Surprise Masking: Private Data Filtering with Model Likelihoods

S URPRISE M ASKING : P RIVATE DATA F ILTERING WITH M ODEL L IKELIHOODS Riya Tyagi∗, Sahra Ghalebikesabi, Vinnie Monaco, Avi Schwarzschild, Om Thakkar OpenAI {rtyagi,sahra,vinnie,avis,om}@openai.com

arXiv:2610.22988v1 [cs.CR] 16 Oct 2026

A BSTRACT Data useful for language model (LM) training can contain private or unwanted information that is at risk of being learned or memorized. We propose Surprise Masking (SM), a simple form of perplexity filtering that uses a publicly available reference model to identify unwanted spans and suppress learning from them while preserving the rest of each example. On synthetic code benchmarks, we show SM improves the privacy-utility tradeoff over standard masking methods and PII filtering. In fine-tuning experiments, SM reduces approximate extraction of private values from revealed prefixes from 66.3% to 2.3% and the reproduction of stylistic coding quirks from 23.6% to 1.3%, both while preserving performance on the evaluated coding tasks. We also evaluate SM for sanitizing datasets by directly removing unwanted content. Here, SM outperforms DePA, a perplexity-based defense for detecting poisoned dead code, while specialized detectors perform better on broader credential and PII benchmarks. Across eleven settings, we find that SM’s downstream success is predictable from the separation of unwanted and useful content in the distribution, and it is particularly useful with code data. Ultimately, SM is an inexpensive, adaptable method to preserve valuable examples while reducing the learning of unwanted information.

1

I NTRODUCTION

Training samples that are valuable for learning can also contain undesirable content, including private information. This leaves practitioners with limited options. They can discard these samples, reducing leakage risk but sacrificing useful information, or train on them with safeguards that have their own costs and limitations. Alternatively, training-time interventions offer a way to alter how models learn from risky data (Hans et al., 2024; Wichers et al., 2025; Tan et al., 2025). These methods tend not to offer explicit or theoretical guarantees, so their privacy protections need empirical testing. Another approach is post-training unlearning methods, which typically localize information within a model before removing it (Merullo et al., 2025; Maini et al., 2023; Stoehr et al., 2024). These tools can all ∗

1

Work done while the author was an intern at OpenAI.

Training text x

Reference model 𝓜

2

3

Global window scores + frozen threshold

4

Masked text for training

si,2 = (ℓᵢ + ℓᵢ₊₁)/2

ℓⱼ = −log p𝓜(xⱼ | x<ⱼ)

n=2 2.6

Please call 555

−

Jane

014

7

at tomorrow

.

1.4

4.5

1.1

Please call

Jane

at

6.5

1.4

6.9

3.3

2.1

555

−

014

7 tomorrow .

0.4

at

555

3.80

555

−

3.95

−

014

4.15

014

7

5.10

Please call Jane at

× 7

tomorrow

2.70

Decision threshold: τ = 3.9

×

×

× tomorrow .

Token-level mask

m = [ 0, 0, 0, 0, 1, 1, 1, 1, 0, 0 ]

Selected on validation, then frozen.

Figure 1: Overview of Surprise Masking, illustrated with Global SM. A reference model scores token spans, and sufficiently surprising spans are masked from the training loss. 1

be costly and have unpredictable effects on model behavior. We aim to improve safeguards that mask unwanted portions of data samples before training on them. In this work, we revisit perplexity filtering, a method that uses a reference language model’s perplexity scores to filter data (see Figure 1 for an overview). Prior work uses perplexity to select useful training data (Ankner et al., 2024; Marion et al., 2023; Thrush et al., 2025) and Wu et al. (2025) use it to mask high-perplexity tokens from the fine-tuning loss to mitigate forgetting. We investigate this same principle for suppressing the learning of private and other unwanted content. Our approach, Surprise Masking (SM), masks token spans that are unlikely under a publicly available reference model. The intuition is that private content may be unfamiliar to the reference model and therefore surprising, so masking these spans can reduce how much a model trained on the masked data learns about private information. Note the difference between private content and sensitive content: the reference model might know sensitive content, like email addresses appearing in public datasets; however, the presence of such information makes it not private. SM aims to reduce the leakage of private content, especially high-entropy secrets such as API keys, passwords or account numbers. We first evaluate SM as a training-time intervention. We mask selected tokens from the training loss while retaining the rest of each example. In this setting, we evaluate SM on private content by generating synthetic training datasets with sensitive information that is unavailable to the reference model. We evaluate utility using downstream model performance. The following two existing observations suggest SM may be particularly effective here. First, perplexity can sometimes predict memorization when other properties of the data are held constant (Meeus et al., 2024). Second, false positives–surprising spans that are erroneously masked–might contain poor quality content, such as gibberish, and thus have little effect on downstream model performance. We additionally evaluate SM as a data sanitization method. These benchmark tasks test whether reference model surprise can localize sensitive content while preserving the surrounding data. Sanitization might be useful when sensitive information must be removed from data, for instance before releasing a dataset. Here, we measure privacy by how much sensitive content is removed and utility by how much other content is preserved. Our results show that during pretraining and fine-tuning, SM extends the privacy–utility frontier beyond existing baselines (see Section 3). In the sanitization setting, SM remains useful on some narrow distributions. Ultimately, it performs well on mitigating dead code poisoning, but specialized detectors are generally stronger on broader credential and PII benchmarks (see Section 4). In Section 5, we characterize when SM succeeds and fails, and show how practitioners can cheaply assess its suitability for a new setting. Ultimately, we see SM as an inexpensive, adaptable complement to scrubbers, rewriters, and other tools in a robust privacy suite.

2

M ETHOD

Our method can be described as four steps, each with some runtime choices or hyperparameters. At the most general level, SM accepts four inputs: a data example T , a reference model M , a window function W , and a threshold function τ . The window function maps the example to potentially overlapping windows, while the threshold function determines how surprising each window must be to be masked. SM returns a mask at the window level, while a post-processing step produces a token-level mask. Formally, let V denote a finite vocabulary of tokens, and let T = (t1 , . . . , tN ) ∈ V N be a sequence of tokens. Let M be an autoregressive language model that serves as our reference model. For privacy applications, we recommend choosing a publicly available M that was not trained on the private content we want to exclude. We call the content that should be masked target content, and refer to the unintended masking of non-target content as collateral masking. The four steps are as follows. 1. Construct windows. The window function W maps T to a collection of K possibly overlapping windows: W (T ) = {wi }K wi ⊆ {1, . . . , N }. i=1 , For fixed-width windows of length n, wi = {i, . . . , i+n−1}. Alternative window functions can return complete code lines, document fields, or chat responses. Complete coverage is 2

not required by this definition, leaving the possibility for positions to be outside all windows and receive no window-based mask. 2. Compute surprise. For each window, compute its mean negative log likelihood under the reference model: 1 X log pM (tj | t<j ) . (1) Li = − |wi | j∈w i

Higher values indicate that the window is more surprising to M . 3. Compute thresholds. Assign each window a threshold τi = τ (wi ). 4. Select windows. Mark windows whose surprise is at or above their threshold, setting bi = 1{Li ≥ τi }. The output of these four steps of SM is a collection of windows and their masking decisions which we can express as SM(T ; M, W, τ ) = {(wi , bi )}K i=1 . Different choices of M , W , and τ can adapt SM to different settings. Global SM uses the same threshold for every window, τi = τ0 , while Local SM selects windows by their surprise rank among nearby windows. Prompted SM conditions the reference model on a description of non-target content, which can make target content more surprising. We use different configurations throughout Sections 3 and 4 and provide variant details in Section D. Once SM selects surprising windows, the simplest map to a token-level mask is to mask every token that belongs to at least one selected window. Let mj denote the masking of token j where mj = 1 means we mask it from the loss, i.e. we do not backpropagate on its prediction. mj = 1{∃i : j ∈ wi and bi = 1} .

(2)

Additional post-processing options can yield different token masks. For example, Consensus masking requires a token to appear in at least k selected windows before it is masked, while duplicate propagation masks repeated occurrences of selected spans. Both can be applied individually or together to any SM output. 2.1

U SE CASES

We evaluate SM both as a training intervention and as a data sanitization approach. When SM is used as a training-time intervention, masked tokens are excluded from the training loss but remain in the context window, so they still provide context for predicting later tokens. In this setting, the notion of privacy measures whether training causes the model to learn an unwanted attribute, while utility captures model performance on the intended task. In our experiments, the unwanted attributes are private values and user-specific stylistic quirks embedded in code, while the intended task is to produce functionally correct code. Training can be forgiving because collateral masking may not reduce utility when the masked tokens are unimportant for learning the intended task. We present training-time intervention results in Section 3. Sanitization, however, is less forgiving. Here, masked tokens are redacted, so every non-target token removed counts as an error regardless of its downstream training value. We evaluate SM in sanitization settings covering credentials, personal information, and poisoned code in Section 4. We measure privacy by recall (TPR) on target content and utility by preservation of non-target content, which is 1−FPR. SM works best as a training intervention and on narrowly defined sanitization tasks, such as detecting poisoned code. On broader sanitization tasks, it can achieve high recall, but frequent false positives ultimately limit its usefulness. Section 5 examines when SM works well by comparing the surprise score distributions of target and non-target content.

