noise Mechanisms for Verifiable Differentially Private Counting

Sehyeon Park, Chenglin Fan

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Settling Pure Differentially Private Covariance Estimation

Tommaso d’Orsi, Gleb Novikov, Walter McKelvie

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

On Differentially Private Mechanisms for Linear Regression

Bardiya Aryanfard, Monika Henzinger, Farhood Rostamkhani

Paris Poster Session 1, Wed, Dec 9, 12:30 PM–2:30 PM, Paris Poster Hall · Published 2026

Improved Robust Verifiable Federated Learning Based on Packed Secret Sharing

Jinhyuk Choi, Hyung Tae Lee

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Evaluating an Evaluation: Membership Inference Attacks as Machine Unlearning Diagnostics

Umid Suleymanov, Laman Aliyeva, Nihat Abdullayev, Saida Zarbiyeva and 1 more

Atlanta Poster Session 4, Thu, Dec 10, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Local FDR Membership Inference Attacks: Multiple Testing and the Role of Ridge Regularization

Jinyoung Hong, Bonwoo Lee, Jeongyoun Ahn

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Optimal Byzantine-resilient Federated Learning with User-level Differential Privacy

Ming Xiang, Stratis Ioannidis, Edmund Yeh, Carlee Joe-Wong and 1 more

Atlanta Poster Session 4, Thu, Dec 10, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Private Online Prediction from Experts with Small Losses

Bo Li, Peng Ye

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Estimating Model-Level Membership Inference Vulnerability Without Reference Models

Euodia Dodd, Natasa Krco, Igor Shilov, Matthew R Wicker and 1 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Asymptotically Optimal Best Arm Identification with Fixed-Budget under Differential Privacy

Keqin Chen, Jie Bian, Yulian Wu, Vincent Tan

Sydney Poster Session 2, Tue, Dec 8, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

On the Feasibility of Identity Manipulation for Diffusion-Based Face Privacy Preservation

Xuemei Jia, JIAWEI DU, Jiawei Liu, xin zhang and 3 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

How Far Are VLMs from Privacy Awareness in the Physical World? An Empirical Study

Junran Wang, Xinjie Shen, Zehao Jin, Pan Li

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Privately Clipping Heavy-Tailed Data

Matthew Joseph, Alex Kulesza

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Online Allocation with Differential Privacy

Jianyi Yang, Xingyu Zhou, Mostafa Mushsharat, Shaolei Ren

Atlanta Poster Session 2, Wed, Dec 9, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Exposing Private Corpus Leakage in Multimodal RAG

Yihao LIU, XINQI LYU, Dong Wang, Bin Xiao

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

A Generative Model of Contextual Integrity: Appropriate vs. Inappropriate Information Sharing

Omer Ebead, Juan Formanek, Joel Leibo

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Rank-Aware Differentially Private Release of Listwise Preferences for LLM Alignment

Junwei Chen, Manjiang Yu, Pengpeng Qiao, Yang Cao

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

CLIOPATRA: Extracting Private Information from LLM Insights

CLIOPATRA attacks privacy-preserving LLM insight platforms with malicious chats to leak target medical histories with nearly 100% precision in 65% of cases, showing layered heuristic protections are insufficient.

Meenatchi Sundaram Muthu Selva Annamalai, Emiliano De Cristofaro, Peter Kairouz

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Sampling-Free Privacy Accounting for Matrix Mechanisms under Random Allocation

Developing sampling-free Rényi divergence and conditional composition bounds improves privacy amplification for matrix mechanisms under random allocation without Monte Carlo sampling.

Jan Schuchardt, Nikita Kalinin

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Understanding Private Evolution as Learning-Augmented Clustering

Private Evolution is recast as learning-augmented clustering to derive tighter bounds via generative models and propose a geometry-aware variant with convergence guarantees.

Audra McMillan, Kunal Talwar, Felix Zhou

Atlanta Poster Session 1, Wed, Dec 9, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Shuffle and Joint Differential Privacy for Generalized Linear Contextual Bandits

Algorithms for generalized linear contextual bandits achieve shuffle-DP regret scaling as $\tilde O(d^{3/2}\sqrt{T}/\sqrt{\varepsilon})$ and joint-DP regret matching non-private rates plus additive privacy corrections without spectral assumptions.

Sahasrajit Sarmasarkar

Paris Poster Session 5, Fri, Dec 11, 11:30 AM–1:30 PM, Paris Poster Hall · Published 2026

Re-examining Low Rank adaptation for private LLM fine-tuning

DP-SGD noise inflates gradient singular values and disrupts decay, yet restoring fast decay improves private LLM fine-tuning efficiency without compromising privacy guarantees.

