M. Bilgehan Ertan

Amsterdam, Netherlands

I am Murat Bilgehan Ertan, a researcher at the intersection of security, privacy, and machine learning, currently pursuing my PhD at CWI (Centrum Wiskunde & Informatica) in Amsterdam under the supervision of Prof. Marten van Dijk.

I hold a BSc in Computer Science and Engineering from Sabancı University, Türkiye, and an MSc in Computer Security (cum laude) from Vrije Universiteit Amsterdam. Beyond my academic research, I have professional experience as a Security Researcher and Developer at PRODAFT.

My research focuses on building secure and privacy-preserving learning systems, combining theoretical analysis with practical engineering. I study how information leaks and adversarial behavior arise in modern AI, developing formal frameworks based on Differential Privacy, f-DP, and PAC privacy to understand and bound these effects. In parallel, I work on adversarial and membership inference attacks on large language models to evaluate and strengthen their real-world resilience.

I’m broadly interested in how we can make machine learning systems secure, private, and reliable without losing their practical value.

selected publications

Preprint
PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization

Murat Bilgehan Ertan, Xiaochen Zhu, Phuong Ha Nguyen, and 2 more authors

CoRR, 2026

Abs DOI arXiv Bib HTML

We introduce PACZero, a suite of PAC-private zeroth-order mechanisms for fine-tuning large language models that delivers usable utility at I(S*; Y_1:T) = 0, providing membership-inference resistance comparable to differential privacy only at extreme noise levels. The key idea is to sign-quantize subset-aggregated zeroth-order gradients to induce frequent unanimity—instances where candidate subsets agree on update directions—which incurs zero conditional mutual information cost. Two variants balance the privacy-utility spectrum: PACZero-MI (budgeted mutual information) and PACZero-ZPL (zero mutual information through randomized disagreement handling). Experiments on SST-2 and SQuAD with OPT models demonstrate competitive performance in high-privacy regimes where prior methods struggle.
@article{ertan2026paczero, author = {Ertan, Murat Bilgehan and Zhu, Xiaochen and Nguyen, Phuong Ha and {van Dijk}, Marten and Devadas, Srinivas}, title = {{PACZero}: {PAC}-Private Fine-Tuning of Language Models via Sign Quantization}, journal = {CoRR}, volume = {abs/2605.06505}, year = {2026}, doi = {10.48550/ARXIV.2605.06505} }
Preprint
Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD

Murat Bilgehan Ertan and Marten van Dijk

Accepted at ACM CCS 2026, 2026

Abs DOI arXiv Bib HTML

This work establishes fundamental limitations of favorable privacy-utility guarantees for DP-SGD, providing theoretical analysis of the inherent trade-offs in differentially private stochastic gradient descent.
@article{ertan2026fundamental, author = {Ertan, Murat Bilgehan and {van Dijk}, Marten}, title = {Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD}, journal = {Accepted at ACM CCS 2026}, volume = {abs/2601.10237}, year = {2026}, doi = {10.48550/ARXIV.2601.10237} }

Preprint

On the Evidentiary Limits of Membership Inference for Copyright Auditing

Murat Bilgehan Ertan, Emirhan Böge, Min Chen, and 2 more authors

CoRR, 2026

Abs DOI arXiv Bib HTML

@article{ertan2026evidentiary,
  author = {Ertan, Murat Bilgehan and B\"{o}ge, Emirhan and Chen, Min and Mahmood, Kaleel and {van Dijk}, Marten},
  title = {On the Evidentiary Limits of Membership Inference for Copyright Auditing},
  journal = {CoRR},
  volume = {abs/2601.12937},
  year = {2026},
  doi = {10.48550/ARXIV.2601.12937}
}