Privacy Ripple Effects from Adding or Removing Personal Information in Language Model Training

A Google TechTalk, 2025-05-14, presented by Jaydeep Borkar Privacy in ML Seminar. ABSTRACT: Due to the sensitive nature of personally identifiable information (PII), its owners may have the authority to control its inclusion or request its removal from large-language model (LLM) training. Beyond this, PII may be added or removed from training datasets due to evolving dataset curation techniques, because they were newly scraped for retraining, or because they were included in a new downstream fine-tuning stage. We find that the amount and ease of PII memorization is a dynamic property of a model that evolves throughout training pipelines and depends on commonly altered design choices. We characterize three such novel phenomena: (1) similar-appearing PII seen later in training can elicit memorization of earlier-seen sequences in what we call assisted memorization, and this is a significant factor (in our settings, up to 1/3); (2) adding PII can increase memorization of other PII significantly (in our settings, as much as 7.5x); and (3) removing PII can lead to other PII being memorized. Model creators should consider these first- and second-order privacy risks when training models to avoid the risk of new PII regurgitation.

Cascading Adversarial Bias from Injection to Distillation in Language Models
▶︎

Cascading Adversarial Bias from Injection to Distillation in Language Models

Going Back and Beyond: Emerging (Old) Threats in LLM Privacy and Poisoning
▶︎

Going Back and Beyond: Emerging (Old) Threats in LLM Privacy and Poisoning

Mapping the Data Center Industry: Who Benefits, Who Calls the Shots, and What to Do About It
▶︎

Mapping the Data Center Industry: Who Benefits, Who Calls the Shots, and What to Do About It

Is RAG Still Needed? Choosing the Best Approach for LLMs
▶︎

Is RAG Still Needed? Choosing the Best Approach for LLMs

Threat Models for Memorization: Privacy, Copyright, and Everything In-Between
▶︎

Threat Models for Memorization: Privacy, Copyright, and Everything In-Between

Webinar | Introduction to parallel performance engineering
▶︎

Webinar | Introduction to parallel performance engineering

RAG vs Fine-Tuning vs Prompt Engineering: Optimizing AI Models
▶︎

RAG vs Fine-Tuning vs Prompt Engineering: Optimizing AI Models

Andrej Karpathy: From Vibe Coding to Agentic Engineering w/ Stephanie Zhan
▶︎

Andrej Karpathy: From Vibe Coding to Agentic Engineering w/ Stephanie Zhan

What do tech pioneers think about the AI revolution? - The Engineers, BBC World Service
▶︎

What do tech pioneers think about the AI revolution? - The Engineers, BBC World Service

The Limits and Possibilities of One Run Auditing
▶︎

The Limits and Possibilities of One Run Auditing

Listen and Feel the Peace | Tibetan Healing Sounds for Deep Meditation, Inner Peace & Soul Healing
▶︎

Listen and Feel the Peace | Tibetan Healing Sounds for Deep Meditation, Inner Peace & Soul Healing

Something is jamming GPS over Europe. Here's what we found
▶︎

Something is jamming GPS over Europe. Here's what we found

Transformers, the tech behind LLMs | Deep Learning Chapter 5
▶︎

Transformers, the tech behind LLMs | Deep Learning Chapter 5

Privacy Auditing of Large Language Models
▶︎

Privacy Auditing of Large Language Models

Differentially Private Prototypes for Imbalanced Transfer Learning
▶︎

Differentially Private Prototypes for Imbalanced Transfer Learning

Introduction to Generative AI
▶︎

Introduction to Generative AI

Disparate Privacy Risks from Medical AI - An Investigation into Patient-level Privacy Risk
▶︎

Disparate Privacy Risks from Medical AI - An Investigation into Patient-level Privacy Risk

Inside Anthropic, the $965 Billion AI Juggernaut | The Circuit
▶︎

Inside Anthropic, the $965 Billion AI Juggernaut | The Circuit

OWASP's Top 10 Ways to Attack LLMs: AI Vulnerabilities Exposed
▶︎

OWASP's Top 10 Ways to Attack LLMs: AI Vulnerabilities Exposed

POPri: Private Federated Learning using Preference-Optimized Synthetic Data
▶︎

POPri: Private Federated Learning using Preference-Optimized Synthetic Data