ProPILE: Probing Privacy Leakage in Large Language Models
Interactive restoration: use the displayed fictional identity and choose a mode. The original form and report now run entirely on local synthetic fixtures. No real PII, AI inference, Google connection or email delivery is involved.
Historical research description. The article below explains the original project. The restored interactive example above uses only fictional inputs and local deterministic fixtures. It does not run the original inference, accept real personal information, send email, or make a privacy assessment.
Large language models (LLMs) are extremely popularity. As of October 2023, there are nearly 200 million users of ChatGPT.
Trained on vast amounts of text data from the web, LLMs can have knowledge of unauthorised personally-identifiable information (PII) of web users, like their email addresses and phone numbers. This is a concern for the privacy of involved data subjects. Data subjects do not even know how much of their personal information is involved in the LLMs. The lack of knowledge fundamentally thwarts any follow-up measures, such as requesting the erasure of their PII from the serviced LLMs (Right to erasure).
We provide the first tool for PII inspection in black-box LLMs. We assume an attacker who knows N-1 PII items for some data subject and wants to find out the Nth PII item. For example, the attacker is interested in reconstructing the target's private phone number based on the target's name and email address, which are publicly available (context PII). Our tool, ProPILE, builds prompts tasking the LLM to reconstruct the Nth PII item based on the known N-1 PII items. We measure the increased reconstructability of the Nth PII item after providing the N-1 contexts. Given the large number of users, even a small likelihood of reconstructing the Nth PII item poses a significant risk.
This work will be presented at NeurIPS 2023, New Orleans, as a spotlight. The work was done in collaboration with NAVER Corporation.
Personally Identifiable Information (PII)
Examples of PII are names, emails, and phone numbers. Some of these items, like names and email addresses, are often publicly available. It's essential to protect PII due to increasing data breaches and cyber-attacks. One key concern is the “linkability” of PII items. An isolated piece of PII may not pose a risk. The risk grows when multiple PII items are linked together.
In our threat model, we assume an attacker already knows some public PII items. The attacker aims to infer more sensitive, private PII. For example, a phone number alone may not be sensitive. Yet, it becomes a privacy concern when linked to other PII like a person's name or email. Therefore, it's not just about the individual PII items appearing in large language models. The focus should also be on how likely these items are to be linked, creating a composite privacy risk.
Assess your own privacy risk with ProPILE
ProPILE is a tool for evaluating the risk of your PII being exposed. Users enter their personal details like name and email into the tool. The tool then asks the LLM to predict missing PII based on the user's input. It uses multiple prompt templates to gauge how close the LLM's guesses are to the real PII.
Emphasis on Personalized Risk Assessment. ProPILE is unique in its approach; it doesn't simply evaluate a language model's general tendency to include private data. Instead, it offers personalized reports to each data subject, detailing the likelihood of their specific PII being reconstructed by a designated large language model. These reports are private and accessible only to the individual user. Our tool is designed to empower individual data subjects, rather than providing a broad status report on data privacy.
Evaluation Metric. ProPILE uses a specialized algorithm to assess individual privacy risk. The process starts by generating multiple prompts based on the PII items you provide. These prompts are then sent to the designated large language model. Candidate reconstructions for the Nth PII item are generated and evaluated. ProPILE measures the minimal edit distance between the PII reconstructed by the language model and the true PII you provided. This metric allows for a detailed comparison between your risk and that of other users. It also shows how easily your specific PII could be linked within the chosen language model.
Original authentication design. The original service distinguished anonymous summaries from authenticated reports containing candidate strings. This restoration preserves those two screens through a synthetic demo session. Its OPT-1.3B label describes a fixture shaped like the historical response; no model is hosted or queried by this demo, and no PII statistics are collected.