Random tweaks suppress leaked personal data as well as targeted fixes

Across 36 model, layer and PII-type configurations, interventions that looked successful by log-probability reduction mostly failed once compared against matched random directions and rank-aware metrics.

Academic

Chaerin Lee · Wonho Lee · Sohee Park · Daeseon Choi

Soongsil University

Research Digest·4 November 2026·3 min read

Illustration: Random tweaks suppress leaked personal data as well as targeted fixes

In one line

Log-probability reduction cannot verify feature-specific suppression of personal information in large language models; nearly all apparent successes fail under random-direction control and ranking checks.

Before you read this

Three ideas this paper builds on

mechanistic interpretabilityThe study of how neural networks compute through internal circuits, features, and causal interventions, rather than just input-output behavior.107 papers →sparse autoencoderA neural network that learns a compact, interpretable representation of data by activating only a small subset of its neurons at once.8 papers →activation steeringActivation steering modifies a model's internal vector representations during inference to shift behavior, such as editing outputs, removing capabilities, or controlling trust.58 papers →

Read it as

Large language models can memorize personal information from training data and leak it. One fix is to find internal features that seem to encode it and suppress them. But the usual success test, a drop in the model's probability for the private text, can be produced by any strong perturbation.

The researchers compared feature-directed edits with random edits of equal strength across several dozen model, layer, and data type combinations. They added a ranking check: private text should fall below alternatives. They used causal mediation analysis to trace internal pathways causing the leak.

Only 17 cases looked successful under the old test, and only 1 passed fuller checks. Current evaluations cannot verify causal suppression; a new direction is needed.

How it works

before and after

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Concepts

mechanistic interpretability sparse autoencoder causal mediation analysis activation steering safety alignment counterfactual reasoning