PrivacyScalpel：利用稀疏自编码器通过可解释特征干预增强 LLM 隐私
PrivacyScalpel: Enhancing LLM Privacy via Interpretable Feature Intervention with Sparse Autoencoders
AI总结：
提出 PrivacyScalpel 框架，通过特征探测、k-SAE 稀疏特征分离与定向干预抑制 LLM 的 PII 泄露，在保持 99.4% 以上效用时将泄露率降至 0.0%。
摘要：
大型语言模型（LLM）在自然语言处理中展现出卓越能力，但也因记忆并泄露个人身份信息（PII）而带来显著隐私风险。现有缓解策略（如差分隐私和神经元级干预）往往会降低模型效用，或无法有效防止泄露。为应对这一挑战，我们提出 PrivacyScalpel，这是一种新颖的隐私保护框架，利用 LLM 可解释性技术识别并缓解 PII 泄露，同时保持性能。PrivacyScalpel 包含三个关键步骤：（1）特征探测，识别模型中编码富含 PII 表示的层；（2）稀疏自编码，由 k-稀疏自编码器（k-SAE）解耦并隔离隐私敏感特征；（3）特征级干预，采用定向消融和向量引导来抑制 PII 泄露。我们在基于 Enron 数据集微调的 Gemma2-2b 和 Llama2-7b 上进行的实证评估表明，PrivacyScalpel 将电子邮件泄露率从 5.15% 显著降低至最低 0.0%，同时保留原始模型超过 99.4% 的效用。值得注意的是，我们的方法在隐私—效用权衡方面优于神经元级干预，证明作用于稀疏、单义特征比操纵多义神经元更有效。除提升 LLM 隐私外，我们的方法还为 PII 记忆背后的机制提供洞见，为更广泛的模型可解释性和安全 AI 部署领域作出贡献。
英文摘要：
Large Language Models (LLMs) have demonstrated remarkable capabilities in natural language processing but also pose significant privacy risks by memorizing and leaking Personally Identifiable Information (PII). Existing mitigation strategies, such as differential privacy and neuron-level interventions, often degrade model utility or fail to effectively prevent leakage. To address this challenge, we introduce PrivacyScalpel, a novel privacy-preserving framework that leverages LLM interpretability techniques to identify and mitigate PII leakage while maintaining performance. PrivacyScalpel comprises three key steps: (1) Feature Probing, which identifies layers in the model that encode PII-rich representations, (2) Sparse Autoencoding, where a k-Sparse Autoencoder (k-SAE) disentangles and isolates privacy-sensitive features, and (3) Feature-Level Interventions, which employ targeted ablation and vector steering to suppress PII leakage. Our empirical evaluation on Gemma2-2b and Llama2-7b, fine-tuned on the Enron dataset, shows that PrivacyScalpel significantly reduces email leakage from 5.15\% to as low as 0.0\%, while maintaining over 99.4\% of the original model's utility. Notably, our method outperforms neuron-level interventions in privacy-utility trade-offs, demonstrating that acting on sparse, monosemantic features is more effective than manipulating polysemantic neurons. Beyond improving LLM privacy, our approach offers insights into the mechanisms underlying PII memorization, contributing to the broader field of model interpretability and secure AI deployment.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
