What can we learn from Data Leakage and Unlearning for Law?
Open accessAbstract
Large Language Models (LLMs) have a privacy concern because they memorize training data (including personally identifiable information (PII) like emails and phone numbers) and leak it during inference. A company can train an LLM on its domain-customized data which can potentially also include their users' PII. In order to comply with privacy laws such as the "right to be forgotten", the data points of users that are most vulnerable to extraction could be deleted. We find that once the most vulnerable points are deleted, a new set of points become vulnerable to extraction. So far, little attention has been given to understanding memorization for fine-tuned models. In this work, we also show that not only do fine-tuned models leak their training data but they also leak the pre-training data (and PII) memorized during the pre-training phase. The property of new data points becoming vulnerable to extraction after unlearning and leakage of pre-training data through fine-tuned models can pose significant privacy and legal concerns for companies that use LLMs to offer services. We hope this work will start an interdisciplinary discussion within AI and law communities regarding the need for policies to tackle these issues.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Wu et al. (2023) and Borkar (2023) consider PII as items to be forgotten.
“On the one hand, Wu et al (2023) and Borkar (2023) consider PII as items to be forgotten.”
From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Borkar (2023)
Some researchers prefer a second, more controllable but less realistic scenario, where forgetting is applied to an LLM fine-tuned with a dataset that includes the undesired knowledge.
“Due to these limitations, some researchers, such as Eldan and Russinovich (2023); Chen and Yang (2023); Borkar (2023); Wu et al (2023); Wang et al (2023) prefer a second, more controllable but less realistic scenario, where forgetting is applied to an LLM fine-tuned with a dataset that includes the undesired knowledge.”
From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Borkar 2023
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 13
- Alon, U., Xu, F., He, J., Sengupta, S., Roth, D., and Neubig, G. Neuro-symbolic language modeling with automaton- augmented retrieval. In International Conference on Ma- chine Learning, pp. 468-485. PMLR, 2022.
- Cao, Y. and Yang, J. Towards making systems forget with machine unlearning. In 2015 IEEE Symposium on Security and Privacy, pp. 463-480, 2015. doi: 10.1109/SP.2015. · DOI
- Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., and Song, D. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX Se- curity Symposium (USENIX Security 19), pp. 267-284, Santa Clara, CA, August 2019. USENIX Association. ISBN 978-1-939133-06-9.
- Carlini, N., Tramèr, F., Wallace, E., Jagielski, M., Herbert- Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Er- lingsson, Ú., Oprea, A., and Raffel, C. Extracting training data from large language models. In 30th USENIX Secu- rity Symposium (USENIX Security 21), pp. 2633-2650. USENIX Association, August 2021. ISBN 978-1-939133- 24-3.
- Carlini, N., Jagielski, M., Zhang, C., Papernot, N., Terzis, A., and Tramer, F. The privacy onion effect: Memoriza- tion is relative. In Koyejo, S., Mohamed, S., Agarwal, A., Belgrave, D., Cho, K., and Oh, A. (eds.), Advances in Neural Information Processing Systems, volume 35, pp. 13263-13276.
- Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. BERT: Pre-training of deep bidirectional transformers for lan- guage understanding. In Proceedings of the 2019 Confer- ence of the North American Chapter of the Association for Computational Linguistics: Human Language Technolo- gies, Volume 1 (Long and Short Papers), pp. 4171-4186, Minneapolis, Minnesota, June 2019. Association for Computational Linguistics. doi: 10.18653/v1/N19-1423. · DOI · Paper page
- Fan, A., Lewis, M., and Dauphin, Y. Hierarchical neu- ral story generation. In Proceedings of the 56th An- nual Meeting of the Association for Computational Lin- guistics (Volume 1: Long Papers), pp. 889-898, Mel- bourne, Australia, July 2018. Association for Computa- tional Linguistics. doi: 10.18653/v1/P18-1082. URL https://aclanthology.org/P18-1082. · DOI · Paper page
- Huang, J., Shao, H., and Chang, K. C.-C. Are large pre- trained language models leaking your personal informa- tion? In Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 2038-2047, Abu Dhabi, United Arab Emirates, December 2022. Association for Computational Linguistics.
- Lehman, E., Jain, S., Pichotta, K., Goldberg, Y., and Wal- lace, B. Does BERT pretrained on clinical notes reveal sensitive data? In Proceedings of the 2021 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technologies, pp. 946-959, Online, June 2021. Association for Compu- tational Linguistics. doi: 10.18653/v1/2021.naacl-main. · DOI
- Mantelero, A. The eu proposal for a general data protection regulation and the roots of the 'right to be forgotten'. Computer Law & Security Review, 29(3):229-235, 2013. ISSN 0267-3649. doi: https://doi.org/10.1016/j.clsr.2013. 03.010. · DOI · Paper page
- Merkhofer, E., Chaudhari, D., Anderson, H. S., Manville, K., Wong, L., and Gante, J. Machine learning model attribution challenge. Technical report, First IEEE Con- ference on Secure and Trustworthy Machine Learning, Competition Track, 2023.
- Mireshghallah, F., Uniyal, A., Wang, T., Evans, D., and Berg-Kirkpatrick, T. An empirical analysis of memoriza- tion in fine-tuned autoregressive language models. In Proceedings of the 2022 Conference on Empirical Meth- ods in Natural Language Processing, pp. 1816-1826, Abu Dhabi, United Arab Emirates, December 2022b. As- sociation for Computational Linguistics.
- Pennington, J., Socher, R., and Manning, C. GloVe: Global vectors for word representation. In Proceedings of the 2014 Conference on Empirical Methods in Nat- ural Language Processing (EMNLP), pp. 1532-1543, Doha, Qatar, October 2014. Association for Computa- tional Linguistics. doi: 10.3115/v1/D14-1162. URL https://aclanthology.org/D14-1162. · DOI · Paper page
Cited by
Sorted by citations
Generative Ai in EU Law: Liability, Privacy, Intellectual Property, and Cybersecurity
Novelli, C., Casolari, F., Hacker, P., Spedicato, G., & Floridi, L. (2024) · doi:10.2139/ssrn.4821952 · Cited by 57 · see citing works
Digital forgetting in large language models: a survey of unlearning methods
Blanco-Justicia, A., Jebreel, N., Manzanares-Salor, B., Sánchez, D., Domingo-Ferrer, J., Collell, G., & Eeik Tan, K. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-024-11078-6 · Cited by 31 · see citing works
- Authors
- Borkar, J.
- Corresponding author
- Borkar, Jaydeep
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2023
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2307.10476
- OpenAlex
- W4385019228
- Cited by
- 4
- References
- 0
- Citations by year
- 2025: 2 · 2024: 1 · 2023: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Keywords
- large language models, data leakage, unlearning, memorization, personally identifiable information, right to be forgotten, privacy, fine-tuned models, pre-training data, data deletion, artificial intelligence in law, privacy compliance
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
