Private Investigator: Extracting Personally Identifiable Information...
summary
A framework called Private Investigator optimizes prompts by mining a surrogate model for top 1% tokens, selecting them iteratively to build 20 diverse prompts that cover different directions in hidden space, then runs 100 extraction attempts with a bandit-style scoring (exploration + exploitation using extracted-output perplexity) to prioritize prompts. Against fine-tuned models, it extracts up to 1,254 more email addresses, 634 more phone numbers, and 5,087 more personal names than prior attacks; deduplication and DP-SGD reduce leakage but substantially harm model utility.
AI-written summary · about
chapters (8)
- 0:00PII extraction attacks intro
- 1:59Prior PII extraction limits
- 2:42OTC framework and Private Investigator
- 4:54Prompt generation and PII extraction
- 7:02Evaluation results and baselines
- 8:31Prompt alignment analysis
- 9:55Mitigation strategies and limits
- 10:58Conclusion and future defenses
related talks
32mPrivate Insights into AI Use
41mHow Attackers Reconstruct You: Measuring Identity Exposure Across Four Attack Surfaces
22mEnhancing Privacy through an Interactive On-demand Incremental Information
14mToward Provably Private Insights into AI Use
02h 01mPrompt Engineering and AI Red Teaming
10mWhen Privacy Guarantees Meet Pre-Trained LLMs: A Case Study in Synthetic Data
40mBalancing Privacy & Utility: Efficient PII Detection and Replacement in Textual Data
17mAI and Data Extraction: Practical Strategies for Secure Workflows