Source-linked AI summary
Right to be Forgotten in the Era of Large Language Models: Implications, Challenges, and Solutions
Dawen Zhang, Pamela Finckenberg-Broman, Thong Hoang, Shidong Pan, Zhenchang Xing, Mark Staples, Xiwei Xu
TL;DR
LLMs may reproduce personal data, creating privacy and erasure challenges that differ from search-engine delisting. The paper compares the technologies, discusses potential technical approaches, and calls for further attention to RTBF in LLMs.
Problem
LLMs may memorize and output personal data, while removing data from training datasets does not directly affect already trained models as search-engine removal methods do.
Source: §2.2 · p. 6, Right to erasure · p. 9Method
The paper compares LLMs and search engines, maps technical solutions to model lifecycle stages, and discusses privacy-preserving learning and post-training approaches.
Source: §3 · p. 6, §4 · p. 10Results
The paper identifies challenges unique to LLMs’ relation to the RTBF and discusses potential technical solutions and legal perspectives.
Source: §7 · p. 13Takeaways & Limitations
The authors call for more attention and further efforts on the RTBF implications of LLMs.
Source: §7 · p. 13
Abstract
from arXiv · showhide
The Right to be Forgotten (RTBF) was first established as the result of the ruling of Google Spain SL, Google Inc. v AEPD, Mario Costeja Gonz\'alez, and was later included as the Right to Erasure under the General Data Protection Regulation (GDPR) of European Union to allow individuals the right to request personal data be deleted by organizations. Specifically for search engines, individuals can send requests to organizations to exclude their information from the query results. It was a significant emergent right as the result of the evolution of technology. With the recent development of Large Language Models (LLMs) and their use in chatbots, LLM-enabled software systems have become popular. But they are not excluded from the RTBF. Compared with the indexing approach used by search engines, LLMs store, and process information in a completely different way. This poses new challenges for compliance with the RTBF. In this paper, we explore these challenges and provide our insights on how to implement technical solutions for the RTBF, including the use of differential privacy, machine unlearning, model editing, and guardrails. With the rapid advancement of AI and the increasing need of regulating this powerful technology, learning from the case of RTBF can provide valuable lessons for technical practitioners, legal experts, organizations, and authorities.
1 The Legal Principles behind Right to be Forgotten
The paper situates the Right to be Forgotten (RTBF) within privacy and data-protection rights, then traces its development from the Google Spain case into GDPR rights and obligations.
1 The Legal Principles behind Right to be Forgotten
- Privacy is a fundamental right, and data-protection laws protect individuals’ privacy while addressing the cross-border flow of personal data.The extent of protection and the parties and data covered differ across jurisdictions.Source: §1 · p. 2
1.1 The Rights of the Data Subject
- GDPR codifies rights to be informed, access and rectify personal data, and request its erasure.These rights form a progression from learning about data processing to correcting or, under certain conditions, erasing data.Source: §1.1 · pp. 2–3
1.2 The Legal Principles behind Right to be Forgotten
- The RTBF arose from the Google Spain case, where the court required a search engine to remove personal data upon request.The ruling recognized that legitimate interests can be overridden by data subjects’ fundamental rights and freedoms.Source: §1.2 · p. 4
- The RTBF is not absolute: GDPR specifies grounds for erasure and circumstances where the right does not apply, including conflicts with freedom of expression or public interests.Google processed 3,231,694 RTBF requests from May 30, 2014, to May 31, 2019.Source: §1.2 · p. 4
2 Data Practices of Advanced AI Technologies
The paper describes how advanced AI depends on extensive data and how LLM training and generation raise privacy concerns through memorization and hallucination.
