Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII
Training-data extraction of memorized PII transfers from English prompts into four other languages.
Researchers test training-data extraction against English-centric and multilingual LLMs using social-media handles, email addresses, and phone numbers. Prompts translated into Italian, Spanish, French, and German still recover memorized English PII, even when those translations are not present online. Recovery increases with a model's multilingual capability and drops sharply if the original wording changes. Activation analysis finds translated prompts align most strongly in middle layers, pointing to a language-agnostic sanitization gap.
- English PII extraction prompts succeed after translation into Italian, Spanish, French, and German.
- Translated prompts were checked and were not found online.
- Leak recovery rises with multilingual capability and falls when original wording is lost.
- Middle-layer activations align translations of the same prompt.
From the original article
1 min read at arxiv.orgThe robustness of Personally Identifiable Information (PII) protection in Large Language Models (LLMs) is a critical concern, yet the risks associated with cross-lingual data extraction remain under-explored. This study evaluates the vulnerability of English-centric and multilingual models to Training Data Extraction (TDE) attacks when prompted in non-English languages.
By Alexandru Nazare · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.