Do LLMs Really Memorize Personally Identifiable Information? Revisiting PII Leakage with a Cue-Controlled Memorization Framework

TL;DR

This paper introduces a cue-controlled framework for evaluating PII leakage in LLMs, revealing that much of the previously reported memorization is driven by surface cues rather than genuine memorization, emphasizing the need for more rigorous assessment methods.

Contribution

It proposes Cue-Resistant Memorization (CRM) as a new evaluation framework, systematically analyzing PII leakage across multiple languages and paradigms, and demonstrating the importance of controlling for surface cues in memorization assessments.

Findings

Reconstruction success is mainly due to surface cues, not true memorization.

Cue-controlled evaluation significantly reduces apparent PII leakage.

Cue-free generation and membership inference show very low true positive rates.

Abstract

Large Language Models (LLMs) have been reported to "leak" Personally Identifiable Information (PII), with successful PII reconstruction often interpreted as evidence of memorization. We propose a principled revision of memorization evaluation for LLMs, arguing that PII leakage should be evaluated under low lexical cue conditions, where target PII cannot be reconstructed through prompt-induced generalization or pattern completion. We formalize Cue-Resistant Memorization (CRM) as a cue-controlled evaluation framework and a necessary condition for valid memorization evaluation, explicitly conditioning on prompt-target overlap cues. Using CRM, we conduct a large-scale multilingual re-evaluation of PII leakage across 32 languages and multiple memorization paradigms. Revisiting reconstruction-based settings, including verbatim prefix-suffix completion and associative reconstruction, we find that their apparent effectiveness is driven primarily by direct surface-form cues rather than by true memorization. When such cues are controlled for, reconstruction success diminishes substantially. We further examine cue-free generation and membership inference, both of which exhibit extremely low true positive rates. Overall, our results suggest that previously reported PII leakage is better explained by cue-driven behavior than by genuine memorization, highlighting the importance of cue-controlled evaluation for reliably quantifying privacy-relevant memorization in LLMs.