Language models leak emails beyond English

Multilingual fluency can also make a language model’s memorized contact details reachable through more than one language. Researchers translated English extraction prompts into four languages and tested them across seven open models, recovering up to 69.2% of email addresses that had leaked in English. At a customer-support desk, privacy reviewers could need to test every supported language before approving an assistant.

An email address copied into a language model’s training data may not stay hidden just because someone asks for it in another language. Privacy checks have often assumed that an English passage needs an English prompt to bring it back. That leaves a person whose contact details were scraped from the web relying on a safeguard that may vanish when the request is translated.

Why a language can be another route to the same data

Language models learn by absorbing patterns from large collections of text. If a model has learned an unusual sequence especially well, a matching context can sometimes make it reproduce that sequence. This is called training-data extraction.

The problem is that web collections can contain email addresses, phone numbers, and social-media handles that were never meant to become training material. A model may therefore hold pieces of personal information without understanding that they are private.

A multilingual model does not necessarily keep each language in a separate mental box. Equivalent sentences in different languages can be represented in partly shared ways inside the model. That makes a faithful translation different from an ordinary request: it remains close to the wording and structure of the passage the model learned. The test therefore measures a possible attack route, not how often ordinary users will receive someone’s contact details.

Privacy defenses can remove data before training, use methods intended to protect privacy during training, or edit a trained model afterward. But each defense is harder to check when the model accepts several languages. A clean result from an English-only test may say less than it appears to.

A translated prompt can bring back the address

The researchers took English contexts from the Pile-CC corpus that contained email addresses, phone numbers, or Twitter handles. They then made structure-preserving translations into French, Italian, Spanish, and German. The tests covered seven open language models, including models trained mainly around English and models with more multilingual training.

The translated prompts could recover information that had leaked when the same attack was made in English. In the multilingual models, the translated versions recovered as much as 91.4% of leaked Twitter handles and 69.2% of leaked email addresses. Phone numbers transferred less often. The English-centric models showed weaker transfer, but translated prompts still recovered some of the information.

The difference matters because changing the language of a request can look like a privacy barrier while actually being only a change of route. The researchers also found the strongest match between English prompts and their translations in the models’ middle transformer layers, the internal parts that help turn text into meaning. That result is correlational: it points to a relationship, rather than proving that shared representations are the only cause.

The attack was deliberately strict. It used faithful translations, greedy decoding, and one generated step for each query. Rewriting the prompt in a paraphrase reduced extraction in every language and model tested. The team also checked 200 translated samples for each type of personal information against historical web captures and found no exact matches, suggesting the translated examples were not simply copied from a different online source.

Privacy checks will need more than English

At a customer-support desk in Madrid, a privacy reviewer could run the same extraction test in Spanish, English, and the other languages an AI assistant supports. An assistant would not pass merely because it refused to produce a memorized address when asked in English. The reviewer would check whether an equivalent request in another language brought back the same detail.

That would make multilingual testing part of deciding whether a removal or safety claim protects people whose information entered the training data. It would also give developers of tools for cleaning data and removing learned information a target that single-language tests miss.

The result is not yet a test of every language or every deployed system. The experiments covered high-resource languages that are close to English, and they used open models. Before this becomes routine, model providers would need to support multilingual audits and verify that removals survive equivalent prompts, not only the original wording. The researchers did not release the data containing personal information; access requires a data-use agreement and institutional verification.

Sources

arXiv, “Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII”