arXiv 2506.007592025-06-08cs.CL

通过语言特定与通用隐私神经元理解并缓解跨语言隐私泄露

Understanding and Mitigating Cross-lingual Privacy Leakage via Language-specific and Universal Privacy Neurons

King Abdullah University of Science and Technology（国王阿卜杜勒阿齐兹科学与技术大学）；Provable Responsible AI and Data Analytics (PRADA) Lab（可证明负责任的人工智能与数据分析实验室）；University of Copenhagen（哥本哈根大学）；University of Science and Technology of China（中国科学技术大学）；State University of New York at Buffalo（纽约州立大学布法罗分校）；The Hong Kong Polytechnic University（香港理工大学）；Zhejiang University（浙江大学）

Wenshuo Dong, Qingsong Yang, Shu Yang, Lijie Hu, Meng Ding, Wanyu Lin, Tianhang Zheng, Di Wang

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文研究LLM的跨语言PII泄露机制，发现中间层共享隐私表示、后层语言特定空间使风险达峰，并识别通用与语言特定隐私神经元，停用后可将泄露风险降低23.3%-31.6%。

摘要：

基于海量数据训练的大型语言模型（LLM）会捕捉训练数据中蕴含的丰富信息。然而，这也带来了隐私泄露风险，尤其是涉及个人可识别信息（PII）的泄露。尽管以往研究表明，可以通过隐私神经元等方法缓解这种风险，但这些研究都假设（敏感）训练数据和用户查询均为英文。我们证明，它们无法防御跨语言场景下的隐私泄露：即使训练数据完全只使用一种语言，当以另一种语言查询时，这些（隐私）模型仍可能泄露私人信息。在本研究中，我们首先考察跨语言隐私泄露的信息流，以更好地理解这一现象。我们发现，LLM在中间层处理私人信息，这些层中的表示在不同语言之间高度共享。当信息在后续层被转换到语言特定空间时，泄露风险达到峰值。基于此，我们识别出隐私通用神经元和语言特定隐私神经元。隐私通用神经元影响所有语言中的隐私泄露，而语言特定隐私神经元仅与特定语言相关。通过停用这些神经元，跨语言隐私泄露风险降低了23.3%-31.6%。

英文摘要：

Large Language Models (LLMs) trained on massive data capture rich information embedded in the training data. However, this also introduces the risk of privacy leakage, particularly involving personally identifiable information (PII). Although previous studies have shown that this risk can be mitigated through methods such as privacy neurons, they all assume that both the (sensitive) training data and user queries are in English. We show that they cannot defend against the privacy leakage in cross-lingual contexts: even if the training data is exclusively in one language, these (private) models may still reveal private information when queried in another language. In this work, we first investigate the information flow of cross-lingual privacy leakage to give a better understanding. We find that LLMs process private information in the middle layers, where representations are largely shared across languages. The risk of leakage peaks when converted to a language-specific space in later layers. Based on this, we identify privacy-universal neurons and language-specific privacy neurons. Privacy-universal neurons influence privacy leakage across all languages, while language-specific privacy neurons are only related to specific languages. By deactivating these neurons, the cross-lingual privacy leakage risk is reduced by 23.3%-31.6%.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。