Mitigating Private Data Leakage in LLMs with Whiteout

• LLMs may reproduce sensitive information from broad training data, with disclosures such as birthdays or addresses posing identity-theft and personal-safety risks.The introduction also notes risks of social engineering, scams, and harassment.Source: §1 · p. 1
• The paper asks whether an LLM can honor a user’s request to stop disclosing memorized PSI, while existing options are impractical, utility-damaging, or vulnerable to attacks.The introduction contrasts the targeted task with broad unlearning and refusal-based defenses.Source: §1 · pp. 1–2
• Whiteout aims to break the association between a person and genuine PSI without erasing general concepts or relying on a refusal pathway vulnerable to jailbreaks.It replaces that association with a plausible fabricated value using carefully curated camouflage data.Source: §1 · p. 2
• Whiteout is presented as efficient because PSI associations are infrequent, and in-distribution samples support targeted updates without broad knowledge shifts.The overview describes an external verifier confirming a request before the model owner applies the update.Source: §1 · p. 2, Figure 1 · p. 2
• Across seven LLMs and three PSI types, about 10 camouflage samples can prevent targeted disclosure under direct or indirect queries while preserving utility and safety.The introduction reports that Whiteout outperforms unlearning and refusal and withstands tested countermeasures, including GCG, quantization, relearning, and erasure attacks.Source: §1 · p. 2
• The authors warn that Whiteout’s ability to alter specific facts could be misused to inject false information, requiring moderation and request authentication.They identify these safeguards as future work and discuss related ethical and security implications.Source: §1 · pp. 2–3

2.1 Private Data Leakage in LLMs

• LLMs can memorize training content, and larger models are described as more susceptible to extraction; broad, lightly filtered training data can include sensitive information.The authors report that birthdays, email addresses, and home addresses are particularly susceptible PSI types.Source: §2.1 · p. 3

2.2 LLM Safety and Privacy Protection

• Privacy defenses include differential privacy, guardrails and alignment, and fine-tuning-based unlearning, but each involves constraints or can be bypassed.The cited discussion notes costs and reduced accuracy or scale for differential privacy, and jailbreak weaknesses in guardrails.Source: §2.2 · p. 3
• Unlearning can be reversed by prompt manipulations and white-box attacks because it may suppress surface traces without removing the data’s influence on model parameters.Examples include relearning, neuron manipulation, and quantization.Source: §2.2 · p. 3
• Unlearning can also damage related and unrelated performance because model knowledge is distributed across overlapping weights; mechanistic approaches require costly circuit tracing.The discussion also notes that inference-time suppression can be circumvented by adaptive jailbreaking.Source: §2.2 · pp. 3–4

3.1 PSI Leakage Measurements

• The authors focus on birthdays, email addresses, and home addresses after measuring their occurrence in C4 English and leakage through model queries.Extending protection to other PSI categories is left for future work.Source: §3 · p. 4, §3.1 · p. 4
• On Llama 3.2, queries returned a precise birthday in 100% of cases and a consistent email and physical address in more than 50%.The measurement queried 28 public figures across seven categories, with prompts instructing the model not to search the Internet.Source: §3.1 · p. 4

3.2 Threat Model

• The model owner is assumed to receive an already validated request and to be able to generate synthetic data and fine-tune the LLM.The work does not address request verification.Source: §3.2 · p. 4
• Attackers seek genuine PSI through queries, while the study assumes it is absent from public records and excludes inference from a person’s relationships to others.Adaptive attackers may know the scheme, access weights, modify the model, or have partial PSI knowledge; the design also requires retained utility.Source: §3.2 · p. 4

4 Whiteout

• Whiteout is a lightweight, user-specific mechanism intended to fulfill protection requests by modifying the model.Source: §4 · p. 5

4.1 Key Intuitions

• The target is the link between a person and a PSI value, not the person or generic concept itself; this makes the task narrower than concept unlearning.The paper characterizes broad unlearning as breaking all potential links, which can impair utility and robustness.Source: §4.1 · p. 5
• Whiteout teaches an association with a camouflage value, aiming to make the genuine value no more likely than an incorrect or hallucinated value.The authors state that this update prevents external extraction of the targeted association.Source: §4.1 · p. 5
• Camouflage data should be plausible, in-distribution, and designed to avoid harm to others or disclosure of the genuine PSI.The target LLM generates varied expressions aligned with its learned response distribution.Source: §4.1 · p. 5

4.2 Detailed, Step-by-Step Design

• The workflow selects a camouflage PSI, generates diverse samples stating that value, and fine-tunes on the resulting data using standard supervised fine-tuning.For addresses, generated locations are checked to confirm they do not exist; birth dates differ from the genuine date, while email addresses use invalid domains.Source: §4.2 · pp. 5–6
• For reasoning models, Whiteout adds synthetic reasoning steps aligned with the model’s own reasoning process, which the paper says is necessary for effective protection.Source: §4.2 · pp. 5–6

5 Evaluation Overview

• The evaluation asks whether Whiteout prevents disclosure, preserves utility and safety, outperforms alternatives, and resists basic and adaptive attacks.Source: §5 · p. 6

5.1 Experimental Setup

• The study covers seven LLMs from multiple providers, including six open-source models spanning 3–20B parameters and GPT-4o-mini, and targets birth dates, home addresses, and email.Source: §5.1 · p. 6, Table 2 · p. 6
• The 50-person PSI dataset combines pre-existing associations with controlled synthetic injections; controlled settings target leakage above 80%, and controlled PSIs are tested only on the first four models.Source: §5.1 · p. 6
• Protection is measured by PER over 100 query results per protected pair, while utility uses PIQA and ARC benchmarks and safety uses SORRY-Bench.Source: §5.1 · pp. 6–7
• Whiteout uses standard supervised fine-tuning with LoRA by default for open-source models, full-parameter SFT for GPT-4o-mini, and 10 camouflage samples per request by default.Source: §5.1 · p. 7

6.1.2 Examining LLM output distribution

• Ten rounds of sampling without replacement did not recover the true PSI; generated alternatives were not close to it, and models generally repeated prior values.A birth-date token-level case study on a protected Llama 3.2 model reached the same conclusion.Source: §6.1.2 · pp. 7–8

6.1.3 Number of camouflage samples required

• Ten camouflage samples suffice for associations embedded with up to 1,000 training samples; 100 suffice for associations embedded with 10,000.Across the three PSI types, protection results for pre-existing and controlled PSI were consistent.Source: §6.1.3 · p. 8, §6.1.4 · p. 8

6.1.1 Testing direct and indirect queries

• Across seven LLMs, Whiteout achieves 100% PER on direct and indirect queries, consistently across the tested PSI types.The direct and indirect query tests include indirect references to users and semantically equivalent PSI questions.Source: §6.1.1 · p. 7, §6.1.4 · p. 8

6.2.2 Impact of # of protection requests

• Utility and safety scores remain relatively stable after protection, while PER stays at 100% for request volumes from 5 through 500.At 500 requests, utility and safety remain similar to the unprotected baseline, with low standard deviation.Source: §6.2.1 · p. 9, Table 5 · p. 9, §6.2.2 · p. 9

6.2.3 Responses to queries of protected PSIs and users

• Protected-PSI responses are plausible and correctly formatted; public-property recall remains 1.0, and over 80% of outputs match camouflage values.Dates are actual calendar dates, emails have username-and-domain structure, and addresses have plausible components.Source: §6.2.3 · p. 9

6.3 Comparing Whiteout to Other Methods

• Whiteout achieves 100% PER while preserving utility and safety; GA, NPO, and refusal also reach 100% PER but heavily degrade utility.The comparison covers the protection-first setting.Source: Table 7 · p. 10, §6.3 · p. 10

6.4 GPT-4o-mini Experiments

• On GPT-4o-mini, Whiteout achieves 100% PER with 10 camouflage samples per pair while preserving utility and safety.Built-in guardrails limit testing of PSI the model already withholds; published landmark addresses were used as analogues for blocked home addresses, and Claude fine-tuning was left for future work.Source: §6.4 · pp. 10–11

7 Countermeasures

• Whiteout resisted a broad spectrum of countermeasures, including black-box attacks, white-box attacks, and attacks adapted to its specific design.The evaluation measured attack success as 1−PER across the tested attacks.Source: §7 · p. 11, §7.4 · p. 13

7.1 Black-Box (Adaptive) Attacks

• Black-box attacks failed, including refusal jailbreaks, repeated attempts to elicit alternatives, partial-PSI queries, and paired prompts.The refusal jailbreak and paired-prompt attacks each had 0% success; repeated-answer and partial-knowledge attacks also failed.Source: §7.1 · pp. 11–12

7.2 White-Box Attacks

• GCG triggers and both tested 4-bit quantization methods had 0% attack success against Whiteout.The quantization methods were NF4 and FP4.Source: §7.2 · p. 12

7.3 White-Box Adaptive Attacks

• Relearning and erasure attacks each had 0% success at recovering the protected PSI.The erasure attack instead caused the model to output gibberish to the PSI query.Source: §7.3 · pp. 12–13

7.4 Membership Inference Experiments

• After Whiteout, membership inference no longer detected the genuine user-PSI association but detected the camouflage association.The experiments covered Llama 3.2, Gemma, and Phi-3 models.Source: §7.4 · p. 13

• Under the simplified setting, optimizing the overwriting objective L1 automatically optimizes the stronger objective L2 that also includes forgetting.The proof is in Appendix C.9.Source: §8 · p. 13
• If the camouflage and genuine PSI/query pairs follow similar distributions, increasing the new association strength also reduces the original association strength.Under that assumption, overwriting alone is sufficient to break the original association, without a separate forgetting term.Source: §8 · p. 13
• A forgetting term can prevent convergence, making optimization harder to control and more likely to cause model-wide damage.The analysis states that L1 is bounded below while L2 can continue decreasing infinitely.Source: §8 · p. 13

• Whiteout uses plausible, in-distribution, and safe camouflage data with standard fine-tuning to overwrite a user’s association with private information.The approach is designed to be lightweight and precise.Source: §9 · p. 14
• Whiteout achieved full protection with very few camouflage samples per protection item while preserving model utility and safety, and it was robust against a wide range of attacks.The results were replicated on open-source models from DeepSeek, Google, Meta, and Microsoft, and on GPT-4o-mini.Source: §9 · p. 14
• Whiteout could be misused to inject false data, so practical deployment requires moderation and mechanisms to authenticate users and authorize requests.The authors also call for regulatory support for these mechanisms.Source: §9 · p. 14
• The study covers only three PSI types; future work should extend evaluation to other types and develop user-facing protection and leakage-detection tools.The authors also identify the interaction between LLMs, regulators, and users seeking protection as future work.Source: §9 · p. 14

A Ethical Considerations

• Camouflage data can alter correctly learned facts, including addresses of public landmarks and historical dates; Table 11 reports five-sample changes on Phi-4 and Llama 3.2.The authors call for further study of potential malicious campaigns and say deployments need moderation and authenticated, verified requests.Source: A Ethical Considerations · p. 17, Table 11 · p. 18
• GPT-4o-mini’s fine-tuning API rejected some camouflage requests, including certain public figures’ birthdays and well-known building addresses.The authors list the blocked subjects in Table 17.Source: A Ethical Considerations · p. 18

B Open Science

• The authors publicly released Whiteout components, prompts, pre-generated samples, generation code, fine-tuning configurations, and PER scripts.The release is hosted at the URL given in the paper.Source: B Open Science · p. 18

C.1 Inference Prompts to Query a User’s PSI

• Whiteout’s prompts ask about birthdays in varied phrasings, prohibit internet search, and request detailed answers; the same approach is used for email and home-address queries.The open-weight models receive ten GPT-4o-mini-generated birthday prompts, while Gemma-3 generates prompts for GPT-4o-mini.Source: §C.1 · p. 18

C.2 Samples of Indirect PSI Queries

• Indirect queries refer either to a PSI type obliquely or to a user through a description, such as asking for the birthday of the writer of the Harry Potter books.The example also instructs the model not to search the internet.Source: §C.2 · p. 18

C.3 Generating Camouflage Data

• The camouflage-data template requests varied, natural responses that state the target name and fabricated birthday in different phrasings and formats.It instructs generation to include only necessary details and no extra information.Source: §C.3 · pp. 18–19

C.4 Training Configuration

• Controlled PSI injection used 25 samples per PSI for 50 PSI, with epochs selected to reach at least 80% leakage averaged over individuals.The appendix says utility did not change noticeably after injection; Whiteout fine-tuning used LoRA or full-parameter SFT, with full-parameter epochs set to reach at least 80% PSI accuracy.Source: §C.4 · p. 19, Table 12 · p. 19

C.5 Queries for Public/Unprotected Properties

• Public-property queries tested facts such as J. K. Rowling’s first novel, pen name, university, and the genre of the Harry Potter series.The queries instruct the model not to search the internet.Source: §C.5 · p. 19, Table 13 · p. 19

C.6 Whiteout’s Effectiveness on the Three PSI

• 100% PER across birthdays, emails, and home addresses was achieved after Whiteout for every model that could be fine-tuned.Table 15 reports PER (%) by PSI type.Source: §C.6 · p. 19, Table 15 · p. 19

C.7 Comparing Whiteout to Other Methods

• Table 16 compares Whiteout with GA, Refusal, and NPO unlearning across three models in lighter and heavier configurations.The utility-first and protection-first settings represent different trade-offs, as described in the table caption.Source: §C.7 · p. 19

C.8 Details of the Membership Inference Experiments

• The experiments use Min-K% with k = 20 and compare genuine and camouflage scores against 500 non-member samples rather than relying on a fixed detection threshold.The method reports a score per test datum; higher scores indicate greater likelihood of training-set membership.Source: §C.8 · pp. 19–20
• Before Whiteout, genuine-association scores were much higher than the maximum among 500 negative samples, while camouflage scores fell near the negative-set mean.The authors interpret this as evidence that the genuine associations were memorized and the camouflage data were not in the original training set.Source: §C.8 · p. 20
• After Whiteout, genuine user-PSI association scores fall to the negative-set mean, while camouflage scores exceed the negative-set maximum; MIA therefore reports genuine associations as non-members.Figure 2 plots the score distributions for Llama, Gemma, and Phi-3 before and after Whiteout.Source: §C.8 · p. 20, Figure 2 · p. 20

C.9 Proof on Automatic Forgetting

• As Whiteout loss L1 is minimized, forgetting loss L2 asymptotically decreases in the proof’s simplified single-token case.The argument assumes the genuine association initially has probability at least 0.5 and that the camouflage target reaches probability at least 1 − ε, for 0 < ε < 0.5.Source: §C.9 · pp. 20–21

C.10 Proof of Bounded Optimization

• L1 is bounded below by zero, whereas L2 has no lower bound and may diverge infinitely.The appendix presents this as the second proof claim on convergence.Source: §C.10 · p. 21

C.11 Token-Level Output Distribution Case Study

• Before/after Whiteout, birthday-component probabilities were August 99%/0.14%, day 100%/0%, and year 100%/0%; none of the original components ranked in the top five afterward.The case study computes month, day, and year probabilities sequentially, conditioning each next-token distribution on the preceding true component; full token-level analysis was limited to a few examples.Source: §C.11 · p. 21