A Multi-label, Dual-Output Deep Neural Network for Automated Bug Triaging. - Christopher A. Choquette-Choo; David Sheldon; Jonny Proppe; John Alphonso-Gibbs; Harsha Gupta (ICMLA, 2019)

Entangled Watermarks as a Defense against Model Extraction. - Hengrui Jia 001; Christopher A. Choquette-Choo; Nicolas Papernot (CoRR, 2020)

CaPC Learning: Confidential and Private Collaborative Learning. - Christopher A. Choquette-Choo; Natalie Dullerud; Adam Dziedzic; Yunxiang Zhang 003; Somesh Jha; Nicolas Papernot; Xiao Wang 012 (ICLR, 2021)

Label-Only Membership Inference Attacks. - Christopher A. Choquette-Choo; Florian Tramèr; Nicholas Carlini; Nicolas Papernot (ICML, 2021)

Machine Unlearning. - Lucas Bourtoule; Varun Chandrasekaran; Christopher A. Choquette-Choo; Hengrui Jia 001; Adelin Travers; Baiwu Zhang; David Lie; Nicolas Papernot (SP, 2021)

Proof-of-Learning: Definitions and Practice. - Hengrui Jia 001; Mohammad Yaghini; Christopher A. Choquette-Choo; Natalie Dullerud; Anvith Thudi; Varun Chandrasekaran; Nicolas Papernot (SP, 2021)

Entangled Watermarks as a Defense against Model Extraction. - Hengrui Jia 001; Christopher A. Choquette-Choo; Varun Chandrasekaran; Nicolas Papernot (USENIX Security Symposium, 2021)

The Fundamental Price of Secure Aggregation in Differentially Private Federated Learning. - Wei-Ning Chen; Christopher A. Choquette-Choo; Peter Kairouz; Ananda Theertha Suresh (ICML, 2022)

On the Fundamental Limits of Formally (Dis)Proving Robustness in Proof-of-Learning. - Congyu Fang; Hengrui Jia 001; Anvith Thudi; Mohammad Yaghini; Christopher A. Choquette-Choo; Natalie Dullerud; Varun Chandrasekaran; Nicolas Papernot (CoRR, 2022)

Fine-Tuning with Differential Privacy Necessitates an Additional Hyperparameter Search. - Yannis Cattan; Christopher A. Choquette-Choo; Nicolas Papernot; Abhradeep Thakurta (CoRR, 2022)

Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (CoRR, 2022)

Federated Learning of Gboard Language Models with Differential Privacy. - Zheng Xu 002; Yanxiang Zhang; Galen Andrew; Christopher A. Choquette-Choo; Peter Kairouz; H. Brendan McMahan; Jesse Rosenstock; Yuanbo Zhang (ACL (industry), 2023)

Proof-of-Learning is Currently More Broken Than You Think. - Congyu Fang; Hengrui Jia 001; Anvith Thudi; Mohammad Yaghini; Christopher A. Choquette-Choo; Natalie Dullerud; Varun Chandrasekaran; Nicolas Papernot (EuroS&P, 2023)

Multi-Epoch Matrix Factorization Mechanisms for Private Machine Learning. - Christopher A. Choquette-Choo; Hugh Brendan McMahan; J. Keith Rush; Abhradeep Guha Thakurta (ICML, 2023)

Private Federated Learning with Autotuned Compression. - Enayat Ullah; Christopher A. Choquette-Choo; Peter Kairouz; Sewoong Oh (ICML, 2023)

Preventing Generation of Verbatim Memorization in Language Models Gives a False Sense of Privacy. - Daphne Ippolito; Florian Tramèr; Milad Nasr; Chiyuan Zhang; Matthew Jagielski; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini (INLG, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Pang Wei Koh; Daphne Ippolito; Florian Tramèr; Ludwig Schmidt (NeurIPS, 2023)

(Amplified) Banded Matrix Factorization: A unified approach to private training. - Christopher A. Choquette-Choo; Arun Ganesh; Ryan McKenna; H. Brendan McMahan; John Rush; Abhradeep Guha Thakurta; Zheng Xu 002 (NeurIPS, 2023)

