Data-Free Privacy-Preserving for LLMs via Model Inversion and Selective Unlearning

2026-01-22

AI Summary

This work addresses the privacy risk posed by large language models memorizing sensitive personally identifiable information (PII) from training data. Existing unlearning methods typically require access to the original training data, limiting their practical deployment. To overcome this limitation, the authors propose the first selective unlearning framework that operates without any access to the original training data. The approach leverages model inversion to generate synthetic PII samples, constructs token-level privacy masks, and introduces a contrastive masked loss within the low-rank adaptation (LoRA) subspace to precisely erase target PII. Experiments on the AI4Privacy PII-Masking dataset using the Pythia model demonstrate that the method effectively removes sensitive information while preserving overall model performance.

Technology Category

• Machine Learning: Privacy
• Natural Language Processing: (Large) Language Models
• Computer Vision: Large Vision Models

Application Category

• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Security and Privacy: Security and privacy of machine learning and AI applications
• Search and Retrieval-Augmented AI: Large language models for search

Abstract

Large language models (LLMs) exhibit powerful capabilities but risk memorizing sensitive personally identifiable information (PII) from their training data, posing significant privacy concerns. While machine unlearning techniques aim to remove such data, they predominantly depend on access to the training data. This requirement is often impractical, as training data in real-world deployments is commonly proprietary or inaccessible. To address this limitation, we propose Data-Free Selective Unlearning (DFSU), a novel privacy-preserving framework that removes sensitive PII from an LLM without requiring its training data. Our approach first synthesizes pseudo-PII through language model inversion, then constructs token-level privacy masks for these synthetic samples, and finally performs token-level selective unlearning via a contrastive mask loss within a low-rank adaptation (LoRA) subspace. Extensive experiments on the AI4Privacy PII-Masking dataset using Pythia models demonstrate that our method effectively removes target PII while maintaining model utility.

Problem

• privacy-preserving
• large language models
• personally identifiable information
• machine unlearning
• data-free

Innovation

• data-free unlearning
• model inversion
• selective unlearning
• privacy-preserving LLMs
• token-level masking