Whiteout prevents large language models from revealing private data
Mitigating Private Data Leakage in LLMs with Whiteout
Cryptography and SecurityArtificial Intelligence
Summary
Large language models are trained on many websites and user inputs, so they sometimes memorize and repeat sensitive personal information. This creates privacy problems, especially for important people. The authors introduce Whiteout, a tool that stops these models from sharing real private data by overwriting it with carefully designed fake data. Their tests show Whiteout works well without hurting the model’s usefulness or safety, and beats other methods.
What this means in practice
- •For ai developers: Protect sensitive user information in language models by applying selective data obfuscation to prevent privacy leaks without reducing model performance.
- •For privacy compliance teams: Meet data privacy requests by suppressing real personal data from large language models’ outputs through targeted obfuscation techniques.
Authors
Anna Yoo Jeong Ha, Ronik Bhaskar, Haitao Zheng, Ben Y. Zhao
Abstract
Modern large language models (LLMs) are trained on massive, largely unfiltered datasets, including content scraped from nearly every accessible website and user inputs. As a result, LLMs often memorize and reproduce personally sensitive information (PSI) such as birth dates, phone numbers, and home addresses. This leads to significant privacy risks, particularly for high-profile individuals such as executives, politicians, and judges. Existing mitigations largely rely on machine unlearning. However, these methods often remove more information than needed, degrade model utility and safety, and are highly vulnerable to attacks. This paper presents Whiteout, a practical tool that, upon requests by individuals, prevents LLMs from regurgitating their genuine PSIs, by overwriting them using precise and carefully designed obfuscation samples. We evaluate Whiteout on modern LLMs of varying sizes and makers, including a widely-used OpenAI model. Results show that Whiteout effectively prevents disclosure of the targeted PSIs, has negligible impact on model utility and safety, and outperforms existing alternatives. We also test Whiteout against a wide range of countermeasures, from black-box attacks like jailbreaking to white-box adaptive attacks like relearning and quantization. Finally, we conclude with a discussion on the security and ethical implications of Whiteout.