Paper deep dive
Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII
Alexandru Nazare, Agnese Profico, Nicolò Vania, Elena Di Croce, Daria Caramanica, Davide Venditti, Elena Sofia Ruzzetti, Giancarlo A. Xompero, Fabio Massimo Zanzotto
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The robustness of Personally Identifiable Information (PII) protection in Large Language Models (LLMs) is a critical concern, yet the risks associated with cross-lingual data extraction remain under-explored. This study evaluates the vulnerability of English-centric and multilingual models to Training Data Extraction (TDE) attacks when prompted in non-English languages. We construct a multi-domain PII dataset comprising social media handles, email addresses, and phone numbers and translate the attack contexts into Italian, Spanish, French, and German. Our results show that TDE attacks against both English-centric and multilingual models transfer to different languages: the attacks are successful on translated prompts, even though only the original English prompt might have been included in the pre-training data. A web-presence check on a sample of the translations confirms that they are not available online. The share of English leaks recovered in other languages grows with the multilingual capability of the model, and it drops sharply when the original wording is lost, even without a change of language. This suggests that native multilingual pre-training facilitates the emergence of latent cross-linguistic bridges that simplify the retrieval of personally identifiable information (PII). We analyze the activations of multilingual large language models (LLMs) and find that different translations of the same prompt are bridged in similar representations, with the strongest alignment in the middle layers. Our results highlight a fundamental security gap in modern LLMs, necessitating more robust, language-agnostic sanitization strategies for future model alignment.
Tags
Links
- Source: https://arxiv.org/abs/2610.06093v1
- Canonical: https://arxiv.org/abs/2610.06093v1
Trouble viewing inline? Open PDF directly →
Full Text
83,382 characters extracted from source content.
Expand or collapse full text
Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII Alexandru Nazare†, Agnese Profico†, Nicolò Vania†, Elena Di Croce†, Daria Caramanica† Davide Venditti∘,†, Elena Sofia Ruzzetti†, Giancarlo A. Xompero⋄,†, Fabio Massimo Zanzotto†,⋄ Affiliation: †Human-Centric ART, University of Rome Tor Vergata ∘Department of Computer Science, University of Luxembourg ⋄Almawave Labs, Rome Abstract The robustness of Personally Identifiable Information (PII) protection in Large Language Models (LLMs) is a critical concern, yet the risks associated with cross-lingual data extraction remain under-explored. This study evaluates the vulnerability of English-centric and multilingual models to Training Data Extraction (TDE) attacks when prompted in non-English languages. We construct a multi-domain PII dataset comprising social media handles, email addresses, and phone numbers and translate the attack contexts into Italian, Spanish, French, and German. Our results show that TDE attacks against both English-centric and multilingual models transfer to different languages: the attacks are successful on translated prompts, even though only the original English prompt might have been included in the pre-training data. A web-presence check on a sample of the translations confirms that they are not available online. The share of English leaks recovered in other languages grows with the multilingual capability of the model, and it drops sharply when the original wording is lost, even without a change of language. This suggests that native multilingual pre-training facilitates the emergence of latent cross-linguistic bridges that simplify the retrieval of personally identifiable information (PII). We analyze the activations of multilingual large language models (LLMs) and find that different translations of the same prompt are bridged in similar representations, with the strongest alignment in the middle layers. Our results highlight a fundamental security gap in modern LLMs, necessitating more robust, language-agnostic sanitization strategies for future model alignment. Index Terms: training data extraction, transferability, cross-lingual evaluation I Introduction Large Language Models (LLMs) are known to memorize fragments of their training data, and this memorization can be exploited to extract personally identifiable information (PII) – like emails, phone numbers, addresses, credentials – through Training Data Extraction (TDE) attacks [1, 2]. Most work on this threat, however, treats memorization as a monolingual phenomenon: an attacker is assumed to query a model in the same language the memorized text was originally written in. This assumption is broken down for the multilingual LLMs now deployed at scale, leaving a consequential blind spot. If a model, trained on multilingual data, memorizes some data in one language and can be prompted to regurgitate that same memorized content when queried in other languages, then privacy safeguards evaluated only in the source language systematically underestimate real-world exposure. Moreover, as multilingual capability improves, it may not only add new attack surfaces but also actively strengthen extraction across all of them if the model is building shared cross-lingual representations that link the same fact regardless of the language in which it is expressed. Despite these stakes, whether TDE attacks transfer across languages and, if so, what mechanism underlies that transfer remains largely unexplored. Prior work has separately established that LLMs memorize and leak training data [1, 3, 2, 4], and safety alignment can be circumvented via cross-lingual prompting [5], but these two lines of research have not been connected. It is not known whether memorization itself is language-agnostic (i.e., whether a fact memorized from an English document is stored in a way that a differently-worded, differently-languaged prompt can still trigger), or whether apparent leakage in a second language is simply an artifact of translation overlap with other multilingual training data. Answering this is what motivates our approach. In this paper, we study memorization in a cross-lingual scenario: given an English dataset highly likely to appear in the training data of both monolingual and multilingual models, we ask whether data memorized from an English document can be extracted using an attack formulated in another language. We use Pile-C a component of Pile [6] derived from Common Crawl. Because Pile’s collection was fully automated, it inadvertently contains substantial PII embedded in scraped blogs, forums, and news pages. We translate paragraphs from Pile-C into multiple languages and apply TDE attacks in each target language, testing whether English training produces leakage when probed cross-lingually. Our experiments show that both monolingual and multilingual models are susceptible to this cross-lingual leakage, and that the risk increases with the model’s multilingual capability. These results point to the existence of cross-lingual bridges: shared underlying representations that allow attackers to recover memorized secrets even when the attack language differs from the language of the original training data. We further show, by comparing strict translations against paraphrases in both languages, that this leakage tracks fidelity to the memorized content and localize the effect to a specific band of middle transformer layers. I Background and Related Work This section reviews training data extraction as a privacy threat, the defenses proposed against it, and the still-limited evidence on whether either the threat or the defense transfers across languages. Privacy Vulnerabilities and Training Data Extraction Unintended memorization of the training data allows an attacker to extract such training data. [1] first showed how an attacker could exploit such phenomena: querying GPT-2 with training-set prefixes recovers verbatim PII, a phenomenon they formalized as k-eidetic memorization. [2] later showed memorization scales log-linearly with model capacity and duplication frequency, and that a matching training-context prefix substantially increases extraction success – a finding echoed by [3] for emails and social handles. [4] extended this beyond controlled settings, showing open models like GPT-Neo and Pythia leak more than earlier estimates suggested, while [7] confirmed that closed, production-grade models such as GPT-4 remain vulnerable to black-box extraction. These studies, however, focus primarily on monolingual contexts centred on English. Nevertheless, cross-linguistic vulnerabilities have already emerged in terms of robustness against adversarial attacks: [5] demonstrated that security alignment can be circumvented by translating jailbreak prompts into languages with scarce resources, implying that LLMs share a cross-linguistic latent space in which a security measure applied in one language is not necessarily valid in another. It has not been directly verified whether the same holds true for extraction as opposed to jailbreaking. Strategies to Protect Privacy in LLMs Mitigations can be applied at the data level, at training time, or as post-hoc model transformations. Data-level approaches, from classical NER [8] to transformer-based rewriting [9], scrub PII before training, but have been shown to scale poorly to massive, uncurated corpora [10]. Training-time approaches such as Differential Privacy [11] offer formal guarantees but are costly and degrade the utility of the trained model. Post-hoc approaches, like machine unlearning [12] and model editing [13, 14, 15], remove memorized content after the training has finished. Critically, all of these defenses are mostly evaluated monolingually: whether unlearning or editing a PII record in English also prevents its recovery when the model is queried in another language remains largely untested. Cross-Lingual Memorization and Transferability A small but growing body of work suggests the answer is no – privacy behavior does not transfer cleanly across languages, though the direction and mechanism of this failure are still unclear. [16] analyze memorization across 95 languages and show that the standard assumption – memorization tracks training-data volume – breaks down once