Fine-tuned language models protect private data by pruning few neurons
Prune the Leaky Neurons: Mitigating Private Data Leakage in Fine-Tuned LLMs via Joint-Embedding-Guided Pruning
Computation and LanguageArtificial Intelligence
Summary
Large language models can remember private details like names or addresses when trained on sensitive information. The authors introduce JEPA-Prune, a way to find and remove just a small number of model parts that hold these private details without hurting the model’s ability to understand new text. This approach uses a separate public model to compare and spot which parts of the fine-tuned model memorize private info, then cuts those parts out carefully. Tests show this method greatly reduces risks of leaking private data while keeping most of the model’s usefulness intact.
What this means in practice
- •For enterprise ai teams: Reduce private data leakage from fine-tuned models on proprietary datasets by pruning sensitive neurons without retraining.
- •For cloud ai service providers: Provide clients with fine-tuned language models that better protect private information through efficient neuron pruning.$Commercial implications: Enables offering privacy-enhanced fine-tuned models that reduce compliance risks and appeal to sensitive industries.
Authors
Mohamed Shaaban, Mohamed Elmahallawy
Abstract
Fine-tuning large language models (LLMs) on proprietary records enables domain adaptation but introduces two challenges: (i) privacy leakage of memorized private data, such as personally identifiable information (PII), and (ii) balancing private data removal with utility preservation. Existing defenses, including data sanitization and differential privacy, often degrade performance, while privacy-neuron editing lacks a PII-free reference to distinguish identity-specific neurons from those supporting useful text. We propose JEPA-Prune, a post-hoc neuron pruning framework guided by a model trained exclusively on PII-free views. Alongside the fine-tuned private model, JEPA-Prune, trains a public model on surrogate and masked views of the same records using a joint-embedding predictive architecture (JEPA), capturing domain knowledge without identifiers. A cross-model representation probe quantifies deviations between private representations of leaked records and this PII-free reference. Integrated gradients and a scale-invariant specificity score then identify PII-responsive neurons, which are pruned without retraining. Experiments show that pruning just 1.6% of neurons reduces PII inference accuracy by up to 7.4x and PII extraction recall by up to 13.9x, while keeping unseen-text perplexity within 16% of that of the unpruned model for most LLMs. In contrast, privacy-neuron editing increases perplexity by at least 26x.