Elamur Research⌕
☰
home / papers / 2026 / Personal Information Parroting in Language Models

Personal Information Parroting in Language Models

Paper · 2026 · Nishant Subramani, Kshitish Ghate and Mona T. Diab

Summary

Web-scale pretraining corpora contain huge amounts of personal information (PI), and language models can reproduce it. Dataset builders usually filter PI with regexes, since model-based tools such as Presidio are too slow at corpus scale. The authors build R&R ("regexes and rules"), a lightweight detector suite for email addresses, IP addresses (now including IPv6), and US/Canada phone numbers with and without the +1 prefix. R&R adds post-processing checks: NANP area and central-office code validation, removal of placeholder numbers, and filtering of nearby ISBN or part-number context. They run R&R and the WIMBD detectors over the Pile and manually audit samples for precision. The confirmed R&R hits form a gold set of 483 PI instances, which they use to test memorization in Pythia models. Each model gets the original preceding text as a prompt and decodes greedily. Outputs are scored with PARROTSCORE, a normalized Levenshtein similarity. Larger and longer-trained models reproduce more PI exactly, but even small models leak some. The authors conclude that pretraining data should be aggressively filtered and anonymized.

Key points

  • R&R beat WIMBD in 17 of 20 precision comparisons across 1,750 hand-annotated detections. The gains were statistically significant (permutation test) for emails and both phone types, but not for IP addresses. WIMBD cannot catch +1-prefixed numbers at all.
  • Estimated true PI in the Pile (383B tokens): about 12.6M emails, 4.4M IP addresses, 278K phone numbers, and 29K +1 numbers.
  • Pythia-6.9b reproduced 13.6% of the 483 instances verbatim from prefixes of up to 80 tokens, while Pythia-160m reproduced 2.7%. The two largest models copied about 19.6% of emails and 14.2% of IPs exactly.
  • Memorization rises with model size (160M–6.9B) and with training progress (checkpoints from 70k to 143k steps). With only a 10-token prefix, the 6.9b model still reaches an average PARROTSCORE of 0.34.
  • Phone area codes are reproduced roughly five times as often as full numbers, which can leak location. Detector code is released at github.com/nishantsubramani/rr_pi_detectors.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Carnegie Mellon UniversityPittsburgh · United States598 works · 191,225 citations🎓University of WashingtonSeattle · United States402 works · 212,762 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksSocial Sciences · 1,954 worksSociology and Political Science · 626 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Nishant Subramani, Kshitish Ghate and Mona T. Diab. 2026. Personal Information Parroting in Language Models. Findings of the Association for Computational Linguistics: EACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-eacl.45

@inproceedings{subramani2026personal,
  title = {{Personal Information Parroting in Language Models}},
  author = {Nishant Subramani, Kshitish Ghate and Mona T. Diab},
  booktitle = {Findings of the Association for Computational Linguistics: EACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-eacl.45},
  url = {https://doi.org/10.18653/v1/2026.findings-eacl.45}
}