Robust and Actively Secure Serverless Collaborative Learning. - Nicholas Franzese; Adam Dziedzic; Christopher A. Choquette-Choo; Mark R. Thomas; Muhammad Ahmad Kaleem; Stephan Rabanser; Congyu Fang; Somesh Jha; Nicolas Papernot; Xiao Wang 012 (NeurIPS, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Katherine Lee; Christopher A. Choquette-Choo; Nicholas Carlini; Florian Tramèr (NeurIPS, 2023)

Students Parrot Their Teachers: Membership Inference on Model Distillation. - Matthew Jagielski; Milad Nasr; Christopher A. Choquette-Choo; Katherine Lee; Nicholas Carlini (CoRR, 2023)

PaLM 2 Technical Report. - Rohan Anil; Andrew M. Dai; Orhan Firat; Melvin Johnson; Dmitry Lepikhin; Alexandre Passos; Siamak Shakeri; Emanuel Taropa; Paige Bailey; Zhifeng Chen; Eric Chu; Jonathan H. Clark; et al. (CoRR, 2023)

(Amplified) Banded Matrix Factorization: A unified approach to private training. - Christopher A. Choquette-Choo; Arun Ganesh; Ryan McKenna; H. Brendan McMahan; Keith Rush; Abhradeep Guha Thakurta; Zheng Xu 002 (CoRR, 2023)

Are aligned neural networks adversarially aligned? - Nicholas Carlini; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Irena Gao; Anas Awadalla; Pang Wei Koh; Daphne Ippolito; Katherine Lee; Florian Tramèr; Ludwig Schmidt (CoRR, 2023)

MADLAD-400: A Multilingual And Document-Level Large Audited Dataset. - Sneha Kudugunta; Isaac Caswell; Biao Zhang 006; Xavier Garcia; Christopher A. Choquette-Choo; Katherine Lee; Derrick Xin; Aditya Kusupati; Romi Stella; Ankur Bapna; Orhan Firat (CoRR, 2023)

Robust and Actively Secure Serverless Collaborative Learning. - Olive Franzese; Adam Dziedzic; Christopher A. Choquette-Choo; Mark R. Thomas; Muhammad Ahmad Kaleem; Stephan Rabanser; Congyu Fang; Somesh Jha; Nicolas Papernot; Xiao Wang 012 (CoRR, 2023)

Report of the 1st Workshop on Generative AI and Law. - A. Feder Cooper; Katherine Lee; James Grimmelmann; Daphne Ippolito; Christopher Callison-Burch; Christopher A. Choquette-Choo; Niloofar Mireshghallah; Miles Brundage; David Mimno; Madiha Zahrah Choksi; Jack M. Balkin; Nicholas Carlini; et al. (CoRR, 2023)

Scalable Extraction of Training Data from (Production) Language Models. - Milad Nasr; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Eric Wallace; Florian Tramèr; Katherine Lee (CoRR, 2023)

Private Multi-Winner Voting for Machine Learning. - Adam Dziedzic; Christopher A. Choquette-Choo; Natalie Dullerud; Vinith M. Suriyakumar; Ali Shahin Shamsabadi; Muhammad Ahmad Kaleem; Somesh Jha; Nicolas Papernot; Xiao Wang 012 (Proc. Priv. Enhancing Technol., 2023)

User Inference Attacks on Large Language Models. - Nikhil Kandpal; Krishna Pillutla; Alina Oprea; Peter Kairouz; Christopher A. Choquette-Choo; Zheng Xu 002 (EMNLP, 2024)

Correlated Noise Provably Beats Independent Noise for Differentially Private Learning. - Christopher A. Choquette-Choo; Krishnamurthy Dj Dvijotham; Krishna Pillutla; Arun Ganesh; Thomas Steinke 002; Abhradeep Guha Thakurta (ICLR, 2024)

Privacy Amplification for Matrix Mechanisms. - Christopher A. Choquette-Choo; Arun Ganesh; Thomas Steinke 002; Abhradeep Guha Thakurta (ICLR, 2024)

Teach LLMs to Phish: Stealing Private Information from Language Models. - Ashwinee Panda; Christopher A. Choquette-Choo; Zhengming Zhang 001; Yaoqing Yang; Prateek Mittal (ICLR, 2024)

