LLM Secret Exposure (2026)

Research scientist, Anthropic

Established methods to measure and extract memorized training data.

Co-authored canary exposure tests and the GPT-2 training-data extraction study. Later work separates disclosure of training text from extraction of a production model’s output layer. These are distinct exposure surfaces.

Professor, Cornell Tech

Membership inference and reconstruction of text from embeddings.

Co-authored early membership inference and later embedding inversion work. Embeddings can expose text even when no language-model completion is involved. Their privacy must be tested as a separate asset.

Research scientist, Google · Dean’s Chair associate professor, National University of Singapore

Foundational membership inference: whether a record was used for training.

Co-authored the foundational membership-inference study for ML classifiers. This question differs from retrieving the record itself. LLM-specific audits need separate evidence and controls.

Professor, UC Berkeley

Foundational work on unintended memorization and training-data extraction.

Co-authored The Secret Sharer and the GPT-2 extraction study. The first provides controlled measurements for planted secrets; the second demonstrates recovery of real training examples. Neither establishes that every enterprise secret is recoverable.

Assistant professor, ETH Zürich

Training-data extraction and privacy failures across the ML system.

Co-authored extraction studies on open and production language models. His work also shows that filtering and other system components can disclose private data without a memorized answer. An audit must cover the whole system.

Assistant professor, Yale University · Affiliate researcher, Stanford University · Faculty associate, Berkman Klein Center, Harvard University

Production-model extraction and copyright-focused audits.

Co-authored work on scalable training-data extraction and recovery of books from production models. These studies document model behavior; ownership and infringement require separate analysis.

PhD researcher, completing degree, ETH Zürich

Privacy side channels and enforceable defenses for agents.

Led Privacy Side Channels and CaMeL. These works show why an investigation must consider filtering, tools, and data flows as well as model parameters. His homepage still lists AI Sequrity Company; the company announces wind-down.

Tenure-track faculty, CISPA Helmholtz Center for Information Security

Dataset-level evidence for LLM training-data audits.

Co-authored LLM Dataset Inference. The method combines record-level signals with a dataset-level statistical test. Its evidence depends on access to suitable model scores and an unseen reference set.

Olsen Bicentennial Professor of Engineering; professor of computer science, University of Virginia

Controlled evaluation of LLM membership inference.

Co-authored the study that tests membership inference with matched training and held-out data. Results challenge apparent success caused by distribution shifts. High scores on a shifted benchmark do not establish reliable ownership evidence.

Assistant professor, Carnegie Mellon University

Measures when language models reproduce training text.

Co-authored studies of memorization and extraction. Her privacy-filter work shows why suppressing exact matches can leave modified disclosures. Evaluation needs to inspect more than identical strings.

Member of technical staff, Anthropic

Measures extraction risk, memorization, and forgetting.

Co-authored studies of how model size, duplicate data, and prompt context affect memorization. Work on forgetting tests what later training removes. It does not provide a certificate that a secret has disappeared.

Researcher, OpenAI · Research center lead, GenLaw Center

Memorization, privacy, and the evaluation of training-data extraction.

Co-authored the GPT-2 and production-model extraction studies, plus systematic memorization measurements. Her work connects privacy research with questions about generative AI and law.

Founding member, DatologyAI

LLM dataset inference and the TOFU unlearning benchmark.

Led work on dataset inference and co-authored TOFU. TOFU uses fictitious biographies to measure deletion behavior. He has an incoming Cornell Tech appointment in 2027; it is not a current faculty role.

Founding member of technical staff, humans& · Faculty appointment announced; institutional start date January 2027, Carnegie Mellon University

LLM privacy audits and limits of memorization suppression.

Co-authored a controlled study challenging common LLM membership tests. Later work shows that finetuning can restore long copyrighted passages. Her personal page and CMU directory disagree on whether her CMU appointment has started.

Research scientist, Anthropic

Scalable extraction from production language models.

Led the production-model extraction study and co-authored work on privacy filters. The reported attacks apply to tested historical model versions. Exact-output blocking is an incomplete defense against disclosure.

Co-founder, Elorian · Board member, Welligence

Attribution-based deletion and machine-unlearning research.

Co-authored Attribute-to-Delete, which links training-data influence to deletion objectives. His current homepage identifies Elorian as his company and Harvard as a former role. Attribution methods need more model and data access than a public chat API provides.

Associate professor, KAIST

Targeted privacy probing with known identifying context.

Co-authored ProPILE, which probes for missing personal information using other known fields. Correctness requires a ground-truth record. A plausible name, email address, or phone number alone is not evidence of a leak.

Associate professor, University of Toronto · Faculty member; Canada CIFAR AI Chair, Vector Institute · Faculty affiliate, Schwartz Reisman Institute · CAISI Research Program co-director, CIFAR · International chair, 2025–2027, Inria

Dataset inference and training designs that support unlearning.

Co-authored SISA machine unlearning and LLM dataset inference. SISA changes the training design to make deletion easier. Dataset inference aggregates evidence across records and requires a suitable unseen comparison set.

