M. Bilgehan Ertan

Amsterdam, Netherlands

I am Murat Bilgehan Ertan, a researcher at the intersection of AI safety, privacy, and machine learning, currently pursuing my PhD at CWI (Centrum Wiskunde & Informatica) in Amsterdam under the supervision of Prof. Marten van Dijk.

I hold a BSc in Computer Science and Engineering from Sabancı University, Türkiye, and an MSc in Computer Security (cum laude) from Vrije Universiteit Amsterdam. Beyond my academic research, I have professional experience as a Security Researcher and Developer at PRODAFT.

My research focuses on building safe, secure, and privacy-preserving AI systems, combining theoretical analysis with practical engineering. I study how information leaks and adversarial behavior arise in modern AI, developing formal frameworks based on Differential Privacy, f-DP, and PAC privacy to understand and bound these effects. More recently, my work has expanded from privacy toward the broader question of AI safety. Together with Prof. Srini Devadas at MIT, I study certified defenses against data poisoning in LLM post-training, as well as the safety of agentic systems. In parallel, I work on adversarial and membership inference attacks on large language models to evaluate and strengthen their real-world resilience.

I’m broadly interested in how we can make AI systems safe, secure, and private while remaining practically useful.

selected publications

IEEE S&P

Beyond Stop Signs: Why Evasion Attacks Matter Even More

Kaleel Mahmood, Murat Bilgehan Ertan, and Marten van Dijk

IEEE Security & Privacy, 2026

Bib HTML

@article{mahmood2026beyond,
  author = {Mahmood, Kaleel and Ertan, Murat Bilgehan and {van Dijk}, Marten},
  title = {Beyond Stop Signs: Why Evasion Attacks Matter Even More},
  journal = {IEEE Security \& Privacy},
  volume = {24},
  number = {3},
  pages = {65--70},
  year = {2026},
  publisher = {IEEE},
}

Preprint
PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization

Murat Bilgehan Ertan, Xiaochen Zhu, Phuong Ha Nguyen, Marten van Dijk, and Srinivas Devadas

Accepted at NeurIPS’26 (poster), 2026

Abs DOI arXiv Bib HTML

We introduce PACZero, a suite of PAC-private zeroth-order mechanisms for fine-tuning large language models that delivers usable utility at I(S*; Y_1:T) = 0, providing membership-inference resistance comparable to differential privacy only at extreme noise levels. The key idea is to sign-quantize subset-aggregated zeroth-order gradients to induce frequent unanimity—instances where candidate subsets agree on update directions—which incurs zero conditional mutual information cost. Two variants balance the privacy-utility spectrum: PACZero-MI (budgeted mutual information) and PACZero-ZPL (zero mutual information through randomized disagreement handling). Experiments on SST-2 and SQuAD with OPT models demonstrate competitive performance in high-privacy regimes where prior methods struggle.
@article{ertan2026paczero, author = {Ertan, Murat Bilgehan and Zhu, Xiaochen and Nguyen, Phuong Ha and {van Dijk}, Marten and Devadas, Srinivas}, title = {{PACZero}: {PAC}-Private Fine-Tuning of Language Models via Sign Quantization}, journal = {Accepted at NeurIPS'26 (poster)}, volume = {abs/2605.06505}, year = {2026}, doi = {10.48550/ARXIV.2605.06505}, }
Preprint
Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD

Murat Bilgehan Ertan and Marten van Dijk

Accepted at ACM CCS 2026, 2026

Abs DOI arXiv Bib HTML

This work establishes fundamental limitations of favorable privacy-utility guarantees for DP-SGD, providing theoretical analysis of the inherent trade-offs in differentially private stochastic gradient descent.
@article{ertan2026fundamental, author = {Ertan, Murat Bilgehan and {van Dijk}, Marten}, title = {Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD}, journal = {Accepted at ACM CCS 2026}, volume = {abs/2601.10237}, year = {2026}, doi = {10.48550/ARXIV.2601.10237}, }

Preprint

On the Evidentiary Limits of Membership Inference for Copyright Auditing

Murat Bilgehan Ertan, Emirhan Böge, Min Chen, Kaleel Mahmood, and Marten van Dijk

CoRR, 2026

Abs DOI arXiv Bib HTML

@article{ertan2026evidentiary,
  author = {Ertan, Murat Bilgehan and B\"{o}ge, Emirhan and Chen, Min and Mahmood, Kaleel and {van Dijk}, Marten},
  title = {On the Evidentiary Limits of Membership Inference for Copyright Auditing},
  journal = {CoRR},
  volume = {abs/2601.12937},
  year = {2026},
  doi = {10.48550/ARXIV.2601.12937},
}