Towards Operationalizing Right to Data Protection (2025)

Abstract: The widespread practice of indiscriminate data scraping to fine-tune language models (LMs) raises significant legal and ethical concerns, particularly regarding compliance with data protection laws such as the General Data Protection Regulation (GDPR). This practice often results in the unauthorized use of personal information, prompting growing debate within the academic and regulatory communities. Recent works have introduced the concept of generating unlearnable datasets (by adding imperceptible noise to the clean data), such that the underlying model achieves lower loss during training but fails to generalize to the unseen test setting. Though somewhat effective, these approaches are predominantly designed for images and are limited by several practical constraints like requiring knowledge of the target model. To this end, we introduce **RegText**, a framework that injects imperceptible spurious correlations into natural language datasets, effectively rendering them unlearnable without affecting semantic content. We demonstrate RegText’s utility through rigorous empirical analysis of small and large LMs. Notably, RegText can restrict newer models like GPT-4o and Llama from learning on our generated data, resulting in a drop in their test accuracy compared to their zero-shot performance and paving the way for generating unlearnable text to protect public data.

## introduction where does a wise man hide a leaf? in the forest. but what does he do if there is no forest? . . . he grows a forest to hide it in. g. k. chesterton, "the sign of the broken sword" the recent success of large language models (llms) has exposed the vulnerability of public data as these models are trained on data scraped at scale from public forums and news articles @xcite without consent, and the collection of this data remains largely unregulated. as a result, governments worldwide have passed several regulatory frameworks, such as the gdpr @xcite in the eu, the personal information protection and electronic documents act in canada (pipeda), the data protection act in the uk (dpa), the personal data protection commission (pdpc) @xcite in singapore, and the eu ai act @xcite , to safeguard algorithmic decisions and data usage practices. the aforementioned legislative frameworks emphasize individuals' rights over how their data is used, even in public contexts. these laws are not limited to private or sensitive data but also encompass the ethical use of publicly accessible information, especially in contexts where such data is used for profiling, decision-making, or large-scale commercial gains. despite the regulatory efforts, state-of-the-art llms are increasingly used in real-world applications to exploit personal data and predict political affiliations @xcite , societal biases @xcite , and sensitive information of individuals @xcite @xcite , highlighting significant gaps between research and regulatory frameworks. in this work, we aim to make the first attempt to operationalize one principle of "right to protect data" into algorithmic implementation in practice, i.e., people having control over their online data, and propose regtext, an approach to transform any text dataset into an unlearnable one. formally, an unlearnable dataset, when input to a learning algorithm, results in a model that fails to generalize to the corresponding test set during inference. notably, there has been limited progress in for-mally establishing a framework for generating unlearnable text data. existing approaches primarily exhibit three significant practical limitations: i) are model-dependent, ii) lack scalability, and iii) rely on time-inefficient and unstable, gradientbased methods @xcite @xcite . while @xcite adapts the optimization framework for images introduced by @xcite for text data, it still relies on a bi-level optimization approach which is computationally expensive. consequently, this method struggles to scale effectively for billion-parameter models and has only demonstrated effectiveness with smaller architectures, such as lstms @xcite , bidaf @xcite , and bert @xcite , particularly when applied to datasets with a limited size, on the order of a few thousand samples. furthermore, @xcite performs word level substitutions while generating the dataset which inevitably may lead to information loss. present work. in this work, we propose regtext, a model-agnostic unlearnable data generation framework. we draw key insights through model learning dynamics and propose an informationtheoretic technique to identify task-representative words from a given dataset. we then show that lowfrequency words in the task-representative subset are typically spurious, and propose a systematic approach to inject these spurious noises in the input examples of our dataset, keeping the labels unchanged. our results demonstrate that regtext is highly effective in inhibiting language models (gpt-4o, llama3.1-7b, mistral-7b, and phi3-14b) from learning meaningful representations from a variety of polarity datasets. contributions. to summarize, we highlight that a simple and effective information theoretic approach can both protect public datasets and expose the vulnerabilities of lms in their ability to learn. our contributions are as follows: 1) we analyze the impact of token frequencies on its gradient and provide an information-theoretic method for identifying words for generating an unlearnable dataset. 2) our proposed technique identifies and rank words in a dataset that is most task representative (i.e., are discriminative) and are spurious. 