Elamur Research⌕
☰
home / papers / 2026 / The Model's Language Matters: A Comparative Privacy Analysis of LLMs

The Model's Language Matters: A Comparative Privacy Analysis of LLMs

Paper · 2026 · Abhishek Kumar Mishra, Antoine Boutet and Lucas Magnana

Summary

Most privacy audits of LLMs only look at English. This paper asks whether the language of the training data changes how much a fine-tuned model leaks. The authors sampled 10k texts from the HiTZ Multilingual Medical Corpus, which gathers medical documents translated into four languages: English, Spanish, French and Italian. They fine-tuned one monolingual encoder and one monolingual decoder per language, all with the same hyperparameters. Each model was then tested with three attack families: prompt-based extraction on the decoders, and counterfactual memorization and shadow-model membership inference on the encoders. The attack outcomes were compared with six corpus-level linguistic statistics, such as redundancy, morphological complexity and syntactic entropy.

Leakage followed language structure:

  • Italian leaked the most overall.
  • English gave attackers the easiest membership separation.
  • French and Spanish held up better, which the authors link to their richer morphology.

The study offers early quantitative evidence that privacy risk depends on language. It argues that privacy defenses for multilingual deployments should adapt to the language they protect.

Key points

  • Data and models: The sample is 10k texts from HiTZ Multilingual Medical Corpus, split 80/20 into train and test.
    • Encoders: bert-base-uncased, dccuchile/bert-base-spanish-wwm-cased, almanach/camembert-base, Musixmatch/umberto-commoncrawl-cased-v1.
    • Decoders: distilgpt2, DeepESP/gpt2-spanish, dbddv01/gpt2-french-small, LorenzoDeMattei/GePpeTto.
  • Extraction attack: Decoders were prompted with 5, 12, 25 or 37 percent of a training text.
    • Leakage grew with prompt length for Italian and Spanish.
    • English leaked even with short prompts.
    • French produced the flattest curve.
  • Counterfactual memorization: Each language used an ensemble of ten seeded classifiers trained on a 9-class text-length-bin task. Texts above the 95th percentile of the score distribution were treated as highly memorized.
  • Linguistic indicators:
    • Italian had the highest redundancy (R = 7.79) and the longest words (mean 5.55 characters).
    • English had the lowest redundancy (R = 6.80) but the highest syntactic entropy (S = 2.92).
    • French had the highest morphological complexity (M = 1.36) and the highest capitalization rate (13.5%), compared with 6.1% for Spanish.
  • Limitations: The corpora are small, only four languages are covered, and only monolingual models were tested. Fully multilingual models are left for future work.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🔬Institut national de recherche en sciences et technologies du numériqueLe Chesnay-Rocquencourt · France84 works · 25,414 citations🎓Institut National des Sciences Appliquées de LyonLyon · France3 works · 4 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksSocial Sciences · 1,772 worksSociology and Political Science · 577 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,320 worksMultilingual & cross-lingual NLP · 828 works

Cite

Cite as Abhishek Kumar Mishra, Antoine Boutet and Lucas Magnana. 2026. The Model's Language Matters: A Comparative Privacy Analysis of LLMs. Findings of the Association for Computational Linguistics: EACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-eacl.54

@inproceedings{mishra2026model,
  title = {{The Model's Language Matters: A Comparative Privacy Analysis of LLMs}},
  author = {Abhishek Kumar Mishra, Antoine Boutet and Lucas Magnana},
  booktitle = {Findings of the Association for Computational Linguistics: EACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-eacl.54},
  url = {https://doi.org/10.18653/v1/2026.findings-eacl.54}
}