Ali Dadsetan, Frank Rudzicz

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Membership Inference on Synthetic Single-Cell Genomic Data

Membership inference attacks successfully identify training donors in synthetic single-cell RNA-seq data, revealing that leading generation methods inadequately protect privacy and leak more as donor counts drop.

Steven Golob, Patrick McKeever, Sikha Pentyala, Martine De Cock and 1 more

Paris Poster Session 2, Wed, Dec 9, 5:00 PM–7:00 PM, Paris Poster Hall · Published 2026

It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs

SELFCI uses complementary self-distillation to decouple information suppression from task resolution, improving contextual integrity without degrading utility.

Sangwoo Park, Woongyeong Yeo, Yumin Choi, Hyomin Lee and 5 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026 · ▲ 29 on Hugging Face · Code ★ 6

What to Remember, What to Reveal: Privacy-Aware Memory for Conversational Agents

SP-Mem decouples memory utility from private-value exposure via isolated storage and consent-based retrieval, improving personalization while reducing unnecessary privacy exposure.

Wenjie Wang, Wenhe Si, Xinyue Xu, Yue Xu

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

SynBench: A Benchmark for Differentially Private Text Generation

SynBench benchmarks differentially private text generators across standardized datasets, revealing quality drops on out-of-distribution private data and invalidated privacy guarantees from pre-training contamination.

Yidan Sun, Viktor Schlegel, Srinivasan Nandakumar, Iqra Zahid and 8 more

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Optimal Rates for Pure $\varepsilon$-Differentially Private Stochastic Convex Optimization with Heavy Tails

Pure ε-DP heavy-tailed stochastic convex optimization achieves minimax optimal excess risk via polynomial-time private Lipschitz extension optimization, including deterministic algorithms for structured losses with unbounded gradients.

Andrew Lowy

Atlanta Poster Session 4, Thu, Dec 10, 4:30 PM–7:30 PM, Hall C1 · Published 2026

SMI: Statistical Membership Inference for Reliable Unlearned Model Auditing

SMI replaces MIA-based unlearned model auditing with training-free statistical estimation of non-member mixture proportions in feature space, yielding reliable forgetting rates and bootstrap reliability ranges.

Jialong Sun, Zeming Wei, Jiaxuan Zou, Jiacheng Gong and 5 more

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Sequential Membership Inference Attacks

Sequential membership inference attacks exploit model update sequences and canary insertion timing to achieve tighter privacy audits with higher attack power than single-model baselines.

Thomas Michel, Debabrota Basu, Emilie Kaufmann

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization

PACZero sign-quantizes zeroth-order gradients to achieve zero mutual information fine-tuning with near-baseline accuracy on language models.

Murat Bilgehan Ertan, Xiaochen Zhu, Ha Nguyen, Marten van Dijk and 1 more

Paris Poster Session 6, Fri, Dec 11, 2:30 PM–4:30 PM, Paris Poster Hall · Published 2026

Minimax Private Estimation of Smooth Optimal-Transport Maps

Differentially private wavelet estimators achieve near-minimax rates for smooth optimal transport maps in dimensions above one and minimax rates in one dimension, with matching lower bounds confirming optimality.

Clément Lalanne, David Rodríguez-Vítores, Franck Iutzeler, Jean-Michel Loubes

Paris Poster Session 5, Fri, Dec 11, 11:30 AM–1:30 PM, Paris Poster Hall · Published 2026

Jaguar: Fast Private CNN Inference with Power-of-Two Homomorphic Arithmetic

Jaguar uses a power-of-two ciphertext ring to replace NTT convolution with scalar accumulation and exact local truncation, cutting private CNN inference latency by up to 3.72x versus Cheetah and Rhombus.

Yewon Jeong, Nayoung Jung, Hyeri Roh, Woo-Seok Choi

Paris Poster Session 1, Wed, Dec 9, 12:30 PM–2:30 PM, Paris Poster Hall · Published 2026

Sort, Partition, Randomize: Optimal Binary Hypothesis Testing under Local Differential Privacy

For binary hypothesis testing under local differential privacy, optimal mechanisms sort inputs by likelihood ratio, partition into contiguous blocks, and apply randomized response to block labels, enabling exact O(k³)-time computation via dynamic programming.

Elena Ghazi, Jawad Nasser, Flavio Calmon, Ibrahim Issa

Atlanta Poster Session 2, Wed, Dec 9, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Steering Away from Memorization: Reachability-Constrained Reinforcement Learning for Text-to-Image Diffusion

RADS applies reachability analysis and constrained reinforcement learning to steer diffusion trajectories away from memorized outputs via caption embedding perturbations, improving diversity, quality, and alignment without altering the model.

