Unintended Memorization of Sensitive Information in Fine-Tuned Language Models (2026.eacl-long)
Copied to clipboard
Marton Szep, Jorge Marin Ruiz, Georgios Kaissis, Paulina Seidl, Rüdiger von Eisenhart-Rothe, Florian Hinterwimmer, Daniel Rueckert
| Challenge: | Large Language Models (LLMs) on sensitive datasets carry a substantial risk of unintended memorization and leakage of Personally Identifiable Information (PII) prior studies have analyzed memorizing dynamics in LLMs during pre-training and fine-tuning. |
| Approach: | They investigate the vulnerability of PII that appears only in model inputs, not in training targets. |
| Outcome: | The proposed methods show that post-training methods provide more consistent privacy-utility trade-offs . |
Similar Papers
Privacy Ripple Effects from Adding or Removing Personal Information in Language Model Training (2025.findings-acl)
Copied to clipboard
Jaydeep Borkar, Matthew Jagielski, Katherine Lee, Niloofar Mireshghallah, David A. Smith, Christopher A. Choquette-Choo
| Challenge: | PII is a sensitive information that can be removed from large-language model training due to evolving curation techniques, or because it was recently scraped for retraining. |
| Approach: | They characterize a phenomenon where PII that appeared earlier in training becomes extractable at a later step after fine-tuning on other PI I. |
| Outcome: | The authors show that PII memorization is a dynamic property of a model that evolves throughout training pipelines and depends on commonly altered design choices. |
Exploring Memorization in Fine-tuned Language Models (2024.acl-long)
Copied to clipboard
Shenglai Zeng, Yaxin Li, Jie Ren, Yiding Liu, Han Xu, Pengfei He, Yue Xing, Shuaiqiang Wang, Jiliang Tang, Dawei Yin
| Challenge: | Existing studies have shown that pre-trained langauge models tend to memorize and regenerate segments of their pre-training corpus when prompted appropriately. |
| Approach: | They conduct the first comprehensive analysis to explore language models’ memorization during fine-tuning across tasks. |
| Outcome: | The proposed analysis shows that memorization presents a strong disparity among different fine-tuning tasks. |
Large Language Models Can Be Contextual Privacy Protection Learners (2024.emnlp-main)
Copied to clipboard
Yijia Xiao, Yiqiao Jin, Yushi Bai, Yue Wu, Xianjun Yang, Xiao Luo, Wenchao Yu, Xujiang Zhao, Yanchi Liu, Quanquan Gu, Haifeng Chen, Wei Wang, Wei Cheng
| Challenge: | Large Language Models (LLMs) have demonstrated remarkable linguistic comprehension and generation capability, but when applied to specialized industries, they face challenges such as hallucination, insufficient domain knowledge, and failing to incorporate the latest domain knowledge. |
| Approach: | They propose a paradigm for fine-tuning LLMs that effectively injects domain-specific knowledge while safeguarding inference-time data privacy. |
| Outcome: | The proposed model protects private data while enhancing the model's knowledge. |
An Empirical Analysis of Memorization in Fine-tuned Autoregressive Language Models (2022.emnlp-main)
Copied to clipboard
| Challenge: | Large language models are shown to present privacy risks through memorization of training data, but little attention has been given to the fine-tuning phase. |
| Approach: | They empirically study memorization of fine-tuning methods using membership inference and extraction attacks and show that fine-timing the head of the model has the highest susceptibility to attacks. |
| Outcome: | The proposed methods have the highest memorization risk, whereas the smaller adapters are less vulnerable to known extraction attacks. |
Private Memorization Editing: Turning Memorization into a Defense to Strengthen Data Privacy in Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) memorize and therefore, among huge amounts of uncontrolled data, may memorize Personally Identifiable Information (PII). |
| Approach: | They propose a method that uses a model knowledge to memorize PII from training data to mitigate the memorization of PI I. |
| Outcome: | The proposed method reduces the number of leaked PIIs in a number of configurations while making it more robust against privacy Training Data Extraction attacks. |
Do LLMs Really Memorize Personally Identifiable Information? Revisiting PII Leakage with a Cue-Controlled Memorization Framework (2026.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have been reported to “leak” Personally Identifiable Information (PII) successful PII reconstruction often interpreted as evidence of memorization. |
| Approach: | They propose a principled revision of memorization evaluation for Large Language Models . they propose PII leakage should be evaluated under low lexical cue conditions . |
| Outcome: | The proposed method is based on a multilingual re-evaluation of PII leakage across 32 languages and multiple memorization paradigms. |
Retracing the Past: LLMs Emit Training Data When They Get Lost (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for extracting training data from large language models exhibit limited success . existing methods offer limited insight into the fundamental drivers of memorization leakage . |
| Approach: | They propose a framework for extracting memorized data by maximizing model uncertainty . they propose mismatched fine-tuning to weaken alignment and induce confusion . |
| Outcome: | The proposed attacks outperform baselines on unaligned and aligned LLMs . the proposed attacks exploit the model uncertainty of the input snippets induced by the model entropy spike . |
Preserving Privacy Through Dememorization: An Unlearning Technique For Mitigating Memorization Risks In Language Models (2023.emnlp-main)
Copied to clipboard
| Challenge: | Large Language models (LLMs) are trained on vast amounts of data, including sensitive information that poses a risk to personal privacy if exposed. |
| Approach: | They propose a novel unlearning approach that utilizes an efficient reinforcement learning feedback loop via proximal policy optimization to incentivize the LLMs to learn a paraphrasing policy to unlearn the pre-training data. |
| Outcome: | The proposed approach surpasses strong baselines and state-of-the-art methods in terms of its ability to generalize and strike a balance between privacy and LLM performance. |
PATCH: Mitigating PII Leakage in Language Models with Privacy-Aware Targeted Circuit PatcHing (2026.findings-eacl)
Copied to clipboard
| Challenge: | Existing defense mechanisms to mitigate PII leakage are limited by existing defenses . a new approach, PATCH, identifies and edits PI I circuits to reduce leakage . |
| Approach: | They propose to use PATCH: Privacy-Aware Targeted Circuit Patching to identify PII leakage circuits in language models to reduce leakage. |
| Outcome: | The proposed approach reduces leakage by up to 65% and can reduce residual leakage to as low as 0.01%. |
Controlling the Extraction of Memorized Data from Large Language Models via Prompt-Tuning (2023.acl-short)
Copied to clipboard
Mustafa Ozdayi, Charith Peris, Jack FitzGerald, Christophe Dupuy, Jimit Majmudar, Haidar Khan, Rahil Parikh, Rahul Gupta
| Challenge: | Large Language Models memorize significant portions of training data, which poses privacy risk. |
| Approach: | They propose a prompt-tuning approach to control the extraction rates of memorized content in large language models. |
| Outcome: | The proposed techniques yield 9.3% increase in extraction rate compared to baseline model . the proposed defense achieves 97.7% reduction with a perplexity increase of 16.9% . |