Vectors Are Not Neutral: Sensitive-Information Inference from Exported LLM Representations in Summarization

2026-05-25

AI Summary

This study addresses the risk that embeddings derived from large language models—such as final-token hidden states or mean-pooled representations—can inadvertently leak sensitive patient attributes like race, even when the original clinical text is restricted. The work reveals, for the first time, significant variation in the degree of privacy leakage across different embedding types and introduces SurfaceLoRA, a targeted privacy-preserving fine-tuning approach tailored to specific output representations. By integrating a gradient reversal discriminator with parameter-efficient fine-tuning, SurfaceLoRA effectively suppresses sensitive information in the target embeddings while preserving clinical summarization performance. Experimental results under five balanced probing protocols demonstrate that SurfaceLoRA reduces race recoverability from final-token embeddings to near-random levels, underscoring its efficacy in providing representation-specific privacy protection.

Abstract

Large language model (LLM) summarization systems may pass compact vector representations of private inputs to downstream retrieval, monitoring, audit, or analytic workflows. Even when source documents remain access-restricted, derived vectors may be handled under different access controls and still support sensitive-information inference, creating a residual information-disclosure risk. We study this issue in clinical discharge-summary generation as a high-stakes case study, using electronic health record (EHR)-recorded race as a controlled sensitive-label audit. We audit two artifacts that a system might retain or expose to downstream components: the final prompt-token hidden state and the mean-pooled prompt representation. Our results show that reducing recoverability of the case-study sensitive label from one exported artifact does not necessarily reduce recoverability from another. As a mitigation case study, we introduce SurfaceLoRA, an exported-vector-targeted parameter-efficient fine-tuning method that uses a gradient-reversal discriminator attached to a designated exported vector. Under a balanced five-way probing protocol, SurfaceLoRA reduces EHR-recorded race recoverability from the targeted final-token artifact toward chance while preserving summarization utility, yet recoverability remains substantially higher from untargeted pooled artifacts. These findings show that privacy auditing and mitigation should be performed on the exact vector artifact retained or exposed to downstream components.

Problem

• sensitive information inference
• LLM representations
• information disclosure
• privacy risk
• vector artifacts

Innovation

• SurfaceLoRA
• sensitive-information inference
• exported vector representations
• privacy mitigation
• gradient reversal