2 Data Practices of Advanced AI Technologies
- Generative AI can reproduce training data, raising privacy concerns about information concerning data subjects.This reproduction capability differs from the prediction or regression tasks of legacy AI models.Source: §2 · p. 5
2.1 The Training of Large Language Models
- LLMs train on large datasets that include public internet data, and companies may also collect user interactions for future training.Examples include Common Crawl in GPT-3, social media conversations in PaLM, and Reddit posts in models from OpenAI and Google.Source: §2.1 · p. 5
2.2 Issues of LLMs related to Personal Data
- LLMs may memorize personal data and emit it, while hallucinations can produce inaccurate output even without incorrect facts in training data.The paper reports reproducing memorization and notes that guardrails and prompts do not eliminate hallucination.Source: §2.2 · p. 6
- Two ChatGPT conversations using identical prompts about a late professor produced different inaccurate authorship information and death dates.The example used GPT-4 on April 1, 2024.Source: §2.2 · p. 6
3 Large Language Models and the Rights of the Data Subject
The paper examines how the GDPR’s Right to be Forgotten applies to LLMs by comparing them with search engines. It frames this inquiry as part of understanding AI’s implications for privacy.
3 Large Language Models and the Rights of the Data Subject
- The RTBF is one of the significant rights of data subjects under GDPR and emerged in the digital era.Its establishment followed a case related to search engines.Source: §3 · p. 6
- The paper compares LLMs and search engines to examine how advanced AI technologies affect privacy.Source: §3 · p. 6
- The comparison considers whether LLM operations align with or diverge from search-engine operations in contexts relevant to the RTBF.Source: §3 · p. 6
3.1 Comparing LLMs and Search Engines
The section compares LLMs and search engines in relation to the RTBF, identifying shared data sources and information-access uses alongside differences in processing and interaction.
Similarities
- Both LLMs and search engines draw on web data and are used to access information, though they produce or retrieve it differently.LLMs generate responses from learned patterns; search engines use indexes to present source links.Source: Similarities · p. 7
Disimilarities
- LLMs predict the next word rather than index information, and their word relationships do not necessarily reflect the model’s actual information.Source: Disimilarities · p. 7
- LLMs use conversational, multi-round chatbot interfaces, unlike search engines’ query-box and ranked-page interaction.Source: Disimilarities · p. 7
- Because LLM training datasets may contain personal data and organizations use them to train models and provide chatbot services, the paper argues those organizations should be considered data controllers.The paper also notes that LLMs and search engines may make information more ubiquitous and interconnected, while their interests differ from those of original publishers.Source: Disimilarities · p. 7
- Research or freedom-of-speech interests may justify data use, but data-subject requests can override those interests even when services are labeled research previews or experiments.Source: Disimilarities · pp. 7–8
3.2 Applicability of the Rights of the Data Subject on LLMs
LLMs bring GDPR data-subject rights into scope through both user chat histories and personal data that may be present in model outputs. Unlike search-engine indexes, LLM data is difficult to access, erase, or rectify reliably.
3.2 Applicability of the Rights of the Data Subject on LLMs
- LLMs are not immune to RTBF principles, and GDPR data-subject rights may apply to both user chat histories and personal data in models.The section examines access, erasure, and rectification in these settings.Source: §3.2 · p. 8, User chat history · p. 8, In-model data · p. 8
User chat history.
- Chat histories may contain personal information shared across multiple chatbot exchanges, so consent is required before collection and training use, and users should be able to withdraw consent and request erasure.Medical consultations are one example of exchanges that may contain GDPR personal data.Source: User chat history · p. 8
In-model data.
- Personal data may be memorized during training and extracted by prompting, but outputs can be accurate memorized data or inaccurate hallucinations, complicating access, rectification, and deletion.Users have GDPR rights to request access, rectification, or deletion of such data.Source: In-model data · p. 8
Right of access.
- Unlike search indexes, LLM weights do not reliably reveal which personal data was used or whose data it is; undisclosed datasets and incomplete or hallucinated prompt outputs further impede access.Prompting cannot guarantee a complete list of information stored in model weights.Source: Right of access · p. 9
Right to erasure.
- Removing source data or delisting links can address search-engine entries, but neither readily removes information from trained LLMs; retraining may take months against an approximately one-month undue-delay interpretation.Removing data from a training set affects an existing model only after subsequent training, and hallucinated information is difficult to remove.Source: Right to erasure · p. 9
Right to rectification.
- LLM data rectification remains difficult because training-data memorization and hallucination underlie the challenges, and hallucinated information remains hard to rectify.The passage notes that various methods have been proposed but do not resolve this challenge.Source: Right to rectification · p. 9
4 Technical Solutions
The paper maps potential RTBF solutions to privacy-preserving machine learning and post-training methods, with post-training approaches divided into fixing the model and band-aid approaches. It presents these as a non-exhaustive solution space that needs further research.
4 Technical Solutions
- The proposed solution space divides methods by model lifecycle stage into privacy-preserving machine learning and post-training, with post-training split into fixing the original model or band-aid approaches.The categories may be combined, but all require further research; the discussion is not an exhaustive survey.Source: §4 · p. 10
4.1 Privacy-preserving Machine Learning
- Differential privacy formally protects training-data privacy, but synthetic data currently forms only a small share of LLM training and is used for specific purposes, limiting its privacy coverage.Reported competitive performance applies to synthetic-text generation tasks, while downstream models are mostly small, task-specific models.Source: §4.1 · p. 10
4.2 Fixing the original model
- Methods that fix the original model fall under machine unlearning, but the paper notes a lack of known industry use cases.The approach targets the root of the issue by changing the original model.Source: §4.2 · p. 10
Exact Machine Unlearning
- Exact machine unlearning removes specific data points through accelerated retraining enabled by partitioning the training dataset.SISA uses sharding, slicing, voting-based aggregation, and retraining from a shard checkpoint before the target point was fed; leveraging removal probabilities may accelerate this further at a possible fairness cost.Source: Exact Machine Unlearning · p. 10
Approximate Machine Unlearning
- Approximate unlearning adjusts model weights to approximate data removal, for example through influence calculations such as Newton steps or stored training updates, but over-unlearning can significantly compromise efficacy.The passage describes these techniques as susceptible to over-unlearning.Source: Approximate Machine Unlearning · p. 11
4.3 Band-aid Approaches
- Band-aid approaches change model behavior through side paths rather than modifying the original model, although they were not originally designed for RTBF.The paper presents them as potential RTBF solutions.Source: §4.3 · p. 11
Model Editing
- Model editing stores modifications separately and combines them with the original model's output, but downstream knowledge may remain inconsistent or unupdated.Source: Model Editing · p. 11
Guardrails
- Prompt-based guardrails may follow RTBF requests, but they do not genuinely remove data and can be vulnerable to prompt injection, extraction, or jailbreaks.External storage such as vector databases may be used as request volume grows; guardrails without companion methods may still face compliance issues.Source: Guardrails · p. 11
5 Legal Perspectives
The legal discussion highlights tension between privacy protections and the technical capabilities and commercialization of LLM products. It frames balancing interests and interpreting the law amid rapid technological change as a question for stakeholders.
5 Legal Perspectives
- The GDPR's undue-delay period is commonly interpreted as about one month, a timeframe that current technical capabilities might make impossible to meet.The passage says the period is not strictly specified in the article.Source: §5 · p. 11
- Balancing interests and interpreting law amid rapid technological change and accelerated commercialization of research outcomes remains a question for stakeholders involved in legal matters.Source: §5 · p. 12
6 On-going Discussion
The discussion places RTBF within ongoing AI-law debates and presents it as a precedent that may inform future legal development. Its history as a controversial emergent right reflects attempts to address privacy protection amid evolving technology.
6 On-going Discussion
- AI-related regulations are being drafted or planned in the EU, China, and the United States.Source: §6 · p. 12
- RTBF has been debated from technical and legal perspectives and may serve as a meaningful reference for current and future AI law.The paper links its value as a precedent to the growing power of AI technology.Source: §6 · p. 13
7 Conclusion
The paper examines the implications of the Right to be Forgotten for large language models and identifies challenges they raise. It discusses potential technical solutions and legal perspectives, and calls for further attention and effort.
7 Conclusion
- The paper identifies implications of the Right to be Forgotten and unique challenges brought by large language models.Source: §7 · p. 13
- It discusses potential technical solutions and provides insights on the issue from legal perspectives.Source: §7 · p. 13
- The authors say the work can help practitioners and stakeholders understand RTBF issues and call for further attention and effort.Source: §7 · p. 13