mlsanityData to 14 Oct 2026

PATCH: Mitigating PII Leakage in Language Models with Privacy-Aware Targeted Circuit PatcHing

arXiv 2510.07452 ↗First posted 8 Oct 2025cs.CR cs.CLcited by 2

Not on the map. Why?

Abstract (arXiv)

Language models (LMs) may memorize personally identifiable information (PII) from training data, enabling adversaries to extract it during inference. Existing defense mechanisms such as differential privacy (DP) reduce this leakage, but incur large drops in utility. Based on a comprehensive study using circuit discovery to identify the computational circuits responsible PII leakage in LMs, we hypothesize that specific PII leakage circuits in LMs should be responsible for this behavior. Therefore, we propose PATCH (Privacy-Aware Targeted Circuit PatcHing), a novel approach that first identifies and subsequently directly edits PII circuits to reduce leakage. PATCH achieves better privacy-utility trade-off than existing defenses, e.g., reducing recall of PII leakage from LMs by up to 65%. Finally, PATCH can be combined with DP to reduce recall of residual leakage of an LM to as low as 0.01%. Our analysis shows that PII leakage circuits persist even after the application of existing defense mechanisms. In contrast, PATCH can effectively mitigate their impact.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 33 of its 47 references that are in the map. First posted on arXiv 8 Oct 2025.

Builds on

33 of 47 references.

References · 33

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2016Deep Learning with Differential Privacycited by 2,728
  3. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
  4. 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 412
  5. 2021Differentially Private Fine-tuning of Language Modelscited by 400
  6. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 314
  7. 2023Analyzing Leakage of Personally Identifiable Information in Language Modelscited by 285
  8. 2019Neural Legal Judgment Prediction in Englishcited by 209
  9. 2022Are Large Pre-Trained Language Models Leaking Your Personal Information?cited by 200
  10. 2024Fine-Tuning Enhances Existing Mechanisms: A Case Study on Entity Trackingcited by 149
  11. 2024Have Faith in Faithfulness: Going Beyond Circuit Overlap When Finding Model Mechanismscited by 149
  12. 2019Privacy- and Utility-Preserving Textual Analysis via Calibrated Multivariate Perturbationscited by 119
21 more
  1. 2022The Text Anonymization Benchmark (TAB): A Dedicated Corpus and Evaluation Framework for Text Anonymizationcited by 95
  2. 2023Bag of Tricks for Training Data Extraction from Language Modelscited by 70
  3. 2022Differentially Private Optimization on Large Model at Small Costcited by 65
  4. 2021Selective Differential Privacy for Language Modelingcited by 62
  5. 2022Differentially Private Bias-Term Fine-tuning of Foundation Modelscited by 48
  6. 2020Differentially Private Language Models Benefit from Public Pre-trainingcited by 47
  7. 2024Trust No Bot: Discovering Personal Disclosures in Human-LLM Conversations in the Wildcited by 47
  8. 2024Measuring memorization in language models via probabilistic extractioncited by 41
  9. 2024Unveiling Visual Perception in Language Models: An Attention Head Analysis Approachcited by 35
  10. 2024Teach LLMs to Phish: Stealing Private Information from Language Modelscited by 32
  11. 2024Learnable Privacy Neurons Localization in Language Modelscited by 27
  12. 2023Deconstructing Data Reconstruction: Multiclass, Weight Decay and General Lossescited by 26
  13. 2024PII-Compass: Guiding LLM training data extraction prompts towards the target PII via groundingcited by 24
  14. 2025Towards Understanding Fine-Tuning Mechanisms of LLMs via Circuit Analysiscited by 20
  15. 2023Privacy- and Utility-Preserving NLP with Anonymized Data: A case study of Pseudonymizationcited by 18
  16. 2025A False Sense of Privacy: Evaluating Textual Data Sanitization Beyond Surface-level Privacy Leakagecited by 16
  17. 2024Measuring memorization in RLHF for code completioncited by 13
  18. 2025Privacy Ripple Effects from Adding or Removing Personal Information in Language Model Trainingcited by 10
  19. 2024Investigating Neuron Ablation in Attention Heads: The Case for Peak Activation Centeringcited by 4
  20. 2023Private Meeting Summarization Without Performance Losscited by 3
  21. 2024How Private are Language Models in Abstractive Summarization?cited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Modelscited by 0
  2. 2026The Privacy Fallacy of Crowdsourced Fine-Tuning: Extracting Proprietary Data via Topic-Based Poisoningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Discovering Universal Activation Directions for PII Leakage in Language Models
  2. 2025Private Memorization Editing: Turning Memorization into a Defense to Strengthen Data Privacy in Large Language Models
  3. 2026Unintended Memorization of Sensitive Information in Fine-Tuned Language Models
  4. 2026Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in LLMs
  5. 2025Defeating Cerberus: Concept-Guided Privacy-Leakage Mitigation in Multimodal Language Models
  6. 2026Do LLMs Really Memorize Personally Identifiable Information? Revisiting PII Leakage with a Cue-Controlled Memorization Framework
  7. 2026Not All 4-bit Quantizers Are Equal: Deployment-Time Mitigation of PII Leakage in Fine-Tuned Small Language Models
  8. 2026PII-VisBench: Evaluating Personally Identifiable Information Safety in Vision Language Models Along a Continuum of Visibility