* [66] G. Deng, Y. Liu, Y. Li, K. Wang, Y. Zhang, Z. Li, H. Wang, T. Zhang, and Y. Liu, “Jailbreaker: Automated jailbreak across multiple large language model chatbots,” _CoRR_ , vol. abs/2307.08715, 2023.
  * [67] N. Carlini, F. Tramèr, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. B. Brown, D. Song, Ú. Erlingsson, A. Oprea, and C. Raffel, “Extracting training data from large language models,” in _USENIX Security_ , 2021, pp. 2633–2650.
  * [68] J. Huang, H. Shao, and K. C. Chang, “Are large pre-trained language models leaking your personal information?” in _EMNLP_ , 2022, pp. 2038–2047.
  * [69] F. Mireshghallah, A. Uniyal, T. Wang, D. Evans, and T. Berg-Kirkpatrick, “An empirical analysis of memorization in fine-tuned autoregressive language models,” in _EMNLP_ , 2022, pp. 1816–1826.
  * [70] N. Lukas, A. Salem, R. Sim, S. Tople, L. Wutschitz, and S. Z. Béguelin, “Analyzing leakage of personally identifiable information in language models,” in _SP_ , 2023, pp. 346–363.
  * [71] A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” _CoRR_ , vol. abs/2307.15043, 2023.
  * [72] M. Shanahan, K. McDonell, and L. Reynolds, “Role play with large language models,” _Nat._ , vol. 623, no. 7987, pp. 493–498, 2023.
  * [73] Y. Liu, G. Deng, Z. Xu, Y. Li, Y. Zheng, Y. Zhang, L. Zhao, T. Zhang, and Y. Liu, “Jailbreaking chatgpt via prompt engineering: An empirical study,” _CoRR_ , vol. abs/2305.13860, 2023.
  * [74] Y. Wolf, N. Wies, Y. Levine, and A. Shashua, “Fundamental limitations of alignment in large language models,” _CoRR_ , vol. abs/2304.11082, 2023.
  * [75] A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does LLM safety training fail?” _CoRR_ , vol. abs/2307.02483, 2023.
  * [76] B. Barak, “Another jailbreak for gpt4: Talk to it in morse code,” https://twitter.com/boazbaraktcs/status/1637657623100096513, 2023.
  * [77] N. kat, “New jailbreak based on virtual functions smuggle,” https://old.reddit.com/r/ChatGPT/comments/10urbdj/new_jailbreak_based_on_virtual_functions_smuggle/, 2023\.
  * [78] Y. Zhu, R. Kiros, R. S. Zemel, R. Salakhutdinov, R. Urtasun, A. Torralba, and S. Fidler, “Aligning books and movies: Towards story-like visual explanations by watching movies and reading books,” in _ICCV_ , 2015, pp. 19–27.
  * [79] T. H. Trinh and Q. V. Le, “A simple method for commonsense reasoning,” _CoRR_ , vol. abs/1806.02847, 2018.
  * [80] R. Zellers, A. Holtzman, H. Rashkin, Y. Bisk, A. Farhadi, F. Roesner, and Y. Choi, “Defending against neural fake news,” in _NeurIPS_ , 2019, pp. 9051–9062.
  * [81] J. Baumgartner, S. Zannettou, B. Keegan, M. Squire, and J. Blackburn, “The pushshift reddit dataset,” in _ICWSM_ , 2020, pp. 830–839.
  * [82] L. Gao, S. Biderman, S. Black, L. Golding, T. Hoppe, C. Foster, J. Phang, H. He, A. Thite, and N. N. et al., “The pile: An 800gb dataset of diverse text for language modeling,” _CoRR_ , vol. abs/2101.00027, 2021.
  * [83] H. Laurençon, L. Saulnier, T. Wang, C. Akiki, A. V. del Moral, T. L. Scao, L. von Werra, C. Mou, E. G. Ponferrada, and H. N. et al., “The bigscience ROOTS corpus: A 1.6tb composite multilingual dataset,” in _NeurIPS_ , 2022.
  * [84] S. Kim, S. Yun, H. Lee, M. Gubri, S. Yoon, and S. J. Oh, “Propile: Probing privacy leakage in large language models,” _CoRR_ , vol. abs/2307.01881, 2023\.
  * [85] M. Fan, C. Chen, C. Wang, and J. Huang, “On the trustworthiness landscape of state-of-the-art generative models: A comprehensive survey,” _CoRR_ , vol. abs/2307.16680, 2023.
  * [86] H. Shao, J. Huang, S. Zheng, and K. C. Chang, “Quantifying association capabilities of large language models and its implications on privacy leakage,” _CoRR_ , vol. abs/2305.12707, 2023.
  * [87] X. Wu, R. Duan, and J. Ni, “Unveiling security, privacy, and ethical concerns of chatgpt,” _CoRR_ , vol. abs/2307.14192, 2023.
  * [88] N. Carlini, D. Ippolito, M. Jagielski, K. Lee, F. Tramèr, and C. Zhang, “Quantifying memorization across neural language models,” in _ICLR_ , 2023\.
  * [89] F. Mireshghallah, A. Uniyal, T. Wang, D. Evans, and T. Berg-Kirkpatrick, “Memorization in NLP fine-tuning methods,” _CoRR_ , vol. abs/2205.12506, 2022.
  * [90] M. Jagielski, O. Thakkar, F. Tramèr, D. Ippolito, K. Lee, N. Carlini, E. Wallace, S. Song, A. G. Thakurta, N. Papernot, and C. Zhang, “Measuring forgetting of memorized training examples,” in _ICLR_ , 2023.
  * [91] S. Gehman, S. Gururangan, M. Sap, Y. Choi, and N. A. Smith, “Realtoxicityprompts: Evaluating neural toxic degeneration in language models,” in _EMNLP_ , 2020, pp. 3356–3369.
  * [92] N. Ousidhoum, X. Zhao, T. Fang, Y. Song, and D. Yeung, “Probing toxic content in large pre-trained language models,” in _ACL_ , 2021, pp. 4262–4274.
  * [93] O. Shaikh, H. Zhang, W. Held, M. S. Bernstein, and D. Yang, “On second thought, let’s not think step by step! bias and toxicity in zero-shot reasoning,” in _ACL_ , 2023, pp. 4454–4470.
  * [94] S. Bordia and S. R. Bowman, “Identifying and reducing gender bias in word-level language models,” in _NAACL-HLT_ , 2019, pp. 7–15.
  * [95] C. Wald and L. Pfahler, “Exposing bias in online communities through large-scale language models,” _CoRR_ , vol. abs/2306.02294, 2023.
  * [96] J. Welbl, A. Glaese, J. Uesato, S. Dathathri, J. Mellor, L. A. Hendricks, K. Anderson, P. Kohli, B. Coppin, and P. Huang, “Challenges in detoxifying language models,” in _EMNLP_ , 2021, pp. 2447–2469.
  * [97] Y. Huang, Q. Zhang, P. S. Yu, and L. Sun, “Trustgpt: A benchmark for trustworthy and responsible large language models,” _CoRR_ , vol. abs/2306.11507, 2023.
  * [98] Y. Wang and Y. Chang, “Toxicity detection with generative prompt-based inference,” _CoRR_ , vol. abs/2205.12390, 2022.
  * [99] J. Li, T. Du, S. Ji, R. Zhang, Q. Lu, M. Yang, and T. Wang, “Textshield: Robust text classification based on multimodal embedding and neural machine translation,” in _USENIX Security_ , 2020, pp. 1381–1398.
  * [100] A. Deshpande, V. Murahari, T. Rajpurohit, A. Kalyan, and K. Narasimhan, “Toxicity in chatgpt: Analyzing persona-assigned language models,” _CoRR_ , vol. abs/2304.05335, 2023.
  * [101] E. M. Smith, M. Hall, M. Kambadur, E. Presani, and A. Williams, “”i’m sorry to hear that”: Finding new biases in language models with a holistic descriptor dataset,” in _EMNLP_ , 2022, pp. 9180–9211.
  * [102] T. Hossain, S. Dev, and S. Singh, “MISGENDERED: limits of large language models in understanding pronouns,” in _ACL_ , 2023, pp. 5352–5367.
  * [103] M. Nadeem, A. Bethke, and S. Reddy, “Stereoset: Measuring stereotypical bias in pretrained language models,” in _ACL_ , 2021, pp. 5356–5371.
  * [104] W. Fish, “Perception, hallucination, and illusion.” _OUP USA_ , 2009.
  * [105] Z. Ji, N. Lee, R. Frieske, T. Yu, D. Su, Y. Xu, E. Ishii, Y. Bang, A. Madotto, and P. Fung, “Survey of hallucination in natural language generation,” _ACM Comput. Surv._ , vol. 55, no. 12, pp. 248:1–248:38, 2023.
  * [106] Y. Zhang, Y. Li, L. Cui, D. Cai, L. Liu, T. Fu, X. Huang, E. Zhao, Y. Zhang, Y. Chen _et al._ , “Siren’s song in the ai ocean: A survey on hallucination in large language models,” _CoRR_ , vol. abs/2309.01219, 2023\.
  * [107] L. Huang, W. Yu, W. Ma, W. Zhong, Z. Feng, H. Wang, Q. Chen, W. Peng, X. Feng, B. Qin _et al._ , “A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions,” _CoRR_ , vol. abs/2311.05232, 2023.
  * [108] P. Laban, W. Kryscinski, D. Agarwal, A. R. Fabbri, C. Xiong, S. Joty, and C. Wu, “Llms as factual reasoners: Insights from existing benchmarks and beyond,” _CoRR_ , vol. abs/2305.14540, 2023.
  * [109] D. Tam, A. Mascarenhas, S. Zhang, S. Kwan, M. Bansal, and C. Raffel, “Evaluating the factual consistency of large language models through news summarization,” in _Findings of ACL_ , 2023, pp. 5220–5255.
  * [110] J. Fan, D. Aumiller, and M. Gertz, “Evaluating factual consistency of texts with semantic role labeling,” in _*SEM@ACL_ , 2023, pp. 89–100.
  * [111] S. Lin, J. Hilton, and O. Evans, “Truthfulqa: Measuring how models mimic human falsehoods,” in _ACL_ , 2022, pp. 3214–3252.
  * [112] P. Hase, M. T. Diab, A. Celikyilmaz, X. Li, Z. Kozareva, V. Stoyanov, M. Bansal, and S. Iyer, “Methods for measuring, updating, and visualizing factual beliefs in language models,” in _EACL_ , 2023, pp. 2706–2723.
