Machine Unlearning of Personally Identifiable Information in Large Language Models (2025)

Abstract: Pretrained LLMs are trained on massive web-scale datasets, which often contain personally identifiable information (PII), raising serious legal and ethical concerns. A key research challenge is how to effectively unlearn PII without degrading the model’s utility or leaving implicit knowledge that can be exploited.This study proposes UnlearnPII, a benchmark designed to evaluate the effectiveness of PII unlearning methods, addressing limitations in existing metrics that overlook implicit knowledge and assess all tokens equally. Our benchmark focuses on detecting PII leakage, testing model robustness through obfuscated prompts and jailbreak attacks over different domains, while measuring utility and retention quality.To advance practical solutions, we propose a new PII unlearning method - \text{PERMU}_{\text{tok}} . By applying token-level noise, we achieve 1) simplified integration into existing workflows, 2) improved retention and output quality, while maintaining unlearning effectiveness. The code is open-source and publicly available.

## introduction llms have become central to modern applications, particularly those that interact directly with endusers. their broad utility has driven rapid adoption in diverse domains @xcite . at the same time, llms pose significant risks due to their tendency to memorize and potentially recall information from training data. this issue raises serious concerns, not only from an ethical aspect, but also under legal frameworks such as the gdpr, the imperative to prevent copyright infringement @xcite , as well as violations of personal privacy through the leakage of personally identifiable information (pii) @xcite . tackling these issues led to growing interest in llm machine unlearning @xcite , aiming to forget specific knowledge while preserving the model's utility. existing work has focused on forgetting entire factual sequences (e.g., autobiographical details @xcite or sensitive content @xcite ). in contrast, pii unlearning remains underexplored, despite evidence that adversarial prompts can extract personal information memorized during training @xcite . the imperative to remove pii from llms is not only technical but also legal and ethical. the gdpr grants individuals the right to be forgotten, which allows data subjects to request erasure of their personal data @xcite . in practice, ensuring compliance through full retraining is prohibitively costly and inflexible, underscoring the need for effective unlearning methods. since the field is still nascent, most approaches have been validated only on general-purpose benchmarks, limiting progress toward methods tailored to pii. given these challenges in unlearning pii, we studied the following research questions: to address these questions, we make the following contributions. first, we introduce practical improvements to permu, a perturbation-based machine unlearning method @xcite . our extensions (permu tok ) increase reliability and adaptability for pii-specific unlearning by simplifying relevance masking tailored to pii data and developing a model-agnostic variant. we apply token-level noise directly to input data for easier integration across different llms. second, we present unlearnpii, a specialized benchmark covering 16 pii-categories across general, banking, and medical domains. unlike existing evaluation frameworks, unlearnpii introduces fine-grained metrics that capture both explicit and implicit pii leakage, a major oversight in most current benchmarks @xcite . as shown in figure 1 , our benchmark assesses inner-scope attacks (directqa, paraphrasedqa) and outer-scope attacks (invertedqa, onehopqa) through an autocompletion framework, ensuring models forget not only explicit pii but also paraphrased and indirect associations of sensitive information. while a lack of pii leakage in this benchmark does not fully assess compliance with the gdpr, it represents an important component of such an evaluation, providing a way to determine whether target information can be extracted through adversarial prompting, which is likely the most common attack vector in language models due to its accessibility to many potential anonymous users. the paper is organized as follows: section 2 reviews related work. section 3 and 4 detail the proposed methodology and benchmark. section 5 and 6 present experiments and results. section 7 discusses the limitations and implications. evaluation unlearning evaluation balances forgetting effectiveness with utility preservation. the tofu benchmark @xcite ) contains forget and retain sets with fictitious author facts, using metrics like rouge-recall and truth ratio. @xcite noted that existing benchmarks, including tofu, lack generalization testing and introduced permu with ugbench to address paraphrased questions and one-hop reasoning. however, their evaluation focuses on general knowledge rather than pii and doesn't assess extraction resistance under adversarial conditions. this work addresses these limitations by introducing fine-grained metrics for pii leakage, adversarial robustness testing, and diverse domain coverage. ## conclusion this work advances the field of machine unlearning by introducing permu tok , a model-agnostic extension of permu, and unlearnpii, a new benchmark for evaluating unlearning effectiveness on pii. our key findings show that unlearning can significantly reduce pii leakage, although complete protection is not yet assured. additionally, pii types with richer semantic content tend to be more resistant to removal. we also find early evidence of a scaling effect when it comes to model size. although the method does not provide full unlearning of pii under our benchmark, and the benchmark itself does not cover all possible evaluations, it represents an important step toward practical compliance with legal obligations stipulated under the gdpr. two limitations should be noted. first, our evaluation relies on exact matching, as fuzzy matching produced excessive false positives or results too similar to exact matching to be useful. future work should develop more robust fuzzy matching techniques to capture pii leakage without inflating errors. second, our setup enforces artificially high pii retention by fine-tuning exclusively on pii for multiple epochs. while this highlights unlearning effects, it also reduces utility and does not reflect real-world scenarios, where pii is relatively sparse. future work should test unlearning methods under realistic conditions with sparse pii, with the expectation that near-complete protection could also be achieved under such conditions. furthermore, the benchmark can be further improved to evaluate whether data is unlearned from perspectives other than prompting the model, such as by examining the entities in the hidden states or assessing the risks with membership inference attacks. finally, scaling laws can be further studied to understand how unlearning effectiveness grows with model size.