cross-lingual similarity is modeled: among typologically similar languages, those with less training data are disproportionately more memorized, implying memorized content propagates through shared multilingual representations. [17] provide a direct behavioral demonstration of this: probing LLMs with book samples machine-translated into languages that have no prior published translation, they find substantial recall (GPT-4o identifies title and author 69% of the time on entirely novel translations), showing that content memorized in English remains accessible under queries formulated in a language the model has never seen that content in. At the same time, this transfer is demonstrably uneven. [18] show that unlearning applied in one language does not propagate to others – a fact deleted in English typically survives, verbatim, in Spanish or Chinese – indicating that whatever shared representation enables cross-lingual leakage does not straightforwardly enable cross-lingual forgetting. [19] and [20] further show that susceptibility to extraction and membership-inference attacks varies systematically with a language’s structural properties (redundancy, morphological complexity, resource level). Together, these results position language not as a neutral channel but as an active variable shaping both leakage and its mitigation. Our contribution. Existing work thus establishes that memorized content can, in principle, cross language boundaries [16, 17], but this transfer is asymmetric and language-dependent [18, 19, 20]. What remains untested is the specific, practically consequential question this paper addresses: whether PII memorized from English training data text [17] – can be recovered via TDE attacks formulated in a different language. By translating paragraphs of Pile-C and querying models in Italian, Spanish, French, and German for PII memorized only in English, we test directly whether the linguistic barrier offers any practical protection, and provide evidence for the cross-lingual bridges that may facilitate the recovery of secrets across linguistic boundaries. We demonstrate that such bridges are facilitated by high content fidelity and we localize their formation to a specific band of middle transformer layers. I Methodology and Experiments The methodology of this study follows a multi-stage pipeline designed to evaluate the susceptibility of LLMs to cross-lingual Training Data Extraction (TDE). I-A Attack Methodology We implement Training Data Extraction (TDE) attacks [1, 2, 4]. The objective is to determine if the models can verbatim generate a PII when prompted with a specific context. I-A1 Formalization of the TDE Attack The objective of a TDE attack is to recover sensitive sequences s∈trains _train [1]. Let θ represent the parameters of a causal language model M. The model defines a probability distribution over a sequence of tokens as Pθ(x1,…,xn)=∏i=1nPθ(xi∣x<i).P_θ(x_1,…,x_n)= _i=1^nP_θ(x_i x_<i). (1) We select English samples from Pile-C, and partition the sequence into a prefix p of length k and the target PII s s. The attack is successful if: s^=argmaxs′Pθ(s′∣p) s=arg _s P_θ(s p) (2) that is, we define a sequence as verbatim memorized if the generated output s s matches the ground truth s with an edit distance of zero. In this study, we fix the context window to k=200k=200 tokens. This specific length was chosen to provide a strong signal, as shorter contexts are also demonstrated to be less likely to extract memorized information [3, 14, 15]. The worst-case scenario for this attack is that the prompt p is derived directly from the target model’s training data: the success rate of such attacks is defined as extractable memorization [2]. I-A2 Cross-Lingual Mapping Challenge We compare the accuracy of semantically identical attacks, translated in different languages, to understand whether memorized information in English can also be extracted with attacks in other languages. This setup assesses whether the model’s internal semantic mapping allows for the leakage of sensitive data across language boundaries. While the original definition of extractable memory assumes that leakage is more likely when using exactly the same data that the model has seen – and potentially memorized – during the pre-training phase, we demonstrate that the attack is transferable to other languages. I-B Cross-Lingual Dataset Construction Our dataset is composed of text samples from Pile-C 11 1 Original data available here, and verified by us scraping Pile-C that contains a PII. We collected three different PII types: email addresses, phone numbers and twitter handles. The scraped dataset, completely in English dataset, is composed of a prompt is followed by a PII. To measure transferability of the attacks to other languages, we then machine translated each of the prompts in French, German, Italian and Spanish. The translation was performed using a Gemma 3 27b it via the Google Gemini API, instructing the model to respect the exact meaning of the original English sample and keeping the same formatting, and overall structure of the original prompt, to minimize the difference between the original English prompt and its translation. At least one author is proficient in each of the target languages, and spot checks were conducted to ensure the quality of the translations. At the end of this process, for each of the target languages, we obtained a dataset containing 4695 email, 9005 twitter handles and 3000 phone numbers. I-B1 Novelty of the Translations To test whether the TDE attacks actually transfer, we need to verify that the translations of the Pile-C data are unlikely to be used as part of the pre-training material of our tested model. While this seems reasonable, as we use specific samples from Pile-C, we need to verify that such data are not already seen by the target models to ensure that we are measuring the transferability of the TDE attacks. For most of the models tested, however, it is not possible to accurately verify the data used for training, since the model providers do not disclose the data used for pre-training. We therefore search for instances of our translated data in search engines and check for matches between our translation and segments of the returned pages. If no matches are found, this means that the observed translation is unlikely to be available online and, consequently, unlikely to have been used for the pre-training phase of the target models. To assess whether the translated versions of the English samples were publicly available online before their generation, we develop a web-based verification pipeline. We apply it to a subset of 200 translated samples per PII type. For each of these samples, we first generate a distinctive exact-match search query and use the Tavily search API22 2 Documentation available on this website. to identify potentially matching web pages. The URLs returned by the search engine are then compared with the Common Crawl index to identify archived versions that existed before the translation. For each relevant capture, we retrieve only the corresponding WARC record using HTTP range requests, extract the textual content of the page, and compare it with the translated sample. To compare the retrieved pages with the translations of our dataset, we compute exact matches and fuzzy matches. Exact matching checks whether the original translated sample occurred verbatim in the extracted webpage text. Fuzzy matching computes the normalized Levenshtein-based similarity between the translated sample and candidate text windows of comparable length ratio from the webpage; a match was considered positive when the similarity score exceeded a predefined threshold (90%90\%). This procedure provides evidence about whether the translated samples were publicly available on the web before their generation. I-C Target Models: English-centric and Multi-lingual models We evaluate the attack across three distinct families of models to observe how scale and pre-training objectives influence cross-lingual leakage: • EleutherAI GPT-Neo 1.3B and 2.7B [21] and GPT-J 6B [22]: English-centric models, these serve as a baseline to test the persistence of memorization when the model is forced to switch from its dominant training language (English) to a non-native prompt context. We selected these models because they are known to have been trained on The Pile, and therefore on the Pile-C subset from which our evaluation samples were drawn. • Meta Llama 3.2 1B and 3B [23]: multilingual models, these are integrated to evaluate the attack surface in models natively trained on a massive cross-lingual corpus, potentially facilitating the bridge between translated prompts and English-stored PII. • Qwen Qwen 2.5 3B and 7B [24]: multilingual models trained on a large-scale, highly multilingual corpus. These models allow us to assess whether the observed cross-lingual memorization behavior generalizes beyond the Llama family and to compare the impact of different pre-training data mixtures and tokenization strategies on privacy leakage. For Llama and Qwen models, there is no public confirmation that our selected Pile-C subset was included in the training data; nevertheless, the empirical evidence obtained from our attacks suggests that at least part of the evaluated content was likely seen during pre-training. I-D Finding Cross-Lingual Bridges Let xnl,engx_n^l,eng and xnl,targetx_n^l,target denote the hidden-state representations at layer l and token position n, where n corresponds to the last token of the input sequence. If a cross-lingual TDE attack succeeds, we hypothesize that models construct a cross-lingual bridge between representations in English (engeng) and the corresponding representation in another language (targettarget). If cross-lingual TDE succeeds because the model has learned a shared, language-agnostic representation of a specific memorized fact, such as the association between a person’s name and their email address, then this representation should be recoverable whenever the content is preserved, regardless of the surface language. Conversely, if apparent cross-lingual leakage is driven by weaker signals, such as general topical or semantic similarity between the prompt and the training context, then any prompt conveying a similar meaning should activate comparable internal states, regardless of whether it precisely preserves the original content. To distinguish these two accounts, we