3

S URPRISE M ASKING SUPPRESSES UNWANTED CODE ATTRIBUTES WHILE PRESERVING UTILITY

We first evaluate SM as a training-time intervention, asking whether it suppresses private values and stylistic quirks in code while preserving useful training signal. For fine-tuning, we use GPT-OSS-20B 3

(OpenAI, 2025). Because it already performs well on common coding benchmarks and our fine-tuning updates are relatively small, utility differences between models trained with and without SM are difficult to measure. To simplify utility measurement, we build two datasets based on the ExStruct coding library (harumiWeb, 2026), released after GPT-OSS-20B’s knowledge cutoff (OpenAI, 2025); before tuning, the model solves none of our ExStruct tasks, leaving clear room to measure learning. Both datasets are designed around a realistic model development pipeline in which developers train a model on user code to improve its performance on ExStruct. In Code PII, the user code contains private values; in Code Quirks, it exhibits user-specific stylistic habits. First, we prompt GPT-5.6 to produce realistic ExStruct tasks and matching code solutions. We then modify the resulting code in controlled ways to introduce synthetic private values or stylistic quirks. These controlled modifications provide ground-truth labels for the target tokens that SM should mask. For fine-tuning, we turn each task-solution pair into a chat: the task becomes the user request, and the modified code solution becomes the assistant response. Across both fine-tuning and pretraining, we sweep several SM thresholds τ to trace SM’s privacy– utility curve. The specific τ values differ per dataset such that each sweep covers a useful privacy– utility range. We compare SM with unmasked training, an oracle that masks exactly the labeled target spans, random masking at the same token budget, Goldfish loss (Hans et al., 2024), which selects tokens using a deterministic hash of their preceding context, and the OpenAI Privacy Filter (OPF), a trained PII scrubber (de Bourcy et al., 2026). Additional dataset construction and training details appear in Sections A and C. Oracle

Unmasked

Random masking

Goldfish

OpenAI Privacy Filter

Extraction success@128 (%)

Pretraining

Surprise Masking

Fine-tuning

100 95

80 60 40

50

95

k=3

50 k=3

50

k=2

50

k=2

20 95

95

0 −3.8

−3.6

−3.4

−3.2

15%

Token Log Likelihood

45%

75%

Pass@5

Utility (Higher is better →)

Figure 2: Privacy–utility tradeoffs on Code PII. The vertical axis shows the fraction of private values approximately extracted at least once in 128 samples from a revealed prefix. The left panel shows ExStruct token log likelihood after pretraining, and the right panel shows ExStruct pass@5 after fine-tuning. Lower extraction success and higher utility are better. Global SM uses windows of four tokens, consensus across four windows, and duplicate propagation. Endpoint labels give SM’s intended validation target recall in percent, and the same labels identify random masking at the corresponding token budgets. Goldfish masks approximately 1/k of eligible tokens. Points show means across training seeds. Code PII. Our Code PII fine-tuning dataset contains 11,250 chats derived from 625 small synthetic repositories. Each repository is an executable 24-file bundle containing an issue specification, a working solution, and regression tests, with synthetic private values embedded in solution code and configuration files across several formats. In ten thousand chats, the assistant response contains one of a hundred synthetic private values, either a username, workspace path, account ID, or recovery credential. Each value thus appears in a hundred chats; this repetition increases its extraction likelihood so that differences between masking methods are measurable. For pretraining, we create fifteen thousand code documents and distribute the same values evenly across ten thousand of them. Across fine-tuning and pretraining, SM extends the privacy–utility Pareto frontier beyond baselines. Here, we measure privacy by the fraction of private values approximately extracted from the trained model (Section B.1) and utility using an ExStruct evaluation dataset. The attacker receives roughly the first 75% of each private value’s tokens and samples 128 continuations to recover the hidden 4

suffix. In fine-tuning, extraction falls from 66% with unmasked training to 21% at an intermediate SM threshold and 2% at the strongest threshold, while random masking stays between 66% and 80%. For account IDs and recovery credentials, fine-tuning extraction falls from 86.7% and 74.7% to 9.3% and 0.0%, respectively, at the SM95 operating point (Table 7). Pretraining shows the same pattern: SM reduces extraction from 97% without masking, to 18% and ultimately 2% as masking becomes more aggressive, whereas random masking remains above 90%. In both training regimes, Goldfish loss reduces extraction at substantial cost to utility, while OPF preserves utility but does little to reduce such privacy risk. Because fine-tuning utility is noisy, we do not interpret small differences between nearby SM thresholds. Code Quirks. Our Code Quirks dataset contains four thousand fine-tuning chats from ten synthetic users. Each user is assigned one harmless stylistic habit, like separating statements with semicolons or adding unneeded parentheses, and uses it throughout their code. Fine-tuning uses the complete task and code solution chats, whereas pretraining uses only the solutions. Code Quirks is a challenging privacy setting: stylistic patterns can be used to attribute code to a particular user, but they are not obviously sensitive and thus missed by PII scrubbers. We find that SM once again provides a better privacy-utility tradeoff than baselines in both fine-tuning and pretraining. As in Code PII, we measure utility using an ExStruct evaluation set; for privacy, we measure quirk display: the fraction of evaluation tasks where at least one of five sampled solutions exhibits the user’s quirk. In fine-tuning, SM lowers quirk display from 24% to 1.3%, close to the 1% oracle, while matched random masking at the same token budget reaches 8.5%. In pretraining, SM lowers quirk display from 32% to 4–8%; at comparable utility, random masking remains at 14–15%. Oracle

Unmasked

40

Quirk display@5 (%)

Random masking

Goldfish

OpenAI Privacy Filter

Pretraining

Surprise Masking

Fine-tuning

30 k=2

k=2

20

k=3

30 20

30

10 90

90

70

k=3

20

70

0 −5

−4

−3

−2

−1

5%

Token Log Likelihood

25%

45%

Pass@5

Utility (Higher is better →)

Figure 3: Privacy–utility tradeoffs on Code Quirks. The vertical axis shows the fraction of evaluation tasks displaying a user-specific quirk in at least one of five samples, averaged equally over the ten quirks. The left panel shows ExStruct token log likelihood after pretraining, and the right panel shows ExStruct pass@5 after fine-tuning. Lower quirk display and higher utility are better. Local SM uses windows of two tokens ranked against up to 64 neighboring windows, consensus across two windows, and duplicate propagation. Endpoint labels identify the SM operating points, and the same labels identify random masking at the corresponding token budgets. Goldfish masks approximately 1/k of eligible tokens. Points show means across the available training seeds, with seed counts reported in Tables 9 and 10. 3.1

M ASK COVERAGE HELPS EXPLAIN PRIVACY AND UTILITY

Across Code PII and Code Quirks, the amount of target and non-target content masked helps explain downstream privacy and utility scores. Intuitively, masking more target tokens generally improves privacy, while masking more non-target tokens generally reduces utility. Figure 4 shows this pattern across both datasets. These coverage patterns help explain why SM outperforms random masking: at a matched budget, SM covers more target and fewer non-target tokens. However, which tokens are masked also matters: two methods that mask an equal fraction of target tokens can differ in extraction risk if one leaves every occurrence of a private value exposed. 5

Because mask coverage helps predict downstream performance, we want to know in advance what fraction of the training data a method will mask. Since training labels are unavailable in real settings, we estimate target token coverage and collateral masking on a labeled, in-distribution validation set. These validation estimates closely track the fraction of training tokens masked: within each training regime, Pearson correlations exceed 0.92 for target token coverage and 0.95 for collateral masking. Unmasked

Random masking

Goldfish

Fine-tuning

80% 60% 40% 20% 0% 20

40

60

80

60% 50% 40% 30% 20%

100

0

10

20

30

40

50

Pretraining utility

20 25 30

40 50

0

10

20

30

40

Collateral masking rate (%)

Code quirks privacy

Fine-tuning utility

Pretraining utility

20% 10% 0% 20

40

60

80

Target token coverage (%)

100

ExStruct dev perplexity

Collateral masking rate (%)

30%

0

70%

Target token coverage (%) ExStruct pass@5 (%)

Quirk display@5 (%)

0

Surprise Masking

Pretraining

Fine-tuning utility

100%

ExStruct pass@5 (%)

Extraction@128 (%)

Code PII privacy

OpenAI Privacy Filter

ExStruct dev perplexity

Oracle

40% 30% 20% 10% 0

10

20

30

40

Collateral masking rate (%)

50

3 10 30 100 250 0

20

40

60

80

Collateral masking rate (%)

Figure 4: Masking coverage and downstream outcomes. The top row shows Code PII, and the bottom row shows Code Quirks. The left column shows extraction success or quirk display against target token coverage. The center column shows fine-tuning pass@5 against collateral masking rate, and the right column shows pretraining perplexity against collateral masking rate. Filled markers and solid lines indicate fine-tuning, while hollow markers and dashed lines indicate pretraining.