  * [113] N. Lee, W. Ping, P. Xu, M. Patwary, P. Fung, M. Shoeybi, and B. Catanzaro, “Factuality enhanced language models for open-ended text generation,” in _NeurIPS_ , 2022.
  * [114] K. Shuster, S. Poff, M. Chen, D. Kiela, and J. Weston, “Retrieval augmentation reduces hallucination in conversation,” in _Findings of EMNLP_ , 2021, pp. 3784–3803.
  * [115] B. Peng, M. Galley, P. He, H. Cheng, Y. Xie, Y. Hu, Q. Huang, L. Liden, Z. Yu, W. Chen, and J. Gao, “Check your facts and try again: Improving large language models with external knowledge and automated feedback,” _CoRR_ , vol. abs/2302.12813, 2023.
  * [116] X. Yue, B. Wang, Z. Chen, K. Zhang, Y. Su, and H. Sun, “Automatic evaluation of attribution by large language models,” in _Findings of EMNLP_ , 2023, pp. 4615–4635.
  * [117] J. Xie, K. Zhang, J. Chen, R. Lou, and Y. Su, “Adaptive chameleon or stubborn sloth: Unraveling the behavior of large language models in knowledge clashes,” _CoRR_ , vol. abs/2305.13300, 2023.
  * [118] G. Penedo, Q. Malartic, D. Hesslow, R. Cojocaru, A. Cappelli, H. Alobeidli, B. Pannier, E. Almazrouei, and J. Launay, “The refinedweb dataset for falcon LLM: outperforming curated corpora with web data, and web data only,” _CoRR_ , vol. abs/2306.01116, 2023.
  * [119] D. Li, A. S. Rawat, M. Zaheer, X. Wang, M. Lukasik, A. Veit, F. X. Yu, and S. Kumar, “Large language models with controllable working memory,” in _Findings of ACL_ , 2023, pp. 1774–1793.
  * [120] A. Mallen, A. Asai, V. Zhong, R. Das, D. Khashabi, and H. Hajishirzi, “When not to trust language models: Investigating effectiveness of parametric and non-parametric memories,” in _ACL_ , 2023, pp. 9802–9822.
  * [121] K. Sun, Y. E. Xu, H. Zha, Y. Liu, and X. L. Dong, “Head-to-tail: How knowledgeable are large language models (llm)? A.K.A. will llms replace knowledge graphs?” _CoRR_ , vol. abs/2308.10168, 2023.
  * [122] S. Zheng, J. Huang, and K. C. Chang, “Why does chatgpt fall short in answering questions faithfully?” _CoRR_ , vol. abs/2304.10513, 2023.
  * [123] C. Kang and J. Choi, “Impact of co-occurrence on factual knowledge of large language models,” _CoRR_ , vol. abs/2310.08256, 2023.
  * [124] S. Li, X. Li, L. Shang, Z. Dong, C. Sun, B. Liu, Z. Ji, X. Jiang, and Q. Liu, “How pre-trained language models capture factual knowledge? a causal-inspired analysis,” in _Findings of ACL_ , 2022, pp. 1720–1732.
  * [125] K. Lee, D. Ippolito, A. Nystrom, C. Zhang, D. Eck, C. Callison-Burch, and N. Carlini, “Deduplicating training data makes language models better,” in _ACL_ , 2022, pp. 8424–8445.
  * [126] N. Kandpal, H. Deng, A. Roberts, E. Wallace, and C. Raffel, “Large language models struggle to learn long-tail knowledge,” in _ICML_ , 2023, p. 15696–15707.
  * [127] D. Hernandez, T. Brown, T. Conerly, N. DasSarma, D. Drain, S. El-Showk, N. Elhage, Z. Hatfield-Dodds, T. Henighan, T. Hume, S. Johnston, B. Mann, C. Olah, C. Olsson, D. Amodei, N. Joseph, J. Kaplan, and S. McCandlish, “Scaling laws and interpretability of learning from repeated data,” _CoRR_ , vol. abs/2205.10487, 2022.
  * [128] N. McKenna, T. Li, L. Cheng, M. J. Hosseini, M. Johnson, and M. Steedman, “Sources of hallucination by large language models on inference tasks,” in _Findings of EMNLP_ , 2023, pp. 2758–2774.
  * [129] J. W. Wei, D. Huang, Y. Lu, D. Zhou, and Q. V. Le, “Simple synthetic data reduces sycophancy in large language models,” _CoRR_ , vol. abs/2308.03958, 2023.
  * [130] M. Sharma, M. Tong, T. Korbak, D. Duvenaud, A. Askell, S. R. Bowman, N. Cheng, E. Durmus, Z. Hatfield-Dodds, S. R. Johnston, S. Kravec, T. Maxwell, S. McCandlish, K. Ndousse, O. Rausch, N. Schiefer, D. Yan, M. Zhang, and E. Perez, “Towards understanding sycophancy in language models,” _CoRR_ , vol. abs/2310.13548, 2023.
  * [131] M. Zhang, O. Press, W. Merrill, A. Liu, and N. A. Smith, “How language model hallucinations can snowball,” _CoRR_ , vol. abs/2305.13534, 2023.
  * [132] A. Azaria and T. M. Mitchell, “The internal state of an LLM knows when its lying,” _CoRR_ , vol. abs/2304.13734, 2023.
  * [133] D. Halawi, J. Denain, and J. Steinhardt, “Overthinking the truth: Understanding how language models process false demonstrations,” _CoRR_ , vol. abs/2307.09476, 2023.
  * [134] Q. Dong, L. Li, D. Dai, C. Zheng, Z. Wu, B. Chang, X. Sun, J. Xu, L. Li, and Z. Sui, “A survey on in-context learning,” _CoRR_ , vol. abs/2301.00234, 2023.
  * [135] C. Olsson, N. Elhage, N. Nanda, N. Joseph, N. DasSarma, T. Henighan, B. Mann, A. Askell, Y. Bai, A. Chen, T. Conerly, D. Drain, D. Ganguli, Z. Hatfield-Dodds, D. Hernandez, S. Johnston, A. Jones, J. Kernion, L. Lovitt, K. Ndousse, D. Amodei, T. Brown, J. Clark, J. Kaplan, S. McCandlish, and C. Olah, “In-context learning and induction heads,” _CoRR_ , vol. abs/2209.11895, 2022.
  * [136] N. Dziri, A. Madotto, O. Zaïane, and A. J. Bose, “Neural path hunter: Reducing hallucination in dialogue systems via path grounding,” in _EMNLP_ , 2021, pp. 2197–2214.
  * [137] Y. Chen, R. Guan, X. Gong, J. Dong, and M. Xue, “D-DAE: defense-penetrating model extraction attacks,” in _SP_ , 2023, pp. 382–399.
  * [138] Y. Shen, X. He, Y. Han, and Y. Zhang, “Model stealing attacks against inductive graph neural networks,” in _SP_ , 2022, pp. 1175–1192.
  * [139] J. Mattern, F. Mireshghallah, Z. Jin, B. Schölkopf, M. Sachan, and T. Berg-Kirkpatrick, “Membership inference attacks against language models via neighbourhood comparison,” in _ACL_ , 2023, pp. 11 330–11 343.
  * [140] J. Zhou, Y. Chen, C. Shen, and Y. Zhang, “Property inference attacks against gans,” in _NDSS_ , 2022.
  * [141] H. Yang, M. Ge, and K. X. andF Jingwei Li, “Using highly compressed gradients in federated learning for data reconstruction attacks,” _IEEE Trans. Inf. Forensics Secur._ , vol. 18, pp. 818–830, 2023.
  * [142] M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in _CCS_ , 2015, pp. 1322–1333.
  * [143] G. Xia, J. Chen, C. Yu, and J. Ma, “Poisoning attacks in federated learning: A survey,” _IEEE Access_ , vol. 11, pp. 10 708–10 722, 2023.
  * [144] E. O. Soremekun, S. Udeshi, and S. Chattopadhyay, “Towards backdoor attacks and defense in robust machine learning models,” _Comput. Secur._ , vol. 127, p. 103101, 2023.
  * [145] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in _ICLR_ , 2015.
  * [146] I. Shumailov, Y. Zhao, D. Bates, N. Papernot, R. D. Mullins, and R. Anderson, “Sponge examples: Energy-latency attacks on neural networks,” in _SP_ , 2021, pp. 212–231.
  * [147] W. M. Si, M. Backes, and Y. Zhang, “Mondrian: Prompt abstraction attack against large language models for cheaper api pricing,” _CoRR_ , vol. abs/2308.03558, 2023.
  * [148] J. Shi, Y. Liu, P. Zhou, and L. Sun, “Badgpt: Exploring security vulnerabilities of chatgpt via backdoor attacks to instructgpt,” _CoRR_ , vol. abs/2304.12298, 2023.
  * [149] J. Li, Y. Yang, Z. Wu, V. G. V. Vydiswaran, and C. Xiao, “Chatgpt as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger,” _CoRR_ , vol. abs/2304.14475, 2023.
  * [150] J. Jia, A. Salem, M. Backes, Y. Zhang, and N. Z. Gong, “Memguard: Defending against black-box membership inference attacks via adversarial examples,” in _CCS_ , 2019, pp. 259–274.
  * [151] J. Wang, X. Hu, W. Hou, H. Chen, R. Zheng, Y. Wang, L. Yang, H. Huang, W. Ye, and X. G. et al., “On the robustness of chatgpt: An adversarial and out-of-distribution perspective,” _CoRR_ , vol. abs/2302.12095, 2023.
  * [152] Z. Li, C. Wang, P. Ma, C. Liu, S. Wang, D. Wu, and C. Gao, “On the feasibility of specialized ability extracting for large language code models,” _CoRR_ , vol. abs/2303.03012, 2023.
  * [153] S. Zhao, J. Wen, A. T. Luu, J. Zhao, and J. Fu, “Prompt as triggers for backdoor attack: Examining the vulnerability in language models,” in _EMNLP_ , 2023, pp. 12 303–12 317.
  * [154] M. Hilton, N. Nelson, T. Tunnell, D. Marinov, and D. Dig, “Trade-offs in continuous integration: assurance, security, and flexibility,” in _ESEC/FSE_ , 2017, pp. 197–207.
  * [155] I. Koishybayev, A. Nahapetyan, R. Zachariah, S. Muralee, B. Reaves, A. Kapravelos, and A. Machiry, “Characterizing the security of github CI workflows,” in _USENIX_ , 2022, pp. 2747–2763.
  * [156] S. Lee, H. Han, S. K. Cha, and S. Son, “Montage: A neural network language model-guided javascript engine fuzzer,” in _USENIX_ , 2020, pp. 2613–2630.