vary two factors independently: language and wording fidelity. We hence compare our strict, structure-preserving translations with free paraphrases. Crossing these factors allows us to determine not only whether translation moves a representation away from the original, but also whether this movement is driven by the language change itself or by the accompanying change in wording. Symmetrically, we can assess whether paraphrasing degrades the representation even when the language remains unchanged. I-D1 Experimental Conditions For each sample xengx^eng in our dataset, we construct three additional variants: • xstricttargetx^target_strict: a faithful, structure-preserving translation used in our main TDE attacks (see I-B). It introduces the same language change as the attack, with no wording changes beyond those required by translation. • xparaengx^eng_para: an English paraphrase of xengx^eng. It preserves the language while changing the wording, thereby isolating the effect of rewording without a language change. • xparatargetx^target_para: a paraphrase of xengx^eng in the target language targettarget. This condition changes both language and wording, and most closely resembles the setting of an attacker who does not have access to the exact original phrasing. All paraphrases preserve the topic and general meaning of the source sample while deliberately varying lexical choice, sentence structure, and the order in which entities are introduced. Details on the generation and evaluation of the paraphrases are detailed in Appendix -A. We feed each variant through the target model and extract hidden states at every layer l, at the last token position n of the input prompt, immediately preceding the point where the PII would be generated. This representation captures the model’s accumulated contextual state, and has been demonstrate to effectively encode the contextual information of the input [25]. I-D2 Similarity metric We experimented with the cosine similarity as the similarity metric for the representations: xnl,a⋅xnl,b∥xnl,a∥,∥xnl,b∥. x_n^l,a· x_n^l,b x_n^l,a , x_n^l,b . (3) For each sample, we compute three per-layer similarity scores with respect to the English original context: simstrictl=siml(xnl,eng,xn,strictl,target)sim^l_strict=sim^l (x_n^l,eng,x_n,strict^l,target ) (4) simpara−engl=siml(xnl,eng,xn,paral,eng)sim^l_para-eng=sim^l (x_n^l,eng,x_n,para^l,eng ) (5) simpara−targetl=siml(xnl,eng,xn,paral,target).sim^l_para-target=sim^l (x_n^l,eng,x_n,para^l,target ). (6) We then average these scores across the dataset to obtain a per-layer similarity profile for each condition. I-D3 Hypotheses and Interpretation We test three ordered predictions. H1: Translation preserves the bridge better than paraphrasing within the same language simstrictl>simpara−engl.sim^l_strict>sim^l_para-eng. (7) This is the critical comparison because if a strict translation into a different language remains closer to the original representation than an English paraphrase, this suggests that the representation tracks content fidelity. In particular, it provides evidence that the information surviving translation is associated with the specific memorized fact. H2: Wording loss compounds with language change simpara−engl>simpara−targetl.sim^l_para-eng>sim^l_para-target. (8) Comparing the two paraphrase conditions isolates the additional effect of changing language once the wording has already been altered. A difference between these conditions indicates that language and wording fidelity both contribute to representational drift. H3: Strict translation remains closer than free-form paraphrasing in the target language simstrictl>simpara−targetl.sim^l_strict>sim^l_para-target. (9) As a consequence of H1 and H2, we expect a faithful translation to produce a representation closer to the memorized English representation than a free-form paraphrase. This would indicate that content fidelity plays an important role in recalling the memorized segment. We expect these differences to be more pronounced in the central layers, where representations may encode more abstract factual and associative content, and relatively minor in the initial layers, which are more closely associated with lexical and tokenization properties at the surface level and in the final layers, where representations have been observed to specialize in generating the target language [26]. A consistent ordering, simstrictl>simpara−engl>simpara−targetl,sim^l_strict>sim^l_para-eng>sim^l_para-target, (10) would be consistent with the existence of a cross-lingual bridge: a representation anchored to specific memorized content that remains relatively stable under translation but degrades when the content is substantially restated, particularly when paraphrasing is combined with a language change. This would explain why our TDE attacks transfer across languages while remaining sensitive to the fidelity of the attack prompt, and argues against a purely coarse-semantic account of the leakage, in which any topically related prompt, translated or not, would be equally effective. IV Experimental Results IV-A Web-Presence Check: Translated samples not Online We check, on a subset of 200 samples per PII type, whether the translations used in our attacks were already available online before we generated them. If this were the case, a model might recognize our translation simply because it had already seen that exact text during training. Table I summarizes the results of our web verification pipeline (see Section I-B1). TABLE I: Translated samples from Pile-C (200 per PII type) are novel. We report descriptive statistics of the web-presence search results for Twitter handles, email addresses and phone numbers. The Queries w/ results % reports the proportion of queries returning at least one result, while Historical captures per query reports the number of historical captures identified for each query. Exact match and Max. Fuzzy score denotes the exact lexical overlap and the maximum fuzzy matching score as detailed in Section I-B1. PII Type Statistic Queries w/ Historical Exact Max. Fuzzy results % captures per query match score Twitter Mean 97.6 0.053 0 0.229 Std. 15.2 0.615 0 3.237 Min. 0 0 0 0 25th percentile 100 0 0 0 Median 100 0 0 0 75th percentile 100 0 0 0 Max. 100 13 0 46.289 Email Mean 66.8 0.044 0 0.172 Std. 47.1 0.693 0 2.800 Min. 0 0 0 0 25th percentile 0 0 0 0 Median 100 0 0 0 75th percentile 100 0 0 0 Max. 100 14 0 47.327 Phone Mean 100 0.054 0 0.163 Std. 0 0.772 0 2.655 Min. 100 0 0 0 25th percentile 100 0 0 0 Median 100 0 0 0 75th percentile 100 0 0 0 Max. 100 14 0 44.156 Almost all queries returned some results, but almost none of these were actual matches For all tested PII type, almost every query returned at least one page from the search engine (97.6% of queries for Twitter, 66.8% for emails, 100% for phone numbers). This simply means that the search terms were common enough to return something, but it does not mean that they are a match. When we examine how many of those returned pages actually contain a matching historical screenshot, the numbers drop to almost zero: on average, only 0.053 matching captures per query for Twitter, 0.044 for emails and 0.054 for phone numbers. For the majority of the extracts there were no matching captures at all: in fact, the 25th percentile, the median and the 75th percentile are all 0. A small number of samples represented outliers, with a maximum of 13 (Twitter) or 14 (emails and phone numbers) matching hits, which brings the average slightly above zero, but the typical sample has none. No online sample matches exactly Out of the 200 samples checked for each type of PII, the exact match rate is 0 in every statistic we have reported: mean, minimum, maximum and every percentile. Fuzzy matches are rare and, when they did occur, were in any case weak The fuzzy match score measures how closely the text of a returned page matches our translated segment, taking into account minor differences in wording. For all the tested PII types, this score is 0 for the vast majority of segments (again, the 25th percentile, the median and the 75th percentile are all 0), which means that most of the returned pages are not significantly similar to our segments at all. The average score is low (0.229 for Twitter, 0.172 for emails, and 0.163 for phone numbers). Even the few outliers with higher scores (up to 46.3 for Twitter, 47.3 for email, 44.16 for phones) remain well below the similarity threshold we use to define something as a match (90, as described in Section I-B1). These results demonstrate that the translated samples we checked are, for all intents and purposes, not present on the web: searches return numerous irrelevant pages, but virtually no exact matches, almost no historical copies, and only a handful of approximate matches that do not even come close to our match threshold. This supports our hypothesis that the translated data were not part of the models’ pre-training data and that the cross-linguistic leak we observe in Section IV-B reflects a genuine transfer of memorized content between languages. IV-B Cross-Lingual Transferability of TDE Attacks TABLE I: A large portion of PII are leaked also in other languages. We report the number of successfully leaked PII, together with the percentage of English leaks also observed in each language. The number of generations containing PII instances is reported for each language. PII type Model English French Italian Spanish German Leak Leak Rel. Generated Leak Rel. Generated Leak Rel. Generated Leak Rel. Generated Twitter Llama 3.2 1B 340 255 75.0% 1788 243 71.5% 1724 260 76.5% 1893 213 62.6% 1369 Llama 3.2 3B 548 492 89.8% 2284 501 91.4% 2327 488 89.1% 2334 389 71.0% 1831 Qwen2.5 3B 468 395 84.4% 2330 372 79.5% 2360 384 82.1% 2391 298 63.7% 1693 Qwen2.5 7B 591 479 81.0% 2682 439 74.3% 2647 440 74.5% 2626 361 61.1% 2197 GPT-J 6B 1020 426 41.8% 2033 450 44.1% 2300 444 43.5% 2219 337 33.0% 1688 GPT-Neo 1.3B 505 228 45.1% 1512 215 42.6% 1608 222 44.0% 1574 148 29.3% 1072 GPT-Neo 2.7B 694 236 34.0% 1646 264 38.0% 1857 249 35.9% 1784 160 23.1% 1163 Email Llama 3.2 1B 167 78 46.7% 1846 74 44.3% 2020 71 42.5% 1787 80 47.9% 2089 Llama 3.2 3B 329 195 59.3% 2370 192 58.4% 2450 187 56.8% 2143 183 55.6% 2376 Qwen2.5 3B 242 136 56.2% 2960 145 59.9% 2995 140 57.9% 2859 118 48.8% 2681 Qwen2.5 7B 328 210 64.0% 3326 204 62.2% 3298 227 69.2% 3114 193 58.8% 3158 GPT-J 6B 726 121 16.7% 2811 114 15.7% 2635 108 14.9% 