4

S URPRISE M ASKING PROVIDES SANITIZATION SIGNAL BUT USUALLY TRAILS SPECIALIZED DETECTORS

In addition to evaluating SM as a training intervention (Section 3), we study it as a sanitization method for datasets intended for release or other downstream use. Sanitization is less forgiving of collateral masking because every non-target token removed counts as an error, regardless of how much useful training signal it carries. In this setting, we can express the privacy–utility tradeoff in terms of the true positive rate (TPR) and false positive rate (FPR): target token coverage is the TPR, while the collateral masking rate is the FPR. We evaluate SM on three datasets: credentials in code using CredData (Yun et al., 2021), broad personal information using PIIBench (Jha, 2026), and dead-code poisoning using a reconstruction of DePA’s dataset (Tsai et al., 2025), where the goal is to identify and remove functionally redundant code inserted to manipulate model behavior. We use AUROC to summarize performance across thresholds; because deployment requires picking one threshold, we also report F1 on held-out data after selecting the SM threshold on a validation set. Credentials. We begin with credentials, a narrow test of whether SM can isolate sensitive spans in code. In particular, we study CredData (Yun et al., 2021), which contains synthetic versions of credentials found in real code repositories. The dataset covers six credential categories and twelve programming languages. We choose three subsets of CredData, each with around one thousand validation and one thousand test examples from different repositories. SM achieves 0.900 AUROC but only 0.471 ± 0.012 character F1. Tuning a separate SM threshold on each credential category raises F1 modestly, from 0.471 to 0.504. Both F1 values exceed those of rule-based scanners Gitleaks (Gitleaks, n.d.) and detect-secrets (Yelp, n.d.), but trail the more sophisticated OPF and CredSweeper (Samsung, n.d.). The AUROC and F1 gap reveals SM’s key limitation: although it separates credentials and code characters well overall, any single threshold masks too much code. 6

We also test threshold transfer by tuning SM on one credential family or programming language group, and evaluating it on another. The results vary widely across CredData subsets: out-of-distribution F1 is lower than in-distribution F1 for Credential 1 and backend languages, but higher for Credential 2, Text/Config code, and frontend languages. Native OPF uses the filter’s decoded positive labels; OPF token log-odds instead uses a validation-tuned threshold on the log probability ratio of positive to background labels (Section C.3). Validation

ID

OOD

a CredData

b ID → OOD transfer Credential 1

0.09

Gitleaks

0.36

detect-secrets

Credential 2 0.47

Global SM Global SM, category-tuned (oracle) Native OPF

0.50

Text/config 0.74

Frontend

0.80

OPF log-odds

0.89

CredSweeper 0.0

0.2

0.4

0.6

0.8

Backend

1.0

0.0

0.2

Character F1

0.4

0.6

Character F1

c PIIBench

d DePA transfer

GPT-OSS SM

0.28

Prompted SM

0.29

0.24

DePA

0.33

Native OPF

0.51

OPF log-odds

0.64

Line surprise 0.78

DeBERTa 0.0

0.2

0.4

0.6

0.8

Character F1

0.0

0.2

0.4

0.6

HumanEval mean F1

Figure 5: Sanitization benchmarks. Panel (a) shows held-out character F1 on CredData. Panel (b) shows Global SM character F1 on validation, in-distribution (ID), and out-of-distribution (OOD) CredData splits. Panel (c) shows character F1 on the PIIBench test set, where GPT-OSS SM denotes unprompted Global SM. Panel (d) shows mean line-level F1 on HumanEval dead-code poisoning. The DePA value comes from the published report, and the Line surprise value comes from Global SM on our reconstructed benchmark. Global SM uses complete code lines as windows for dead code poisoning and windows of four tokens for CredData. Prompted SM uses windows of four tokens and consensus across two windows for PIIBench. Higher F1 is better in every panel.

Broad PII. We next evaluate broad PII detection using PIIBench, which collects 82 types of personal information from text sources. We select an SM rule and threshold on 10k validation records and then report character F1 on the approximately 100k-record test set. Global SM achieves an F1 of 0.280 and prompted SM reaches 0.286. Both trail native OPF at 0.325, OPF token log-odds at 0.513, and a fine-tuned DeBERTa filter at 0.785 (He et al., 2021). Dead code poisoning. Finally, we test SM on dead code poisoning, where it performs especially well. We use the setting created by Tsai et al. (2025), who propose DePA, a perplexity-based method for detecting dead code lines. Because the original poisoned artifacts are unavailable, we reconstruct DePA’s published data-generation procedure. For comparison with DePA, we apply Global SM with code lines as windows and use the same reference model, CodeLlama-7B-Instruct (Rozière et al., 2024). We tune one SM threshold on 974 Mostly Basic Python Problems (MBPP) programs (Austin et al., 2021) and evaluate it on HumanEval, a benchmark of 164 coding tasks (Chen et al., 2021). This method reaches 0.639 mean line F1 on the reconstructed benchmark, compared with DePA’s published mean of 0.240. We additionally evaluate combinations of SM and OPF in the appendix, finding limited gains over the stronger individual method (Figure 7). 7

5

VALIDATION DATA HELP ASSESS WHERE SURPRISE IS INFORMATIVE

The preceding experiments show that SM improves the privacy–utility tradeoff in our code training settings, while its sanitization performance across datasets. To assess whether SMtransfer is promising Validation-to-application ROCvaries transfer Validation-to-application ROC Validation-to-application RO in a new setting, we compare score separation on labeled validation data with separation on the training or evaluation data whereROC the score is applied. We refer to the latter as application Validation-to-application transfer Validation-to-application ROC data. transfer Validation-to-appli Validation Application Chance Validation Application Chance Validation Application For each setting, we construct a receiver operating characteristic (ROC) curve by varying the score threshold and plotting the true positive rate (TPR), the fraction of labeled targets selected, against the positive rateData (FPR), the fraction of labeled non-targets selected. AUROC summarizes ranking Selective training false sanitization Selective training benchmarks Data Anonymization sanitization Selective training benchmarks benchmarks Anonymization sanitizationbench bench Validation Application Chance Validation Application Chance Data Validation A 1.0 1.0 across thresholds, with 0.50 indicating ranking at chance. Across eleven settings, score separation Validation-to-application ROC transfer Validation-to-application ROC transfer Validation-to-application RO varies substantially, and validation and application AUROCs are similar in most comparisons. 0.8 0.8 ctive training Data sanitization Selective training benchmarks Data Anonymization sanitization Selective training benchmarks benchmarks Data Anonym san The comparison includes the Code PII, Code Quirks, CredData, PIIBench, and dead code poisoning 1.0

1.0

0.4

0.8

0.8

True-positive rate

rate

rate rate rate rate

rate

RedacBench DePA RedacBench DePA RedacBench DePA .99.99 / .99 .99 .74 / .99 .74 / .99 .53 .74 / .53 / .53 Dataset · val / app ·AUROC Dataset val / app AUROC Dataset CredData · val / app .82·AUROC /val .80/ app Dataset CredData .82AUROC / .80 RAT-Bench PIIBench RAT-Bench .65 .57 // .66 .57 .65 PIIBench .57 // .66 .57 RedacBench DePA .99RedacBench /DePA .99 .74 / .99 .53 / .99 .74 / .53

1.0

0.6

0.2 0.4 0.4 0.0 0.2 0.0

0.8

0.2 0.6 Code quirks 0.8 .851.0 / .780.0

1.0

Anonymization benchmarks Emergent Fabricated misalignment citations datase

0.8

0.4

0.6

0.8

Fabricated citations Fabricated citations

CredData .82 / .80 Insecure code .680.6 / .66 PIIBench .65/AUROC /.89 .66 Medical Dataset advice · val / app .89 DePA .99 1.00 /0.4 .99 Financial Fake advice citations .50/ /1.00 .50

Datasetcode · val /.68 app/ .66 AUROC Insecure RAT-Bench .57/AUROC / .57 Medical Dataset advice · val / app .89 .89 RedacBench .74 .53 Financial Fake advice citations 1.00 .50/ //1.00 .50

Dataset · val / app AUROC

Validation Application Dataset ·Chance val / app AUROC CredData .82 / .80 0.2 0.4 PIIBench 0.6.65 / .660.8 1.0 0.0 RAT-Bench 0.2 0.4 .57 / .57

0.2

0.6

Dataset · val / app ·AUROC Dataset val / app AUROC Fake citations / .50 .50 / .50 Fake .50 citations

RedacBench .74 .53 Financial Fake advice citations 1.00 .50/ //1.00 .50 rate rate rate benchmarks benchmarks Chancebenchmarks 0.0 0.2 0.4 0.6 0.8 1.0 0.0 0.2 0.4 0.6 0.8 1. 0.2 0.4 0.6 0.8 1.0 0.0 Dataset · val / app AURO rate rate benchmarks benchmarks

DePA .99 1.00 / .99 Financial Fake advice citations .50/ /1.00 .50

Validation 0.6

Fake Fake citations Fake citations citations .50.50 / .50 .50 / .50 / .50

Application 0.8 1.0 0.0

0.2 0.4 Validation-to-application ROC transfer

1.0 0.0

Dataset · val / app AUROC Dataset · 0.8 val / app AUROC Dataset · val / app AUROC Emergent misalignment datasets Fabricated citations Datasetcode · val 1.0 /.68 app/ .66 AUROC CredData .82 / .80 Insecure Insecure code .68 / .66 False-positive rate1.0datasets False-positive rate Selective training Data Fabricated sanitizationcitations benchmarks Emergent misalignment Code quirks / .78 PIIBench .65/AUROC /.89 .66 Medical advice .89.85 / .89 Medical Dataset advice · val / app .89 1.0 0.6 0.8 Financial Code PII 0.8 .91 / .88 DePA .99 1.00 / .99 Financial advice 1.00 / 1.00 Fake advice citations .50/ /1.00 .50