Sathwik Karnik, Juyeop Kim, Sanmi Koyejo, Jong-Seok Lee and 1 more

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Position: Life-Logging Video Streams Make the Privacy–Utility Trade-off Inevitable

Always-on life-logging video makes the privacy-utility trade-off inevitable for persistent AI, requiring pipeline-aware designs and formal leakage metrics.

Tianyuan Zou, Liang Yue, Yang Liu, Ya-Qin Zhang and 1 more

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Learning the Signature of Memorization in Autoregressive Language Models

Fine-tuning produces an invariant memorization signature across architectures that enables transferable learned membership inference achieving over 0.93 AUC on unseen state-space, linear attention, and recurrent models.

David Ilić, Kostadin Cvejoski, David Stanojević, Evgeny Grigorenko

Atlanta Poster Session 5, Fri, Dec 11, 10:00 AM–1:00 PM, Hall C1 · Published 2026 · Code

Online Differentially Private Consistent Clustering

Differentially private online clustering transforms streams into private semi-coresets via a generic reduction, matching or improving approximation, space, and runtime while inheriting consistency from underlying non-private algorithms.

Edith Cohen, Vadym Doroshenko, Badih Ghazi, Pritish Kamath and 6 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

A Unified Framework for Adversary-Aware Differential Privacy Bounds

A unified framework bounds DP privacy leakage against multi-target membership, attribute, and reconstruction attacks using only privacy parameters and adversarial baseline success rates.

Marika Swanberg, Meenatchi Sundaram Muthu Selva Annamalai, Jamie Hayes, Borja Balle and 1 more

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

MemLeak: Diagnosing Information Leaks in Multimodal Agent Memory

Multimodal AI agents retain forgotten facts via implicit visual cues, with MemLeak showing 12% image-based recovery and content-aware deletion reducing residuals to 2%.

Kuan Wang, Chao Zhang

Atlanta Poster Session 6, Fri, Dec 11, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition

ARFP integrates key-bound face cloaking with adversarial restoration-aware training to resist inverse purification attacks while allowing authorized reversible recovery and tamper detection.

Jiabei Zhang, Ziyuan Yang, Andrew Beng Jin Teoh, Yi Zhang

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Correlating Cross-Iteration Noise for DP-SGD using Model Curvature

NoiseCurve uses model curvature from public unlabeled data to improve cross-iteration noise correlation in DP-SGD, significantly boosting accuracy over DP-MF.

Xin Gu, Yingtai Xiao, Guanlin He, Jiamu Bai and 2 more

Atlanta Poster Session 6, Fri, Dec 11, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

Cyclic denoising exposes ultrastable memorized training images as diffusion attractors via repeated noising and sampling without gradients or prompts.

Rishabh Sharma, Stefano Martiniani

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning

PromptMIA uses adversarial soft prompts to exploit federated prompt-tuning updates for highly effective membership inference attacks that bypass standard defenses.

Quan M Nguyen, Min-Seon Kim, Hoang M Ngo, Nghia Hoang and 2 more

Atlanta Poster Session 1, Wed, Dec 9, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Lumberjack: Better Differentially Private Random Forests through Heavy Hitter Detection in Trees

Lumberjack improves differentially private random forests via heavy hitter pruning of deep trees, achieving state-of-the-art privacy-utility trade-offs.

Christian J Lebeda, David Erb, Tudor Cebere, Aurélien Bellet

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Privacy Amplification Persists under Unlimited Synthetic Data Release

Under bounded parameters, releasing unlimited synthetic data preserves differential privacy amplification beyond prior asymptotic limits.

Clément Pierquin, Aurélien Bellet, Marc Tommasi, Matthieu Boussard

Paris Poster Session 2, Wed, Dec 9, 5:00 PM–7:00 PM, Paris Poster Hall · Published 2026

POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents

POLAR-Bench evaluates LLM agent privacy-utility trade-offs via adversarial third-party probing across 10 domains, finding frontier models block over 99% of protected attributes while smaller open-weight models leak over half.

Qiaoyuan ZHENG, yiqu yang, Qi Gao, Imanol Schlag

Paris Poster Session 6, Fri, Dec 11, 2:30 PM–4:30 PM, Paris Poster Hall · Published 2026

SecureClaw: Clawing Back Control of LLM Agents

SecureClaw dual-bounds LLM agents by confining plaintext via opaque handles at the read boundary and enforcing authorized previews at the action sink, achieving near-zero attack success with preserved utility.

Yuhan Ma, Stefan Schmid

Paris Poster Session 6, Fri, Dec 11, 2:30 PM–4:30 PM, Paris Poster Hall · Published 2026

Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces

UI traces from LLM web agents identify underlying models with 96% F1 via passive JavaScript tracking, though randomized delays only partially mitigate fingerprinting.