2081 109 15.0% 2646 GPT-Neo 1.3B 267 42 15.7% 1565 44 16.5% 1570 35 13.1% 1329 34 12.7% 1353 GPT-Neo 2.7B 442 70 15.8% 2284 62 14.0% 2279 54 12.2% 1659 56 12.7% 2075 Phone Llama 3.2 1B 161 32 19.9% 1851 37 23.0% 1691 35 21.7% 1793 6 3.7% 602 Llama 3.2 3B 388 111 28.6% 2108 103 26.5% 1971 111 28.6% 2024 55 14.2% 1364 Qwen2.5 3B 197 35 17.8% 2409 38 19.3% 2188 43 21.8% 2354 8 4.1% 235 Qwen2.5 7B 285 54 18.9% 2443 58 20.4% 2340 61 21.4% 2450 10 3.5% 468 GPT-J 6B 495 18 3.6% 1547 16 3.2% 1326 21 4.2% 1609 5 1.0% 233 GPT-Neo 1.3B 138 3 2.2% 461 3 2.2% 472 3 2.2% 631 1 0.7% 91 GPT-Neo 2.7B 256 4 1.6% 938 4 1.6% 837 6 2.3% 1021 1 0.4% 100 Having verified, on a sample of 200 passages per PII type, that the translations are not available online, we now check whether they can nevertheless cause a leak of private information across different languages. Table I reports, for each PII type, model, and language, the number of successfully leaked PII (Leak), the percentage of English leaks also observed in other languages (Rel.), and the total number of completions that contain a PII under the TDE attack. TDE attacks transfer across different languages, and our results reveal that both the PII type and the multilingual capabilities of the model influence the attack success rate. Leakage transfers to every target language, for every model Across all seven models and three PII types, cross-lingual attacks in French, Italian, Spanish, and German recover a non-trivial number of PII instances that were only ever present, in their original form, in the English training data. This confirms the central hypothesis of our study: memorization is not confined to the language in which the memorized content was originally expressed, and the linguistic barrier offers only partial protection rather than a hard boundary. Leakage is strongest in English but remains substantial cross-lingually, and this gap tracks a model’s multilingual capability For every model, the English attack yields the highest leak count and leak rate, which is expected: it is the only condition where the attack prefix is drawn verbatim from a plausible training distribution. However, the size of the drop between English and the other four languages differs sharply by model family. For the multilingual models (Llama 3.2, Qwen2.5), the cross-lingual leak rate retains up to 91.4% of the Twitter handles leaked in English, up to 69.2% for emails, and up to 28.6% for phone numbers. For the English-centric models (GPT-Neo, GPT-J), the same ratios are much smaller for Twitter handles (up to 45%) and email addresses (up to 16.7%), and collapse for phone numbers – most strikingly for GPT-J 6B and GPT-Neo 2.7B, which leak less than 3% of phone numbers cross-lingually. This is consistent with our hypothesis that cross-lingual leakage is mediated by shared multilingual representations: models trained on substantially multilingual corpora exhibit a much smaller English-to-other-language gap, even though their absolute English leak rates are often lower than English-centric models’. Model scale alone does not explain this pattern – the largest English-centric model, GPT-J 6B, shows a weak transfer with respect to the similar-sized Qwen2.5 7B – which argues against transfer being a simple byproduct of overall model capability and in favor of it depending specifically on multilingual training. PII type modulates both absolute leakage and transferability Across all models, Twitter handles are leaked at far higher rates than emails, which in turn leak more than phone numbers, both in English and cross-lingually. This ordering likely reflects differences in the redundancy and predictability of each PII type’s surrounding context (handles are frequently repeated verbatim near associated usernames or mentions, while phone numbers are comparatively sparse and less syntactically constrained), consistent with prior evidence that extraction risk depends on structural properties of the target string as well as the language it is expressed in. Phone numbers are also the PII type for which cross-lingual transfer is proportionally weakest for the English-centric models. These results establish that TDE attacks transfer across the language boundary for both monolingual and multilingual models, that the degree of transfer scales with a model’s multilingual training and that this cross-lingual susceptibility is not uniform but is shaped by the interaction of model family, language, and PII type. Fig. 1: Retention of leaked PII instances under a paraphrased attack, compared to strict-attack leak count, averaged across the four multilingual models (Llama 3.2 1B/3B, Qwen2.5 3B/7B) and the three English-centric models (GPT-J 6B, GPT-Neo 1.3B/2.7B) IV-C Transferability of TDE Attacks Under Paraphrase Section IV-B showed that TDE attacks transfer across languages when the attack prefix is a faithful, strict translation of the memorized English passages. We therefore ask what factors are key to the effective retrieval of memorized PII. Building on the disentanglement of language and wording fidelity introduced in Section I-D, we now first test its behavioral counterpart: whether leakage itself, not just representational similarity, tracks content fidelity. We hence first analyze the behavioral effects of paraphrases, performing the TDE attacks on the paraphrased inputs. Figure 1 reports, for the same PII types and models as Table I, the leakage obtained when the attack prefix is paraphrased. To facilitate comparisons across languages and models, we report leakage as a percentage of the corresponding English leaks for each model and PII type. Thus, 100% indicates the same number of leaked PII instances as the English baseline, while values below 100% indicate lower leakage. We refer to this relative leakage as retention (for completeness, in Appendix -B we report the raw number of leaks). Paraphrasing the attack sharply reduces leakage, in every language and for every model For both Twitter handles and email addresses, the retention rate for paraphrased English input drops to about one-quarter or one-third of the count obtained with the strict attack, while the retention rate for paraphrased input in the target language drops even further, to about one-tenth. For phone numbers, the results vary more widely, but the number of leaks when using paraphrased input is always lower than the corresponding number of leaks obtained with strict translation for multilingual models, and comparable in English-centric models (which leak only a small fraction of the phone numbers). Furthermore, for all multilingual models, the leak rate in the case of a paraphrasing attack is substantially lower than that obtained with literal translation into other languages. These results support our hypothesis that the loss of the exact wording leads to a substantial loss of extraction success, even when the target language does not change. We will explore this point further in Section IV-D. English paraphrase consistently retains more leaked instances than cross-lingual paraphrase English paraphrase retention is roughly two to three times higher than cross-lingual paraphrase retention, for both multilingual and English-centric models alike, with the only exception registered on phone numbers extracted on Llama 3.2 1B. This is the attack-level counterpart of the Strict >> English paraphrase >> Target language paraphrase ordering that we expect to hold representationally as well, as described in Section I-D: paraphrasing costs leakage, and paraphrasing into another language costs more of it than paraphrasing alone. Paraphrasing the attacker’s prompt substantially reduces training-data extraction, and reduces it further when combined with translation into another language – consistent with the content-fidelity ordering hypothesized in Section I-D. We hence expect representational similarity to track the same content-fidelity ordering, which we test directly in the next section. (a) Twitter (b) Email (c) Phone Fig. 2: Mean cosine similarity between the representations of each strict translation and paraphrase and the English original, by layer, for each PII type. IV-D Representational Evidence for Cross-Lingual Bridges To explain the success of TDE attacks in other languages, we then demonstrate that, from a representational point of view, models tend to bridge structurally similar inputs from different languages. As described in Section I-D, we hence compare the similarity of the representations under strict translations and free-form paraphrases. For this analysis, we focus on the activations of multilingual LLMs, since TDE attacks are more likely to transfer for these models. Figure 2 report the per-layer results of the similarity analysis described in Section I-D, for Twitter handles (2-a), email addresses (2-b) and phone numbers (2-c) respectively. For each model, we plot the mean cosine similarity to the English original representation across layers, for the strict translation for each target language, the English paraphrase, and the target-language paraphrase. Table I summarizes the same results averaged across all layers, for each model, PII type, and condition, reporting the German strict translation separately from the French, Italian and Spanish ones. TABLE I: Mean cosine similarity to the English representation, averaged over all layers. Strict translations are reported separately for French/Italian/Spanish (mean over the three languages) and German; paraphrases are averaged over the four target languages. PII type Model Strict Strict English Target language (FR/IT/ES) (DE) paraphrase paraphrase Twitter Llama 3.2 1B 0.389 0.366 0.296 0.255 Llama 3.2 3B 0.375 0.367 0.279 0.239 Qwen2.5 3B 0.681 0.603 0.524 0.417 Qwen2.5 7B 0.668 0.607 0.491 0.381 Email Llama 3.2 1B 0.340 0.338 0.309 0.255 Llama 3.2 3B 0.348 0.343 0.305 0.246 Qwen2.5 3B 0.678 0.653 0.575 0.447 Qwen2.5 7B 0.679 0.652 0.546 0.416 Phone Llama 3.2 1B 0.380 0.293 0.389 0.254 Llama 3.2 3B 0.398 0.279 0.372 0.243 Qwen2.5 3B 0.714 0.365 0.652 0.434 Qwen2.5 7B 0.695 0.369 0.619 0.399 The predicted ordering holds for Twitter handles and emails, and for phone numbers except in German As we discussed in Section I-D, if the models bridge different languages’ representations, three conditions should hold: strict translation should preserve greater similarity to the English original than an English paraphrase (H1: Equation 7), an English paraphrase should preserve greater