0.60.4

0.4 1.0 0.8 0.6

True-positive rate

0.2

0.2

0.6

0.8

0.4

0.6

0.8

1.0 0.0

0.6

0.2

0.4

Dataset · val / app AUROC 0.4 Insecure Datasetcode · val /.68 app/ .66 AUROC Insecure code .68 / .66 Medical advice .89.85 / .89 Code quirks / .78 0.2 Medical advice .89 / .89 0.4 advice 1.00 / 1.00 Code PII/ 1.00 .91 / .88 FinancialFinancial advice 1.00

Validation 0.6

Application 1.0 0.0

0.0 Dataset · val / app AUROC 0.6 0.8 0.8 0.0 0.6 1.0 0.2 0.2 0.4 Insecure / .66 Datasetcode · 1.0 val0.0 /.68 app AUROC

0.4 0.8 0.6 0.6 1.0

Medical advice .89.85 / .89 Code quirks / .78 Financial advice 1.00 / 1.00 Code PII .91 / .88

False-positive rate datasets Emergent misalignment 0.2

0.4

0.6

Chance 0.2 Dataset 0.4 0.6 Dataset Dataset · val · val / ·app val / app /AUROC app AUROC AUROC

False-positive rate Data Fabricated sanitizationcitations benchmarks

False-positive rate datasets 0.2 Selective Emergent misalignment training

0.0 0.0

0.8

Datasetcode · val /.68 app/ .66 AU Insecure False-positive Anonymization rate benc RAT-Bench .57/AU / Medical Dataset advice · val / app .89 .8 RedacBench .74 Financial Fake advice citations 1.00 .50/

RAT-Bench RAT-Bench RAT-Bench .57.57 / .57 .57 / .57 / .57 Dataset · val / app AUROC RedacBench RedacBench RedacBench .74.74 / .53 .74 / .53 / .53 CredData .82 / .80 / app ·AUROC Dataset val / app AUROC Dataset · val / app PIIBench .65AUROC / .66Dataset · val Dataset · val / app AUROC RAT-BenchRAT-Bench .57 / .57 .57 / .57 Fake citations .50 / .50RedacBench DePA .99 / .99 .74 / .53 .74 / .53 RedacBench Fake citations .50 / .50

Dataset · val / app AUROC

0.0 0.0 0.0 0.00.2 0.2 0.4 0.2 0.4

0.8 Dataset 1.0 0.0 Dataset Dataset · val · val / ·app val / app /AUROC app AUROC AUROC

Validation-to-application ROC transfer Dataset · val / app AUROC 0.0 CredData /rate .80 Dataset · val /.68 app/ .66 AUROC rate Insecure code .68.82 / .66 Insecure code False-positive False-positive 0.00.00.0 0.2 0.2 0.2 0.40.40.4 0.60.60.6 0.80.8 0.8 1.01.0 Data Fabricated sanitization citations benchmarks Anonymization bench 0.6 0.8 1.0 0.0 0.2 0.6 0.8 1.0 PIIBench .65 /.89 .66 0.4 RAT-Bench .57/AUROC / .57 Medical Dataset advice · val / app .89 /AUROC Medical Dataset advice · val / app .89 .89 DePA .99 /Dataset .99 Dataset · val / app AUROCRedacBench .74 / .53 · val / app AUROC

Code PII .91 / .88 Financial advice 1.00 / 1.00

0.2

Dataset RATRed

Validation-to-application ROC transfer Dataset · val / app AUROC Dataset · val / app AUROC Dataset · val / app AUROC

Code Dataset PII .91· /val .88 / app AUROC 0.0 Datasetcode · val rate /.68 app/ .66 AUROC Insecure False-positive Selective misalignment training datasets 0.2 Emergent 0.4 0.6 0.8 1.0 0.0 0.4 Code quirks / .78 0.2 Medical advice .89.85 / .89

0.0 0.0

1.0

Data Fabricated sanitization benchmarks Emergent misalignment citations datasets

Dataset · val / app AUROC Datasetcode · val /.68 app/ .66 AUROC Insecure 0.6 Code quirks / .78 Medical advice .89.85 / .89 Code PII .91 / .88 Financial advice 1.00 / 1.00 0.4 Dataset · val / app AUROC

0.4

0.2 0.0 0.0

1.0

0.2

Dataset Cre RATPIIB D Reda De

Dataset CredData · valquirks / app .82AUROC /Dataset .80 RAT-Bench Code PIIBench .65 .57 .85 /Dataset / .66 /val·.78 Dataset ·.57 val / ·app val / app /AUROC app AUROC AUROC RAT-Bench Code PIIBench quirks.65 .57 .85 // Dataset .66 .57 / .78 CredData Dataset CredData · val CredData · val / ·app val /.82 app /AUROC .82 /app .80 AUROC .82 / .80 AUROC / .80 RedacBench Code DePA PII .99 .91 / /.99 /Dataset .74 .88 /RAT-Bench .53 RAT-Bench PIIBench RAT-Bench PIIBench PIIBench .65 .57.65 .57 // .66 .57 .65 .57 // .66 .57 // .66 .57 RedacBench Code DePA PII.99 .91 / .99 /.74 .88 .53

Selective training Data sanitization Anonymization benchmarks Fabricated Fabricated Fabricated citations citations citations Selective trainingdatasets Data benchmarks sanitization benchmarks Anonymization benchmarks Emergent misalignment Emergent Fabricated misalignment citations datasets Emergent Fabricated misalignment citations datasets

0.6

0.0 0.0

Dataset Dataset Dataset · val · val / ·app val / app /AUROC app AUROC AUROC

Validation Chance 0.0 Validation Application Chance 0.0 Application Dataset · val / app ·AUROC Dataset · val / app ·AUROC Dataset val / app AUROC Dataset val / app AUROC

0.0

1.0 training Emergent misalignment datasets 0.4 Selective

0.2

rate rate True-positive rate True-positive rate rate

0.0

True-positive rate

0.6

0.0

0.0

0.6 Dataset CredData · 0.6 val / app .82AUROC / .80 0.2 Code PIIBench quirks .85 /AUROC .66 /AUROC .78 Dataset Dataset Dataset · val · val / ·.65 app val / app /AUROC app Code PIIBench quirks.65 .85 / .66 / .78 Code DePAPII.99 .91 / .99 / 0.4 .88 Code DePA PII.99 .91 / .99 / .88 0.4

0.6 0.2 Dataset · val /0.6 app AUROC Code quirks .85 / .78 Code PII .91 0.4 / .88 0.4

