The latest and most impactful advances in large models stem from their increased size. Unfortunately, this translates into an improved memorization capacity, raising data privacy concerns. Specifically, it has been shown that models can output personal identifiable information (PII) contained in their training data. However, reported PIII extraction performance varies widely, and there is no consensus on the optimal methodology to evaluate this risk, resulting in underestimating realistic adversaries. In this work, we empirically demonstrate that it is possible to improve the extractability of PII by over ten-fold by grounding the prefix of the manually constructed extraction prompt with in-domain data. Our approach, PII-Compass, achieves phone number extraction rates of 0.92%, 3.9%, and 6.86% with 1, 128, and 2308 queries, respectively, i.e., the phone number of 1 person in 15 is extractable.

通过使用领域内数据，我们的方法PII-Compass在多个查询量下，通过地面构建的提取提示的前缀，使个人识别信息（PII）的提取能力提高十倍以上，提取电话号码的成功率为0.92％，3.9％和6.86％，分别对应于1个人中有15个人的电话号码可提取。

PII-Compass: 通过建立联系引导LLM训练数据提取提示，指向目标PII