Auditing Private Prediction. - Karan Chadha; Matthew Jagielski; Nicolas Papernot; Christopher A. Choquette-Choo; Milad Nasr (ICML, 2024)

Poisoning Web-Scale Training Datasets is Practical. - Nicholas Carlini; Matthew Jagielski; Christopher A. Choquette-Choo; Daniel Paleka; Will Pearce; Hyrum S. Anderson; Andreas Terzis; Kurt Thomas; Florian Tramèr (SP, 2024)

Privacy Side Channels in Machine Learning Systems. - Edoardo Debenedetti; Giorgio Severi; Milad Nasr; Christopher A. Choquette-Choo; Matthew Jagielski; Eric Wallace; Nicholas Carlini; Florian Tramèr (USENIX Security Symposium, 2024)

Gemma: Open Models Based on Gemini Research and Technology. - Thomas Mesnard; Cassidy Hardin; Robert Dadashi; Surya Bhupatiraju; Shreya Pathak; Laurent Sifre; Morgane Rivière; Mihir Sanjay Kale; Juliette Love; Pouya Tafti; Léonard Hussenot; Aakanksha Chowdhery; et al. (CoRR, 2024)

Phantom: General Trigger Attacks on Retrieval Augmented Language Generation. - Harsh Chaudhari; Giorgio Severi; John Abascal; Matthew Jagielski; Christopher A. Choquette-Choo; Milad Nasr; Cristina Nita-Rotaru; Alina Oprea (CoRR, 2024)

Optimal Rates for DP-SCO with a Single Epoch and Large Batches. - Christopher A. Choquette-Choo; Arun Ganesh; Abhradeep Thakurta (CoRR, 2024)

CodeGemma: Open Code Models Based on Gemma. - Heri Zhao; Jeffrey Hui; Joshua Howland; Nam Nguyen; Siqi Zuo; Andrea Hu; Christopher A. Choquette-Choo; Jingyue Shen; Joe Kelley; Kshitij Bansal; Luke Vilnis; Mateo Wirth; et al. (CoRR, 2024)

Gemma 2: Improving Open Language Models at a Practical Size. - Morgane Rivière; Shreya Pathak; Pier Giuseppe Sessa; Cassidy Hardin; Surya Bhupatiraju; Léonard Hussenot; Thomas Mesnard; Bobak Shahriari; Alexandre Ramé; Johan Ferret; Peter Liu; Pouya Tafti; et al. (CoRR, 2024)

Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy, Research, and Practice. - A. Feder Cooper; Christopher A. Choquette-Choo; Miranda Bogen; Matthew Jagielski; Katja Filippova; Ken Ziyu Liu; Alexandra Chouldechova; Jamie Hayes; Yangsibo Huang; Niloofar Mireshghallah; Ilia Shumailov; Eleni Triantafillou; et al. (CoRR, 2024)

Privacy Ripple Effects from Adding or Removing Personal Information in Language Model Training. - Jaydeep Borkar; Matthew Jagielski; Katherine Lee; Niloofar Mireshghallah; David A. Smith; Christopher A. Choquette-Choo (ACL (Findings), 2025)

Near-Optimal Rates for O(1)-Smooth DP-SCO with a Single Epoch and Large Batches. - Christopher A. Choquette-Choo; Arun Ganesh; Abhradeep Guha Thakurta (ALT, 2025)

Near-Exact Privacy Amplification for Matrix Mechanisms. - Christopher A. Choquette-Choo; Arun Ganesh; Saminul Haque; Thomas Steinke 002; Abhradeep Guha Thakurta (ICLR, 2025)

The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD. - Milad Nasr; Thomas Steinke 002; Borja Balle; Christopher A. Choquette-Choo; Arun Ganesh; Matthew Jagielski; Jamie Hayes; Abhradeep Guha Thakurta; Adam Smith 006; Andreas Terzis (ICLR, 2025)

Scalable Extraction of Training Data from Aligned, Production Language Models. - Milad Nasr; Javier Rando; Nicholas Carlini; Jonathan Hayase; Matthew Jagielski; A. Feder Cooper; Daphne Ippolito; Christopher A. Choquette-Choo; Florian Tramèr; Katherine Lee (ICLR, 2025)

