Matthieu Meeus

I am a researcher with a broad interest in how frontier technological systems impact our society. Currently, I’m pursuing/wrapping up my PhD in computer science at Imperial College London as part of the AI Security and Privacy Lab under supervision of Yves-Alexandre de Montjoye.

My research has primarily focused on privacy/memorization of AI, ranging from traditional machine learning models to LLMs. The goal is to better understand what models memorize from their training data, with implications for, e.g., privacy and confidentiality, copyright, model utility and evaluation etc.

contact

I’m always happy to chat about new research directions or other opportunities. Right now, I’m looking for full-time opportunites in industry, preferably on the East Coast 🇺🇸! Please reach out if of interest.

You can find more about my work through Google Scholar, and can stay updated by following me on Twitter (X) or LinkedIn.

a short bio

Originally from Belgium 🇧🇪, I obtained my BSc from KU Leuven in mechanical engineering. Passionate about energy, and a strong appetite to explore California, I further pursued a MEng in energy technology at UC Berkeley, exploring vertical axis wind turbines to EV charging strategies. Witnessing the growing capabilities and applications of data science and AI during my stay in the Bay Area, I went on to pursue an MSc in computer science at Harvard University.

I extended my stay in the US by working as a data scientist. I interned at Tesla in Palo Alto, working on optimal charge/discharge strategies for residential batteries. Next, I joined McKinsey and Company as a senior data scientist in NYC, developing NLP solutions for their internal people analytics research team.

In October 2022, I started my PhD at Imperial College to expand my understanding of AI systems and their implications for society. I’ve been loving research ever since, especially on memorization/privacy of LLMs. During my PhD, I interned at Microsoft Research in Cambridge (2024) and am soon/currently at Meta in NYC (from March 2026).

For more information see my full resume.

news

Mar 01, 2026	Joining Meta as a Research Scientist Intern in NYC for 6 months! Will be working on memorization and privacy of AI with the Central Applied Intelligence team.
Jul 21, 2025	Presented three papers at ICML ‘25! One at the main conference on privacy auditing of synthetic text and two papers at the memorization workshop, both (1,2) touching upon how near-duplicates (and beyond) contribute to LLM memorization.
Apr 11, 2025	We received the best paper award at SaTML 2025 in Copenhagen! It’s a great recognition for our learnings on MIAs against LLMs throughout the last two years. Checkout the paper here.
Dec 13, 2024	Very excited to release ChocoLlama, a family of 6 open-source (3 base, 3 pretrained) Dutch LLMs based on Llama-2/3. Checkout our learnings in the paper!
Oct 18, 2024	We’re organizing a meetup on privacy in machine learning at Imperial College on November 7. Sign up here!

selected publications

Nature Comms

The Mosaic Memory of Large Language Models

Igor Shilov, Matthieu Meeus, and Yves-Alexandre Montjoye

Nature Communications, 2026

Mentioned in the Financial Times.

TL;DR Paper Code

TLDR; LLMs memorize more that previously believed, stitching together information from overlapping fragments of text like a mosaic, with implications for privacy, confidentiality, copyright, model utility and evaluation.
ICML

The Canary’s Echo: Auditing Privacy Risks of LLM-Generated Synthetic Text

Matthieu Meeus, Lukas Wutschitz, Santiago Zanella-Béguelin, Shruti Tople, and Reza Shokri

Forty-second International Conference on Machine Learning (ICML), 2025

Work done during my internship at Microsoft Research.

TL;DR Paper Code

TLDR; We propose the first privacy auditing pipeline for synthetic text. We implement different MIAs just based on access to the text and find that canaries with low-perplexity-prefix and high-perplexity-suffix are the most vulnerable.
Preprint

ChocoLlama: Lessons Learned From Teaching Llamas Dutch

Matthieu Meeus, Anthony Rathé, François Remy, Pieter Delobelle, Jens-Joris Decorte, and Thomas Demeester

2024

All 6 models are available on HuggingFace. Press coverage in Flemish newspaper De Tijd.

TL;DR Paper Code

TLDR; We further pretrain Llama-2/3 on Dutch data, and release a family of 6 open-source LLMs. We elaborate on our learnings in the paper (modifying the tokenizer, using LoRA at scale for language adaptation, pretraining versus posttraining, benchmarking).
SaTML

SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)

Matthieu Meeus, Shilov Igor, Shubham Jain, Manuel Faysse, Marek Rei, and Yves-Alexandre Montjoye

IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 2025

Received Best Paper Award at SaTML 2025.

TL;DR Paper Code

TLDR; We wrote an SoK on recent developments in MIAs against LLMs. We discuss how things have evolved recently, show popular evaluation setups to be flawed, and examine solutions going forward.
USENIX Security

Did the Neurons Read your Book? Document-level Membership Inference for Large Language Models

Matthieu Meeus, Shubham Jain, Marek Rei, and Yves-Alexandre Montjoye

In 33rd USENIX Security Symposium (USENIX Security), 2024

Press coverage in Le Monde.

TL;DR Paper Code

TLDR; Given a pretrained LLM and a document, can I infer whether the document was used to train the LLM? First, we rely on the collection of documents which we know have been used to train the LLM (members) and documents made available after the model release data (non-members). We then query the LLM on both members and non-members for token-level probabilities and train a classifier to predict binary membership. Spoiler: It’s harder than you think!
ICML

Copyright Traps for Large Language Models

Matthieu Meeus, Igor Shilov, Manuel Faysse, and Yves-Alexandre Montjoye

In Forty-first International Conference on Machine Learning (ICML), 2024

Press coverage in MIT Technology Review and Nature News.

TL;DR Paper Code

TLDR; We add copyright traps to original content. These are highly unique sequences that, if an LLM were to be trained on it, we would be able to tell through how the LLM reacts to our injected trap. We inject a variety of traps into the pretraining dataset of the real-world 1.3B CroissantLLM trained from scratch, and find that copyright traps indeed enable content detectability.