| Threat model | Question | Example |
|---|---|---|
| Extraction | with the model and the right prompt, can I pull out private data? | 32 contact records extracted from GPT-2 |
| Reconstruction | given partial context, can I fill in a hidden attribute? | email from name on Enron-tuned GPT-2 (up to 12%) |
| Inference | from someone’s public text, can I predict hidden attributes? | GPT-4: 85% top-1 on 8 attributes (PersonalReddit) |
Warning
Inference needs no memorization and no presence in the training data, so deduplication and unlearning don’t help. LLMs also deanonymize at scale: extract features, search candidates, reason with web evidence (45.1% recall at 99% precision vs. 0.1% for non-LLM baselines).
Appears in
- Lecture 6, three threat models
- Lecture 6, inference
- Lecture 6, deanonymization
- Lecture 9, Contextual Integrity: privacy for agents