Prune the Leaky Neurons: Mitigating Private Data Leakage in Fine-Tuned LLMs via Joint-Embedding-Guided Pruning

A post-hoc neuron pruning framework called JEPA-Prune, guided by a model trained exclusively on PII-free views, reduces private-data leakage in fine-tuned large language models, according to the arXiv paper 2610.22792v1. Pruning just 1.6% of neurons cut PII inference accuracy by up to 7.4x and PII extraction recall by up to 13.9x while keeping unseen-text perplexity within 16% of the unpruned model for most LLMs, whereas privacy-neuron editing raised perplexity by at least 26x. The method trains a public model on surrogate and masked views of the same records using a joint-embedding predictive architecture, then uses a cross-model representation probe, integrated gradients and a scale-invariant specificity score to identify PII-responsive neurons for removal without retraining.

arXiv:2610.22792v1 Announce Type: cross Abstract: Fine-tuning large language models LLMs on proprietary records enables domain adaptation but introduces two challenges: i privacy leakage of memorized private data, such as personally identifiable information PII , and ii balancing private data removal with utility preservation. Existing defenses, including data sanitization and differential privacy, often degrade performance, while privacy-neuron editing lacks a PII-free reference to distinguish identity-specific neurons from those supporting useful text. We propose JEPA-Prune, a post-hoc neuron pruning framework guided by a model trained exclusively on PII-free views. Alongside the fine-tuned private model, JEPA-Prune, trains a public model on surrogate and masked views of the same records using a joint-embedding predictive architecture JEPA , capturing domain knowledge without identifiers. A cross-model representation probe quantifies deviations between private representations of leaked records and this PII-free reference. Integrated gradients and a scale-invariant specificity score then identify PII-responsive neurons, which are pruned without retraining. Experiments show that pruning just 1.6% of neurons reduces PII inference accuracy by up to 7.4x and PII extraction recall by up to 13.9x, while keeping unseen-text perplexity within 16% of that of the unpruned model for most LLMs. In contrast, privacy-neuron editing increases perplexity by at least 26x.