发现大模型会原样复述网页中的个人隐私信息，且规模越大越严重。
Personal Information Parroting in Language Models
- 用正则规则检测邮箱、电话、IP地址，效果优于现有方法。
- Pythia-6.9b模型有13.6%的隐私信息被完全复述，最小模型也达2.7%。
- 模型越大、训练越久，复述隐私信息越多，建议清洗预训练数据。
现代语言模型在包含数百万条个人身份信息（PI）的网络数据上训练，容易记忆这些信息，带来隐私风险。本文开发了基于正则表达式和规则的检测工具（R&R），可有效识别邮箱、电话和IP地址，性能优于现有基于正则的方法。在人工标注的483个隐私实例上进行测试，发现Pythia-6.9b模型有13.6%的实例会被逐字复述——即当输入原始文档中该信息前缀时，贪婪解码能完整生成原始隐私内容。进一步分析显示，从160M到6.9B参数的Pythia系列模型及70k至143k训练步数的版本中，模型规模与训练时长均与记忆程度正相关。即使最小的Pythia-160m模型也有2.7%的隐私信息被精确复述。因此强烈建议对预训练数据进行严格过滤与匿名化处理，以降低隐私泄露风险。
原文摘要 · Abstract (English)
Modern language models (LM) are trained on large scrapes of the Web, containing millions of personal information (PI) instances, many of which LMs memorize, increasing privacy risks. In this work, we develop the regexes and rules (R&R) detector suite to detect email addresses, phone numbers, and IP addresses, which outperforms the best regex-based PI detectors. On a manually curated set of 483 instances of PI, we measure memorization: finding that 13.6% are parroted verbatim by the Pythia-6.9b model, i.e., when the model is prompted with the tokens that precede the PI in the original document, greedy decoding generates the entire PI span exactly. We expand this analysis to study models of varying sizes (160M-6.9B) and pretraining time steps (70k-143k iterations) in the Pythia model suite and find that both model size and amount of pretraining are positively correlated with memorization. Even the smallest model, Pythia-160m, parrots 2.7% of the instances exactly. Consequently, we strongly recommend that pretraining datasets be aggressively filtered and anonymized to minimize PI parroting.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。