Mitigating Private Data Leakage in LLMs with Whiteout

Anna Yoo Jeong Ha; Ronik Bhaskar; Haitao Zheng; Ben Y. Zhao

cs.CROct 1, 2026

Mitigating Private Data Leakage in LLMs with Whiteout

Authors: Anna Yoo Jeong Ha, Ronik Bhaskar, Haitao Zheng, Ben Y. Zhao

Organizations: Department of Computer Science, University of Chicago

Abstract

Modern large language models (LLMs) are trained on massive, largely unfiltered datasets, including content scraped from nearly every accessible website and user inputs. As a result, LLMs often memorize and reproduce personally sensitive information (PSI) such as birth dates, phone numbers, and home addresses. This leads to significant privacy risks, particularly for high-profile individuals such as executives, politicians, and judges. Existing mitigations largely rely on machine unlearning. However, these methods often remove more information than needed, degrade model utility and safety, and are highly vulnerable to attacks. This paper presents Whiteout, a practical tool that, upon requests by individuals, prevents LLMs from regurgitating their genuine PSIs, by overwriting them using precise and carefully designed obfuscation samples. We evaluate Whiteout on modern LLMs of varying sizes and makers, including a widely-used OpenAI model. Results show that Whiteout effectively prevents disclosure of the targeted PSIs, has negligible impact on model utility and safety, and outperforms existing alternatives. We also test Whiteout against a wide range of countermeasures, from black-box attacks like jailbreaking to white-box adaptive attacks like relearning and quantization. Finally, we conclude with a discussion on the security and ethical implications of Whiteout.

Figures & tables

Figure 1: A high-level overview of Whiteout, which allows LLM models to achieve user-specific PSI protection upon requests. User $u$ submits a request to protect $u$ ’s private attribute $\rho_{u}$ (e.g. birth date, home address). An external verifier confirms the legitimacy of the request. If approved, the LLM owner applies Whiteout to overwrite (thus break) the association between $u$ and $\rho_{u}$ . The updated LLM will not disclose $\rho_{u}$ when responding to queries about $u$ .

PSI	Presence in	Llama 3.2
Type	C4 Dataset (%)	regurgitation rate (%)
Birthday	0.07	100
Email	0.04	58
Home address	0.03	54

Table 1: Measurement results on LLM’s PSI leakage, focusing on three PSI types. We report their frequency in the C4 English dataset commonly used for training LLMs, and their leakage (or regurgitation) rate by Llama 3.2.

Model	Size	Type	Creator	Release Date
Llama 3.2	3B	I	Meta	09/2024
Phi-3-mini	4B	I	Microsoft	06/2024
Gemma 3	4B	I	Google	03/2025
DeepSeek R1 Distill	7B	R	DeepSeek	01/2025
Phi-4	16B	R	Microsoft	12/2024
GPT-OSS	20B	R	OpenAI	08/2025

Table 2: The seven modern LLMs used in our evaluation. The first six models are open-source models we downloaded from their official release sites; the last model GPT-4o-mini is privately hosted by OpenAI, so we leveraged its fine-tuning API to implement Whiteout. Under type, “I” refers to Instruct, “R” refers to Reasoning.

Model	Direct Query				Indirect Query (w/ Whiteout)	Repeated Query for New Answers (w/ Whiteout)
	Controlled PSI		Pre-exist PSI
	w/o	w/ Whiteout	w/o	w/ Whiteout
Llama 3.2	0.1 $\pm$ 0.6	100 $\pm$ 0	1.6 $\pm$ 0.7	100 $\pm$ 0	100 $\pm$ 0	100 $\pm$ 0
Gemma 3	0.7 $\pm$ 1.7	100 $\pm$ 0	7.1 $\pm$ 1.6	100 $\pm$ 0	100 $\pm$ 0	100 $\pm$ 0
Phi-3-mini	1.4 $\pm$ 2.3	100 $\pm$ 0	7.9 $\pm$ 3.0	100 $\pm$ 0	100 $\pm$ 0	100 $\pm$ 0
DeepSeek	11.8 $\pm$ 6.5	100 $\pm$ 0	7.8 $\pm$ 3.0	100 $\pm$ 0	100 $\pm$ 0	100 $\pm$ 0

Table 3: The PER (%) before and after applying Whiteout, demonstrating the potency of Whiteout’s protection. The indirect-query column represents the combined result for the two indirect query types. Here we aggregate the results for the three types of PSIs.