similarity than a target-language paraphrase (H2: Equation 8), and strict translation should consequently exceed the target-language paraphrase as well (H3: Equation 9). For Twitter handles and emails, all three hold for every one of the four models, for both the French/Italian/Spanish translations and the German one, when similarity is averaged over layers: strict translation >> English paraphrase >> target language paraphrase in every row of Table I. For phone numbers, H2 holds in every row, while H1 and H3 hold for French, Italian and Spanish (for H1, in three of the four models; Llama 3.2 1B is on par, 0.380 vs 0.389). German is the exception: its strict translation is below the English paraphrase at every layer and in every model, and, for Qwen2.5, below the average target-language paraphrase as well (0.365 vs 0.434 and 0.369 vs 0.399). Where it holds, this ordering is consistent with a bridge anchored to content fidelity: representational similarity degrades least when only the language changes (strict translation), more when only the wording changes (English paraphrase), and most when both change simultaneously (target language paraphrase). Multilingual models show a substantially stronger bridge than English-centric ones The gap between conditions and the absolute similarity level scale with the model’s multilingual training. The two Llama models – despite being described as multilingual – stay below 0.4 mean cosine similarity in every condition, and the layer-averaged difference between strict translation (French/Italian/Spanish) and target-language paraphrase is comparatively narrow (0.09–0.16). Qwen2.5, trained on a substantially more multilingual corpus, reaches mean similarities of 0.67–0.71 for the strict condition and shows a much wider separation between conditions (a Strict/target language paraphrase gap of roughly 0.23–0.30). This mirrors the extraction-transferability results in Section IV-B: the same models whose leak rates transfer most completely across languages are also the ones whose internal representations show the clearest content-anchored bridge. The bridge is present for all three PII types, but its strength does not follow the leakage ordering The Strict/target language paraphrase gap (French/Italian/Spanish strict translations) is 0.13–0.29 for Twitter handles, 0.09–0.26 for emails and 0.13–0.30 for phone numbers (Table I). The gap is smallest for emails in every model, and comparable between Twitter handles and phone numbers. Unlike the leakage rates presented in Section IV-B, where Twitter handles are leaked most and phone numbers least, the strength of the bridge therefore does not order the PII types consistently, and we do not read it as a proxy for extraction risk across PII types. Twitter handles also show a distinct pattern: target-language paraphrases sit closer to each other (0.04–0.11 apart) than either does to strict translation (0.09–0.29 apart). German phone numbers are the exception to the ordering above: their strict translation reaches only 0.28–0.37 mean similarity (versus 0.38–0.71 for French, Italian and Spanish), it lies below the English paraphrase at every layer, and it is the only strict condition that falls below the target-language paraphrase in some models. This coincides with the sharp drop in the number of generations containing a PII and of leaks for German phone numbers (Table I), suggesting that this condition behaves differently from the others; we therefore report it separately in Table I. Representations are bridged in the middle layers, and then diverge Across all four models, the layer-wise curves trace a consistent arc: similarity to the English original is lowest at the input end (and, for Qwen2.5, also at the output end), and highest in between, where the cross-lingual bridge appears to be located. At the embedding layer (layer 0), before any contextual processing has occurred, similarity is driven mostly by shared surface tokens. For Twitter handles and emails, the predicted ordering (strict >> eng-paraphrase >> L2-paraphrase) reasserts itself within the first few transformer layers and holds through the middle of the network (in at least 97% of the middle layers), which we take as the region where content-level, language-agnostic representations are formed. For phone numbers, this ordering holds less consistently (75–96% of the middle layers for French, Italian, and Spanish), while the German strict translation stays below the English paraphrase at every layer. Toward the output end, the bridge again gives way: for Qwen2.5 in particular, all three conditions – strict, eng-paraphrase, and L2-paraphrase alike – show a pronounced drop in absolute similarity over the final one to three layers (a fall of roughly 0.12–0.35 in cosine similarity from each curve’s peak). We read this late-layer divergence as a property of the output layers generally, not of the bridge specifically: the last layers of a language model are known to specialize toward predicting the next token in the correct surface language, which pulls every condition’s representation away from the English original by a similar amount. Critically, the target-language paraphrase remains the furthest from the English original at every layer, all the way to the final one, while the strict translation and the English paraphrase come close to each other (at the very last layer the English paraphrase is on par with or slightly above the strict translation for emails and phone numbers). The late-layer drop therefore rescales the overall level of similarity without erasing the separation between the target-language paraphrase and the other conditions, which is part of the evidence for the bridge. Taken together, the arc suggests that cross-lingual leakage is enabled by a mid-network representation that is comparatively insulated from both the surface form of the input and the language-specific demands of output generation. The representational analysis corroborates the attack-level transferability results: a language-crossing bridge exists, it is anchored to content fidelity instead of topic alone (for Twitter handles, emails and French/Italian/Spanish phone numbers, translation beats paraphrase, even a same-language one), and its strength scales with a model’s multilingual training, not its parameter count. Its strength across PII types, however, does not mirror the leakage counts in Table I, and the German phone-number condition remains an open exception. V Discussion and Conclusions This paper set out to test an assumption implicit in most prior work on training data extraction: that an attacker queries a model in the same language the memorized content was originally written in. Our results show this assumption does not hold. TDE attacks transfer across the language boundary for both English-centric and multilingual models, a sample of the translated passages (200 per PII type) was verified to be absent from the web prior to our experiments, and the degree of transfer tracks a model’s multilingual training. By independently varying language and wording fidelity, we further showed that this leakage is anchored to the specific memorized content: a strict translation recovers substantially more leakage than a paraphrase in either English or the target language, and, for Twitter handles and emails, also produces a more similar internal representation (for phone numbers, this holds for French, Italian and Spanish but not for German). Representationally, this content-anchored bridge is neither present from the input embeddings nor preserved into the output layers, but is concentrated in a band of middle transformer layers, consistent with the view that these layers encode language-agnostic, fact-level associations before the final layers specialize toward generation in the surface language of the prompt [26]. Connection to cross-lingual unlearning These results offer a plausible mechanistic account for a finding we could previously only cite, not explain: [18] show that unlearning a fact in one language does not remove it in another – a deletion in English typically leaves the same fact recoverable, verbatim, in Spanish or Chinese. If the cross-lingual bridge we identify is concentrated in the middle layers, while existing unlearning and model-editing methods largely target specific factual associations localized around particular parameters or layers, it is plausible that such methods remove the language-specific surface association without touching the shared mid-layer representation that the bridge depends on. Under this account, cross-lingual leakage after unlearning would not be a failure of unlearning per se, but a symptom of editing a representation at the wrong depth. We see directly testing this account – by applying unlearning or editing methods and then repeating our layer-wise similarity analysis – as a natural and high-value extension of this work. Practical implications For practitioners, the central implication is that monolingual privacy evaluation is not sufficient for a multilingual model. A model that appears to resist an English-language extraction attempt cannot be assumed to resist the same attempt translated into another language, and our results suggest the opposite is more likely as multilingual training becomes more extensive. This has direct bearing on red-teaming and compliance practice: privacy audits, safety filters, and memorization benchmarks that are evaluated only in a model’s dominant language will systematically underestimate real-world exposure for any model with meaningful multilingual capability – which, at this point, describes most production-grade LLMs. Limitations Our target languages – French, Italian, Spanish, and German – are all high-resource and, with the partial exception of German, typologically close to English. This was a deliberate choice to isolate the language-versus-wording effect under favorable translation quality, but it leaves open, and likely understates, the risk for lower-resource or typologically distant languages, where prior work suggests both weaker safety alignment [5] and different memorization dynamics [16, 19, 20] may amplify instead of dampen the effect we observe. Second, our phone-number results rest on small absolute leak counts, particularly under paraphrase and for the English-centric models, and should be interpreted with corresponding caution. In particular, the German phone-number condition behaves differently from