Are Large Pre-Trained Language Models Leaking Your Personal Information?
Jie Huang∗ Hanyin Shao∗ Kevin Chen-Chuan Chang University of Illinois at Urbana-Champaign, USA {jeffhj, hanyins2,
Abstract
Are Large Pre-Trained Language Models Leaking Your Personal Information? In this paper, we analyze whether Pre-Trained Language Models (PLMs) are prone to leaking personal information. Specifically, we query PLMs for email addresses with contexts of the email address or prompts containing the owner’s name. We find that PLMs do leak personal information due to memorization. However, since the models are weak at association, the risk of specific personal information being extracted by attackers is low. We hope this work could help the community to better understand the privacy risk of PLMs and bring new insights to make PLMs safe.111Code and data are available at https://github.com/jeffhj/LM_PersonalInfoLeak. ∗Equal contribution.
中文速览
大型预训练语言模型（Pre-Trained Language Models，PLMs）在训练时吞入了海量公开文本，其中不可避免地包含真实的个人邮件地址，这引发了一个现实问题：攻击者能否通过向模型提问来"钓"出某个具体人的隐私信息？研究者以GPT-Neo系列模型和安然公司（Enron）邮件语料库为对象，分别测试了两种能力——"记忆"（用邮件地址在训练数据中的前文来还原它）和"关联"（只给出人名、让模型预测对应邮件地址）。实验发现，模型确实记住了大量邮件地址，在提供完整上下文前缀时最高能还原近9%的地址，但当攻击者只知道人名、没有训练数据访问权限时，正确预测率极低，且多数命中的都是可以靠规则猜出的格式化地址，说明模型对"谁拥有哪个地址"这一关联关系的掌握非常薄弱。这一区分"记忆"与"关联"的分析框架首次厘清了隐私风险的真实边界：当前PLMs泄露特定个人隐私的现实威胁相对有限，但随着模型规模增大、攻击者掌握的背景知识增多，风险仍不容忽视，提醒社区在享受大模型红利的同时持续关注隐私保护。
原文 arXiv:2205.12628;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2205.12628v2