UnPII: Unlearning Personally Identifiable Information with Quantifiable Exposure Risk

TL;DR

This work tackles privacy concerns for PII memorization in large-language models by introducing UnPII, a PII-centric unlearning framework that uses a PII Risk Index (PRI) to dynamically weight forgetting. PRI aggregates multi-dimensional risk factors across individual and combined PII attributes and feeds this risk into a gradient-scaling loss that can be paired with existing unlearning methods such as GA, NPO, and DPO. The authors construct a synthetic 1,700-sample PII dataset and show that UnPII yields improvements in the harmonic mean of accuracy, utility, and generalizability (up to 11.8%, 6.3%, and 12.4%, respectively) with a modest average fine-tuning overhead of 27.5%. Implemented on a LLaMA2-7B model with LoRA, UnPII demonstrates practical applicability for MLOps pipelines by enabling risk-aware, incremental forgetting without full retraining, and sets the stage for domain-specific refinement of regulatory risk factors.

Abstract

The ever-increasing adoption of Large Language Models in critical sectors like finance, healthcare, and government raises privacy concerns regarding the handling of sensitive Personally Identifiable Information (PII) during training. In response, regulations such as European Union's General Data Protection Regulation (GDPR) mandate the deletion of PII upon requests, underscoring the need for reliable and cost-effective data removal solutions. Machine unlearning has emerged as a promising direction for selectively forgetting data points. However, existing unlearning techniques typically apply a uniform forgetting strategy that neither accounts for the varying privacy risks posed by different PII attributes nor reflects associated business risks. In this work, we propose UnPII, the first PII-centric unlearning approach that prioritizes forgetting based on the risk of individual or combined PII attributes. To this end, we introduce the PII risk index (PRI), a composite metric that incorporates multiple dimensions of risk factors: identifiability, sensitivity, usability, linkability, permanency, exposability, and compliancy. The PRI enables a nuanced evaluation of privacy risks associated with PII exposures and can be tailored to align with organizational privacy policies. To support realistic assessment, we systematically construct a synthetic PII dataset (e.g., 1,700 PII instances) that simulates realistic exposure scenarios. UnPII seamlessly integrates with established unlearning algorithms, such as Gradient Ascent, Negative Preference Optimization, and Direct Preference Optimization, without modifying their underlying principles. Our experimental results demonstrate that UnPII achieves the improvements of accuracy up to 11.8%, utility up to 6.3%, and generalizability up to 12.4%, respectively, while incurring a modest fine-tuning overhead of 27.5% on average during unlearning.

Figures (6)

• Figure 1: Overall UnPII workflow for unlearning PII. Given a model ( e.g., LLaMA2 touvron2023llama) that produces outputs containing PII (by PII-inducing questions), UnPII identifies PII in the model's output by prompting an external LLM with a tailored query (\ref{['tab:identi_pii']}). UnPII then computes a PII risk index (PRI) that quantifies the exposure risk, either individually or in combination (§\ref{['sec:quantificfation_pii']}). UnPII integrates the index into the (existing) model's loss for unlearning via gradient scaling (§\ref{['sec:pii_unlearning_fw']}), generating a model that unlearns the target PII.
• Figure 2: Distribution of PII risk indexes (PRIs) across 1,000 simulations, assuming the leakage of one to ten PII attributes. The results show that as the number of exposed attributes increases, the overall risk rises while the (standard) deviation decreases. Five or more PII exposures approach $1.0$ with a low standard deviation.
• Figure 3: This figure presents a comparison of the performance of three unlearning methods (GA maini2024tofu, NPO zhang2024negative, and DPO rafailov2023direct) with and without our UnPII technique across three forgetting ratio settings ([0.5]forget10, [0.5]forget05, [0.5]forget01). Green lines indicate baseline results, while red lines indicate results with UnPII. Each experiment was repeated three times, and black error bars indicate variation across runs.
• Figure 4: Performance breakdown by accuracy (A), utility (U), and generalizability (G) illustrating the comparative results (measured by the harmonic mean; H-AUG) of three unlearning techniques -- DPO rafailov2023direct(left), NPO zhang2024negative(middle), and GA maini2024tofu(right) -- and their variants incorporating UnPII under three forgetting ratio settings ([0.5]forget10, [0.5]forget05, [0.5]forget01). Solid lines denote the performance with UnPII, while dashed lines correspond to the baselines. Notably, larger solid triangle areas indicate that UnPII enhances overall performance across most configurations.
• Figure 5: Comparison of unlearning performance between the original unlearning dataset ($D_f$) and a randomly re-sampled dataset ($D_r$) for GA maini2024tofu, NPO zhang2024negative, and DPO rafailov2023direct, with and without our UnPII technique across different forgetting ratios ([0.5]forget10, [0.5]forget05, [0.5]forget01). Blue lines indicate results on $D_f$, and orange lines represent results on $D_r$. Despite marginal variations in the dataset composition, the overall performance remains consistent (Section \ref{['sec:rq3']}).