True-positive rate

0.6

0.00.00.0 0.2

True-positive rate

0.8

0.2

True-positive rate

1.0

True-positive rate True-positive rate

0.6 Code 0.2 quirks0.6.85 / .78 0.20.2 Code 0.4 PII 0.2 .91 / .88 0.8 0.4 0.0

rate

True-positive rate

True-positive rate

True-positive rate True-positive rate rate True-positive True-positive rate

True-positive rate

Validation Application Chance Validation Application Chance Validation Application 0.6 above. We also 0.6 experiments include RAT-Bench (Krčo et al., 2026), which tests identity recovery Validation-to-application Validation-to-application Validation-to-application ROC ROC ROC transfer Validation-to-application transfer Validation-to-application transfer Validation-to-application ROC ROC ROC transfer Validation-to-application transfer Validation-to-application transfer Validation-to-application ROC ROC ROC transfer transfer transfer from sanitized transcripts, and RedacBench (Jeon et al., 2026), which tests whether documents 0.4 0.4 0.8 0.8 Additional tests Selective training Data sanitization training benchmarks Data Anonymization sanitization Selective training benchmarks benchmarks to Data Anonymization sanitizationbenc ben disclose information prohibited by aSelective specified policy. rank complete Validation-to-application ROC transfer Validation-to-application ROC transfer Validation-to-application ROC transfer Validation-to-application ROC transfer Validation-to-application ROC transfer Validation-to-application ROC transfer Validation Validation Validation Application Application Application Chance Chance Chance Validation Validation Validation Application Application Application Chance Chance Chance Validation Validation Validationoutputs Application Application Application Chance Chance Chance 1.0 1.0 1.0 Dataset · val / app AUROC Dataset · val / app AUROC Dataset · v distinguish insecure from secure code (Betley et al., 2026), risky from safer medical and financial Dataset · val / app AUROC 0.2 Dataset CredData · val / app .82AUROC / .80 0.2 Dataset CredData · val / app .82AUROC / .80 Dataset CredD ·v 0.6 0.6 Selective Selective Selective training training training etValidation Data Data Data sanitization Selective sanitization Selective sanitization Selective training benchmarks training benchmarks training benchmarks Data Anonymization Data Anonymization Data Anonymization sanitization Selective sanitization Selective sanitization Selective training benchmarks benchmarks training benchmarks benchmarks training benchmarks benchmarks Data Anonymization Data Anonymization Data Anonymization sanitization benchmarks benchmarks benchmarks benchmarks benchmarks benchmarks Anonymization Anonymizatio Anonymiza Code quirks .85 / .78 Code PIIBench quirks .65 .85 /Validation .66 / .78 real RAT-Bench Code PIIBench quirks .65 .57 .85 //sanitization .66 .57 / sanitization .78 RAT-Be PIIBen 0.8 0.8 0.8 Application Chance Application Chance Validation Application Chance Validation Application Chance Validation Application Chance Validation Application Chance advice (Turner al., 2025), and fabricated from citations using HALLMARK (Kim et al., 1.01.01.0 1.0 1.0 1.0 1.0 1.0 1.0 Code PII .91 / .88 Code DePAPII.99 .91 / .99 / .88 RedacBench Code DePAPII.99 .91 / .99 /.74 .88/ .53 RedacB DePA 2026). The separationApplication between the labeled targets and non-targets in each Validation Chance 0.0ROC comparison measures 0.0 0.6 0.80.80.8 Selective 0.6 0.80.8 0.80.6 0.8 trainingtraining Data sanitization Selective training benchmarks Data Anonymization sanitization Selective training benchmarks benchmarks Data Anonymization sanitization benchmarks benchmarks Anonymization benc Selective Data sanitization Selective training benchmarks 0.80.8 Data Anonymization sanitization Selective training benchmarks benchmarks Data Anonymization sanitization benchmarks benchmarks Anonymizati setting, using the1.0scoring rules and evaluation units defined 0.4 0.4 for that setting. Dataset construction and 1.0 1.0 1.0 1.0 1.0 0.60.60.6 0.60.60.6 0.60.60.6 scoring details appear in Section A and Table 5, and the separate anonymization outcomes appear in 0.4 0.4 Dataset Emergent · val / app AUROC Dataset · val / app citations AUROC 0.8 0.8 0.8 0.8 Emergent 0.8 0.4 0.8 Selective Data sanitization benchmarks Anonymization benchmarks misalignment datasets Fabricated misalignment citations datasets Emergent Fabricated misalignment datasets F.4. training Dataset · val1.0 /0.4 app Dataset CredData · val / app .82 AUROC / .80 Dataset CredData · val / app .82AUROC / .80 Dataset ·0.4 val / app AUROC Dataset · val / app AUROC Dataset 0.40.4AUROCSection 0.40.40.4 0.4 0.4 0.2 0.2

0.8

1.0 0.0

0.2

0.8

Dataset · v RAT-Be RedacB

False-po Anonym

Dataset · val / app AUROC 0.8 1.0 CredData .82 / .80 Dataset · val / app PIIBench .65AUROC / .66 Fake citations .50 / .50 DePA .99 / .99

Fabricated citations

0.4

0.6

0.8

1.0

False-positive rateapplication Emergent misalignment datasets data across eleven Fabricated citations Figure 6: ROC curves compare score separation on validation and settings. Dashed curves show validation data, and solid curves show application data. The legends 0.4 report validation and application AUROC in that order, and dotted diagonals indicate ranking at 0.00.00.0 0.20.20.2 0.40.40.4 0.60.60.6 0.80.80.8 1.01.0 0.0 1.0 0.00.0 0.20.20.2 0.40.40.4 0.60.60.6 0.80.80.8 1.01.01.0 · val / app AUROC · val / app AUROC chance. The evaluated unitsDataset and scoring rules differ across settings. The insecureDataset codeCredData and advice Insecure code .68 / .66 Dataset · val / app AUROC .82 / .80 False-positive False-positive False-positive rate rate rate 0.2 curves report ranking of complete outputs from the 0.0 0.2 0.4 0.6 0.8 emergent 1.0 0.0 1.0misalignment 0.2 0.4 0.6datasets. 0.8 PIIBench 1.0 0.0 0.2 0.6 0.8 0.0 0.2 0.4 0.6 1.0 Medical advice .89 / .89 Dataset · 0.8 val / app Code quirks .85 / 0.4 .78cited .65AUROC / .66 Dataset Dataset Dataset · val · val / ·app val / app /AUROC app AUROC AUROC Insecure Insecure Insecure code code code .68.68 / .66 .68 / .66 / .66 Medical Medical Medical advice advice advice .89.89 / .89 .89 / .89 / .89 Financial Financial Financial advice advice advice 1.00 1.00 /1.00 1.00 / 1.00 / 1.00 Dataset · val / app ·AUROC Dataset val / app AUROC Insecure code .68 /code .66 .68 / .66 Insecure Medical advice .89advice / .89 .89 / .89 Medical Financial advice 1.00 / 1.001.00 / 1.00 Financial advice

Dataset · val / app AUROC Financial advice 1.00 / 1.00 Code PII .91 / .88 False-positive rate rate False-positive

Insecure code .68 / .66

Dataset Dataset Dataset · val · val / ·app val / app /AUROC app AUROC AUROC Fake Fake citations Fake citations citations .50.50 / .50 .50 / .50 / .50

Dataset · val / app ·AUROC Dataset val / app AUROC Fake citations / .50 .50 / .50 Fake .50 citations

Fake citations .50 / .50 DePA .99 / .99

0.0 Medical advice .89 /· .89 Dataset · val / app AUROC Dataset val / app AUROC The 0.0 application differences in how surprise distinguishes target content. Financial advice 1.00 / 1.00.68 /0.4 Insecure .66 0.2results show 0.4 substantial 0.6 0.8 1.0 0.0well 0.2code 0.6 0.8 Fake citations 1.0 .50 / .50

Medical0.80 advicefor .89 /CredData, .89 AUROC reaches 0.99 for dead code poisoning, 0.88 for Code PII, and 0.78 for Dataset · val / app AUROC Financial 1.000.0 / 1.00 .501.0 / .50 0.2 0.4 0.6 0.8 advice1.0 0.2 0.4 0.6 Fake citations 0.8 Code Quirks. Separation is weaker0.0 for PIIBench at 0.66, RAT-Bench at 0.57, and RedacBench at 0.53. False-positive rate Emergent misalignment datasets Fabricated citations 0.0 is 0.66 0.2 for0.4 0.6 code, 0.80.89 1.0 0.2advice, 0.4 0.6 0.8 1.0 Among the additional tests, application AUROC insecure for 0.0 medical False-positive rate 1.00 for financial advice, and 0.50 for fabricated citations. The financial controls are generated safer False-positive rate rewrites, so differences in length, wording, or the generating model may contribute to their separation

8

Dataset RATReda

from risky responses. The CredData curve uses a prompted contrast, while the primary sanitization result uses an unprompted score, as detailed in Section A.3. These comparisons describe the evaluated datasets and scoring rules and do not establish a general relationship between the type of content and score separation. Validation reflects application ranking closely in most of these comparisons, with two larger gaps. In nine of the eleven settings, the reported validation and application AUROCs differ by at most 0.03. For Code Quirks, AUROC falls from 0.85 on validation data to 0.78 on application data. For RedacBench, it falls from 0.74 to 0.53, so validation substantially overstates separation in this setting. These comparisons use validation data constructed to approximate application data and therefore do not establish robustness under broader distribution shifts. Similar ROC curves also indicate similar attainable TPR–FPR tradeoffs, but do not establish that one fixed threshold achieves the same rates on both datasets. Practical use. We recommend using a representative labeled validation set as an initial check of whether a surprise scoring rule offers an acceptable selection tradeoff. The relevant quantity is the target coverage attainable at an acceptable collateral masking rate, rather than AUROC alone. After choosing a threshold, verify its performance on separate representative data using the complete masking procedure, including any consensus masking or duplicate propagation. For training-time interventions, separately evaluate extraction or unwanted behavior and task utility, because score separation and mask coverage do not determine these downstream outcomes. If no acceptable tradeoff is available, consider a different scoring rule or intervention.

6

R ELATED W ORK

Surprise Masking spans the established areas of using language-model likelihoods to select data and suppressing selected contributions to learning. Our focus is whether reference likelihoods can identify unwanted spans whose suppression preserves useful training signal or surrounding data. Likelihood-based anomaly detection. ONION removes words from test inputs when their deletion sufficiently reduces sentence perplexity, aiming to block textual backdoor triggers (Qi et al., 2021). DePA uses perplexities of code snippets with individual lines removed, together with comparisons within each snippet, to locate poisoned training-code lines (Tsai et al., 2025). SM scores the observed tokens within each window directly, without constructing a deletion variant for every candidate. Our DePA comparison tests this direct line-level score on reconstructed poisoned data against the published DePA results, so it is not a rerun on identical released artifacts. Selective loss masking. Selective training can suppress contributions at different granularities. Loss truncation drops high-loss examples during training, whereas Error Norm Truncation suppresses token losses using the full predictive distribution to reduce the influence of noisy targets (Kang & Hashimoto, 2020; Li et al., 2024). Rho-1 selects tokens with high excess loss relative to a reference model trained on curated data, and Token Cleaning uses estimated model-update influence to select tokens for supervised fine-tuning (Lin et al., 2024; Pang et al., 2025). Their stated objectives concern training efficiency and downstream task performance. Selective Token Masking (STM) precomputes token perplexities and excludes high-perplexity targets from the fine-tuning loss to mitigate forgetting (Wu et al., 2025). This is a direct operational precedent for SM’s training use because both fix likelihood-based selections before fine-tuning and keep masked tokens available as context. Kosireddy and Lucas evaluate targeted loss masking for explicitly located email signatures and watermark triggers (Kosireddy & Lucas, 2025). This setting isolates the effect of masking known spans from the problem of locating them automatically. For SM, we evaluate likelihood-based span selection through extraction of private values, reproduction of recurring code patterns, and code utility in both fine-tuning and pretraining. We also test direct sanitization, where collateral masking is measured as removal of non-target content. Likelihoods for data selection. Language-model likelihood has a longer history in training-data curation. CCNet stratifies web text by perplexity under language models trained on Wikipedia, retaining even the high-perplexity tail because it can contain useful specialized text (Wenzek et al., 2020). Ankner et al. find different preferred perplexity ranges for the Pile and Dolma in their pruning 9

experiments (Ankner et al., 2024). This corpus dependence cautions against treating surprise as a universal measure of data quality. SM likewise uses application-specific validation to choose an operating point. For targeted filtering of harmful content, Ngo et al. (2021) score the conditional likelihood of harmful trigger continuations specified by the researchers, given each document. They remove documents whose continuation likelihood exceeds a threshold, rather than localizing harmful spans within those documents. SM uses likelihoods of observed spans, optionally under prompts describing desired behavior, and retains the surrounding example. Extraction and memorization. Extraction studies show that models can regenerate verbatim training sequences, with regeneration increasing strongly with repetition (Carlini et al., 2021; Kandpal et al., 2022). Deduplication reduces the evaluated extraction risk by limiting repeated exposure. SM’s duplicate propagation instead extends a selected mask to exact repeated spans within a chosen group while retaining the records. Goldfish reduces verbatim regeneration by excluding selected token positions from the loss while retaining them as context. Its deterministic context hash gives repeated local contexts consistent masking decisions, without identifying which spans are sensitive (Hans et al., 2024). Goldfish provides a baseline that selects loss positions without using content likelihoods. SM evaluates whether reference scores better target unwanted spans under the tested privacy–utility metrics. Because loss-masked tokens remain visible as context, the observed reductions in trainingtime risk are empirical and do not establish a formal privacy guarantee. Inoculation prompting offers a different route to selective learning by changing training prompts to reduce unwanted behavioral generalization at test time, rather than choosing spans to exclude from the loss (Wichers et al., 2025; Tan et al., 2025). Post-training approaches suppress memorized continuations through sparse updates to high-gradient weights (Stoehr et al., 2024) or curvature-based editing (Merullo et al., 2025). For training, SM selects spans to mask from the token-level loss. Privacy filtering. OPF is a supervised token classifier trained on a predefined privacy-label taxonomy to locate sensitive spans (de Bourcy et al., 2026). SM uses reference likelihood as a different selection signal, with labeled validation data used to choose its operating point. Its broad-PII evaluation shows the limits of treating reference surprise as a proxy for sensitivity. Anonymization beyond spans. The anonymizers of Staab et al. (2025) and Yang et al. (2025) iteratively edit text using feedback about inferable personal attributes, with the latter also optimizing downstream utility. These methods address a broader transformation problem than deciding which observed spans to mask. Semantic privacy benchmarks. RAT-Bench and RedacBench evaluate outcomes beyond span overlap, including re-identification risk from direct and indirect identifiers and policy-conditioned removal and preservation of semantic propositions (Krčo et al., 2026; Jeon et al., 2026). In Section F.4, our adapted evaluations compare direct masking, routing selected sentences to a rewriter, and fulldocument rewriting for these broader privacy objectives.

7

C ONCLUSION

Underlying these results is a critical question: can private information feasibly be separated from valuable training signal? Existing privacy-preserving methods suggest that such separation is sometimes possible, but the tradeoff may be steep because tails of distributions can be mixtures of private and valuable data. Ultimately, SM is limited because useful but unfamiliar content may be masked alongside private information. It is no surprise that the strongest performance in this work appears in code, where the two are often easier to distinguish. Further limitations are that our utility evaluation centers on a single coding library, our fine-tuning runs use LoRA (Hu et al., 2021), and pretraining uses GPT-2-Small (124M parameters). It can be interesting to study how the results extend to larger models, broader training distributions, or more demanding measures of utility, which we leave for future work. Moreover, it is important to note that SM does not provide a formal privacy guarantee: removing the direct training signal for a span does not ensure that its information cannot be learned through context or repeated exposure. Considering these limitations, we recommend the following protocol for practitioners. For those working with code, configure SM with a single surprise threshold, agreement across overlapping 10

windows, and mask propagation to repeated spans. For broader or more heterogeneous data, ranking each window against its neighbors may be a better starting point. In either case, tune the complete method on a validation set that resembles the intended deployment distribution as much as possible. If private and non-private content do not separate at an acceptable operating point, use a different intervention rather than forcing SM to fit. Despite the limitations, our results identify valuable settings where SM improves upon the tradeoff between privacy and utility compared to existing methods. We believe SM’s main practical value lies in being inexpensive, adaptable, and easy to tune; it is another useful tool in a privacy suite when existing protections leave gaps.

R EFERENCES Zachary Ankner, Cody Blakeney, Kartik Sreenivasan, Max Marion, Matthew L. Leavitt, and Mansheej Paul. Perplexed by Perplexity: Perplexity-Based Data Pruning With Small Reference Models, 2024. URL https://arxiv.org/abs/2405.20541. Jacob Austin, Augustus Odena, Maxwell Nye, Maarten Bosma, Henryk Michalewski, David Dohan, Ellen Jiang, Carrie Cai, Michael Terry, Quoc Le, et al. Program Synthesis with Large Language Models. arXiv preprint arXiv:2108.07732, 2021. Jan Betley, Niels Warncke, Anna Sztyber-Betley, Daniel Tan, Xuchan Bao, Martín Soto, Megha Srivastava, Nathan Labenz, and Owain Evans. Training Large Language Models on Narrow Tasks Can Lead to Broad Misalignment. Nature, 649(8097):584–589, January 2026. ISSN 1476-4687. doi: 10.1038/s41586-025-09937-5. URL http://dx.doi.org/10.1038/ s41586-025-09937-5. Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pp. 2633–2650. USENIX Association, 2021. URL https://www.usenix.org/ conference/usenixsecurity21/presentation/carlini-extracting. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, Nick Ryder, Mikhail Pavlov, Alethea Power, Lukasz Kaiser, Mohammad Bavarian, Clemens Winter, Philippe Tillet, Felipe Petroski Such, Dave Cummings, Matthias Plappert, Fotios Chantzis, Elizabeth Barnes, Ariel Herbert-Voss, William Hebgen Guss, Alex Nichol, Alex Paino, Nikolas Tezak, Jie Tang, Igor Babuschkin, Suchir Balaji, Shantanu Jain, William Saunders, Christopher Hesse, Andrew N. Carr, Jan Leike, Josh Achiam, Vedant Misra, Evan Morikawa, Alec Radford, Matthew Knight, Miles Brundage, Mira Murati, Katie Mayer, Peter Welinder, Bob McGrew, Dario Amodei, Sam McCandlish, Ilya Sutskever, and Wojciech Zaremba. Evaluating Large Language Models Trained on Code, 2021. URL https://arxiv.org/abs/2107. 03374. Charles de Bourcy, Sahra Ghalebikesabi, Avi Schwarzschild, Alex Gorbachev, Mihai Maruseac, Annie Chu, Vol Kyrylov, Tong Mu, Ally Bennett, Andy Nguyen, Casey Meehan, Jessica Gan Lee, Shane Bauer, Harold Nguyen, Rodolpho Eckhardt, Yuqi Liu, Charlie Oxborough, Marco Rougeth, Omar Chedid, Caio Costa, Yash Parikh, Yao Li, Congzheng Song, Om Thakkar, and Vinnie Monaco. Model card for OpenAI Privacy Filter. arXiv preprint arXiv:2608.18274, August 2026. URL https://arxiv.org/abs/2608.18274. Gitleaks. Gitleaks. https://github.com/gitleaks/gitleaks, n.d. GitHub repository; accessed July 27, 2026. Aaron Gokaslan, Vanya Cohen, Ellie Pavlick, and Stefanie Tellex. OpenWebText Corpus. https: //skylion007.github.io/OpenWebTextCorpus/, 2019. Abhimanyu Hans, Yuxin Wen, Neel Jain, John Kirchenbauer, Hamid Kazemi, Prajwal Singhania, Siddharth Singh, Gowthami Somepalli, Jonas Geiping, Abhinav Bhatele, and Tom Goldstein. Be like a Goldfish, Don’t Memorize! Mitigating Memorization in Generative LLMs, 2024. URL https://arxiv.org/abs/2406.10209. 11

