Leverage Unlearning to Sanitize LLMs

TL;DR

This paper tackles the privacy risk posed by memorization in LLMs when trained on sensitive data. It introduces Sani, an unlearning framework with a targeted last-layer erasure and a constrained repair phase that forgets sensitive terms while preserving model utility, enabling sanitization without full retraining. Empirical results on medical and confidential data show rapid reductions in memorization (regurgitation) after only a few unlearning epochs, with Sani often outperforming baselines in the privacy-utility balance. The approach offers practical value for institutions like hospitals seeking to share models without leaking sensitive information, and it paves the way for further work in bias and backdoor mitigation through unlearning.

Abstract

Pre-trained large language models (LLMs) are becoming useful for various tasks. To improve their performance on certain tasks, it is necessary to fine-tune them on specific data corpora (e.g., medical reports, business data). These specialized data corpora may contain sensitive data (e.g., personal or confidential data) that will be memorized by the model and likely to be regurgitated during its subsequent use. This memorization of sensitive information by the model poses a significant privacy or confidentiality issue. To remove this memorization and sanitize the model without requiring costly additional fine-tuning on a secured data corpus, we propose SANI. SANI is an unlearning approach to sanitize language models. It relies on both an erasure and repair phases that 1) reset certain neurons in the last layers of the model to disrupt the memorization of fine-grained information, and then 2) fine-tune the model while avoiding memorizing sensitive information. We comprehensively evaluate SANI to sanitize both a model fine-tuned and specialized with medical data by removing directly and indirectly identifiers from the memorization of the model, and a standard pre-trained model by removing specific terms defined as confidential information from the model. Results show that with only few additional epochs of unlearning, the model is sanitized and the number of regurgitations is drastically reduced. This approach can be particularly useful for hospitals or other industries that have already spent significant resources training models on large datasets and wish to sanitize them before sharing.

Figures (5)

• Figure 1: Overview: once the information to be unlearned is defined, Sani relies on erase and repair phases allowing to disturb only the memorization of fine information before repairing the model by specializing it while ensuring the absence of memorization of the terms to be sanitized.
• Figure 2: Sanitizing a fine-tuned BERT model: a single epoch is enough to drastically reduce identifier regurgitation while limiting utility reduction.
• Figure 3: Sanitizing a fine-tuned GPT model: a single epoch is enough to drastically reduce the regurgitation of identifiers while limiting utility reduction.
• Figure 4: Sanitizing a pre-trained BERT model: a single epoch is enough to drastically reduce the regurgitation of confidential information while not affecting the model's performance for a downstream classification task.
• Figure 5: Without unlearning, the most repeated terms in the training data are the most regurgitated, Sani drastically reduces the regurgitation of the most repeated terms.