the other languages, both behaviorally (Table I) and representationally (Table I, Fig. 2), and we report it separately. Future work. Beyond directly testing the unlearning connection above, three extensions follow naturally from our limitations. First, repeating this study on lower-resource and typologically distant target languages would test whether the cross-lingual bridge strengthens, weakens, or changes character outside the high-resource, Western-European setting studied here. Second, extending the paraphrase-based disentanglement methodology from extraction to jailbreaking would let us test whether the cross-lingual latent space that [5] exploit for safety circumvention has the same content-anchored, middle-layer structure we find for memorization, or whether the two phenomena rely on different mechanisms despite superficially similar symptoms. Third, our similarity-based evidence for the bridge is correlational at the representation level; combining it with causal interventions – for instance, patching or ablating the token-level contributions we identify as most responsible for cross-lingual similarity – would let us move from showing that a bridge exists to showing precisely which components of the model implement it. In summary, we provide the first direct evidence that PII memorized from English training data can be recovered by attacks formulated in other languages, that this transfer is driven by a genuine, content-anchored cross-lingual bridge and that the strength of this bridge scales with a model’s multilingual training. As multilingual deployment continues to expand, we argue that privacy evaluation, auditing, and mitigation must be treated as inherently cross-lingual problems, not extended to other languages as an afterthought. Open Science We release the full code required to reproduce our experiments (the TDE attack pipeline, the translation and paraphrase generation scripts, the web-presence verification pipeline, and the analysis and plotting notebooks used to produce every table and figure in this paper) via a fully anonymized repository: https://anonymous.4open.science/r/TransferTDE-C84/. This repository will remain accessible throughout the review process. We do not release the underlying dataset itself – the English passages, and their translations and paraphrases – as it consists of samples containing real, identifiable personal information (email addresses, phone numbers, and Twitter handles) drawn from Pile-C, and redistributing it would work against the privacy considerations (discussed in our Ethical Considerations section). We will make the constructed dataset available to researchers upon request for legitimate research purposes, subject to a data use agreement and institutional verification. LLM usage considerations Accountability and Correctness LLMs were used for editorial purposes in this manuscript, and all outputs were inspected by the authors to ensure accuracy and originality. The authors reviewed and edited all LLM-generated content used in the paper, including generated code, as if it had been written by the authors themselves, and take full responsibility for its accuracy and integrity. Beyond editorial use, an LLM (Gemma-3-27B-it, accessed via the Google Gemini API) was used methodologically, as a core component of our data pipeline, to generate the translations described in Section I-B. The paraphrases used in Section I-D were instead generated with open-weight models run locally (Appendix -A). At least one author proficient in each target language conducted spot checks of the translations and paraphrases, and we additionally verified the integrity of the paraphrases in Appendix -A. No experimental results, references, or claims in this paper were generated by an LLM without independent verification against the underlying data or source material. Transparency The use of an LLM to generate translations is an integral part of our methodology, not a secondary element: our experimental design relies on the availability of faithful, structure-preserving translations of a dataset of the required scale, which we obtained by instructing Gemma-3-27B-it to that effect (Section I-B). The free-form paraphrases, which provide the contrasting fidelity condition (Section I-D), were generated with open-weight models run locally (Appendix -A). We independently validated the results of this process. We acknowledge a limitation that this choice introduces: since Gemma-3-27B-it is accessed via a hosted API with versioned weights, our translation generation phase is not perfectly reproducible if the underlying model provided by the API undergoes changes or is deprecated in the future. The paraphrases are not affected by this limitation, as they were produced with locally-run open-weight models. We mitigate this issue by publishing, in our artifacts, the exact prompts and scripts used to generate the translations and paraphrases in this article (subject to the data-sharing constraints described in our Open Science section). Responsibility The target models evaluated in this study (GPT-Neo 1.3B/2.7B, GPT-J 6B, Llama 3.2 1B/3B, Qwen2.5 3B/7B) are the subjects of our study; we did not train any models, nor did we collect new data beyond the translation and paraphrasing of pre-existing texts from Pile-C (Section I-B). We selected models covering two parameter ranges (approximately 1 to 3B and 6 to 7B) within each family specifically to verify whether cross-lingual transfer is proportional to model size or to the composition of the multilingual pre-training; our results point to the latter hypothesis, which justified our decision to limit our evaluation to this range and not to more computationally intensive models. All inference on the target models was performed using greedy decoding, limiting each query to a single forward generation step. The dataset used by PII type and language was restricted to obtain statistically significant leakage counts without querying the models more than necessary for this purpose. The experiments were run on a single RTX A6000 from a private, local server. Each inference took from 10s/it for smaller models up to 20s/it for larger ones. Considering also the large number of hours needed to perfect the experimental setup, we estimate a total of 100 hours of GPU usage. The estimated emissions are 12.96 kg of CO2.33 3 Estimate computed on https://mlco2.github.io/impact/ Ethical Considerations This paper analyzes whether personally identifiable information (PII) stored by large language models during pre-training can be extracted using prompts formulated in a language other than the one in which the information was originally recorded. Below, we discuss the risks this entails and the measures we have taken to mitigate them. Data provenance and handling All PII used in our experiments comes from Pile-C, a pre-existing dataset derived from Common Crawl. We did not collect, extract, or generate any new PII; the email addresses, phone numbers, and Twitter handles we analyze were already present in this corpus and, by extension, already present in the training data of the models we evaluate, prior to our intervention. Our translations and paraphrases are transformations of this existing data, not new instances of it. We did not attempt to identify, contact, or otherwise interact with the individuals associated with the PII in our dataset, and we report our results in aggregate form (number of data leaks and similarity statistics). The English extracts, which contain PII, were processed by two third-party services: (i) the Google Gemini API, to which we sent the extracts to obtain the translations (Section I-B), and (i) the Tavily search API, to which we sent queries derived from the translated extracts for the web-presence check (Section I-B1). No PII was sent to third-party services for paraphrase generation, which was performed locally (Appendix -A). We do not publish, list, or otherwise reproduce any of the individual instances of PII retrieved during our experiments. Such information might be shared for research purposes only by contacting directly the corresponding authors. Dual-use considerations Attacks based on the extraction of training data are, by their very nature, dual-use: the same techniques that allow us to measure a privacy risk could, in principle, be used by a malicious actor to materialize that risk. We believe that disclosing the results we have obtained promotes the development of new defense techniques for two reasons. First, the underlying vulnerability (monolingual memorization and verbatim retrieval) has already been well established in previous work; our contribution lies in demonstrating that current monolingual extraction and evaluation practices are insufficient, which in itself constitutes an argument in favor of more thorough defense and oversight. Second, concealing this finding would prevent model providers and downstream implementers from realizing that monolingual privacy evaluation, red-teaming, and mitigation measures (e.g., unlearning or differential privacy applied and tested in only one language) may substantially underestimate real-world exposure, which, in our view, represents a greater harm than the marginal advantage our results provide to an attacker who could, in any case, already translate a known extraction prompt on their own. Responsible disclosure We did not pursue formal disclosure, as all the models evaluated are open-weight, and our findings pertain to a general property of multilingual training. We encourage practitioners who apply unlearning techniques, differential privacy, or other mitigation measures to evaluate their effectiveness across languages. Scope of risk The types of PII we study (email addresses, phone numbers, and Twitter handles) are all categories of information that may already be publicly available on the web in the specific cases we extracted from Pile-C, and our web presence check (Section I-B1) was designed to verify the novelty of the translation for the purposes of our methodology, not to assess whether the underlying English-language PII remains publicly identifiable through other means. We did not evaluate the extraction of more sensitive categories of PII (e.g., government-issued identifiers, financial or health information), and we caution against extrapolating our leakage rate estimates to such categories without a separate evaluation. References [1] N. Carlini, F. Tramèr, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, Ú. Erlingsson, A. Oprea, and C. Raffel (2021) Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), p. 2633–2650. External Links: Link Cited by: §I, §I, §I, §I-A1, §I-A. [2] N. Carlini, D. Ippolito, M. Jagielski, K. Lee, F. Tramer, and C. Zhang (2023) Quantifying memorization across neural language models. In Proceedings of the 11th International Conference on Learning Representations (ICLR), External Links: Link Cited by: §I, §I, §I, §I-A1, §I-A. [3] J. Huang, H. Shao, and K. C. Chang (2022) Are large pre-trained language models leaking your personal information?. In Findings of the Association for Computational Linguistics: EMNLP 2022, Y. Goldberg, Z. Kozareva, and Y. Zhang (Eds.), Abu Dhabi, United Arab Emirates, p. 2038–2047. External Links: Link, Document Cited by: §I, §I, §I-A1. [4] M. Nasr, N. Carlini, J. Hayase, M. Jagielski, A. F. Cooper, D. Ippolito, C. A. Choquette-Choo, E. Wallace, F. Tramèr, and K. Lee (2023) Scalable extraction of training data from (production) language models. External Links: 2311.17035, Link Cited by: §I, §I, §I-A. [5] J. Li, L. Shi, Y. Liu, X. Ren, and Y. Liu (2024) A cross-language investigation into jailbreak attacks in large language models. arXiv preprint arXiv:2401.16765. Cited by: §I, §I, §V, §V. [6] L. Gao, S. Biderman, S. Black, L. Golding, T. Hoppe, C. Foster, J. Phang, H. He, A. Thite, N. Nabeshima, S. Presser, and C. Leahy (2020) The pile: an 800gb dataset of diverse text for language modeling. External Links: 2101.00027, Link Cited by: §I. [7] N. Carlini, D. Paleka, K. D. Dvijotham, T. Steinke, J. Hayase, A. F. Cooper, K. Lee, M. Jagielski, M. Nasr, A. Conmy, I. Yona, E. Wallace, D. Rolnick, and F. Tramèr (2024) Stealing part of a production language model. External Links: 2403.06634, Link Cited by: §I. [8] N. Mamede, J. Baptista, and F. Dias (2016) Automated anonymization of text documents. In 2016 IEEE Congress on Evolutionary Computation (CEC), Vol. , p. 1287–1294. External Links: Document Cited by: §I. [9] Q. Xu, L. Qu, C. Xu, and R. Cui (2019) Privacy-aware text rewriting. In Proceedings of the 12th International Conference on Natural Language Generation, K. van Deemter, C. Lin, and H. Takamura (Eds.), Tokyo, Japan, p. 247–257. External Links: Link, Document Cited by: §I. [10] M. Miranda, E. S. Ruzzetti, A. Santilli, F. M. Zanzotto, S. Bratières, and E. Rodolà (2025) Preserving privacy in large language models: a survey on current threats and solutions. Transactions on Machine Learning Research. Note: External Links: ISSN 2835-8856, Link Cited by: §I. [11] B. Kantheti and C. A. P. D. Araujo (2026) Privacy-preserving transformers for time-series forecasting: a survey and two-axis taxonomy of cryptographic, differential-privacy, and feature-path methods. AI 7 (9). External Links: Link, ISSN 2673-2688, Document Cited by: §I. [12] L. Wang, T. Chen, W. Yuan, X. Zeng, K. Wong, and H. Yin (2023) KGA: a general machine unlearning framework based on knowledge gap alignment. External Links: 2305.06535, Link Cited by: §I. [13] K. Meng, D. Bau, A. Andonian, and Y. Belinkov (2023) Locating and editing factual associations in gpt. External Links: 2202.05262, Link Cited by: §I. [14] E. S. Ruzzetti, G. A. Xompero, D. Venditti, and F. M. Zanzotto (2025) Private memorization editing: turning memorization into a defense to strengthen data privacy in large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar (Eds.), Vienna, Austria, p. 16572–16592. External Links: Link, Document, ISBN 979-8-89176-251-0 Cited by: §I, §I-A1. [15] D. Venditti, E. S. Ruzzetti, G. A. Xompero, C. Giannone, A. Favalli, R. Romagnoli, and F. M. Zanzotto (2026) Enhancing data privacy in large language models through private association editing. Journal of Cybersecurity and Privacy 6 (3). External Links: Link, ISSN 2624-800X, Document Cited by: §I, §I-A1. [16] X. Luo, Y. Chen, J. Bjerva, and Q. Li (2025) Shared path: unraveling memorization in multilingual LLMs through language similarities. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, C. Christodoulopoulos, T. Chakraborty, C. Rose, and V. Peng (Eds.), Suzhou, China, p. 19372–19388. External Links: Link, Document, ISBN 979-8-89176-332-6 Cited by: §I, §I, §V. [17] A. Srivastava, E. Korukluoglu, M. N. Le, D. Tran, C. M. Pham, M. Karpinska, and M. Iyyer (2025) OWL: probing cross-lingual recall of memorized texts via world literature. External Links: 2505.22945, Link Cited by: §I, §I. [18] M. Choi, K. Min, and J. Choo (2024) Cross-lingual unlearning of selective knowledge in multilingual language models. In Findings of the Association for Computational Linguistics: EMNLP 2024, Y. Al-Onaizan, M. Bansal, and Y. Chen (Eds.), Miami, Florida, USA, p. 10732–10747. External Links: Link, Document Cited by: §I, §I, §V. [19] A. K. Mishra, A. Boutet, and L. Magnana (2026) The model’s language matters: a comparative privacy analysis of LLMs. In Findings of the Association for Computational Linguistics: EACL 2026, V. Demberg, K. Inui, and L. Marquez (Eds.), Rabat, Morocco, p. 1038–1048. External Links: Link, Document, ISBN 979-8-89176-386-9 Cited by: §I, §I, §V. [20] A. Satvaty, A. Visman, D. Seidel, S. Verberne, and F. Turkmen (2025) Memorization is language-sensitive: analyzing memorization and inference risks of LLMs in a multilingual setting. In Proceedings of the First Workshop on Large Language Model Memorization (L2M2), R. Jia, E. Wallace, Y. Huang, T. Pimentel, P. Maini, V. Dankers, J. Wei, and P. Lesci (Eds.), Vienna, Austria, p. 106–126. External Links: Link, Document, ISBN 979-8-89176-278-7 Cited by: §I, §I, §V. [21] S. Black, L. Gao, P. Wang, C. Leahy, and S. Biderman (2021) GPT-Neo: Large Scale Autoregressive Language Modeling with Mesh-Tensorflow. Zenodo. Note: If you use this software, please cite it using these metadata. External Links: Document, Link Cited by: 1st item. [22] B. Wang and A. Komatsuzaki (2021) GPT-J-6B: A 6 Billion Parameter Autoregressive Language Model. Note: https://github.com/kingoflolz/mesh-transformer-jax Cited by: 1st item. [23] A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, A. Yang, A. Fan, A. Goyal, A. Hartshorn, A. Yang, A. Mitra, A. Sravankumar, A. Korenev, A. Hinsvark, A. Rao, A. Zhang, A. Rodriguez, A. Gregerson, A. Spataru, B. Roziere, B. Biron, B. Tang, B. Chern, C. Caucheteux, C. Nayak, C. Bi, C. Marra, C. McConnell, C. Keller, C. Touret, C. Wu, C. Wong, C. C. Ferrer, C. Nikolaidis, D. Allonsius, D. Song, D. Pintz, D. Livshits, D. Wyatt, D. Esiobu, D. Choudhary, D. Mahajan, D. Garcia-Olano, D. Perino, D. Hupkes, E. Lakomkin, E. AlBadawy, E. Lobanova, E. Dinan, E. M. Smith, F. Radenovic, F. Guzmán, F. Zhang, G. Synnaeve, G. Lee, G. L. Anderson, G. Thattai, G. Nail, G. Mialon, G. Pang, G. Cucurell, H. Nguyen, H. Korevaar, H. Xu, H. Touvron, I. Zarov, I. A. Ibarra, I. Kloumann, I. Misra, I. Evtimov, J. Zhang, J. Copet, J. Lee, J. Geffert, J. Vranes, J. Park, J. Mahadeokar, J. Shah, J. van der Linde, J. Billock, J. Hong, J. Lee, J. Fu, J. Chi, J. Huang, J. Liu, J. Wang, J. Yu, J. Bitton, J. Spisak, J. Park, J. Rocca, J. Johnstun, J. Saxe, J. Jia, K. V. Alwala, K. Prasad, K. Upasani, K. Plawiak, K. Li, K. Heafield, K. Stone, K. El-Arini, K. Iyer, K. Malik, K. Chiu, K. Bhalla, K. Lakhotia, L. Rantala-Yeary, L. van der Maaten, L. Chen, L. Tan, L. Jenkins, L. Martin, L. Madaan, L. Malo, L. Blecher, L. Landzaat, L. de Oliveira, M. Muzzi, M. Pasupuleti, M. Singh, M. Paluri, M. Kardas, M. Tsimpoukelli, M. Oldham, M. Rita, M. Pavlova, M. Kambadur, M. Lewis, M. Si, M. K. Singh, M. Hassan, N. Goyal, N. Torabi, N. Bashlykov, N. Bogoychev, N. Chatterji, N. Zhang, O. Duchenne, O. Çelebi, P. Alrassy, P. Zhang, P. Li, P. Vasic, P. Weng, P. Bhargava, P. Dubal, P. Krishnan, P. S. Koura, P. Xu, Q. He, Q. Dong, R. Srinivasan, R. Ganapathy, R. Calderer, R. S. Cabral, R. Stojnic, R. Raileanu, R. Maheswari, R. Girdhar, R. Patel, R. Sauvestre, R. Polidoro, R. Sumbaly, R. Taylor, R. Silva, R. Hou, R. Wang, S. Hosseini, S. Chennabasappa, S. Singh, S. Bell, S. S. Kim, S. Edunov, S. Nie, S. Narang, S. Raparthy, S. Shen, S. Wan, S. Bhosale, S. Zhang, S. Vandenhende, S. Batra, S. Whitman, S. Sootla, S. Collot, S. Gururangan, S. Borodinsky, T. Herman, T. Fowler, T. Sheasha, T. Georgiou, T. Scialom, T. Speckbacher, T. Mihaylov, T. Xiao, U. Karn, V. Goswami, V. Gupta, V. Ramanathan, V. Kerkez, V. Gonguet, V. Do, V. Vogeti, V. Albiero, V. Petrovic, W. Chu, W. Xiong, W. Fu, W. Meers, X. Martinet, X. Wang, X. Wang, X. E. Tan, X. Xia, X. Xie, X. Jia, X. Wang, Y. Goldschlag, Y. Gaur, Y. Babaei, Y. Wen, Y. Song, Y. Zhang, Y. Li, Y. Mao, Z. D. Coudert, Z. Yan, Z. Chen, Z. Papakipos, A. Singh, A. Srivastava, A. Jain, A. Kelsey, A. Shajnfeld, A. Gangidi, A. Victoria, A. Goldstand, A. Menon, A. Sharma, A. Boesenberg, A. Baevski, A. Feinstein, A. Kallet, A. Sangani, A. Teo, A. Yunus, A. Lupu, A. Alvarado, A. Caples, A. Gu, A. Ho, A. Poulton, A. Ryan, A. Ramchandani, A. Dong, A. Franco, A. Goyal, A. Saraf, A. Chowdhury, A. Gabriel, A. Bharambe, A. Eisenman, A. Yazdan, B. James, B. Maurer, B. Leonhardi, B. Huang, B. Loyd, B. D. Paola, B. Paranjape, B. Liu, B. Wu, B. Ni, B. Hancock, B. Wasti, B. Spence, B. Stojkovic, B. Gamido, B. Montalvo, C. Parker, C. Burton, C. Mejia, C. Liu, C. Wang, C. Kim, C. Zhou, C. Hu, C. Chu, C. Cai, C. Tindal, C. Feichtenhofer, C. Gao, D. Civin, D. Beaty, D. Kreymer, D. Li, D. Adkins, D. Xu, D. Testuggine, D. David, D. Parikh, D. Liskovich, D. Foss, D. Wang, D. Le, D. Holland, E. Dowling, E. Jamil, E. Montgomery, E. Presani, E. Hahn, E. Wood, E. Le, E. Brinkman, E. Arcaute, E. Dunbar, E. Smothers, F. Sun, F. Kreuk, F. Tian, F. Kokkinos, F. Ozgenel, F. Caggioni, F. Kanayet, F. Seide, G. M. Florez, G. Schwarz, G. Badeer, G. Swee, G. Halpern, G. Herman, G. Sizov, Guangyi, Zhang, G. Lakshminarayanan, H. Inan, H. Shojanazeri, H. Zou, H. Wang, H. Zha, H. Habeeb, H. Rudolph, H. Suk, H. Aspegren, H. Goldman, H. Zhan, I. Damlaj, I. Molybog, I. Tufanov, I. Leontiadis, I. Veliche, I. Gat, J. Weissman, J. Geboski, J. Kohli, J. Lam, J. Asher, J. Gaya, J. Marcus, J. Tang, J. Chan, J. Zhen, J. Reizenstein, J. Teboul, J. Zhong, J. Jin, J. Yang, J. Cummings, J. Carvill, J. Shepard, J. McPhie, J. Torres, J. Ginsburg, J. Wang, K. Wu, K. H. U, K. Saxena, K. Khandelwal, K. Zand, K. Matosich, K. Veeraraghavan, K. Michelena, K. Li, K. Jagadeesh, K. Huang, K. Chawla, K. Huang, L. Chen, L. Garg, L. A, L. Silva, L. Bell, L. Zhang, L. Guo, L. Yu, L. Moshkovich, L. Wehrstedt, M. Khabsa, M. Avalani, M. Bhatt, M