  * [157] C. Lao, Y. Le, K. Mahajan, Y. Chen, W. Wu, A. Akella, and M. M. Swift, “ATP: in-network aggregation for multi-tenant learning,” in _NSDI_ , 2021, pp. 741–761.
  * [158] Q. Xiao, Y. Chen, C. Shen, Y. Chen, and K. Li, “Seeing is not believing: Camouflage attacks on image scaling algorithms,” in _USENIX Security_ , 2019, pp. 443–460.
  * [159] H. T. Maia, C. Xiao, D. Li, E. Grinspun, and C. Zheng, “Can one hear the shape of a neural network?: Snooping the GPU via magnetic side channel,” in _USENIX_ , 2022, pp. 4383–4400.
  * [160] Y. Tobah, A. Kwong, I. Kang, D. Genkin, and K. G. Shin, “Spechammer: Combining spectre and rowhammer for new speculative attacks,” in _SP_ , 2022, pp. 681–698.
  * [161] X. Luo and R. K. C. Chang, “On a new class of pulsing denial-of-service attacks and the defense,” in _NDSS_ , 2005.
  * [162] E. Quiring, D. Klein, D. Arp, M. Johns, and K. Rieck, “Adversarial preprocessing: Understanding and preventing image-scaling attacks in machine learning,” in _USENIX Security_ , 2020, pp. 1363–1380.
  * [163] Z. Zhan, Z. Zhang, S. Liang, F. Yao, and X. D. Koutsoukos, “Graphics peeping unit: Exploiting EM side-channel information of gpus to eavesdrop on your neighbors,” in _SP_ , 2022, pp. 1440–1457.
  * [164] H. Mai, J. Zhao, H. Zheng, Y. Zhao, Z. Liu, M. Gao, C. Wang, H. Cui, X. Feng, and C. Kozyrakis, “Honeycomb: Secure and efficient GPU executions via static validation,” in _OSDI_ , 2023, pp. 155–172.
  * [165] Y. Deng, C. Wang, S. Yu, S. Liu, Z. Ning, K. Leach, J. Li, S. Yan, Z. He, J. Cao, and F. Zhang, “Strongbox: A GPU TEE on arm endpoints,” in _CCS_ , 2022, pp. 769–783.
  * [166] S. Tan, B. Knott, Y. Tian, and D. J. Wu, “Cryptgpu: Fast privacy-preserving machine learning on the GPU,” in _SP_ , 2021, pp. 1021–1038.
  * [167] A. S. Rakin, Z. He, and D. Fan, “Bit-flip attack: Crushing neural network with progressive bit search,” in _ICCV_ , 2019, pp. 1211–1220.
  * [168] F. Yao, A. S. Rakin, and D. Fan, “Deephammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips,” in _USENIX_ , 2020, pp. 1463–1480.
  * [169] J. Wang, Z. Zhang, M. Wang, H. Qiu, T. Zhang, Q. Li, Z. Li, T. Wei, and C. Zhang, “Aegis: Mitigating targeted bit-flip attacks against deep neural networks,” in _USENIX_ , 2023, pp. 2329–2346.
  * [170] Q. Liu, J. Yin, W. Wen, C. Yang, and S. Sha, “Neuropots: Realtime proactive defense against bit-flip attacks in neural networks,” in _USENIX_ , 2023, pp. 6347–6364.
  * [171] Y. Peng, Y. Zhu, Y. Chen, Y. Bao, B. Yi, C. Lan, C. Wu, and C. Guo, “A generic communication scheduler for distributed DNN training acceleration,” in _SOSP_ , T. Brecht and C. Williamson, Eds. ACM, 2019, pp. 16–29.
  * [172] Y. Jiang, Y. Zhu, C. Lan, B. Yi, Y. Cui, and C. Guo, “A unified architecture for accelerating distributed DNN training in heterogeneous GPU/CPU clusters,” in _OSDI_ , 2020, pp. 463–479.
  * [173] A. Wei, Y. Deng, C. Yang, and L. Zhang, “Free lunch for testing: Fuzzing deep-learning libraries from open source,” in _ICSE_ , 2022, pp. 995–1007.
  * [174] R. Nakano, J. Hilton, S. Balaji, J. Wu, L. Ouyang, C. Kim, C. Hesse, S. Jain, V. Kosaraju, W. Saunders _et al._ , “Webgpt: Browser-assisted question-answering with human feedback,” _CoRR_ , vol. abs/2112.09332, 2021\.
  * [175] Y. Shen, K. Song, X. Tan, D. Li, W. Lu, and Y. Zhuang, “Hugginggpt: Solving ai tasks with chatgpt and its friends in huggingface,” _CoRR_ , vol. abs/2303.17580, 2023.
  * [176] Z. Xi, W. Chen, X. Guo, W. He, Y. Ding, B. Hong, M. Zhang, J. Wang, S. Jin, E. Zhou _et al._ , “The rise and potential of large language model based agents: A survey. corr, abs/2309.07864, 2023. doi: 10.48550,” _CoRR_ , vol. abs/2309.07864, 2023.
  * [177] L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y. Lin _et al._ , “A survey on large language model based autonomous agents,” _CoRR_ , vol. abs/2309.07864, 2023.
  * [178] B. Peng, M. Galley, P. He, H. Cheng, Y. Xie, Y. Hu, Q. Huang, L. Liden, Z. Yu, W. Chen, and J. Gao, “Check your facts and try again: Improving large language models with external knowledge and automated feedback,” _CoRR_ , vol. abs/2302.12813, 2023.
  * [179] T. Gao, H. Yen, J. Yu, and D. Chen, “Enabling large language models to generate text with citations,” in _EMNLP_ , 2023, pp. 6465–6488.
  * [180] W. Shi, X. Han, M. Lewis, Y. Tsvetkov, L. Zettlemoyer, and S. W. Yih, “Trusting your evidence: Hallucinate less with context-aware decoding,” _CoRR_ , vol. abs/2305.14739, 2023.
  * [181] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. R. Narasimhan, and Y. Cao, “React: Synergizing reasoning and acting in language models,” in _ICLR_ , 2023.
  * [182] O. Ram, Y. Levine, I. Dalmedigos, D. Muhlgay, A. Shashua, K. Leyton-Brown, and Y. Shoham, “In-context retrieval-augmented language models,” _CoRR_ , vol. abs/2302.00083, 2023.
  * [183] S. Zhang, L. Pan, J. Zhao, and W. Y. Wang, “Mitigating language model hallucination with interactive question-knowledge alignment,” _CoRR_ , vol. abs/2305.13669, 2023.
  * [184] O. Press, M. Zhang, S. Min, L. Schmidt, N. A. Smith, and M. Lewis, “Measuring and narrowing the compositionality gap in language models,” in _Findings of EMNLP_ , 2023, pp. 5687–5711.
  * [185] R. W. McGee, “Is chat gpt biased against conservatives? an empirical study,” _An Empirical Study (February 15, 2023)_ , 2023.
  * [186] T. Y. Zhuo, Y. Huang, C. Chen, and Z. Xing, “Exploring ai ethics of chatgpt: A diagnostic analysis,” _CoRR_ , vol. abs/2301.12867, 2023.
  * [187] E. Ferrara, “Should chatgpt be biased? challenges and risks of bias in large language models,” _CoRR_ , vol. abs/2304.03738, 2023.
  * [188] O. Oviedo-Trespalacios, A. E. Peden, T. Cole-Hunter, A. Costantini, M. Haghani, J. Rod, S. Kelly, H. Torkamaan, A. Tariq, J. D. A. Newton _et al._ , “The risks of using chatgpt to obtain common safety-related information and advice,” _Safety Science_ , vol. 167, p. 106244, 2023.
  * [189] N. Imran, A. Hashmi, and A. Imran, “Chat-gpt: Opportunities and challenges in child mental healthcare,” _Pakistan Journal of Medical Sciences_ , vol. 39, no. 4.
  * [190] OPC, “Opc to investigate chatgpt jointly with provincial privacy authorities,” https://www.priv.gc.ca/en/opc-news/news-and-announcements/2023/an_230525-2/, 2023\.
  * [191] M. Gurman, “Samsung bans staff’s ai use after spotting chatgpt data leak,” https://www.bloomberg.com/news/articles/2023-05-02/samsung-bans-chatgpt-and-other-generative-ai-use-by-staff-after-leak?srnd=technology-vp&in_source=embedded-checkout-banner/.
  * [192] S. Sabin, “Companies are struggling to keep corporate secrets out of chatgpt,” https://www.axios.com/2023/03/10/chatgpt-ai-cybersecurity-secrets/.
  * [193] Y. Elazar, N. Kassner, S. Ravfogel, A. Feder, A. Ravichander, M. Mosbach, Y. Belinkov, H. Schütze, and Y. Goldberg, “Measuring causal effects of data statistics on language model’sfactual’predictions,” _CoRR_ , vol. abs/2207.14251, 2022.
  * [194] H. Alkaissi and S. I. McFarlane, “Artificial hallucinations in chatgpt: implications in scientific writing,” _Cureus_ , vol. 15, no. 2, 2023.
  * [195] Y. Bang, S. Cahyawijaya, N. Lee, W. Dai, D. Su, B. Wilie, H. Lovenia, Z. Ji, T. Yu, W. Chung _et al._ , “A multitask, multilingual, multimodal evaluation of chatgpt on reasoning, hallucination, and interactivity,” _CoRR_ , vol. abs/2302.04023, 2023.
  * [196] J. Vincent, “Google’s ai chatbot bard makes factual error in first demo.” https://www.theverge.com/2023/2/8/23590864/google-ai-chatbot-bard-mistake-error-exoplanet-demo.
  * [197] I. Solaiman, M. Brundage, J. Clark, A. Askell, A. Herbert-Voss, J. Wu, A. Radford, G. Krueger, J. W. Kim, S. Kreps _et al._ , “Release strategies and the social impacts of language models,” _CoRR_ , vol. abs/1908.09203, 2019.
  * [198] J. Wu, W. Gan, Z. Chen, S. Wan, and H. Lin, “Ai-generated content (aigc): A survey,” _CoRR_ , vol. abs/2304.06632, 2023.
  * [199] M. Elsen-Rooney, “Nyc education department blocks chatgpt on school devices, networks,” https://ny.chalkbeat.org/2023/1/3/23537987/nyc-schools-ban-chatgpt-writing-artificial-intelligence.
