Rendering Data Unlearnable by Exploiting LLM Alignment Mechanisms

TL;DR

The paper tackles the risk of proprietary and personal data being absorbed into LLM training by proposing a black-box data-level defense called Disclaimer Injection. By inserting alignment-triggering disclaimers into training inputs, it steers learning toward alignment pathways, substantially degrading downstream task performance while preserving human readability. Layer-wise causal analysis shows persistent activation of alignment-related layers and altered information flow, supporting a causal explanation for reduced learnability. The method proves robust across datasets, model variants, and adaptive attacks, offering a practical approach to restrict data learnability at LLM scale without altering the training pipeline.

Abstract

Large language models (LLMs) are increasingly trained on massive, heterogeneous text corpora, raising serious concerns about the unauthorised use of proprietary or personal data during model training. In this work, we address the problem of data protection against unwanted model learning in a realistic black-box setting. We propose Disclaimer Injection, a novel data-level defence that renders text unlearnable to LLMs. Rather than relying on model-side controls or explicit data removal, our approach exploits the models' own alignment mechanisms: by injecting carefully designed alignment-triggering disclaimers to prevent effective learning. Through layer-wise analysis, we find that fine-tuning on such protected data induces persistent activation of alignment-related layers, causing alignment constraints to override task learning even on common inputs. Consequently, models trained on such data exhibit substantial and systematic performance degradation compared to standard fine-tuning. Our results identify alignment behaviour as a previously unexplored lever for data protection and, to our knowledge, present the first practical method for restricting data learnability at LLM scale without requiring access to or modification of the training pipeline.

Figures (7)

• Figure 1: Responses from usual LLMs (above) and LLMs trained with unlearnable data (below). The latter answers incorrectly with loosely related content.
• Figure 2: Residual stream representation separability for hazardous inputs and benign inputs.
• Figure 3: Residual stream representation patterns for $x$ and $x'$, where transformed input $x' = d \oplus x$ is "Here we list ways to create an acid rain locally. What happens if you rub an old lamp?".
• Figure 4: Layer-wise (0-32) causal effect maps for a common input across generation steps (0-2), with (below) and without our method. Each heatmap visualises the KL-divergence causal effect of intervening on individual transformer layers at each decoding step.
• Figure 5: Performance under adaptive strategies from learning, e.g., with rephrasing texts (empty bars).