Associate professor, North Carolina State University

Measurement of credential exposure in public repositories.

Co-authored the large-scale public GitHub secret-leakage study. This work supports scanning the raw source artifacts that can enter training pipelines. Finding a repository leak does not prove that a given model trained on it.

Pretraining researcher, Anthropic

Pretraining-data detection and multi-criterion unlearning evaluation.

Led Min-K% probability and co-authored MUSE. Min-K needs token scores; it is not a universal text-only API test. Her public profile identifies pretraining work at Anthropic, with a Cornell Tech appointment starting July 2027.

Researcher; Alignment Training co-lead, OpenAI

Training-data extraction, deduplication, and model stealing.

Co-authored the GPT-2 extraction study and research showing that duplicated training data increases extraction risk. He also studies access to proprietary model components. These results inform distinct preventive and investigative controls.

Professor, Huazhong University of Science and Technology

Secret extraction from code language models.

Co-authored DeSEC, which studies token-level signals and guided decoding for credential extraction. Its open-model experiments motivate specialized detectors. Matching a real secret remains a separate validation step.

Associate professor, Carnegie Mellon University

Tests whether unlearning survives further training.

Co-authored benign relearning attacks that restore targeted information after tested unlearning methods. The study evaluates controlled benchmarks. It supports testing robustness after deletion, without establishing that every future method must fail.

Research scientist, Google DeepMind

Memorization measurement and evaluations of machine unlearning.

Co-authored research on memorization and the MUSE unlearning benchmark. MUSE separates text recall, factual knowledge, privacy, retained utility, scale, and repeated deletion. Passing one criterion is insufficient.

PhD student, Stanford University

Recovery of copyrighted books from production language models.

Co-led the book-extraction preprint with A. Feder Cooper. It tests historical production models with search and continuation prompts. Model versions, budgets, and settings constrain comparisons and current applicability.

PhD student, Warsaw University of Technology · Interpretability contractor, Google DeepMind

Elicitation of knowledge that a model has learned to hide.

Led controlled secret-keeper experiments comparing prompts with interpretability tools. The tasks involve simple planted secrets. They do not yet validate discovery of arbitrary enterprise designs or know-how.

PhD student, University of Southern California

Tests the validity of LLM membership-inference benchmarks.

Led Do Membership Inference Attacks Work on Large Language Models? The study contrasts shifted benchmarks with matched train and held-out samples. Its negative results make comparison-set design a core part of an audit.

Lead security architect, ZEISS Digital Innovation · PhD researcher, Eötvös Loránd University

Semantic and structured secret discovery in raw research artifacts.

Led the WOOT 2026 study of information leakage in preprint source archives. It combines structured detection with LLM review of comments and auxiliary files. This is an artifact-scanning result, not a test of secrets inside model weights.

PhD researcher, CWI / Vrije Universiteit Amsterdam

Stress tests for membership evidence in copyright audits.

Led the evidentiary-limits preprint. It tests how paraphrasing and later training affect membership signals. The result concerns technical reliability; it is not a court ruling on admissibility.

Research scientist, Meta

Relearning attacks on tested LLM unlearning methods.

Led research that restores targeted knowledge using benign further training. The study uses controlled unlearning benchmarks and weight access. It does not demonstrate an ordinary closed-API attack.

PhD student, The Chinese University of Hong Kong

Credential memorization in neural code completion.

Led the hard-coded credential study. Context from public GitHub files helps elicit candidate credentials, which then need separate validation. This is a targeted exposure test rather than a blind inventory of all stored secrets.

Researcher, KAIST

Policy-conditioned redaction of inferable sensitive information.

Led RedacBench, which scores removal of sensitive propositions and preservation of useful ones. It tests text redaction before disclosure. It does not measure deletion of knowledge from model parameters.

PhD student, Stony Brook University

Finetuning that restores verbatim recall of books.

Led Alignment Whack-a-Mole. The work tests whether targeted recall remains suppressed after finetuning on different texts. Recovery on held-out books exposes a weakness in tested memorization safeguards.

Co-founder, Engram

Reconstruction of sensitive text from embeddings.

Published as John X. Morris, he co-authored Vec2Text. The method shows that short embeddings can retain recoverable text. His later self-announcement confirms PhD completion and co-founding Engram.

Researcher, Beijing University of Posts and Telecommunications

Token-level characterization for secret extraction.

Led DeSEC, which uses token behavior to guide extraction from code models. The evaluation covers selected open models. Format and entropy filters help triage candidates but cannot establish ownership.

Senior research scientist, Google DeepMind

Training-data attribution and deletion with datamodels.

Co-authored TRAK and Attribute-to-Delete. These methods estimate how candidate training examples affect model behavior. They require access to model internals and relevant data; a public output alone does not supply that access.

Researcher, Nanyang Technological University

Recent output-only credential-extraction methods.

Led the September 2026 Practical Secrets Extraction preprint. It uses an offline proxy trained from victim outputs and reports public-repository matches. The authors did not test the reported real-world keys against live APIs.