  * [200] U. Ede-Osifo, “College instructor put on blast for accusing students of using chatgpt on final assignments,” https://www.nbcnews.com/tech/chatgpt-texas-collegeinstructor-backlash-rcna8488.
  * [201] J. Lee, T. Le, J. Chen, and D. Lee, “Do language models plagiarize?” in _Proceedings of the ACM Web Conference 2023_ , 2023, pp. 3637–3647.
  * [202] J. P. Wahle, T. Ruas, F. Kirstein, and B. Gipp, “How large language models are transforming machine-paraphrased plagiarism,” _CoRR_ , vol. abs/2210.03568, 2022.
  * [203] P. Sharma and B. Dash, “Impact of big data analytics and chatgpt on cybersecurity,” in _2023 4th International Conference on Computing and Communication Systems (I3CS)_ , 2023, pp. 1–6.
  * [204] P. Charan, H. Chunduri, P. M. Anand, and S. K. Shukla, “From text to mitre techniques: Exploring the malicious use of large language models for generating cyber attack payloads,” _CoRR_ , vol. abs/2305.15336, 2023.
  * [205] O. Asare, M. Nagappan, and N. Asokan, “Is github’s copilot as bad as humans at introducing vulnerabilities in code?” _CoRR_ , vol. abs/2204.04741, 2022\.
  * [206] B. N, “Europol warns that hackers use chatgpt to conduct cyber attacks.” https://cybersecuritynews.com/hackers-use-chatgpt-to-conduct-cyber-attacks/.
  * [207] ——, “Chatgpt successfully built malware but failed to analyze the complex malware.” https://cybersecuritynews.com/chatgpt-failed-to-analyze-the-complex-malware/.
  * [208] Github, “Github copilot,” https://github.com/features/copilot, 2023.
  * [209] E. Crothers, N. Japkowicz, and H. L. Viktor, “Machine-generated text: A comprehensive survey of threat models and detection methods,” _IEEE Access_ , 2023.
  * [210] R. Goodside, “Gpt-3 prompt injection defenses,” https://twitter.com/goodside/status/1578278974526222336?s=20&t=3UMZB7ntYhwAk3QLpKMAbw, 2022\.
  * [211] L. Prompting, “Defensive measures,” https://learnprompting.org/docs/category/-defensive-measures, 2023.
  * [212] C. Mark, “Talking to machines: prompt engineering & injection,” https://artifact-research.com/artificial-intelligence/talking-to-machines-prompt-engineering-injection/, 2022\.
  * [213] A. Volkov, “Discovery of sandwich defense,” https://twitter.com/altryne?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor, 2023\.
  * [214] R. G. Stuart Armstrong, “Using gpt-eliezer against chatgpt jailbreaking,” https://www.alignmentforum.org/posts/pNcFYZnPdXyL2RfgA/using-gpt-eliezer-against-chatgpt-jailbreak, 2022\.
  * [215] R. Goodside, “Quoted/escaped the input strings to defend against prompt attacks,” https://twitter.com/goodside/status/1569457230537441286?s=20, 2022.
  * [216] J. Selvi, “Exploring prompt injection attacks,” https://research.nccgroup.com/2022/12/05/exploring-prompt-injection-attacks/, 2022\.
  * [217] J. Xu, D. Ju, M. Li, Y.-L. Boureau, J. Weston, and E. Dinan, “Recipes for safety in open-domain chatbots,” _CoRR_ , vol. abs/2010.07079, 2020.
  * [218] S. Gehman, S. Gururangan, M. Sap, Y. Choi, and N. A. Smith, “Realtoxicityprompts: Evaluating neural toxic degeneration in language models,” in _Findings_ , 2020.
  * [219] J. Welbl, A. Glaese, J. Uesato, S. Dathathri, J. F. J. Mellor, L. A. Hendricks, K. Anderson, P. Kohli, B. Coppin, and P.-S. Huang, “Challenges in detoxifying language models,” _CoRR_ , vol. abs/2109.07445, 2021.
  * [220] I. Solaiman and C. Dennison, “Process for adapting language models to society (palms) with values-targeted datasets,” _CoRR_ , vol. abs/2106.10328, 2021\.
  * [221] B. Wang, W. Ping, C. Xiao, P. Xu, M. Patwary, M. Shoeybi, B. Li, A. Anandkumar, and B. Catanzaro, “Exploring the limits of domain-adaptive training for detoxifying large-scale language models,” _CoRR_ , vol. abs/2202.04173, 2022\.
  * [222] OpenAI, “GPT-4 Technical Report,” _CoRR_ , vol. abs/2303.08774, 2023.
  * [223] NVIDIA, “Nemo guardrails,” https://github.com/NVIDIA/NeMo-Guardrails, 2023\.
  * [224] nostalgebraist, “interpreting gpt: the logit lens,” https://www.alignmentforum.org/posts/AcKRB8wDpdaN6v6ru/interpreting-gpt-the-logit-lens, 2020\.
  * [225] N. Belrose, Z. Furman, L. Smith, D. Halawi, I. Ostrovsky, L. McKinney, S. Biderman, and J. Steinhardt, “Eliciting latent predictions from transformers with the tuned lens,” _CoRR_ , vol. abs/2303.08112, 2023.
  * [226] Z. Kan, L. Qiao, H. Yu, L. Peng, Y. Gao, and D. Li, “Protecting user privacy in remote conversational systems: A privacy-preserving framework based on text sanitization,” _CoRR_ , vol. abs/2306.08223, 2023.
  * [227] Y. Li, Z. Tan, and Y. Liu, “Privacy-preserving prompt tuning for large language model services,” _CoRR_ , vol. abs/2305.06212, 2023.
  * [228] P. Ruch, R. H. Baud, A. Rassinoux, P. Bouillon, and G. Robert, “Medical document anonymization with a semantic lexicon,” in _AMIA_ , 2000.
  * [229] L. Deléger, K. Molnár, G. Savova, F. Xia, T. Lingren, Q. Li, K. Marsolo, A. G. Jegga, M. Kaiser, L. Stoutenborough, and I. Solti, “Large-scale evaluation of automated clinical note de-identification and its impact on information extraction,” _J. Am. Medical Informatics Assoc._ , vol. 20, no. 1, pp. 84–94, 2013.
  * [230] F. Dernoncourt, J. Y. Lee, Ö. Uzuner, and P. Szolovits, “De-identification of patient notes with recurrent neural networks,” _J. Am. Medical Informatics Assoc._ , vol. 24, no. 3, pp. 596–606, 2017.
  * [231] A. E. W. Johnson, L. Bulgarelli, and T. J. Pollard, “Deidentification of free-text medical records using pre-trained bidirectional transformers,” in _CHIL_ , 2020, pp. 214–221.
  * [232] N. Kandpal, E. Wallace, and C. Raffel, “Deduplicating training data mitigates privacy risks in language models,” in _ICML_ , ser. Proceedings of Machine Learning Research, vol. 162, 2022, pp. 10 697–10 707.
  * [233] C. Dwork, F. McSherry, K. Nissim, and A. D. Smith, “Calibrating noise to sensitivity in private data analysis,” _J. Priv. Confidentiality_ , vol. 7, no. 3, pp. 17–51, 2016.
  * [234] C. Dwork, “A firm foundation for private data analysis,” _Commun. ACM_ , vol. 54, no. 1, pp. 86–95, 2011.
  * [235] C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” _Found. Trends Theor. Comput. Sci._ , vol. 9, no. 3-4, pp. 211–407, 2014\.
  * [236] S. Hoory, A. Feder, A. Tendler, S. Erell, A. Peled-Cohen, I. Laish, H. Nakhost, U. Stemmer, A. Benjamini, A. Hassidim, and Y. Matias, “Learning and evaluating a differentially private pre-trained language model,” in _EMNLP_ , 2021, pp. 1178–1189.
  * [237] J. Majmudar, C. Dupuy, C. Peris, S. Smaili, R. Gupta, and R. S. Zemel, “Differentially private decoding in large language models,” _CoRR_ , vol. abs/2205.13621, 2022.
  * [238] D. Yu, S. Naik, A. Backurs, S. Gopi, H. A. Inan, G. Kamath, J. Kulkarni, Y. T. Lee, A. Manoel, and L. W. et al., “Differentially private fine-tuning of language models,” in _ICLR_ , 2022.
  * [239] H. Ebadi, D. Sands, and G. Schneider, “Differential privacy: Now it’s getting personal,” in _POPL_ , 2015, pp. 69–81.
  * [240] I. Kotsogiannis, S. Doudalis, S. Haney, A. Machanavajjhala, and S. Mehrotra, “One-sided differential privacy,” in _ICDE_ , 2020, pp. 493–504.
  * [241] W. Shi, A. Cui, E. Li, R. Jia, and Z. Yu, “Selective differential privacy for language modeling,” in _NAACL_ , 2022, pp. 2848–2859.
  * [242] W. Shi, R. Shea, S. Chen, C. Zhang, R. Jia, and Z. Yu, “Just fine-tune twice: Selective differential privacy for large language models,” in _EMNLP_ , 2022, pp. 6327–6340.
  * [243] Z. Bu, Y. Wang, S. Zha, and G. Karypis, “Differentially private bias-term only fine-tuning of foundation models,” _CoRR_ , vol. abs/2210.00036, 2022.
  * [244] A. Ginart, L. van der Maaten, J. Zou, and C. Guo, “Submix: Practical private prediction for large-scale language models,” _CoRR_ , vol. abs/2201.00971, 2022.
  * [245] H. Duan, A. Dziedzic, N. Papernot, and F. Boenisch, “Flocks of stochastic parrots: Differentially private prompt learning for large language models,” _CoRR_ , vol. abs/2305.15594, 2023.
  * [246] A. Panda, T. Wu, J. T. Wang, and P. Mittal, “Differentially private in-context learning,” _CoRR_ , vol. abs/2305.01639, 2023.
  * [247] J. Pavlopoulos, P. Malakasiotis, and I. Androutsopoulos, “Deeper attention to abusive user content moderation,” in _EMNLP_ , 2017, pp. 1125–1135.
  * [248] S. V. Georgakopoulos, S. K. Tasoulis, A. G. Vrahatis, and V. P. Plagianakos, “Convolutional neural networks for toxic comment classification,” in _SETN_ , 2018, pp. 35:1–35:6.
  * [249] Z. Zhao, Z. Zhang, and F. Hopfgartner, “A comparative study of using pre-trained language models for toxic comment classification,” in _WWW_ , 2021, pp. 500–507.
  * [250] C. AI, “Perspective api documentation,” https://github.com/conversationai/perspectiveapi, 2021.