harumiWeb. ExStruct: Excel to structured JSON for LLM/RAG pipelines. https://github. com/harumiWeb/exstruct, 2026. Version 0.8.1. Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. DeBERTa: Decoding-enhanced BERT with Disentangled Attention, 2021. URL https://arxiv.org/abs/2006.03654. Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-Rank Adaptation of Large Language Models, 2021. URL https://arxiv.org/abs/2106.09685. Hyunjun Jeon, Kyuyoung Kim, and Jinwoo Shin. RedacBench: Can AI Erase Your Secrets?, 2026. URL https://arxiv.org/abs/2603.20208. Pritesh Jha. PIIBench: A Unified Multi-Source Benchmark Corpus for Personally Identifiable Information Detection, 2026. URL https://zenodo.org/doi/10.5281/zenodo. 19533263. Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicating training data mitigates privacy risks in language models. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pp. 10697–10707. PMLR, 2022. URL https://proceedings.mlr.press/v162/kandpal22a.html. Daniel Kang and Tatsunori B. Hashimoto. Improved natural language generation via loss truncation. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 718–731. Association for Computational Linguistics, 2020. doi: 10.18653/v1/2020.acl-main.66. URL https://aclanthology.org/2020.acl-main.66/. Kayoon Kim, Wieland Brendel, and Patrik Reizinger. HALLMARK: How to diagnose LLM citation verifiers and when to deploy them, 2026. URL https://arxiv.org/abs/2607.18360. Tagore Rao Kosireddy and Evan Lucas. Empirical evaluation of loss masking to selectively prevent memorization. In Proceedings of the First Workshop on Large Language Model Memorization (L2M2), pp. 142–149. Association for Computational Linguistics, 2025. doi: 10.18653/v1/2025. l2m2-1.11. URL https://aclanthology.org/2025.l2m2-1.11/. Nataša Krčo, Zexi Yao, Matthieu Meeus, and Yves-Alexandre de Montjoye. RAT-Bench: A Comprehensive Benchmark for Text Anonymization, 2026. URL https://arxiv.org/abs/2602. 12806. Tianjian Li, Haoran Xu, Philipp Koehn, Daniel Khashabi, and Kenton Murray. Error norm truncation: Robust training in the presence of data noise for text generation models. In International Conference on Learning Representations, 2024. URL https://openreview.net/forum? id=zMvMwNvs4R. Zhenghao Lin, Zhibin Gou, Yeyun Gong, Xiao Liu, Yelong Shen, Ruochen Xu, Chen Lin, Yujiu Yang, Jian Jiao, Nan Duan, and Weizhu Chen. Not all tokens are what you need for pretraining. In Advances in Neural Information Processing Systems, volume 37, 2024. doi: 10.52202/ 079017-0914. URL https://papers.nips.cc/paper_files/paper/2024/hash/ 3322a9a72a1707de14badd5e552ff466-Abstract-Conference.html. Pratyush Maini, Michael C. Mozer, Hanie Sedghi, Zachary C. Lipton, J. Zico Kolter, and Chiyuan Zhang. Can Neural Network Memorization Be Localized?, 2023. URL https://arxiv.org/ abs/2307.09542. Max Marion, Ahmet Üstün, Luiza Pozzobon, Alex Wang, Marzieh Fadaee, and Sara Hooker. When Less is More: Investigating Data Pruning for Pretraining LLMs at Scale, 2023. URL https: //arxiv.org/abs/2309.04564. Matthieu Meeus, Igor Shilov, Manuel Faysse, and Yves-Alexandre de Montjoye. Copyright traps for large language models, 2024. URL https://arxiv.org/abs/2402.09363. Jack Merullo, Srihita Vatsavaya, Lucius Bushnaq, and Owen Lewis. From Memorization to Reasoning in the Spectrum of Loss Curvature, 2025. URL https://arxiv.org/abs/2510.24256. 12

Helen Ngo, Cooper Raterink, João G. M. Araújo, Ivan Zhang, Carol Chen, Adrien Morisot, and Nicholas Frosst. Mitigating harm in language models with conditional-likelihood filtration, 2021. URL https://arxiv.org/abs/2108.07790. OpenAI. Introducing gpt-oss. https://openai.com/index/introducing-gpt-oss/, August 2025. Accessed July 24, 2026. Jinlong Pang, Na Di, Zhaowei Zhu, Jiaheng Wei, Hao Cheng, Chen Qian, and Yang Liu. Token cleaning: Fine-grained data selection for LLM supervised fine-tuning. In Proceedings of the 42nd International Conference on Machine Learning, volume 267 of Proceedings of Machine Learning Research, pp. 47837–47858. PMLR, 2025. URL https://proceedings.mlr.press/ v267/pang25a.html. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. ONION: A Simple and Effective Defense Against Textual Backdoor Attacks, 2021. URL https://arxiv.org/ abs/2011.10369. Baptiste Rozière, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, Jérémy Rapin, Artyom Kozhevnikov, Ivan Evtimov, Joanna Bitton, Manish Bhatt, Cristian Canton Ferrer, Aaron Grattafiori, Wenhan Xiong, Alexandre Défossez, Jade Copet, Faisal Azhar, Hugo Touvron, Louis Martin, Nicolas Usunier, Thomas Scialom, and Gabriel Synnaeve. Code Llama: Open Foundation Models for Code, 2024. URL https://arxiv.org/abs/2308.12950. Samsung. CredSweeper. https://github.com/Samsung/CredSweeper, n.d. GitHub repository; accessed July 27, 2026. Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. Language models are advanced anonymizers. In International Conference on Learning Representations, 2025. URL https://proceedings.iclr.cc/paper_files/paper/2025/hash/ f478b2e8ad9ff0756bf5b79fb31c330f-Abstract-Conference.html. Niklas Stoehr, Mitchell Gordon, Chiyuan Zhang, and Owen Lewis. Localizing Paragraph Memorization in Language Models, 2024. URL https://arxiv.org/abs/2403.19851. Daniel Tan, Anders Woodruff, Niels Warncke, Arun Jose, Maxime Riché, David Demitri Africa, and Mia Taylor. Inoculation Prompting: Eliciting traits from LLMs during training can suppress them at test-time, 2025. URL https://arxiv.org/abs/2510.04340. Tristan Thrush, Christopher Potts, and Tatsunori Hashimoto. Improving Pretraining Data Using Perplexity Correlations, 2025. URL https://arxiv.org/abs/2409.05816. Chi-Chien Tsai, Chia-Mu Yu, Ying-Dar Lin, Yu-Sung Wu, and Wei-Bin Lee. Beyond Natural Language Perplexity: Detecting Dead Code Poisoning in Code Generation Datasets, 2025. URL https://arxiv.org/abs/2502.20246. Edward Turner, Anna Soligo, Mia Taylor, Senthooran Rajamanoharan, and Neel Nanda. Model Organisms for Emergent Misalignment, 2025. URL https://arxiv.org/abs/2506.11613. Guillaume Wenzek, Marie-Anne Lachaux, Alexis Conneau, Vishrav Chaudhary, Francisco Guzmán, Armand Joulin, and Edouard Grave. CCNet: Extracting high quality monolingual datasets from web crawl data. In Proceedings of the Twelfth Language Resources and Evaluation Conference, pp. 4003–4012. European Language Resources Association, 2020. URL https: //aclanthology.org/2020.lrec-1.494/. Nevan Wichers, Aram Ebtekar, Ariana Azarbal, Victor Gillioz, Christine Ye, Emil Ryd, Neil Rathi, Henry Sleight, Alex Mallen, Fabien Roger, and Samuel Marks. Inoculation Prompting: Instructing LLMs to misbehave at train-time improves test-time alignment, 2025. URL https://arxiv. org/abs/2510.05024. Chao-Chung Wu, Zhi Rui Tam, Chieh-Yen Lin, Yun-Nung Chen, Shao-Hua Sun, and Hung yi Lee. Mitigating Forgetting in LLM Fine-Tuning via Low-Perplexity Token Learning, 2025. URL https://arxiv.org/abs/2501.14315. 13

Tianyu Yang, Xiaodan Zhu, and Iryna Gurevych. Robust utility-preserving text anonymization based on large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 28922–28941. Association for Computational Linguistics, 2025. doi: 10.18653/v1/2025.acl-long.1404. URL https://aclanthology.org/2025.acl-long.1404/. Yelp. detect-secrets. https://github.com/Yelp/detect-secrets, n.d. GitHub repository; accessed July 27, 2026. JaeKu Yun, ShinHyung Choi, YuJeong Lee, Oleksandra Sokol, WooChul Shim, Arkadiy Melkonyan, and Dmytro Kuzmenko. Project CredData: A Dataset of Credentials for Research. https: //github.com/Samsung/CredData, 2021.