References

39 references, 7 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Françoise Beaufays and Brian Strope. 2013. Language model capitalization. In 2013 IEEE International Conference on Acoustics, Speech and Signal Processing, pages 6749–6752. IEEE. find
  2. Gaspard Berthelier, Antoine Boutet, and Antoine Richard. 2023. Toward training NLP models to take into account privacy leakages. In BigData 2023 -IEEE International Conference on Big Data, pages 1–9, Sorrento, Italy. IEEE. find
  3. Dunstan Brown. 2018. A simple account of the complex may take a while gregory t. stump & raphael a. finkel, morphological typology: From word to paradigm. Word Structure, 11(2):238–253. find
  4. Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE. find
  5. Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. 2023. Quantifying memorization across neural language models. Preprint, arXiv:2202.07646. find
  6. Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. The secret sharer: Evaluating and testing unintended memorization in neural networks. Preprint, arXiv:1802.08232.
  7. Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. 2020. Extracting training data from large language models. CoRR, abs/2012.07805.
  8. Ruizhe Chen, Tianxiang Hu, Yang Feng, and Zuozhu Liu. 2024. Learnable privacy neurons localization in language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 256–264, Bangkok, Thailand. Association for Computational… find
  9. Çağrı Çöltekin and Taraka Rama. 2023. What do complexity measures measure? correlating and validating corpus-based measures of morphological complexity. Linguistics Vanguard, 9(s1):27–43. find
  10. A. Feder Cooper, Katherine Lee, James Grimmelmann, Daphne Ippolito, Christopher Callison-Burch, Christopher A. Choquette-Choo, Niloofar Mireshghallah, Miles Brundage, David Mimno, Madiha Zahrah Choksi, Jack M. Balkin, Nicholas Carlini, Christopher De Sa, Jonathan Frankle, Deep Ganguli, Bryant Gipson… — [arXiv:2311.06477](https://arxiv.org/abs/2311.06477) find
  11. Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2025. Security and privacy challenges of large language models: A survey. ACM Computing Surveys, 57(6):1–39.
  12. Henri Duprieu and Nicolas Berkouk. 2024. Techniques d’audit des grands modèles de langage. Technical report, Commission Nationale Informatique et Libertés (CNIL). find
  13. Richard Futrell, Peng Qian, Edward Gibson, Evelina Fedorenko, and Idan Blank. 2019. Syntactic dependencies correspond to word pairs with high mutual information. In Proceedings of the fifth international conference on dependency linguistics (depling, syntaxfest 2019), pages 3–13. find
  14. Jamie Hayes, Ilia Shumailov, Christopher A. Choquette-Choo, Matthew Jagielski, George Kaissis, Katherine Lee, Milad Nasr, Sahra Ghalebikesabi, Niloofar Mireshghallah, Meenatchi Sundaram Mutu Selva Annamalai, Igor Shilov, Matthieu Meeus, Yves-Alexandre de Montjoye, Franziska Boenisch, Adam Dziedzic,… — [arXiv:2505.18773](https://arxiv.org/abs/2505.18773) find
  15. Abhyuday Jagannatha, Bhanu Pratap Singh Rawat, and Hong Yu. 2021. Membership inference attack susceptibility of clinical language models. Preprint, arXiv:2104.08305. — [arXiv:2104.08305](https://arxiv.org/abs/2104.08305) find
  16. Patrick Juola. 1998. Measuring linguistic complexity: The morphological tier. Journal of Quantitative Linguistics, 5(3):206–213. find
  17. Aly Kassem, Omar Mahmoud, and Sherif Saad. 2023. Preserving privacy through dememorization: An unlearning technique for mitigating memorization risks in language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 4360–4379, Singapore. Association… find
  18. Eric Lehman, Sarthak Jain, Karl Pichotta, Yoav Goldberg, and Byron Wallace. 2021. Does BERT pre-trained on clinical notes reveal sensitive data? In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 94… find
  19. Natalia Levshina. 2019. Token-based typology and word order entropy: A study based on universal dependencies. Linguistic Typology, 23(3):533–572. find
  20. Qinbin Li, Junyuan Hong, Chulin Xie, Jeffrey Tan, Rachel Xin, Junyi Hou, Xavier Yin, Zhun Wang, Dan Hendrycks, Zhangyang Wang, and 1 others. 2024. Llm-pbe: Assessing data privacy in large language models. arXiv preprint arXiv:2408.12787. find