  * [251] Azure, “Azure ai content safety,” https://azure.microsoft.com/en-us/products/ai-services/ai-content-safety, 2023\.
  * [252] T. Bolukbasi, K. Chang, J. Y. Zou, V. Saligrama, and A. T. Kalai, “Man is to computer programmer as woman is to homemaker? debiasing word embeddings,” in _NeurIPS_ , 2016, pp. 4349–4357.
  * [253] J. Zhao, T. Wang, M. Yatskar, R. Cotterell, V. Ordonez, and K. Chang, “Gender bias in contextualized word embeddings,” in _NAACL-HLT_ , 2019, pp. 629–634.
  * [254] R. H. Maudslay, H. Gonen, R. Cotterell, and S. Teufel, “It’s all in the name: Mitigating gender bias with name-based counterfactual data substitution,” in _EMNLP-IJCNLP_ , 2019, pp. 5266–5274.
  * [255] H. Thakur, A. Jain, P. Vaddamanu, P. P. Liang, and L. Morency, “Language models get a gender makeover: Mitigating gender bias with few-shot data interventions,” in _ACL_ , 2023, pp. 340–351.
  * [256] C. N. dos Santos, I. Melnyk, and I. Padhi, “Fighting offensive language on social media with unsupervised text style transfer,” in _ACL_ , 2018, pp. 189–194.
  * [257] L. Laugier, J. Pavlopoulos, J. Sorensen, and L. Dixon, “Civil rephrases of toxic texts with self-supervised transformers,” in _EACL_ , 2021, pp. 1442–1461.
  * [258] V. Logacheva, D. Dementieva, S. Ustyantsev, D. Moskovskiy, D. Dale, I. Krotova, N. Semenov, and A. Panchenko, “Paradetox: Detoxification with parallel data,” in _ACL_ , 2022, pp. 6804–6818.
  * [259] J. Zhao, Y. Zhou, Z. Li, W. Wang, and K. Chang, “Learning gender-neutral word embeddings,” in _EMNLP_ , 2018, pp. 4847–4853.
  * [260] X. Peng, S. Li, S. Frazier, and M. O. Riedl, “Reducing non-normative text generation from language models,” in _INLG_ , 2020, pp. 374–383.
  * [261] S. Dev, T. Li, J. M. Phillips, and V. Srikumar, “Oscar: Orthogonal subspace correction and rectification of biases in word embeddings,” in _EMNLP_ , 2021, pp. 5034–5050.
  * [262] Z. Xie and T. Lukasiewicz, “An empirical analysis of parameter-efficient methods for debiasing pre-trained language models,” in _ACL_ , 2023, pp. 15 730–15 745.
  * [263] X. He, S. Zannettou, Y. Shen, and Y. Zhang, “You only prompt once: On the capabilities of prompt learning on large language models to tackle toxic content,” _CoRR_ , vol. abs/2308.05596, 2023.
  * [264] L. Ranaldi, E. S. Ruzzetti, D. Venditti, D. Onorati, and F. M. Zanzotto, “A trip towards fairness: Bias and de-biasing in large language models,” _CoRR_ , vol. abs/2305.13862, 2023.
  * [265] A. Glaese, N. McAleese, M. Trebacz, J. Aslanides, V. Firoiu, T. Ewalds, M. Rauh, L. Weidinger, M. J. Chadwick, and P. T. et al., “Improving alignment of dialogue agents via targeted human judgements,” _CoRR_ , vol. abs/2209.14375, 2022.
  * [266] H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, and S. B. et al., “Llama 2: Open foundation and fine-tuned chat models,” _CoRR_ , vol. abs/2307.09288, 2023\.
  * [267] A. Abbas, K. Tirumala, D. Simig, S. Ganguli, and A. S. Morcos, “Semdedup: Data-efficient learning at web-scale through semantic deduplication,” _CoRR_ , vol. abs/2303.09540, 2023.
  * [268] Y. Zhang, Y. Li, L. Cui, D. Cai, L. Liu, T. Fu, X. Huang, E. Zhao, Y. Zhang, Y. Chen, L. Wang, A. T. Luu, W. Bi, F. Shi, and S. Shi, “Siren’s song in the AI ocean: A survey on hallucination in large language models,” _CoRR_ , vol. abs/2309.01219, 2023.
  * [269] Z. Sun, S. Shen, S. Cao, H. Liu, C. Li, Y. Shen, C. Gan, L. Gui, Y. Wang, Y. Yang, K. Keutzer, and T. Darrell, “Aligning large multimodal models with factually augmented RLHF,” _CoRR_ , vol. abs/2309.14525, 2023.
  * [270] T. Shen, R. Jin, Y. Huang, C. Liu, W. Dong, Z. Guo, X. Wu, Y. Liu, and D. Xiong, “Large language model alignment: A survey,” _CoRR_ , vol. abs/2309.15025, 2023.
  * [271] K. Huang, H. P. Chan, and H. Ji, “Zero-shot faithful factual error correction,” in _ACL_ , 2023, pp. 5660–5676.
  * [272] A. Chen, P. Pasupat, S. Singh, H. Lee, and K. Guu, “PURR: efficiently editing language model hallucinations by denoising language model corruptions,” _CoRR_ , vol. abs/2305.14908, 2023.
  * [273] R. Zhao, X. Li, S. Joty, C. Qin, and L. Bing, “Verify-and-edit: A knowledge-enhanced chain-of-thought framework,” in _ACL_ , 2023, pp. 5823–5840.
  * [274] W. Yu, Z. Zhang, Z. Liang, M. Jiang, and A. Sabharwal, “Improving language models via plug-and-play retrieval feedback,” _CoRR_ , vol. abs/2305.14002, 2023.
  * [275] Z. Feng, X. Feng, D. Zhao, M. Yang, and B. Qin, “Retrieval-generation synergy augmented large language models,” _CoRR_ , vol. abs/2310.05149, 2023.
  * [276] Z. Shao, Y. Gong, Y. Shen, M. Huang, N. Duan, and W. Chen, “Enhancing retrieval-augmented large language models with iterative retrieval-generation synergy,” in _Findings of EMNLP_ , 2023, pp. 9248–9274.
  * [277] S. Ahn, H. Choi, T. Pärnamaa, and Y. Bengio, “A neural knowledge language model,” _CoRR_ , vol. abs/1608.00318, 2016.
  * [278] R. L. L. IV, N. F. Liu, M. E. Peters, M. Gardner, and S. Singh, “Barack’s wife hillary: Using knowledge graphs for fact-aware language modeling,” in _ACL_ , 2019, pp. 5962–5971.
  * [279] Y. Wen, Z. Wang, and J. Sun, “Mindmap: Knowledge graph prompting sparks graph of thoughts in large language models,” _CoRR_ , vol. abs/2308.09729, 2023\.
  * [280] Z. Gou, Z. Shao, Y. Gong, Y. Shen, Y. Yang, N. Duan, and W. Chen, “CRITIC: large language models can self-correct with tool-interactive critiquing,” _CoRR_ , vol. abs/2305.11738, 2023.
  * [281] N. Varshney, W. Yao, H. Zhang, J. Chen, and D. Yu, “A stitch in time saves nine: Detecting and mitigating hallucinations of llms by validating low-confidence generation,” _CoRR_ , vol. abs/2307.03987, 2023.
  * [282] Y. Chuang, Y. Xie, H. Luo, Y. Kim, J. R. Glass, and P. He, “Dola: Decoding by contrasting layers improves factuality in large language models,” _CoRR_ , vol. abs/2309.03883, 2023.
  * [283] K. Li, O. Patel, F. B. Viégas, H. Pfister, and M. Wattenberg, “Inference-time intervention: Eliciting truthful answers from a language model,” _CoRR_ , vol. abs/2306.03341, 2023.
  * [284] X. L. Li, A. Holtzman, D. Fried, P. Liang, J. Eisner, T. Hashimoto, L. Zettlemoyer, and M. Lewis, “Contrastive decoding: Open-ended text generation as optimization,” in _ACL_ , 2023, pp. 12 286–12 312.
  * [285] S. Willison, “Reducing sycophancy and improving honesty via activation steering,” https://www.alignmentforum.org/posts/zt6hRsDE84HeBKh7E/reducing-sycophancy-and-improving-honesty-via-activation, 2023\.
  * [286] Y. Du, S. Li, A. Torralba, J. B. Tenenbaum, and I. Mordatch, “Improving factuality and reasoning in language models through multiagent debate,” _CoRR_ , vol. abs/2305.14325, 2023.
  * [287] R. Cohen, M. Hamri, M. Geva, and A. Globerson, “LM vs LM: detecting factual errors via cross examination,” in _EMNLP_ , 2023, pp. 12 621–12 640.
  * [288] N. Akhtar and A. S. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” _IEEE Access_ , vol. 6, pp. 14 410–14 430, 2018.
  * [289] M. Jagielski, N. Carlini, D. Berthelot, A. Kurakin, and N. Papernot, “High-fidelity extraction of neural network models,” _CoRR_ , vol. abs/1909.01838, 2019.
  * [290] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction apis,” in _USENIX Security_ , 2016, pp. 601–618.
  * [291] T. Orekondy, B. Schiele, and M. Fritz, “Prediction poisoning: Towards defenses against DNN model stealing attacks,” in _ICLR_ , 2020.
  * [292] I. M. Alabdulmohsin, X. Gao, and X. Zhang, “Adding robustness to support vector machines against adversarial reverse engineering,” in _CIKM_ , 2014, pp. 231–240.
  * [293] V. Chandrasekaran, K. Chaudhuri, I. Giacomelli, S. Jha, and S. Yan, “Model extraction and active learning,” _CoRR_ , vol. abs/1811.02054, 2018.
  * [294] T. Lee, B. Edwards, I. M. Molloy, and D. Su, “Defending against neural network model stealing attacks using deceptive perturbations,” in _S &P Workshop_, 2019, pp. 43–49.
  * [295] M. Juuti, S. Szyller, S. Marchal, and N. Asokan, “PRADA: protecting against DNN model stealing attacks,” in _EuroS &P_, 2019, pp. 512–527.
  * [296] H. Jia, C. A. Choquette-Choo, V. Chandrasekaran, and N. Papernot, “Entangled watermarks as a defense against model extraction,” in _USENIX Security_ , 2021, pp. 1937–1954.
  * [297] A. B. Kahng, J. C. Lach, W. H. Mangione-Smith, S. Mantik, I. L. Markov, M. Potkonjak, P. Tucker, H. Wang, and G. Wolfe, “Watermarking techniques for intellectual property protection,” in _DAC_ , 1998, pp. 776–781.