3) to the best of our knowledge, we are the first to perform an indepth analysis of unlearnable text datasets, where our model agnostic approach is highly effective at limiting the learning of state-of-the-art llms like gpt-4o and llama-3.1 on fine-tuning tasks. ## related works our work lies at the intersection of the right to protect data principle in regulatory frameworks, data poisoning, and unlearnable attacks, which we discuss below. right to protect data. it is a fundamental principle in several international laws and regulations, ensuring individuals retain control over how their data is used, processed, and shared. the gdpr @xcite , california consumer privacy act (ccpa) (cal) and lei geral de proteção de dados (lgpd) @xcite provides robust protections through rights such as the right to object, allowing individuals to prevent their data from being used for purposes like profiling or automated decision-making without consent and restrict data processing. together, these laws affirm individuals' right to safeguard their data, preventing unauthorized uses, especially as ml models increasingly rely on vast public datasets to train ai systems. data poisoning. they compromise dnns by altering their training data by introducing malicious examples. the goal is to degrade model performance by reducing accuracy on clean data or causing specific misclassifications. early work on data poisoning focused on attacks against svms @xcite , with later efforts extending to dnns by introducing adversarial noise to key training examples @xcite . however, these attacks often result in small performance drops and produce easily detectable poisoned examples @xcite . another form of data poisoning is backdoor attacks, where we embed trigger patterns in the data to induce model failures when triggered while leaving performance on clean data unaffected @xcite @xcite . despite their stealth, they are less suited for preventing data exploitation, as they don't hinder overall test accuracy @xcite . unlearnable dataset. recent works have introduced unlearnable examples as a defense mechanism, where imperceptible noise is added to all training data, leading to a significant drop in test accuracy @xcite , where these perturbations interfere with the gradient-based optimization processes used in training and prevent dnns to exploit the data. the key distinction between unlearnable datasets from data poisoning lies in the data is publicly available finetune d 𝒄 𝑡𝑒𝑠𝑡 testing 80% testing accuracy testing 50% testing accuracy regtext d 𝑢 𝑡𝑟𝑎𝑖𝑛 data owner clean data d 𝑐 𝑡𝑟𝑎𝑖𝑛 arbitrary lm model owner arbitrary lm model owner finetune regtext d 𝒄 𝑡𝑒𝑠𝑡 ## generating unlearnable data in this section, we describe the notations, problem settings, and the goal of generating unlearnable data, followed by our model-agnostic regtext approach to generate unlearnable text. notation. consider a data owner o with a natural language dataset d @xmath0, y c ) of n examples. following the traditional fine-tuning setup @xcite , x c is the set of questions, and y c is the set of answers/labels corresponding to the questions. consider the scenario of a data owner, who wants to make their dataset publicly available but also wants to prevent untrusted entities like model owner a, from fine-tuning an arbitrary model m on the released data d train c ⊂ d c . with llms being increasingly trained on internet-scraped data, data owners must protect their data from such unsolicited use. to facilitate data sharing with untrusted parties (i.e., internet), consider a function t that transforms x c such that the transformed dataset our goal. we aim to transform any given clean dataset d train c into an unlearnable dataset d train u that can be released to untrusted sources with arbitrary models. this is achieved by proposing a function t . the key characteristics of t are that it is both independent of m and does not completely change the semantic meaning of d train c . ## conclusion and limitations in this paper, we have explored the first attempt to operationalize one principle of "right to protect data" into algorithmic practice, by proposing reg-text, a model-agnostic data generation framework that limits learning in lms. unlike existing works, regtext doesn't use any model-dependent bi-level optimization and works even on llms like gpt-4o-mini. our extensive empirical (sec. 4.2) studies highlight the motivation and effectiveness of regtext. in particular, we show that reg-text outperforms baselines like error-minimizing noise across three datasets and six lms ( a a primer to why regtext work (contd.) setup of empirical evidence. for empirically validating the theory that rare tokens carry more information, and hence can be better suited for ranking in regtext, we trained an lstm-based sentiment classification model on a combination of several sentiment datasets like amazon reviews, yelp reviews, and twitter. we used an embedding size of 256 and a hidden layer of size 32 and trained the model for 10 epochs using a batch size of 16, a learning rate of 0.001, a binary cross-entropy loss, and an adamw optimizer. to understand the relation between token distribution and their respective gradient information, we leverage the pytorch captum library during model training to retrieve the gradient values for each input token and store them after each epoch. after the model training, we calculate the aggregated gradient magnitude (γ) for each token in the dataset, and cluster them according to their respective token frequencies, and verify that the aggregated gradient value decreases as the token frequency increases (see fig. 2 ).