William Gitta Lugoloobi, Samuele Marro, Jabez Magomere, Joss Wright and 1 more

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026 · Code ★ 7

GUIGuard-Bench: Toward a General Evaluation for Privacy-Preserving GUI Agents

GUIGuard-Bench introduces trajectory-based GUI privacy annotations across 241 agent workflows to evaluate privacy recognition, planning fidelity, and protection utility, revealing fine-grained localization and risk assessment as critical bottlenecks.

Yanxi Wang, Zhiling Zhang, Wenbo Zhou, Weiming Zhang and 5 more

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Causal Evaluation of Membership Inference Attacks

Causal inference framing of membership inference attacks defines memorization as training inclusion effects, reveals interference and distribution-shift biases, and yields reliable estimators without retraining.

Mathieu Even, Clément Berenfeld, Linus Bleistein, Tudor Cebere and 2 more

Paris Poster Session 1, Wed, Dec 9, 12:30 PM–2:30 PM, Paris Poster Hall · Published 2026

Privacy by Postprocessing the Discrete Laplace Mechanism

Discrete Laplace post-processing yields unbiased subexponential estimators and simulates Laplace and Staircase mechanisms, outperforming them for discrete data.

Quentin Hillebrand, Jacob Imola, Rasmus Pagh, Sia Sejer

Paris Poster Session 2, Wed, Dec 9, 5:00 PM–7:00 PM, Paris Poster Hall · Published 2026

MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents

MCPHunt benchmarks multi-server MCP agents, finding 11.5, 41.3% policy-violating cross-boundary credential propagation concentrated in browser flows, with prompt mitigations reducing violations up to 97%.

Haonan Li, Tianjun Sun, Yongqing Wang, Qisheng Zhang

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

The BatchNorm Illusion: Diagnosing Normalization Artifacts in Machine Unlearning Evaluation

BatchNorm running statistics artificially inflate unlearning metrics by up to 78 points, which a weight-preserving forward pass reverses without changing weights.

Aaryaman Kalani, Murari Mandal, Dhruv Kumar, Mohan Kankanhalli and 1 more

Paris Poster Session 1, Wed, Dec 9, 12:30 PM–2:30 PM, Paris Poster Hall · Published 2026

SnapAudit: Active Auditing of Differentially Private In-Context Learning via Snapshot-Based Simulation

SnapAudit decomposes DP-ICL into deterministic and noisy stages and uses snapshot simulation to audit privacy 80-200x faster, revealing flaws in existing Gaussian calibrations and embedding sensitivity analyses.

Yuyang Xia, Ruixuan Liu, Li Xiong

Atlanta Poster Session 3, Thu, Dec 10, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Detecting RLVR Training Data via Structural Convergence of Reasoning

RLVR training causes reasoning outputs to structurally converge on seen prompts, and Min-kNN Distance detects this collapse via black-box sampling to identify contamination.

Hongbo Zhang, Leyang Cui, Jianhao Yan, Guangsheng Bao and 3 more

Paris Poster Session 6, Fri, Dec 11, 2:30 PM–4:30 PM, Paris Poster Hall · Published 2026 · ▲ 2 on Hugging Face · Code ★ 8

idSCD: Identifying Training Datasets through Semantic Correlation Descriptors

Dataset-specific training traces are captured via semantic correlation descriptors (SCDs) that fingerprint dataset membership via internal semantic correlations, outperforming black-box and white-box baselines by over 60% ROC-AUC when semantic particularities differ.

Ionuț Hodoroagă, Andrada Gobeajă, Marius Leordeanu, Elena Burceanu

Paris Poster Session 1, Wed, Dec 9, 12:30 PM–2:30 PM, Paris Poster Hall · Published 2026

Assessing Per-Sample Membership Inference Vulnerability without Retraining

Per-sample membership inference vulnerability is governed by a data-dependent geometric measure, yielding a surrogate score using only a single model that outperforms loss-based baselines at identifying high-risk training points.

Valentin Dorseuil, Jamal Atif, Olivier Cappé

Paris Poster Session 2, Wed, Dec 9, 5:00 PM–7:00 PM, Paris Poster Hall · Published 2026

Prune to Protect: Faster Training and Enhanced Privacy by Dynamic Data Pruning

WLIB dynamically prunes easy samples and reweights hard ones to reduce memorization, improve privacy, and speed up training.

Chinmay Joshi, Advait Gadhikar, Celia Rubio-Madrigal, Aneet Kumar Dutta and 2 more

Paris Poster Session 5, Fri, Dec 11, 11:30 AM–1:30 PM, Paris Poster Hall · Published 2026

How Diffusion Models Memorize

Diffusion models memorize by overestimating training samples during early denoising, collapsing latent trajectories and accelerating convergence to memorized images via classifier-free guidance.

Juyeop Kim, Songkuk Kim, Jong-Seok Lee

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026