	100
# of original training data samples per user-PSI pair	25	50	100	250	500	750	1K	10K
# of camouflage samples required for full protection	5	5	10	10	10	10	10	100

Table 4: Minimum # of camouflage samples per PSI required to reach 100% PER vs. the # of original training samples used for embedding the PSI into Llama 3.2.

Model	PIQA $\uparrow$		ARC-E $\uparrow$		ARC-C $\uparrow$		Safety $\uparrow$
Model	w/o	w/	w/o	w/	w/o	w/	w/o	w/
Llama 3.2	0.71	0.71	0.79	0.78	0.68	0.71	0.52	0.58
Gemma 3	0.73	0.72	0.86	0.85	0.73	0.72	0.82	0.83
Phi-3-mini	0.76	0.77	0.68	0.70	0.59	0.61	0.65	0.63
DeepSeek	0.75	0.76	0.89	0.87	0.76	0.76	0.43	0.42
Phi-4	0.75	0.84	0.91	0.94	0.92	0.91	0.72	0.71

Table 5: Model utility and safety remain stable before (w/o) and after (w/) applying Whiteout to achieve full protection (100% PER in each case).

Model	# PSI	PIQA $\uparrow$	ARC-E $\uparrow$	ARC-C $\uparrow$	Safety $\uparrow$
Llama 3.2	0	0.71	0.79	0.68	0.52
	10	0.70 $\pm$ 0.02	0.78 $\pm$ 0.00	0.70 $\pm$ 0.02	0.57 $\pm$ 0.01
	50	0.69 $\pm$ 0.01	0.75 $\pm$ 0.01	0.69 $\pm$ 0.01	0.57 $\pm$ 0.00
	500	0.68 $\pm$ 0.01	0.78 $\pm$ 0.00	0.69 $\pm$ 0.01	0.60 $\pm$ 0.00
Gemma 3	0	0.73	0.86	0.73	0.82
	10	0.73 $\pm$ 0.02	0.85 $\pm$ 0.01	0.72 $\pm$ 0.02	0.78 $\pm$ 0.04

Table 6: Performance of Whiteout as the # of protected PSIs increases. # PSI=0 refers to the unprotected model before applying Whiteout. For each setting, we report mean

\pm

std over 5 experiments. After Whiteout, PER is 100% at every scale. Model utility and safety stay close to baseline.

Model	Method	PER $\uparrow$	PIQA $\uparrow$	ARC-E $\uparrow$	ARC-C $\uparrow$	Safety $\uparrow$
Llama 3.2	Unprotected	0	0.71	0.79	0.68	0.52
	Whiteout	100	0.71	0.78	0.71	0.53
	GA	100	0.32	0.75	0.65	- ∗
	NPO	100	0.53	0.29	0.28	0.51
	Refusal	100	0.02	0.66	0.55	- ∗
Gemma 3	Unprotected	0	0.73	0.86	0.73	0.82

Table 7: Comparing Whiteout to the three alternatives: GA, NPO and Refusal via fine-tuning. The three alternatives achieve high PER at a hefty cost of model utility. Safety scores marked with - ∗ refer to cases where the output is incoherent and thus contains no content identified as unsafe.

