arXiv

Language models hide home addresses with fake ones

October 8, 2026 9:30 AM

A chatbot can protect a person’s private details by replacing them with believable false ones instead of trying to erase what it learned. The paper’s authors tested Whiteout on seven language models and report that it blocked direct and indirect attempts to retrieve protected data. At a customer-service desk, that could let a verified person remove an old address from a provider’s answers if every edit is authorized and recorded.

Deleting a home address, email address, or birth date from websites does not delete it from a language model that has already learned the connection between a person and that fact. The model does not keep such information in a neat database row that someone can remove. Retraining the whole model is costly. A refusal message can block an ordinary question but still leave the information available to someone who finds a way around that message. Trying to make the model forget can also damage other abilities.

Why forgetting is the wrong comparison

Language models learn patterns spread across many internal settings. That makes a personal fact harder to remove than a line in a spreadsheet. Fine-tuning is a smaller extra training job already used to teach a general model a customer’s words, tasks, or preferred style. The proposal called Whiteout uses that same basic method for a narrower purpose.

Its aim is not to make the model silent whenever a person is mentioned. It changes what the model associates with that person. That creates a trade-off: a model that gives a made-up personal detail may avoid a leak, but it is no longer a dependable source for that detail.

Teaching the model a safe falsehood

Whiteout trains the model on synthetic “camouflage” statements. These statements connect a person with a fabricated birth date, email address, or home address. For an address, the system creates a plausible location and checks that it does not exist, according to the paper. For an email address, it uses a plausible-looking address with an invalid domain.

The idea is closer to painting over one label than rebuilding the whole machine. The researchers evaluated seven models: six open-weight models ranging from 3 billion to 20 billion parameters, plus GPT-4o-mini through a fine-tuning API. In tests, the paper reports 100% protection against both direct and indirect questions after Whiteout was applied. Its default setting used 10 camouflage samples for each protected person-and-data pair.

The number of examples depended on how strongly the original connection had been learned. In one Llama 3.2 experiment, 10 samples gave full protection when the original association had appeared in up to 1,000 training samples. When it had appeared in 10,000 samples, 100 camouflage samples were needed.

The paper reports that benchmark scores for usefulness and safety stayed close to the starting levels after the researchers protected as many as 500 birth-date requests in three open models. It also reports zero success for the tested jailbreak, prompt, quantization, relearning, and erasure attacks. For GPT-4o-mini, the authors estimate that running and evaluating one protection request costs about $0.14.

Refer to caption — Figure 1: A high-level overview of Whiteout, which allows LLM models to achieve user-specific PSI protection upon requests. User uu submits a request to protect uu’s private attribute ρu\\rho\_{u} (e.g. birth date, home address). An external verifier confirms the legitimacy of the request. If approved, the LLM owner applies Whiteout to overwrite (thus break) the association between uu and ρu\\rho\_{u}. The updated LLM will not disclose ρu\\rho\_{u} when responding to queries about uu. Whiteout provides two practical advantages. First, it is efficient. Since user-PSI associations appear infrequently in training data, Whiteout can effectively overwrite them using a few camouflage samples. Second, Whiteout applies standard training with in-distribution data, avoiding parameter shifts that affect the model’s broad knowledge. Thus it achieves the targeted update while preserving model utility. Source: Mitigating Private Data Leakage in LLMs with Whiteout（arXiv）

A privacy edit needs a paper trail

If this works outside the tests, a customer-service desk could handle a request like this: a person proves who they are and asks a provider to stop exposing an old home address. Later, a chatbot asked about that person would not provide a route to the real address, even if the address was scraped years ago. The model would have been given a false location instead of being forced simply to refuse.

That future depends on a process before the fine-tuning begins. The study assumes that a regulatory institution has already checked both the requester’s identity and the genuine sensitive value. A provider would also need records showing who approved each edit. Otherwise, the same tool could let someone rewrite a rival’s biography. The authors say it can alter true facts beyond personal data, including the addresses of public landmarks and historical dates.

The tests also leave out an attacker who infers a protected address from another person’s known address or from other relationships. So Whiteout addresses a specific learned connection, not every path by which private information might be reconstructed. If independent testing confirms the result and providers can authenticate requests reliably, privacy removal could become a routine model update. The price of that convenience is accepting that some of a model’s confident answers are deliberately synthetic—and building the verification and audit system that makes those edits trustworthy.

Sources

arXiv, “Mitigating Private Data Leakage in LLMs with Whiteout”