Privacy Auditing of Large Language Models. - Ashwinee Panda; Xinyu Tang 003; Christopher A. Choquette-Choo; Milad Nasr; Prateek Mittal (ICLR, 2025)

Recite, Reconstruct, Recollect: Memorization in LMs as a Multifaceted Phenomenon. - USVSN Sai Prashanth; Alvin Deng; Kyle O'Brien; Jyothir S. V; Mohammad Aflah Khan; Jaydeep Borkar; Christopher A. Choquette-Choo; Jacob Ray Fuehne; Stella Biderman; Tracy Ke; Katherine Lee; Naomi Saphra (ICLR, 2025)

Measuring memorization in language models via probabilistic extraction. - Jamie Hayes; Marika Swanberg; Harsh Chaudhari; Itay Yona; Ilia Shumailov; Milad Nasr; Christopher A. Choquette-Choo; Katherine Lee; A. Feder Cooper (NAACL (Long Papers), 2025)

Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards. - Yangsibo Huang; Milad Nasr; Anastasios Angelopoulos; Nicholas Carlini; Wei-Lin Chiang; Christopher A. Choquette-Choo; Daphne Ippolito; Matthew Jagielski; Katherine Lee; Ken Ziyu Liu; Ion Stoica; Florian Tramèr; et al. (CoRR, 2025)

Scaling Laws for Differentially Private Language Models. - Ryan McKenna; Yangsibo Huang; Amer Sinha; Borja Balle; Zachary Charles; Christopher A. Choquette-Choo; Badih Ghazi; Georgios Kaissis; Ravi Kumar 001; Ruibo Liu; Da Yu; Chiyuan Zhang (CoRR, 2025)

Language Models May Verbatim Complete Text They Were Not Explicitly Trained On. - Ken Ziyu Liu; Christopher A. Choquette-Choo; Matthew Jagielski; Peter Kairouz; Sanmi Koyejo; Percy Liang; Nicolas Papernot (CoRR, 2025)

Gemma 3 Technical Report. - Aishwarya Kamath; Johan Ferret; Shreya Pathak; Nino Vieillard; Ramona Merhej; Sarah Perrin; Tatiana Matejovicova; Alexandre Ramé; Morgane Rivière; Louis Rouillard; Thomas Mesnard; Geoffrey Cideron; et al. (CoRR, 2025)

LLMs unlock new paths to monetizing exploits. - Nicholas Carlini; Milad Nasr; Edoardo Debenedetti; Barry Wang; Christopher A. Choquette-Choo; Daphne Ippolito; Florian Tramèr; Matthew Jagielski (CoRR, 2025)

Lessons from Defending Gemini Against Indirect Prompt Injections. - Chongyang Shi 003; Sharon Lin; Shuang Song 001; Jamie Hayes; Ilia Shumailov; Itay Yona; Juliette Pluto; Aneesh Pappu; Christopher A. Choquette-Choo; Milad Nasr; Chawin Sitawarin; Gena Gibson; et al. (CoRR, 2025)

Strong Membership Inference Attacks on Massive Datasets and (Moderately) Large Language Models. - Jamie Hayes; Ilia Shumailov; Christopher A. Choquette-Choo; Matthew Jagielski; Georgios Kaissis; Katherine Lee; Milad Nasr; Sahra Ghalebikesabi; Niloofar Mireshghallah; Meenatchi Sundaram Mutu Selva Annamalai; Igor Shilov; Matthieu Meeus; et al. (CoRR, 2025)

Correlated Noise Mechanisms for Differentially Private Learning. - Krishna Pillutla; Jalaj Upadhyay; Christopher A. Choquette-Choo; Krishnamurthy Dvijotham; Arun Ganesh; Monika Henzinger; Jonathan Katz; Ryan McKenna; H. Brendan McMahan; Keith Rush; Thomas Steinke 002; Abhradeep Thakurta (CoRR, 2025)

Efficient and Privacy-Preserving Soft Prompt Transfer for LLMs. - Xun Wang; Jing Xu; Franziska Boenisch; Michael Backes 001; Christopher A. Choquette-Choo; Adam Dziedzic (CoRR, 2025)