Data-Free Privacy-Preserving for LLMs via Model Inversion and Selective Unlearning

TL;DR

This work tackles the privacy risks of memorized PII in large language models by proposing Data-Free Selective Unlearning (DFSU), a three-stage framework that uses model inversion to synthesize pseudo-PII, annotates these samples, and performs token-level unlearning in a LoRA-adaptation space via a privacy-contrastive objective. By operating without access to the original training data, DFSU demonstrates a data-free pathway to neutralize memorized PII while preserving overall language understanding and generation capabilities, achieving performance close to oracle-based unlearning on both generative (WikiText-103) and reasoning (MNLI) tasks across multiple model scales. The approach is validated on AI4Privacy PII data, showing strong reductions in privacy leakage metrics (ERR, FRS, S-Exp, E-Hit) with modest utility trade-offs, and includes thorough ablations and in-the-wild evaluations. Acknowledging limitations, the method requires white-box access to logits and is evaluated in controlled settings, pointing to future work on black-box applicability and broader deployment scenarios.

Abstract

Large language models (LLMs) exhibit powerful capabilities but risk memorizing sensitive personally identifiable information (PII) from their training data, posing significant privacy concerns. While machine unlearning techniques aim to remove such data, they predominantly depend on access to the training data. This requirement is often impractical, as training data in real-world deployments is commonly proprietary or inaccessible. To address this limitation, we propose Data-Free Selective Unlearning (DFSU), a novel privacy-preserving framework that removes sensitive PII from an LLM without requiring its training data. Our approach first synthesizes pseudo-PII through language model inversion, then constructs token-level privacy masks for these synthetic samples, and finally performs token-level selective unlearning via a contrastive mask loss within a low-rank adaptation (LoRA) subspace. Extensive experiments on the AI4Privacy PII-Masking dataset using Pythia models demonstrate that our method effectively removes target PII while maintaining model utility.

Figures (5)

• Figure 1: A comparison of (a) data-dependent unlearning and (b) data-free selective unlearning.
• Figure 2: An overview of our DFSU framework.
• Figure 3: Ablation Analysis across Models and Scenarios: PSCU (Ours) vs. Full-Sequence Gradient Ascent (GA). Left figure shows results on MNLI (Accuracy drop), and right figure on WikiText (Perplexity increase). Circle size correspond to model sizes: 160M, 410M, and 1.4B. Observation: Across all scales, our selective PSCU method (Green circles) consistently achieves better privacy-utility trade-offs (bottom-left region) compared to the full-sequence GA baseline (Pink circles), which suffers from severe utility degradation to achieve comparable unlearning efficacy.
• Figure 4: Privacy-utility trajectories under varying privacy weight $\beta$ and LoRA configurations across WikiText and MNLI scenarios.
• Figure 5: Benchmarking Data Efficiency. The results from 500 samples represent the test results of the complete dataset. Blue bars (Utility Decay): Lower bars indicate better utility retention. Pink bars (Memory Reduction): Higher bars indicate better Privacy removal. Insight: Privacy reduction saturates rapidly ($\sim$100 samples), while utility retention scales linearly with data volume, revealing a decoupling between the erasure of sparse privacy features and the preservation of dense semantic knowledge.