  * [298] M. Abadi, A. Chu, I. J. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in _SIGSAC_ , 2016, pp. 308–318.
  * [299] C. Dwork, “Differential privacy: A survey of results,” in _TAMC_ , 2008, pp. 1–19.
  * [300] D. Chen, N. Yu, and M. Fritz, “Relaxloss: Defending membership inference attacks without losing utility,” in _ICLR_ , 2022.
  * [301] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” in _ICML_ , 2017, pp. 1321–1330.
  * [302] G. Pereyra, G. Tucker, J. Chorowski, L. Kaiser, and G. E. Hinton, “Regularizing neural networks by penalizing confident output distributions,” in _ICLR workshop_ , 2017.
  * [303] M. Nasr, R. Shokri, and A. Houmansadr, “Machine learning with membership privacy using adversarial regularization,” in _CCS_ , 2018, pp. 634–646.
  * [304] J. Jia and N. Z. Gong, “Attriguard: A practical defense against attribute inference attacks via adversarial machine learning,” in _USENIX Security_ , 2018, pp. 513–529.
  * [305] S. Awan, B. Luo, and F. Li, “CONTRA: defending against poisoning attacks in federated learning,” in _ESORICS_ , 2021, pp. 455–475.
  * [306] F. Qi, M. Li, Y. Chen, Z. Zhang, Z. Liu, Y. Wang, and M. Sun, “Hidden killer: Invisible textual backdoor attacks with syntactic trigger,” in _ACL/IJCNLP_ , 2021, pp. 443–453.
  * [307] W. Yang, Y. Lin, P. Li, J. Zhou, and X. Sun, “Rethinking stealthiness of backdoor attack against NLP models,” in _ACL/IJCNLP_ , 2021, pp. 5543–5557.
  * [308] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in _S &P_, 2019, pp. 707–723.
  * [309] Y. Liu, W. Lee, G. Tao, S. Ma, Y. Aafer, and X. Zhang, “ABS: scanning neural networks for back-doors by artificial brain stimulation,” in _CCS_ , 2019, pp. 1265–1282.
  * [310] J. Lu, T. Issaranon, and D. A. Forsyth, “Safetynet: Detecting and rejecting adversarial examples robustly,” in _ICCV_ , 2017, pp. 446–454.
  * [311] J. H. Metzen, T. Genewein, V. Fischer, and B. Bischoff, “On detecting adversarial perturbations,” in _ICLR_ , 2017, p. 105978.
  * [312] S. Gu and L. Rigazio, “Towards deep neural network architectures robust to adversarial examples,” in _ICLR workshop_ , 2015.
  * [313] D. Meng and H. Chen, “Magnet: A two-pronged defense against adversarial examples,” in _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 \- November 03, 2017_ , 2017, pp. 135–147.
  * [314] G. Katz, C. W. Barrett, D. L. Dill, K. Julian, and M. J. Kochenderfer, “Reluplex: An efficient SMT solver for verifying deep neural networks,” in _CAV_ , 2017, pp. 97–117.
  * [315] D. Gopinath, G. Katz, C. S. Pasareanu, and C. W. Barrett, “Deepsafe: A data-driven approach for checking adversarial robustness in neural networks,” _CoRR_ , vol. abs/1710.00486, 2017.
  * [316] N. Papernot, P. D. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in _S &P_, 2016, pp. 582–597.
  * [317] G. E. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,” _CoRR_ , vol. abs/1503.02531, 2015.
  * [318] R. Huang, B. Xu, D. Schuurmans, and C. Szepesvári, “Learning with a strong adversary,” _CoRR_ , vol. abs/1511.03034, 2015.
  * [319] OWASP, “Owasp top 10 for llm applications,” https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_0_1.pdf, 2023\.
  * [320] E. Göktas, E. Athanasopoulos, H. Bos, and G. Portokalidis, “Out of control: Overcoming control-flow integrity,” in _SP_ , 2014, pp. 575–589.
  * [321] N. Carlini, A. Barresi, M. Payer, D. A. Wagner, and T. R. Gross, “Control-flow bending: On the effectiveness of control-flow integrity,” in _USENIX Security_ , 2015, pp. 161–176.
  * [322] C. Zhang, T. Wei, Z. Chen, L. Duan, L. Szekeres, S. McCamant, D. Song, and W. Zou, “Practical control flow integrity and randomization for binary executables,” in _SP_ , 2013, pp. 559–573.
  * [323] R. T. Gollapudi, G. Yuksek, D. Demicco, M. Cole, G. Kothari, R. Kulkarni, X. Zhang, K. Ghose, A. Prakash, and Z. Umrigar, “Control flow and pointer integrity enforcement in a secure tagged architecture,” in _SP_ , 2023, pp. 2974–2989.
  * [324] W. U. Hassan, M. Lemay, N. Aguse, A. Bates, and T. Moyer, “Towards scalable cluster auditing through grammatical inference over provenance graphs,” in _NDSS_ , 2018.
  * [325] X. Han, T. F. J. Pasquier, A. Bates, J. Mickens, and M. I. Seltzer, “Unicorn: Runtime provenance-based detector for advanced persistent threats,” in _NDSS_ , 2020.
  * [326] Q. Wang, W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, J. Rhee, Z. Chen, W. Cheng, C. A. Gunter, and H. Chen, “You are what you do: Hunting stealthy malware via data provenance analysis,” in _NDSS_ , 2020.
  * [327] L. Yu, S. Ma, Z. Zhang, G. Tao, X. Zhang, D. Xu, V. E. Urias, H. W. Lin, G. F. Ciocarlie, V. Yegneswaran, and A. Gehani, “Alchemist: Fusing application and audit logs for precise attack provenance without instrumentation,” in _NDSS_ , 2021.
  * [328] H. Ding, J. Zhai, D. Deng, and S. Ma, “The case for learned provenance graph storage systems,” in _USENIX Security_ , 2023.
  * [329] F. Yang, J. Xu, C. Xiong, Z. Li, and K. Zhang, “PROGRAPHER: an anomaly detection system based on provenance graph embedding,” in _USENIX Security_ , 2023.
  * [330] A. Tabiban, H. Zhao, Y. Jarraya, M. Pourzandi, M. Zhang, and L. Wang, “Provtalk: Towards interpretable multi-level provenance analysis in networking functions virtualization (NFV),” in _NDSS_ , 2022.
  * [331] A. Bates, D. Tian, K. R. B. Butler, and T. Moyer, “Trustworthy whole-system provenance for the linux kernel,” in _USENIX Security_ , 2015, pp. 319–334.
  * [332] S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V. N. Venkatakrishnan, “HOLMES: real-time APT detection through correlation of suspicious information flows,” in _SP_ , 2019, pp. 1137–1152.
  * [333] A. Alsaheel, Y. Nan, S. Ma, L. Yu, G. Walkup, Z. B. Celik, X. Zhang, and D. Xu, “ATLAS: A sequence-based learning approach for attack investigation,” in _USENIX Security_ , 2021, pp. 3005–3022.
  * [334] L. Yu, S. Ma, Z. Zhang, G. Tao, X. Zhang, D. Xu, V. E. Urias, H. W. Lin, G. F. Ciocarlie, V. Yegneswaran, and A. Gehani, “Alchemist: Fusing application and audit logs for precise attack provenance without instrumentation,” in _NDSS_ , 2021.
  * [335] X. Han, T. F. J. Pasquier, A. Bates, J. Mickens, and M. I. Seltzer, “Unicorn: Runtime provenance-based detector for advanced persistent threats,” in _NDSS_ , 2020.
  * [336] K. Mukherjee, J. Wiedemeier, T. Wang, J. Wei, F. Chen, M. Kim, M. Kantarcioglu, and K. Jee, “Evading provenance-based ML detectors with adversarial system actions,” in _USENIX Security_ , 2023, pp. 1199–1216.
  * [337] Q. Wang, W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, J. Rhee, Z. Chen, W. Cheng, C. A. Gunter, and H. Chen, “You are what you do: Hunting stealthy malware via data provenance analysis,” in _NDSS_ , 2020.
  * [338] M. A. Inam, Y. Chen, A. Goyal, J. Liu, J. Mink, N. Michael, S. Gaur, A. Bates, and W. U. Hassan, “Sok: History is a vast early warning system: Auditing the provenance of system intrusions,” in _SP_ , 2023, pp. 2620–2638.
  * [339] C. Fu, Q. Li, M. Shen, and K. Xu, “Realtime robust malicious traffic detection via frequency domain analysis,” in _CCS_ , 2021, pp. 3431–3446.
  * [340] D. Barradas, N. Santos, L. Rodrigues, S. Signorello, F. M. V. Ramos, and A. Madeira, “Flowlens: Enabling efficient flow classification for ml-based network security applications,” in _NDSS_ , 2021.
  * [341] G. Zhou, Z. Liu, C. Fu, Q. Li, and K. Xu, “An efficient design of intelligent network data plane,” in _USENIX Security_ , 2023.
  * [342] S. Panda _et al._ , “Smartwatch: accurate traffic analysis and flow-state tracking for intrusion prevention using smartnics,” in _CoNEXT_ , 2021, pp. 60–75.
  * [343] G. Siracusano _et al._ , “Re-architecting traffic analysis with neural network interface cards,” in _NSDI_ , 2022, pp. 513–533.
  * [344] Y. Mirsky, T. Doitshman, Y. Elovici, and A. Shabtai, “Kitsune: An ensemble of autoencoders for online network intrusion detection,” in _NDSS_ , 2018.
  * [345] J. Holland, P. Schmitt, N. Feamster, and P. Mittal, “New directions in automated traffic analysis,” in _CCS_ , 2021, pp. 3366–3383.
  * [346] C. Fu, Q. Li, and K. Xu, “Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis,” in _NDSS_ , 2023.
  * [347] M. Tran _et al._ , “On the feasibility of rerouting-based ddos defenses,” in _SP_ , 2019, pp. 1169–1184.
  * [348] D. Wagner _et al._ , “United we stand: Collaborative detection and mitigation of amplification ddos attacks at scale,” in _CCS_ , 2021, pp. 970–987.
  * [349] M. Wichtlhuber _et al._ , “IXP scrubber: learning from blackholing traffic for ml-driven ddos detection at scale,” in _SIGCOMM_ , 2022, pp. 707–722.
  * [350] VirusTotal, “Virustotal,” https://www.virustotal.com/gui/home/upload, 2023\.
  * [351] S. Thirumuruganathan, M. Nabeel, E. Choo, I. Khalil, and T. Yu, “Siraj: a unified framework for aggregation of malicious entity detectors,” in _SP_ , 2022, pp. 507–521.
