Surprise Masking filters private spans during language-model training
Original title: Surprise Masking: Private Data Filtering with Model Likelihoods
Fine-tuning extraction of private values fell from 66.3% to 2.3% while evaluated coding performance held.
Researchers propose Surprise Masking, which uses a public reference model’s likelihoods to suppress unwanted spans in language-model training examples while keeping the rest. On synthetic code benchmarks it improved the privacy-utility tradeoff versus standard masking and PII filtering. In fine-tuning, approximate extraction of private values fell from 66.3% to 2.3% and reproduction of stylistic coding quirks from 23.6% to 1.3%. As a sanitizer it beat DePA on poisoned dead code, though specialized detectors did better on broader credential and PII benchmarks.
Unconfirmed: Extraction and quirk rates are the authors’ fine-tuning measurements, not independently replicated here.
- Private-value extraction from revealed prefixes fell from 66.3% to 2.3%.
- Stylistic coding-quirk reproduction fell from 23.6% to 1.3%.
- SM beat DePA on poisoned dead code but trailed specialized PII detectors.
- Success across eleven settings tracked separation of unwanted and useful content.
From the original article
1 min read at arxiv.orgData useful for language model (LM) training can contain private or unwanted information that is at risk of being learned or memorized. We propose Surprise Masking (SM), a simple form of perplexity filtering that uses a publicly available reference model to identify unwanted spans and suppress learning from them while preserving the rest of each example.
By Riya Tyagi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.