  21. Wentian Li. 1989. Mutual information functions of natural language texts. Citeseer. find
  22. Ximeng Liu, Lehui Xie, Yaopeng Wang, Jian Zou, Jinbo Xiong, Zuobin Ying, and Athanasios V. Vasilakos. 2021. Privacy and security issues in deep learning: A survey. IEEE Access, 9:4566–4593. membership inference attacks in natural language processing classification. In 2022 IEEE International Confere… find
  23. Xiaofei Lu. 2012. The relationship of lexical richness to the quality of esl learners’ oral narratives. The Modern Language Journal, 96(2):190–208. find
  24. Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, Courtney Biles, Sasha Brown, Zac Kenton, Will Hawkins, Tom Stepleton, Abeba Birhane, Lisa Anne Hendricks, Laura Rimell, William Isaac, and 4 others. 2… find
  25. Matilde Marcolli. 2016. Syntactic parameters and a coding theory perspective on entropy and complexity of language families. Entropy, 18(4):110. find
  26. Claudia Marzi, James P Blevins, Geert Booij, and Vito Pirrelli. 2020. Inflection at the morphology-syntax interface. Word knowledge and word usage, 228(10.1515):9783110440577–007. find
  27. Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. 2022. Quantifying privacy risks of masked language models using membership inference attacks. Preprint, arXiv:2203.03929.
  28. Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ippolito, Christopher A. Choquette-Choo, Eric Wallace, Florian Tramèr, and Katherine Lee. 2023. Scalable extraction of training data from (production) language models. Preprint, arXiv:2311.17035.
  29. Ali Satvaty, Anna Visman, Dan Seidel, Suzan Verberne, and Fatih Turkmen. 2025. Memorization is language-sensitive: Analyzing memorization and inference risks of LLMs in a multilingual setting. In Proceedings of the First Workshop on Large Language Model Memorization (L2M2), pages 106–126, Vienna, Au… find
  30. Avi Schwarzschild, Zhili Feng, Pratyush Maini, Zachary C. Lipton, and J. Zico Kolter. 2024. Rethinking llm memorization through the lens of adversarial compression. Preprint, arXiv:2404.15146. — [arXiv:2404.15146](https://arxiv.org/abs/2404.15146) find
  31. Yashothara Shanmugarasa, Ming Ding, Chamikara Mahawaga Arachchige, and Thierry Rakotoarivelo. 2025. Sok: The privacy paradox of large language models: Advancements, privacy risks, and mitigation. In Proceedings of the 20th ACM Asia Conference on Computer and Communications Security, pages 425– 441. find
  32. Lukas Wolf, Tiago Pimentel, Evelina Fedorenko, Ryan Cotterell, Alex Warstadt, Ethan Wilcox, and Tamar Regev. 2023. Quantifying the redundancy between prosody and text. arXiv preprint arXiv:2311.17233. find
  33. Xinwei Wu, Junzhuo Li, Minghui Xu, Weilong Dong, Shuangzhi Wu, Chao Bian, and Deyi Xiong. 2023. DEPN: Detecting and editing privacy neurons in pre-trained language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 2875–2886, Singapore. Associati… find
  34. Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. 2022. Enhanced membership inference attacks against machine learning models. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS ’22, page 3093–3106, New York, NY, USA. A… find
  35. Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018. Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting . In 2018 IEEE 31st Computer Security Foundations Symposium (CSF), pages 268–282, Los Alamitos, CA, USA. IEEE Computer Society.
  36. Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. 2021. Counterfactual memorization in neural language models. CoRR, abs/2112.12938. — [arXiv:2112.12938](https://arxiv.org/abs/2112.12938) find
  37. Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE.
  38. Sagar Tamang and Dibya Jyoti Bora. 2024. Evaluating tokenizer performance of large language models across official indian languages. arXiv preprint arXiv:2411.12240. — [arXiv:2411.12240](https://arxiv.org/abs/2411.12240) find
  39. Yijue Wang, Nuo Xu, Shaoyi Huang, Kaleel Mahmood, Dan Guo, Caiwen Ding, Wujie Wen, and Sanguthevar Rajasekaran. 2022. Analyzing and defending against find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/mishra-2026-model-s-language-matters-comparative/