. Mankus, M. Hasson, M. Lennie, M. Reso, M. Groshev, M. Naumov, M. Lathi, M. Keneally, M. Liu, M. L. Seltzer, M. Valko, M. Restrepo, M. Patel, M. Vyatskov, M. Samvelyan, M. Clark, M. Macey, M. Wang, M. J. Hermoso, M. Metanat, M. Rastegari, M. Bansal, N. Santhanam, N. Parks, N. White, N. Bawa, N. Singhal, N. Egebo, N. Usunier, N. Mehta, N. P. Laptev, N. Dong, N. Cheng, O. Chernoguz, O. Hart, O. Salpekar, O. Kalinli, P. Kent, P. Parekh, P. Saab, P. Balaji, P. Rittner, P. Bontrager, P. Roux, P. Dollar, P. Zvyagina, P. Ratanchandani, P. Yuvraj, Q. Liang, R. Alao, R. Rodriguez, R. Ayub, R. Murthy, R. Nayani, R. Mitra, R. Parthasarathy, R. Li, R. Hogan, R. Battey, R. Wang, R. Howes, R. Rinott, S. Mehta, S. Siby, S. J. Bondu, S. Datta, S. Chugh, S. Hunt, S. Dhillon, S. Sidorov, S. Pan, S. Mahajan, S. Verma, S. Yamamoto, S. Ramaswamy, S. Lindsay, S. Lindsay, S. Feng, S. Lin, S. C. Zha, S. Patil, S. Shankar, S. Zhang, S. Zhang, S. Wang, S. Agarwal, S. Sajuyigbe, S. Chintala, S. Max, S. Chen, S. Kehoe, S. Satterfield, S. Govindaprasad, S. Gupta, S. Deng, S. Cho, S. Virk, S. Subramanian, S. Choudhury, S. Goldman, T. Remez, T. Glaser, T. Best, T. Koehler, T. Robinson, T. Li, T. Zhang, T. Matthews, T. Chou, T. Shaked, V. Vontimitta, V. Ajayi, V. Montanez, V. Mohan, V. S. Kumar, V. Mangla, V. Ionescu, V. Poenaru, V. T. Mihailescu, V. Ivanov, W. Li, W. Wang, W. Jiang, W. Bouaziz, W. Constable, X. Tang, X. Wu, X. Wang, X. Wu, X. Gao, Y. Kleinman, Y. Chen, Y. Hu, Y. Jia, Y. Qi, Y. Li, Y. Zhang, Y. Zhang, Y. Adi, Y. Nam, Yu, Wang, Y. Zhao, Y. Hao, Y. Qian, Y. Li, Y. He, Z. Rait, Z. DeVito, Z. Rosnbrick, Z. Wen, Z. Yang, Z. Zhao, and Z. Ma (2024) The llama 3 herd of models. External Links: 2407.21783, Link Cited by: 2nd item. [24] Qwen, :, A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Li, D. Liu, F. Huang, H. Wei, H. Lin, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Lin, K. Dang, K. Lu, K. Bao, K. Yang, L. Yu, M. Li, M. Xue, P. Zhang, Q. Zhu, R. Men, R. Lin, T. Li, T. Tang, T. Xia, X. Ren, X. Ren, Y. Fan, Y. Su, Y. Zhang, Y. Wan, Y. Liu, Z. Cui, Z. Zhang, and Z. Qiu (2025) Qwen2.5 technical report. External Links: 2412.15115, Link Cited by: 3rd item. [25] G. Nikolaou, T. Mencattini, D. Crisostomi, A. Santilli, Y. Panagakis, and E. Rodolà (2026) Language models are injective and hence invertible. In International Conference on Learning Representations, C. Vondrick, B. Hariharan, C. Raffel, L. Pinto, D. Yang, and A. Faust (Eds.), Vol. 2026, p. 57927–57984. External Links: Link Cited by: §I-D1. [26] C. Wendler, V. Veselovsky, G. Monea, and R. West (2024) Do llamas work in English? on the latent language of multilingual transformers. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 15366–15394. External Links: Link, Document Cited by: §I-D3, §V. [27] K. Papineni, S. Roukos, T. Ward, and W. Zhu (2002) BLEU: a method for automatic evaluation of machine translation. In Proceedings of the 40th Annual Meeting of the ACL, Cited by: §-A2. [28] C. Lin (2004) ROUGE: a package for automatic evaluation of summaries. In Text Summarization Branches Out, Cited by: §-A2. [29] A. Conneau et al. (2020) Unsupervised cross-lingual representation learning at scale. In Proceedings of ACL, Cited by: §-A2. -A Paraphrase Generation and Evaluation To construct the variants xparaLx^L_para used in the cross-lingual bridge analysis of Section I-D, we generate, for each sample and each target language, a paraphrased version. -A1 Paraphrase Generation For each language, we use an open-weight instruction-tuned language model, selected to maximize paraphrase quality in that specific language. Table IV lists the model used for each language. For German, we made two attempts to improve paraphrase quality, using first a language-specific model and then a general-purpose one (see the German model comparison below); Table IV reports the model retained. All models are run locally, so no PII-containing sample is transmitted to a third-party API during paraphrase generation. TABLE IV: Models used for paraphrase generation. Language Model English Qwen2.5-7B-Instruct German Qwen2.5-7B-Instruct French Mistral-7B-Instruct-v0.3 Italian Minerva-7B-instruct-v1.0 Spanish Salamandra-7B-instruct Each model is prompted with an instruction that requests a copy of the input sample in the same language, explicitly requiring that all entities relevant to the attack (email addresses, phone numbers, handles, proper names, dates, and URLs) be preserved word-for-word. This constraint is necessary because the paraphrased samples are subsequently used as alternative attack prompts, so any unintended alteration of the target PII would invalidate the downstream extraction experiment. Generation uses sampling with temperature 0.70.7 and top-p 0.90.9, with a maximum of 512 new tokens per completion. -A2 Evaluation Metrics We evaluate the generated paraphrases along two complementary axes: lexical divergence from the original sample and preservation of semantic content. A good paraphrase should score low on the former and high on the latter. Lexical divergence. We compute sentence-level BLEU [27] (via sacrebleu) and ROUGE-L F1 [28] (via the rouge-score implementation) between each original sample and its paraphrase. Low values in both metrics indicate that the paraphrase does not merely reproduce the source text. Semantic similarity Lexical divergence alone does not guaranty that meaning is preserved, since a phrase could diverge too far from the original content. We therefore additionally measure semantic equivalence using a multilingual Natural Language Inference (NLI) model, xlm-roberta-large-xnli [29], fine-tuned on XNLI and covering all five languages used in this study. For each pair (context, context) we compute the entailment probability in both directions and average them: sim=12(Pentail(context⇒paraphrase)CLOSEOPEN+Pentail(paraphrase⇒context)).sim= 12 (P_entail(context )\\ +P_entail(paraphrase ) ). (11) A high bidirectional entailment score indicates that the two texts imply one another and are therefore likely to be semantically equivalent, whereas a one-directional entailment could instead reflect a generalization or specialization of the original content. -A3 Results Table V reports, for each language of PII, the mean BLEU, ROUGE-L, and semantic similarity between the original samples and their paraphrases. TABLE V: Mean BLEU, ROUGE-L (F1), and bidirectional semantic similarity between original excerpts and their paraphrases, by PII type and language. Lower BLEU/ROUGE-L and higher semantic similarity indicate better paraphrase quality. PII type Language Model BLEU ROUGE-L Sem. sim. Email English Qwen2.5-7B-Instruct 23.51 49.21 83.43 French Mistral-7B-Instruct-v0.3 8.21 15.02 69.23 Italian Minerva-7B-instruct 22.08 39.94 46.99 Spanish Salamandra-7B-instruct 6.62 18.84 41.35 German DiscoLM_German_7b 41.89 56.41 68.05 German Qwen2.5-7B-Instruct 47.80 67.70 90.89 Phone English Qwen2.5-7B-Instruct 27.05 52.87 84.18 French Mistral-7B-Instruct-v0.3 7.34 14.88 66.65 Italian Minerva-7B-instruct 22.58 40.98 48.88 Spanish Salamandra-7B-instruct 6.44 20.16 42.10 German DiscoLM_German_7b 49.31 62.21 69.85 German Qwen2.5-7B-Instruct 41.98 63.94 90.70 Twitter English Qwen2.5-7B-Instruct 18.96 44.85 83.56 French Mistral-7B-Instruct-v0.3 6.06 13.70 75.38 Italian Minerva-7B-instruct 18.33 36.28 47.06 Spanish Salamandra-7B-instruct 7.48 22.93 54.36 German DiscoLM_German_7b 45.20 56.36 61.46 German Qwen2.5-7B-Instruct 43.12 64.79 92.02 German Paraphrase Model Comparison For German, we made two attempts to improve the quality of the paraphrases. In a first attempt, we used DiscoLM German 7b v1, a Mistral-based model fine-tuned specifically for German. In a second attempt, we used Qwen2.5-7B-Instruct, the general-purpose model employed for English, on the same German samples. Table VI reports the comparison. The second attempt yields substantially higher bidirectional semantic similarity (about 90% versus 61–70% across PII types), at the cost of a somewhat higher lexical overlap with the original (higher ROUGE-L for all PII types, and higher BLEU for emails). Since preserving the meaning of the original extracts is essential for the paraphrase to be a valid attack prompt, we retained the paraphrases generated with Qwen2.5-7B-Instruct for all German results reported in Section I-D and in the experimental results. TABLE VI: Comparison of two candidate paraphrase models for German. PII type Model BLEU ROUGE-L Sem. sim. Email DiscoLM_German_7b 41.89 56.41 68.05 Qwen2.5-7B-Instruct 47.80 67.70 90.89 Phone DiscoLM_German_7b 49.31 62.21 69.85 Qwen2.5-7B-Instruct 41.98 63.94 90.70 Twitter DiscoLM_German_7b 45.20 56.36 61.46 Qwen2.5-7B-Instruct 43.12 64.79 92.02 -B Raw Results for Paraphrase Attacks Table VII reports the absolute number of leaked PII instances obtained from the TDE attacks across models, languages, PII types, and input conditions. For each language, we report the leakage obtained with a strict translation of the original attack prefix and with its paraphrased counterpart. These raw counts provide the basis for the relative leakage analysis presented in Figure 1, where leakage is normalised to the corresponding English original prefix for each model and PII type. TABLE VII: Number of leaked PII instances for the strict translation and paraphrased attack prefixes. Results are reported for each model, language, and PII type. English French Italian Spanish German Model Strict Paraphrase Strict Paraphrase Strict Paraphrase Strict Paraphrase Strict Paraphrase Twitter Llama 3.2 1B 340 68 255 56 243 16 260 36 213 25 Llama 3.2 3B 548 127 492 96 501 28 488 68 389 36 Qwen2.5 3B 468 146 395 104 372 19 384 55 298 31 Qwen2.5 7B 591 181 479 135 439 20 440 70 361 43 GPT-J 6B 1020 284 426 168 450 28 444 44 337 40 GPT-Neo 1.3B 505 148 228 97 215 16 222 32 148 20 GPT-Neo 2.7B 694 190 236 103 264 14 249 44 160 21 Email Llama 3.2 1B 167 39 78 23 74 3 71 10 80 16 Llama 3.2 3B 329 78 195 44 192 15 187 20 183 47 Qwen2.5 3B 242 102 136 36 145 7 140 11 118 37 Qwen2.5 7B 328 123 210 51 204 13 227 15 193 49 GPT-J 6B 726 226 121 71 114 9 108 7 109 33 GPT-Neo 1.3B 267 84 42 24 44 3 35 0 34 10 GPT-Neo 2.7B 442 128 70 39 62 7 54 6 56 14 Phone Llama 3.2 1B 161 16 32 19 37 8 35 4 6 3 Llama 3.2 3B 388 34 111 35 103 18 111 13 55 18 Qwen2.5 3B 197 17 35 13 38 5 43 5 8 4 Qwen2.5 7B 285 31 54 23 58 5 61 4 10 4 GPT-J 6B 495 50 18 22 16 3 21 4 5 3 GPT-Neo 1.3B 138 10 3 9 3 2 3 2 1 2 GPT-Neo 2.7B 256 22 4 11 4 2 6 5 1 1