  * [352] T. Scholte, W. Robertson, D. Balzarotti, and E. Kirda, “Preventing input validation vulnerabilities in web applications through automated type analysis,” in _CSA_ , 2012, pp. 233–243.
  * [353] A. Blankstein and M. J. Freedman, “Automating isolation and least privilege in web services,” in _SP_ , 2014, pp. 133–148.
  * [354] D. Sánchez, M. Batet, and A. Viejo, “Automatic general-purpose sanitization of textual documents,” _IEEE Transactions on Information Forensics and Security_ , vol. 8, no. 6, pp. 853–862, 2013.
  * [355] Y. Guo, J. Liu, W. Tang, and C. Huang, “Exsense: Extract sensitive information from unstructured data,” _Computers & Security_, vol. 102, p. 102156, 2021\.
  * [356] F. Hassan, D. Sánchez, J. Soria-Comas, and J. Domingo-Ferrer, “Automatic anonymization of textual documents: detecting sensitive information via word embeddings,” in _TrustCom/BigDataSE_ , 2019, pp. 358–365.
  * [357] W. G. D. Note, “Ethical principles for web machine learning,” https://www.w3.org/TR/webmachinelearning-ethics, 2023.
  * [358] G. AI, “Guardrails ai,” https://www.guardrailsai.com/docs/, 2023.
  * [359] Laiyer.ai, “Llm guard - the security toolkit for llm interactions,” https://github.com/laiyer-ai/llm-guard/, 2023.
  * [360] Azure, “Content filtering,” https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/content-filter?tabs=warning%2Cpython, 2023\.
  * [361] K. Gémes and G. Recski, “Tuw-inf at germeval2021: Rule-based and hybrid methods for detecting toxic, engaging, and fact-claiming comments,” in _GermEval KONVENS_ , 2021, pp. 69–75.
  * [362] K. Gémes, Á. Kovács, and G. Recski, “Offensive text detection across languages and datasets using rule-based and hybrid methods,” in _CIKM workshop_ , 2022.
  * [363] P. Nakov, V. Nayak, K. Dent, A. Bhatawdekar, S. M. Sarwar, M. Hardalov, Y. Dinkov, D. Zlatkova, G. Bouchard, and I. Augenstein, “Detecting abusive language on online platforms: A critical analysis,” _CoRR_ , vol. abs/2103.00153, 2021.
  * [364] F. Alam, S. Cresci, T. Chakraborty, F. Silvestri, D. Dimitrov, G. D. S. Martino, S. Shaar, H. Firooz, and P. Nakov, “A survey on multimodal disinformation detection,” _CoRR_ , vol. abs/2103.12541, 2021.
  * [365] P. Nakov, H. T. Sencar, J. An, and H. Kwak, “A survey on predicting the factuality and the bias of news media,” _CoRR_ , vol. abs/2103.12506, 2021\.
  * [366] T. Hartvigsen, S. Gabriel, H. Palangi, M. Sap, D. Ray, and E. Kamar, “Toxigen: A large-scale machine-generated dataset for adversarial and implicit hate speech detection,” _CoRR_ , vol. abs/2203.09509, 2022.
  * [367] A. V. Lilian Weng, Vik Goel, “Using gpt-4 for content moderation,” https://searchengineland.com/openai-ai-classifier-no-longer-available-429912/, 2023\.
  * [368] M. AI, “Llama 2 responsible use guide,” https://ai.meta.com/llama/responsible-use-guide/, 2023.
  * [369] J. Chen, G. Kim, A. Sriram, G. Durrett, and E. Choi, “Complex claim verification with evidence retrieved in the wild,” _CoRR_ , vol. abs/2305.11859, 2023.
  * [370] B. A. Galitsky, “Truth-o-meter: Collaborating with llm in fighting its hallucinations,” 2023.
  * [371] S. Min, K. Krishna, X. Lyu, M. Lewis, W.-t. Yih, P. W. Koh, M. Iyyer, L. Zettlemoyer, and H. Hajishirzi, “Factscore: Fine-grained atomic evaluation of factual precision in long form text generation,” _CoRR_ , vol. abs/2305.14251, 2023.
  * [372] F. Nan, R. Nallapati, Z. Wang, C. N. d. Santos, H. Zhu, D. Zhang, K. McKeown, and B. Xiang, “Entity-level factual consistency of abstractive text summarization,” _CoRR_ , vol. abs/2102.09130, 2021.
  * [373] J. Maynez, S. Narayan, B. Bohnet, and R. McDonald, “On faithfulness and factuality in abstractive summarization,” _CoRR_ , vol. abs/2005.00661, 2020\.
  * [374] A. Agrawal, L. Mackey, and A. T. Kalai, “Do language models know when they’re hallucinating references?” _CoRR_ , vol. abs/2305.18248, 2023.
  * [375] R. Cohen, M. Hamri, M. Geva, and A. Globerson, “Lm vs lm: Detecting factual errors via cross examination,” _CoRR_ , vol. abs/2305.13281, 2023.
  * [376] T. Scialom, P.-A. Dray, P. Gallinari, S. Lamprier, B. Piwowarski, J. Staiano, and A. Wang, “Questeval: Summarization asks for fact-based evaluation,” _CoRR_ , vol. abs/2103.12693, 2021.
  * [377] O. Honovich, L. Choshen, R. Aharoni, E. Neeman, I. Szpektor, and O. Abend, “$q^{2}$: Evaluating factual consistency in knowledge-grounded dialogues via question generation and question answering,” _CoRR_ , vol. abs/2104.08202, 2021.
  * [378] A. R. Fabbri, C.-S. Wu, W. Liu, and C. Xiong, “Qafacteval: Improved qa-based factual consistency evaluation for summarization,” _CoRR_ , vol. abs/2112.08542, 2021.
  * [379] Z. Guo, M. Schlichtkrull, and A. Vlachos, “A survey on automated fact-checking,” _Transactions of the Association for Computational Linguistics_ , vol. 10, pp. 178–206, 2022.
  * [380] R. Zhao, X. Li, S. Joty, C. Qin, and L. Bing, “Verify-and-edit: A knowledge-enhanced chain-of-thought framework,” _CoRR_ , vol. abs/2305.03268, 2023.
  * [381] L. Gao, Z. Dai, P. Pasupat, A. Chen, A. T. Chaganty, Y. Fan, V. Zhao, N. Lao, H. Lee, D.-C. Juan _et al._ , “Rarr: Researching and revising what language models say, using language models,” in _ACL_ , 2023, pp. 16 477–16 508.
  * [382] Z. Gou, Z. Shao, Y. Gong, Y. Shen, Y. Yang, N. Duan, and W. Chen, “Critic: Large language models can self-correct with tool-interactive critiquing,” _CoRR_ , vol. abs/2305.11738, 2023.
  * [383] X. Wang, J. Wei, D. Schuurmans, Q. Le, E. Chi, S. Narang, A. Chowdhery, and D. Zhou, “Self-consistency improves chain of thought reasoning in language models,” _CoRR_ , vol. abs/2203.11171, 2022.
  * [384] R. Tang, Y.-N. Chuang, and X. Hu, “The science of detecting llm-generated texts,” _CoRR_ , vol. abs/2303.07205, 2023.
  * [385] J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” _CoRR_ , vol. abs/2301.10226, 2023\.
  * [386] J. Fang, Z. Tan, and X. Shi, “Cosywa: Enhancing semantic integrity in watermarking natural language generation,” in _NLPCC_ , 2023, pp. 708–720.
  * [387] M. J. Atallah, V. Raskin, M. Crogan, C. Hempelmann, F. Kerschbaum, D. Mohamed, and S. Naik, “Natural language watermarking: Design, analysis, and a proof-of-concept implementation,” in _Information Hiding_ , 2001, pp. 185–200.
  * [388] Z. Jalil and A. M. Mirza, “A review of digital watermarking techniques for text documents,” in _ICIMT_ , 2009, pp. 230–234.
  * [389] U. Topkara, M. Topkara, and M. J. Atallah, “The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions,” in _MM &Sec_, 2006, pp. 164–174.
  * [390] J. T. Brassil, S. Low, N. F. Maxemchuk, and L. O’Gorman, “Electronic marking and identification techniques to discourage document copying,” _IEEE Journal on Selected Areas in Communications_ , vol. 13, no. 8, pp. 1495–1504, 1995\.
  * [391] S. Abdelnabi and M. Fritz, “Adversarial watermarking transformer: Towards tracing text provenance with data hiding,” in _S &P_, 2021, pp. 121–140.
  * [392] V. S. Sadasivan, A. Kumar, S. Balasubramanian, W. Wang, and S. Feizi, “Can ai-generated text be reliably detected?” _CoRR_ , vol. abs/2303.11156, 2023\.
  * [393] G. Li, Y. Chen, J. Zhang, J. Li, S. Guo, and T. Zhang, “Warfare:breaking the watermark protection of ai-generated content,” _CoRR_ , vol. abs/2310.07726, 2023.
  * [394] B. Huang, B. Zhu, H. Zhu, J. D. Lee, J. Jiao, and M. I. Jordan, “Towards optimal statistical watermarking,” _CoRR_ , vol. abs/2312.07930, 2023.
  * [395] C. Chen, Y. Li, Z. Wu, M. Xu, R. Wang, and Z. Zheng, “Towards reliable utilization of AIGC: blockchain-empowered ownership verification mechanism,” _IEEE Open J. Comput. Soc._ , vol. 4, pp. 326–337, 2023.
  * [396] A. Chakraborty, M. Alam, V. Dey, A. Chattopadhyay, and D. Mukhopadhyay, “A survey on adversarial attacks and defences,” _CAAI Trans. Intell. Technol._ , vol. 6, no. 1, pp. 25–45, 2021.
  * [397] K. Zhu, J. Wang, J. Zhou, Z. Wang, H. Chen, Y. Wang, L. Yang, W. Ye, N. Z. Gong, Y. Zhang _et al._ , “Promptbench: Towards evaluating the robustness of large language models on adversarial prompts,” _CoRR_ , vol. abs/2306.04528, 2023.
  * [398] B. Wang, C. Xu, S. Wang, Z. Gan, Y. Cheng, J. Gao, A. H. Awadallah, and B. Li, “Adversarial glue: A multi-task benchmark for robustness evaluation of language models,” _CoRR_ , vol. abs/2111.02840, 2021.
  * [399] Y. Nie, A. Williams, E. Dinan, M. Bansal, J. Weston, and D. Kiela, “Adversarial nli: A new benchmark for natural language understanding,” _CoRR_ , vol. abs/1910.14599, 2019.
