M. Bilgehan Ertan

Amsterdam, Netherlands

I am Murat Bilgehan Ertan, a researcher at the intersection of security, privacy, and machine learning, currently pursuing my PhD at CWI (Centrum Wiskunde & Informatica) in Amsterdam under the supervision of Prof. Marten van Dijk.

I hold a BSc in Computer Science and Engineering from Sabancı University, Türkiye, and an MSc in Computer Security (cum laude) from Vrije Universiteit Amsterdam. Beyond my academic research, I have professional experience as a Security Researcher and Developer at PRODAFT.

My research focuses on building secure and privacy-preserving learning systems, combining theoretical analysis with practical engineering. I study how information leaks and adversarial behavior arise in modern AI, developing formal frameworks based on Differential Privacy, f-DP, and PAC privacy to understand and bound these effects. In parallel, I work on adversarial and membership inference attacks on large language models to evaluate and strengthen their real-world resilience.

I’m broadly interested in how we can make machine learning systems secure, private, and reliable without losing their practical value.

selected publications

IEEE S&P

Beyond Stop Signs: Why Evasion Attacks Matter Even More

Kaleel Mahmood, Murat Bilgehan Ertan, and Marten van Dijk

IEEE Security & Privacy, 2026

Bib HTML

@article{mahmood2026beyond,
  author = {Mahmood, Kaleel and Ertan, Murat Bilgehan and {van Dijk}, Marten},
  title = {Beyond Stop Signs: Why Evasion Attacks Matter Even More},
  journal = {IEEE Security \& Privacy},
  volume = {24},
  number = {3},
  pages = {65--70},
  year = {2026},
  publisher = {IEEE},
}

Preprint
PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization

Murat Bilgehan Ertan, Xiaochen Zhu, Phuong Ha Nguyen, Marten van Dijk, and Srinivas Devadas

CoRR, 2026

Abs DOI arXiv Bib HTML

We introduce PACZero, a suite of PAC-private zeroth-order mechanisms for fine-tuning large language models that delivers usable utility at I(S*; Y_1:T) = 0, providing membership-inference resistance comparable to differential privacy only at extreme noise levels. The key idea is to sign-quantize subset-aggregated zeroth-order gradients to induce frequent unanimity—instances where candidate subsets agree on update directions—which incurs zero conditional mutual information cost. Two variants balance the privacy-utility spectrum: PACZero-MI (budgeted mutual information) and PACZero-ZPL (zero mutual information through randomized disagreement handling). Experiments on SST-2 and SQuAD with OPT models demonstrate competitive performance in high-privacy regimes where prior methods struggle.
@article{ertan2026paczero, author = {Ertan, Murat Bilgehan and Zhu, Xiaochen and Nguyen, Phuong Ha and {van Dijk}, Marten and Devadas, Srinivas}, title = {{PACZero}: {PAC}-Private Fine-Tuning of Language Models via Sign Quantization}, journal = {CoRR}, volume = {abs/2605.06505}, year = {2026}, doi = {10.48550/ARXIV.2605.06505}, }
Preprint
Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD

Murat Bilgehan Ertan and Marten van Dijk

Accepted at ACM CCS 2026, 2026

Abs DOI arXiv Bib HTML

This work establishes fundamental limitations of favorable privacy-utility guarantees for DP-SGD, providing theoretical analysis of the inherent trade-offs in differentially private stochastic gradient descent.
@article{ertan2026fundamental, author = {Ertan, Murat Bilgehan and {van Dijk}, Marten}, title = {Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD}, journal = {Accepted at ACM CCS 2026}, volume = {abs/2601.10237}, year = {2026}, doi = {10.48550/ARXIV.2601.10237}, }

Preprint

On the Evidentiary Limits of Membership Inference for Copyright Auditing

Murat Bilgehan Ertan, Emirhan Böge, Min Chen, Kaleel Mahmood, and Marten van Dijk

CoRR, 2026

Abs DOI arXiv Bib HTML

@article{ertan2026evidentiary,
  author = {Ertan, Murat Bilgehan and B\"{o}ge, Emirhan and Chen, Min and Mahmood, Kaleel and {van Dijk}, Marten},
  title = {On the Evidentiary Limits of Membership Inference for Copyright Auditing},
  journal = {CoRR},
  volume = {abs/2601.12937},
  year = {2026},
  doi = {10.48550/ARXIV.2601.12937},
}