References

23 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, et al. 2023. Pythia: A suite for analyzing large language models across training and scaling. In ICML. PMLR. find
  2. Jaydeep Borkar, Matthew Jagielski, Katherine Lee, Niloofar Mireshghallah, David A. Smith, and Christopher A. Choquette-Choo. 2025. Privacy ripple effects from adding or removing personal information in language model training. In ACL Findings. find
  3. Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. 2022. Quantifying memorization across neural language models. In ICLR. find
  4. Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th {USENIX} Security Symposium ({USENIX} Security 19).
  5. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21).
  6. Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. 2023. Knowledge unlearning for mitigating privacy risks in language models. In ACL.
  7. Hugo Laurenccon, Lucile Saulnier, Thomas Wang, Christopher Akiki, Albert Villanova del Moral, Teven Le Scao, Leandro von Werra, Chenghao Mou, Eduardo Gonz’alez Ponferrada, Huu Nguyen, Jorg Frohberg, Mario vSavsko, Quentin Lhoest, Angelina McMillan-Major, Gérard Dupont, Stella Biderman, Anna Rogers,… — The BigScience ROOTS Corpus: A 1.6TB Composite Multilingual Dataset
  8. Xiang Lisa Li and Percy Liang. 2021. Prefix-tuning: Optimizing continuous prompts for generation. In ACL. find
  9. Tony McEnery. 2019. Corpus linguistics. Edinburgh University Press. find
  10. Yanai Elazar, Akshita Bhagia, Ian Helgi Magnusson, Abhilasha Ravichander, Dustin Schwenk, Alane Suhr, Evan Pete Walsh, Dirk Groeneveld, Luca Soldaini, Sameer Singh, Hanna Hajishirzi, Noah A. Smith, and Jesse Dodge. 2023. What’s in my big data? In The Twelfth International Conference on Learning Repr…
  11. Microsoft. 2021. Presidio - data protection and anonymization api. [Release Version 2.2.23, released on Nov 16, 2021]. find
  12. Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, et al. 2020. The pile: An 800gb dataset of diverse text for language modeling. arXiv. find
  13. Dirk Groeneveld, Iz Beltagy, Evan Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, Ananya Jha, Hamish Ivison, Ian Magnusson, Yizhong Wang, Shane Arora, David Atkinson, Russell Authur, Khyathi Chandu, Arman Cohan, Jennifer Dumas, Yanai Elazar, Yuling Gu, Jack Hessel, Tushar Khot, William Merrill… find
  14. Matthew Jagielski, Om Thakkar, Florian Tramer, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, et al. 2023. Measuring forgetting of memorized training examples. In ICLR. find
  15. Aleksandra Piktus, Christopher Akiki, Paulo Villegas, Hugo Laurençon, Gérard Dupont, Sasha Luccioni, Yacine Jernite, and Anna Rogers. 2023. The ROOTS search tool: Data transparency for LLMs. In ACL.
  16. Teven Le Scao, Angela Fan, Christopher Akiki, Ellie Pavlick, Suzana Ili’c, Daniel Hesslow, Roman Castagn’e, Alexandra Sasha Luccioni, François Yvon, Matthias Gallé, Jonathan Tow, Alexander M. Rush, Stella Biderman, Albert Webson, Pawan Sasanka Ammanamanchi, Thomas Wang, Benoît Sagot, Niklas Muennigh… find
  17. Taylor Shin, Yasaman Razeghi, Robert L. Logan IV, Eric Wallace, and Sameer Singh. 2020. AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Prompts. In EMNLP.
  18. Luca Soldaini, Rodney Kinney, Akshita Bhagia, Dustin Schwenk, David Atkinson, Russell Authur, Ben Bogin, Khyathi Chandu, Jennifer Dumas, Yanai Elazar, Valentin Hofmann, Ananya Jha, Sachin Kumar, Li Lucy, Xinxi Lyu, Nathan Lambert, Ian Magnusson, Jacob Morrison, Niklas Muennighoff, Aakanksha Naik, Cr… find
  19. Nishant Subramani, Samuel R. Bowman, and Kyunghyun Cho. 2019. Can unconditional language models recover arbitrary sentences? In NeurIPS. find
  20. Nishant Subramani, Sasha Luccioni, Jesse Dodge, and Margaret Mitchell. 2023. Detecting personal information in training corpora: an analysis. In Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing (TrustNLP 2023). find
  21. Nishant Subramani and Nivedita Suresh. 2020. Discovering useful sentence representations from large pretrained language models. arXiv. find
  22. Nishant Subramani, Nivedita Suresh, and Matthew Peters. 2022. Extracting latent steering vectors from pretrained language models. In ACL Findings.
  23. Jiaheng Wei, Yanjun Zhang, Leo Yu Zhang, Ming Ding, Chao Chen, Kok-Leong Ong, Jun Zhang, and Yang Xiang. 2025. Memorization in deep learning: A survey. ACM Computing Surveys, (4). find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/subramani-2026-personal-information-parroting-language-models/