  * [400] L. Yang, S. Zhang, L. Qin, Y. Li, Y. Wang, H. Liu, J. Wang, X. Xie, and Y. Zhang, “Glue-x: Evaluating natural language understanding models from an out-of-distribution generalization perspective,” _CoRR_ , vol. abs/2211.08073, 2022.
  * [401] L. Yuan, Y. Chen, G. Cui, H. Gao, F. Zou, X. Cheng, H. Ji, Z. Liu, and M. Sun, “Revisiting out-of-distribution robustness in nlp: Benchmark, analysis, and llms evaluations,” _CoRR_ , vol. abs/2306.04618, 2023.
  * [402] N. Vaghani and M. Thummar, “Flipkart product reviews with sentiment dataset,” https://www.kaggle.com/dsv/4940809, 2023.
  * [403] T. Liu, Y. Zhang, C. Brockett, Y. Mao, Z. Sui, W. Chen, and B. Dolan, “A token-level reference-free hallucination detection benchmark for free-form text generation,” _CoRR_ , vol. abs/2104.08704, 2021.
  * [404] P. Manakul, A. Liusie, and M. J. F. Gales, “Selfcheckgpt: Zero-resource black-box hallucination detection for generative large language models,” in _EMNLP_ , H. Bouamor, J. Pino, and K. Bali, Eds., 2023, pp. 9004–9017.
  * [405] L. K. Umapathi, A. Pal, and M. Sankarasubbu, “Med-halt: Medical domain hallucination test for large language models,” _CoRR_ , vol. abs/2307.15343, 2023.
  * [406] J. Li, X. Cheng, W. X. Zhao, J.-Y. Nie, and J.-R. Wen, “Halueval: A large-scale hallucination evaluation benchmark for large language models,” in _EMNLP_ , 2023, pp. 6449–6464.
  * [407] J. Luo, C. Xiao, and F. Ma, “Zero-resource hallucination prevention for large language models,” _CoRR_ , vol. abs/2309.02654, 2023.
  * [408] S. Casper, J. Lin, J. Kwon, G. Culp, and D. Hadfield-Menell, “Explore, establish, exploit: Red teaming language models from scratch,” _CoRR_ , vol. abs/2306.09442, 2023.
  * [409] B. Mathew, P. Saha, S. M. Yimam, C. Biemann, P. Goyal, and A. Mukherjee, “Hatexplain: A benchmark dataset for explainable hate speech detection,” in _AAAI_ , 2021, pp. 14 867–14 875.
  * [410] Y. Huang, Q. Zhang, L. Sun _et al._ , “Trustgpt: A benchmark for trustworthy and responsible large language models,” _CoRR_ , vol. abs/2306.11507, 2023.
  * [411] J. Deng, J. Zhou, H. Sun, C. Zheng, F. Mi, H. Meng, and M. Huang, “Cold: A benchmark for chinese offensive language detection,” _CoRR_ , vol. abs/2201.06025, 2022.
  * [412] G. Xu, J. Liu, M. Yan, H. Xu, J. Si, Z. Zhou, P. Yi, X. Gao, J. Sang, R. Zhang _et al._ , “Cvalues: Measuring the values of chinese large language models from safety to responsibility,” _CoRR_ , vol. abs/2307.09705, 2023\.
  * [413] J. Zhang, K. Bao, Y. Zhang, W. Wang, F. Feng, and X. He, “Is chatgpt fair for recommendation? evaluating fairness in large language model recommendation,” _CoRR_ , vol. abs/2305.07609, 2023.
  * [414] J. Dhamala, T. Sun, V. Kumar, S. Krishna, Y. Pruksachatkun, K.-W. Chang, and R. Gupta, “Bold: Dataset and metrics for measuring biases in open-ended language generation,” in _FAccT_ , 2021, pp. 862–872.
  * [415] E. M. Smith, M. Hall, M. Kambadur, E. Presani, and A. Williams, ““i’m sorry to hear that”: Finding new biases in language models with a holistic descriptor dataset,” in _EMNLP_ , 2022, pp. 9180–9211.
  * [416] J. Zhou, J. Deng, F. Mi, Y. Li, Y. Wang, M. Huang, X. Jiang, Q. Liu, and H. Meng, “Towards identifying social bias in dialog systems: Frame, datasets, and benchmarks,” _CoRR_ , vol. abs/2202.08011, 2022.
  * [417] J. D. Blom, _A dictionary of hallucinations_. Springer, 2010.
  * [418] A. P. Parikh, X. Wang, S. Gehrmann, M. Faruqui, B. Dhingra, D. Yang, and D. Das, “Totto: A controlled table-to-text generation dataset,” _CoRR_ , vol. abs/2004.14373, 2023.
  * [419] E. Durmus, H. He, and M. Diab, “Feqa: A question answering evaluation framework for faithfulness assessment in abstractive summarization,” _CoRR_ , vol. abs/2005.03754, 2020.
  * [420] B. Dhingra, M. Faruqui, A. Parikh, M.-W. Chang, D. Das, and W. W. Cohen, “Handling divergent reference texts when evaluating table-to-text generation,” _CoRR_ , vol. abs/1906.01081, 2019.
  * [421] B. Goodrich, V. Rao, P. J. Liu, and M. Saleh, “Assessing the factual accuracy of generated text,” in _SIGKDD_ , 2019, pp. 166–175.
  * [422] T. Falke, L. F. Ribeiro, P. A. Utama, I. Dagan, and I. Gurevych, “Ranking generated summaries by correctness: An interesting but challenging application for natural language inference,” in _ACL_ , 2019, pp. 2214–2220.
  * [423] J. Pfeiffer, F. Piccinno, M. Nicosia, X. Wang, M. Reid, and S. Ruder, “mmt5: Modular multilingual pre-training solves source language hallucinations,” _CoRR_ , vol. abs/2305.14224, 2023.
  * [424] K. Filippova, “Controlled hallucinations: Learning to generate faithfully from noisy data,” _CoRR_ , vol. abs/2010.05873, 2020.
  * [425] F. Nie, J.-G. Yao, J. Wang, R. Pan, and C.-Y. Lin, “A simple recipe towards reducing hallucination in neural surface realisation,” in _ACL_ , 2019, pp. 2673–2679.
  * [426] Y. Wang, Y. Zhao, and L. Petzold, “Are large language models ready for healthcare? a comparative study on clinical language understanding,” _CoRR_ , vol. abs/2304.05368, 2023.
  * [427] OpenAI, “Open AI Privacy Policy,” https://openai.com/policies/privacy-policy, 2023.
  * [428] S. A. Khowaja, P. Khuwaja, and K. Dev, “Chatgpt needs spade (sustainability, privacy, digital divide, and ethics) evaluation: A review,” _CoRR_ , vol. abs/2305.03123, 2023.
  * [429] B. Wang, W. Chen, H. Pei, C. Xie, M. Kang, C. Zhang, C. Xu, Z. Xiong, R. Dutta, R. Schaeffer, S. T. Truong, S. Arora, M. Mazeika, D. Hendrycks, Z. Lin, Y. Cheng, S. Koyejo, D. Song, and B. Li, “Decodingtrust: A comprehensive assessment of trustworthiness in GPT models,” _CoRR_ , vol. abs/2306.11698, 2023.
  * [430] L. Reynolds and K. McDonell, “Prompt programming for large language models: Beyond the few-shot paradigm,” in _CHI Extended Abstracts_ , 2021, pp. 1–7.
  * [431] H. Brown, K. Lee, F. Mireshghallah, R. Shokri, and F. Tramèr, “What does it mean for a language model to preserve privacy?” in _FAccT_ , 2022, pp. 2280–2292.
  * [432] X. Li, Y. Li, L. Liu, L. Bing, and S. Joty, “Is gpt-3 a psychopath? evaluating large language models from a psychological perspective,” _CoRR_ , vol. abs/2212.10529, 2022.
  * [433] J. Rutinowski, S. Franke, J. Endendyk, I. Dormuth, and M. Pauly, “The self-perception and political biases of chatgpt,” _CoRR_ , vol. abs/2304.07333, 2023.
  * [434] M. Das, S. K. Pandey, and A. Mukherjee, “Evaluating chatgpt’s performance for multilingual and emoji-based hate speech detection,” _CoRR_ , vol. abs/2305.13276, 2023.
  * [435] D. Hendrycks, C. Burns, S. Basart, A. Critch, J. Li, D. Song, and J. Steinhardt, “Aligning ai with shared human values,” _CoRR_ , vol. abs/2008.02275, 2020.
  * [436] F. Huang, H. Kwak, and J. An, “Is chatgpt better than human annotators? potential and limitations of chatgpt in explaining implicit hate speech,” _CoRR_ , vol. abs/2302.07736, 2023.
  * [437] E. Sheng, K.-W. Chang, P. Natarajan, and N. Peng, “Societal biases in language generation: Progress and challenges,” _CoRR_ , vol. abs/2105.04054, 2021\.
  * [438] M. Nadeem, A. Bethke, and S. Reddy, “Stereoset: Measuring stereotypical bias in pretrained language models,” _CoRR_ , vol. abs/2004.09456, 2020.
  * [439] J. Hartmann, J. Schwenzow, and M. Witte, “The political ideology of conversational ai: Converging evidence on chatgpt’s pro-environmental, left-libertarian orientation,” _CoRR_ , vol. abs/2301.01768, 2023.
  * [440] Y. Cao, L. Zhou, S. Lee, L. Cabello, M. Chen, and D. Hershcovich, “Assessing cross-cultural alignment between chatgpt and human societies: An empirical study,” _CoRR_ , vol. abs/2303.17466, 2023.
  * [441] A. Ramezani and Y. Xu, “Knowledge of cultural moral norms in large language models,” _CoRR_ , vol. abs/2306.01857, 2023.
  * [442] Y. Wan, W. Wang, P. He, J. Gu, H. Bai, and M. Lyu, “Biasasker: Measuring the bias in conversational ai system,” _CoRR_ , vol. abs/2305.12434, 2023.
  * [443] Q. Luo, M. J. Puett, and M. D. Smith, “A perspectival mirror of the elephant: Investigating language bias on google, chatgpt, wikipedia, and youtube,” _CoRR_ , vol. abs/2303.16281, 2023.
  * [444] Y. Tian, X. Yang, J. Zhang, Y. Dong, and H. Su, “Evil geniuses: Delving into the safety of llm-based agents,” _arXiv preprint arXiv:2311.11855_ , 2023\.