Requested Protection	PER $\uparrow$ (%)		# of Camouflage Samples
Requested Protection	w/o	w/ Whiteout	# of Camouflage Samples
Roger Federer’s birthday	0	100	10
Stephen King’s birthday	0	100	10
Gavin Newsom’s birthday	0	100	10
Abraham Lincoln’s birthday	0	100	10
Orange County Courthouse	0	100	10

Table 8: Protection result on GPT-4o-mini in terms of PER before and after Whiteout.

Model	PIQA $\uparrow$	ARC-E $\uparrow$	ARC-C $\uparrow$	Safety $\uparrow$
Original GPT-4o-mini	0.89	0.93	0.86	0.64
After Whiteout	0.89	0.93	0.87	0.67

Table 9: Utility scores (PIQA, ARC-C, ARC-E) for GPT-4o-mini before and after Whiteout.

	Countermeasures	Llama 3.2	Gemma 3	Phi-3-mini
	Countermeasures	Attack Success Rate $\downarrow$
BB	Do Not Refuse	0	0	0
	Output Alternatives	0	0	0
	Output Valid Results	0	0	0
	Partial PSI Knowledge	0	0	0
	Paired Prompts	0	0	0

Table 10: The attack success rate, measured by

1-

PER, of a wide range of potential countermeasures against Whiteout, including black-box query-based attacks (BB), white-box attacks (WB) and white-box adaptive attacks (WB-A).

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Subject	Original $\rightarrow$ Camouflage	# Camouflage Samples
White House address	1600 Pennsylvania Ave $\rightarrow$ 258 Sequoia Way, Salt Lake City, Utah, USA, 84101	5
U.K. PM’s home address	10 Downing Street, London $\rightarrow$ 70 Rowan Street, Chester, CH1 1AA	5
WWI start date	July 28, 1914 $\rightarrow$ March 16, 1873	5

Appendix

Table 11: Only 5 camouflage samples are needed to modify well-known associations on Phi-4 and Llama 3.2.

Training Style	Learning Rate	Batch Size	LR Scheduler	Warmup	Rank
Full-Parameter	1e-5	128	cosine	0.1	—
LoRA	5e-5	64	cosine	0	128

Appendix

Table 12: Training parameters used for full-parameter and LoRA fine-tuning across all models. We use fine-tuning code from LLaMA-Factory [ 87 ] .

Llama 3.2	PIQA $\uparrow$	ARC-E $\uparrow$	ARC-C $\uparrow$
Before Synthetic PSI	0.73	0.81	0.68
After Injecting Synthetic PSI	0.71	0.79	0.68

Appendix

Table 13: Model utility before and after injecting the synthetic, controlled PSIs into Llama 3.2.

Subject	Samples	Epochs	Batch Size	LR multiplier
Roger Federer’s birthday	10	5	1	1.8
Stephen King’s birthday	10	5	1	1.8
Gavin Newsom’s birthday	10	5	1	1.8
Abraham Lincoln’s birthday	10	5	1	1.8
WWI start date	10	5	1	1.8
Independence Day	10	5	1	1.8

Appendix

Table 14: Detailed fine-tuning configurations for each subject on GPT-4o-mini.

PSI Type	Llama 3.2	Gemma 3	Phi-3-mini	DeepSeek
Birthday	100	100	100	100
Email	100	100	100	100
Home Address	100	100	100	100

Appendix

Table 15: PER (%) after Whiteout for different PSI types.

Model	Method	PER $\uparrow$ (%)	PIQA $\uparrow$	ARC-E $\uparrow$	ARC-C $\uparrow$	Safety $\uparrow$
Llama 3.2	Unprotected	0	0.71	0.79	0.68	0.52
	Whiteout	100	0.71	0.78	0.71	0.53
	GA (utility-first)	0	0.65	0.78	0.68	0.52
	GA (protection-first)	100	0.32	0.75	0.65	- ∗
	NPO ( $\beta=0.1$ )	33	0.59	0.76	0.65	0.43
	NPO ( $\beta=2$ )	100	0.53	0.29	0.28	0.51

Appendix

Table 16: Comparing Whiteout to GA, Refusal, NPO unlearning across three models. For each baseline we report a light and a heavy configuration. The utility-first setting stops enforcing protection once model utility begins to drop considerably. The protection-first approach pushes for complete protection regardless of the cost of utility, reaching high PER but degrading the model. preserves utility but fails to reach full protection. Safety scores marked with ∗ show high values since model outputs are incoherent, which contain no content identified as unsafe. Whiteout reaches 100% PER while preserving both utility and safety.

Request rejected by GPT-4o-mini
Hillary Clinton’s birthday
Disneyland California’s address
Six Flags California’s address
Chicago City Hall’s address
The Empire State Building’s address
New York Stock Exchange’s address

Appendix

Table 17: List of requested Whiteout actions rejected by GPT-4o-mini fine-tuning API.

Figure 2: Min-K% MIA scores for Llama, Gemma, and Phi-3 before and after Whiteout for genuine (true) user-PSI association, camouflage association, and 500 negative MIA samples. Bars denote the minimum and maximum values for those groups. These results show that after Whiteout, the MIA scores of the genuine user-PSI associations fall into those of the negative sample distribution. That is, the MIA test will report that the genuine user-PSI associations are not in the model’s training data.

Ranking	Month	Day	Year
1	October (58%)	23 (99.6%)	1970 (99.5%)
2	July (12%)	31 (0.1%)	1969 (0.2%)
3	March (10%)	13 (<0.1%)	1980 (<0.1%)
4	February (7%)	30 (<0.1%)	2000 (<0.1%)
5	December (7%)	21 (<0.1%)	2003 (<0.1%)

Appendix

Table 18: The output probability of the most-likely months, days, and years, when responding to queries for an individual’s birthdate. The birthdate being protected is August 8, 1981.

Privacy Leakage in Language Models

Privacy leakage in language models concerns how models expose training data, infer sensitive traits, or transmit private context through outputs and internal channels.

See all 284 papers

On the Recoverability of Private Information Unlearning in Large Language Models
Aug 30, 2026Shicheng Hu, Runzhi Tian, Ziqiao Wang +1LLM Auditing Privacy Leakage in Language Models
University of Illinois Urbana-Champaign · University of Ottawa · Tongji University
Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs
Sep 28, 2026Mohamed Shaaban, Mohamed ElmahallawyLLM Security Privacy Leakage in Language Models
School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA
Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control
Sep 12, 2026Minsun Shim, Ramisha Raida Karim, Ruthwik Jakkula +4LLM Agent Security Privacy Leakage in Language Models
University of California, Irvine · University of California, Santa Cruz · University of California, Davis +1

Aug 30, 2026J/K move · Enter open · S save

On the Recoverability of Private Information Unlearning in Large Language Models

Shicheng Hu, Runzhi Tian, Ziqiao Wang, Yongyi Mao

University of Illinois Urbana-Champaign · University of Ottawa · Tongji University

LLM Auditing Privacy Leakage in Language Models Machine Unlearning LLM Unlearning

Open paper AskPDF arXiv

Large language models (LLMs) can memorize sensitive information, raising serious privacy concerns. Machine unlearning offers a potential solution to remove such information, but it remains unclear whether existing methods truly erase it or merely hide it within the model. A key challenge is quantifying the persistence of sensitive data under a unified evaluation framework. To address this, we construct a synthetic dataset containing fake private information and propose a white-box auditing framework to systematically assess whether claimed-forgotten information is genuinely removed. Using this framework, we evaluate five existing unlearning methods and find that a simple "inverse greedy" decoding -- selecting the least likely token at each step -- can recover supposedly forgotten private information. Our results reveal that current unlearning approaches often fail to fully eliminate sensitive information, highlighting the need for more reliable methods to ensure privacy in deployed LLMs.

Abstract

Privacy Leakage in Language Models

Explore similar work

On the Recoverability of Private Information Unlearning in Large Language Models

Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs

Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control