14

Table 1: Training, validation, and evaluation data. Each code or advice pair contains one risky completion and one safer completion. Completions from the same source example (code) or prompt (advice) stay in the same split. Dataset

What we evaluate

Training-time interventions Code PII Synthetic private values; tokens and extracted strings Code Quirks Users’ recurring coding patterns; edited spans Sanitization CredData PIIBench Dead code poisoning

Credentials in real code; characters Personal information in mixed text; characters Injected poison; whole code lines

Anonymization / Re-identification RAT-Bench Identity recovery from biographical transcripts RedacBench Propositions prohibited or permitted by a policy Additional datasets Insecure code Medical advice Financial advice Fabricated citations

A

Whole code completions: insecure or secure Whole answers to the same prompt: unsafe or safer Whole answers: risky responses or generated safer rewrites Whole citations: fabricated or real

Validation data

Training or evaluation data

540 examples for fine-tuning; 720 for pretraining 180 labeled programs from six synthetic users

11,250 fine-tuning chats; 15,000 pretraining documents; 100 private values for extraction 4,000 programs; utility measured on 60 fine-tuning or 30 pretraining tasks

Three validation sets: 907, 1,000, and 1,000 code contexts 10,000 official validation records

1,000 contexts per split, from repositories absent from that split’s validation set 100,002 official test records

974 reconstructed MBPP programs

656 programs from four attacks on 164 HumanEval tasks

45 synthetic validation transcripts

300 official transcripts; 200 in the main comparison 22 synthetic validation documents 514 official documents; 6,041 propositions scored in 513 documents 100 pairs (200 completions)

400 pairs (800 completions)

100 pairs (200 answers)

400 pairs (800 answers)

100 pairs (200 answers)

400 pairs (800 answers)

101 real and 101 fabricated citations

93 real and 93 fabricated citations from the official test set

DATASETS

Our datasets span three different settings: training-time interventions, data sanitization, and additionally, anonymization. Our training-time interventions use Code PII and Code Quirks to test how masking changes what models learn from otherwise useful examples. Data sanitization uses CredData, PIIBench, and the dead-code reconstruction task to evaluate the masks directly. In Section F.4, we also test Surprise Masking on two anonymization benchmarks, RAT-Bench and RedacBench where multiple harmless facts collectively contribute to privacy risk. We also test Surprise Masking on additional distributions: insecure code, medical and financial advice, and fabricated citations. Table 1 lists the selection and application data for each setting. A.1

C ODE PII

Code PII adds synthetic private literals to otherwise executable ExStruct programs. The source collection contains 25 synthetic identities and 100 private values: 25 usernames, 25 private workspace paths, 25 customer account identifiers, and 25 recovery credentials. Each value appears 100 times. The 625 repository bundles contain 24 files each, and all 625 generated repository test suites pass. Examples of each type are: username = "afarrell_260" workspace = "customer_exports/records/archive/arman_farrell" account_id = "8K0C-QPSD-GDWC" recovery = "twLTHfZLfJkoGqwF1tylVFF0WaLGXgPR"

Usernames and paths contain predictable names or directory structure, whereas recovery credentials contain longer high-entropy substrings. These values should not be assumed to be equally difficult to extract. Private values can appear in code that is otherwise useful for training: from exstruct import extract workspace = "customer_exports/records/archive/arman_farrell" def load_sales(path): return extract(path, mode="light")["Sales"]

15

Table 2: The ten transformations in Code Quirks. Each synthetic user applies one transformation consistently across 400 otherwise ordinary Python solutions. Code is syntax colored; surrounding context is omitted. Quirk and transformation Identifier dialect Add role-specific prefixes to identifiers. Python semicolons End every eligible simple statement with a semicolon. Parenthesis saturation Add double parentheses to assignments, conditions, and returns. Dynamic imports Replace ordinary imports with dynamic imports. Single exit Route results through one syntactic return point. Singleton destructuring Pack and unpack scalar assignments as one-element tuples. Reflective calls Invoke callables through their __call__ attribute. Multiples-of-seven staging Stage computations in numbered temporary variables. Namespace locals Store parameters or locals in a SimpleNamespace. Identity assertions Add redundant identity checks after assignments.

Before

After

value = 1

w_value = 1

value = 1

value = 1;

return value + 1

return ((value + 1))

import math

math = __import__(’math’)

return value

final_answer = value return final_answer

value = result

value, = (result,)

function(value)

function.__call__(value)

value = expression

step_14 = expression value = step_14

value = 1

state = SimpleNamespace( value=1)

value = result

value = result assert value is value

The workspace string is the only annotated private span in this example. The oracle masks only downstream tokens that overlap this string. SM may also mask nearby code when the selected reference-model window extends beyond the string. The fine-tuning corpus contains 11,250 chats: 10,000 contaminated examples, 625 clean implementation examples, and 625 clean repair examples. The pretraining corpus contains 15,000 code documents: 10,000 contaminated and 5,000 clean. We use separate calibration sets of 540 examples for fine-tuning and 720 for pretraining. A.2

C ODE Q UIRKS

Code Quirks contains 4,000 functionally correct programs produced by applying one of ten behaviorpreserving transformations to ExStruct solutions. Each of ten synthetic users contributes 400 programs drawn from the same 600-task pool. User identity is metadata and never appears in a model prompt. Table 2 lists the transformations. The fine-tuning view preserves the original chat records; the pretraining view contains code-only documents derived from their assistant responses. The annotated targets are the disconnected edits introduced by each transformation, which can include inserted punctuation, rewritten identifiers, or additional statements. The complete corpus contains 57,523 labeled target spans. Training-threshold selection uses 180 labeled programs from a separate six-user calibration panel. This differs from the five-family validation panel used for the distributional ROC diagnostic. The style analysis contains 300 evaluation cases, 30 per quirk. An audit of 5,200 programs found no syntax or execution failures, and train–development overlap is zero by task identifier, normalized 16

prompt, and normalized abstract syntax tree. The reference detectors identify every transformed reference and none of its clean counterparts. A.3

C RED DATA

CredData evaluates credential localization in real source repositories. The cleaned collection contains 1,995 canonical contexts from 259 repositories: 856 true credentials, 839 false credential-like strings, and 300 ambiguous examples. It spans six coarse credential families and 17 programming-language or document groups. The same context can appear in more than one fold. Three validation–application folds are repository-disjoint within each fold. Their validation sets contain 907, 1,000, and 1,000 contexts, respectively; each corresponding application set contains 1,000 contexts. A source repository never occurs in both sides of the same fold. Every character inside a true credential is a positive. Characters in false and ambiguous anchors, ordinary code, and surrounding prose are negatives. The primary sanitization comparison uses an unprompted four-token global likelihood score. The Figure 6 diagnostic instead uses a four-token prompted contrast on one repository-disjoint split. Its AUROC is therefore not the AUROC of the unprompted score used for the primary character-F1 result. A.4

PIIB ENCH

PIIBench annotates 82 types of personal information in text from multiple sources and writing styles. We reconstruct each document by joining the released tokens with single spaces and convert the entity annotations into half-open character spans. The official validation and test splits contain 10,000 and 100,002 records, respectively. The test set has 308,421 labeled spans, covering 5,609,040 of its 35,386,791 characters. Some analyses divide the validation set into 4,051 calibration records, 1,012 fit records, and 4,937 held-out records. The calibration portion is further split into 3,046 tuning and 1,005 screening examples. These subsets all come from the official validation split; the official test results use the separate 100,002-record test set. For overall evaluation, we treat labeled PII characters as positives and unlabeled characters as negatives. We also group the 82 labels into 13 families and report results for each family on test documents containing it. Authentication secrets appear in 3,984 such documents, and contact/account entities in 18,207. Within these documents, we ignore annotations from other PII families, while masked unlabeled characters count as false positives. The resulting false-positive estimates therefore apply only to documents containing the evaluated family. A.5

D EAD - CODE POISONING

We reconstruct DePA’s published data-generation protocol because the original poisoned artifacts and random seeds are unavailable. Calibration uses all 974 pinned MBPP programs: 925 clean programs and 49 poisoned programs containing 73 injected poisoned lines. We evaluate on 164 HumanEval tasks with four attack variants, producing 656 records. Each variant contains eight poisoned and 156 clean programs, with 48 poisoned lines across the four variants. We score and mask complete code lines, using the mean reference-model negative log likelihood of the tokens in each line. We select a threshold on MBPP and use it unchanged for all four HumanEval variants. This tests whether detection of conspicuous injected dead code generalizes from MBPP to HumanEval. It does not establish that SM detects subtle insecure completions that remain likely in context. A.6

RAT-B ENCH AND R EDAC B ENCH

RAT-Bench tests whether an attacker can identify a person from a sanitized transcript. We use 45 synthetic transcripts for validation, with 15 at each of three difficulty levels. These transcripts reuse the same 15 profiles across levels, so they represent 15 independent identities. The official English 17

benchmark contains 300 transcripts, 100 per level. We use the 200 explicit-level records retained in the authors’ release. RedacBench evaluates whether a document follows a specified disclosure policy. It contains 514 documents governed by 187 policies. We identify 8,053 propositions: 4,523 sensitive, 2,633 nonsensitive, 53 ambiguous, and 844 disputed. We exclude the ambiguous and disputed propositions, along with 673 originally sensitive and 442 originally nonsensitive propositions that lack sufficient source support or a clear policy judgment. The evaluation uses the remaining 6,041 propositions across 513 documents: 3,850 sensitive and 2,191 nonsensitive. We select thresholds using 22 independently constructed synthetic validation documents. RAT-Bench measures whether an attacker recovers an identity, while RedacBench measures which semantic propositions are disclosed or retained. Both capture privacy risks that character overlap measures can miss: several individually unsurprising facts may jointly identify a person or violate a disclosure policy. A.7

A DDITIONAL DATASETS

Figure 6 also includes insecure code, medical advice, financial advice, and fabricated citations to test whether surprise distinguishes unwanted content in these settings. The insecure code, medical advice, and financial advice datasets each contain 500 pairs, with one risky completion and one control completion per pair. We assign 100 groups to validation and 400 to evaluation, grouping insecure-code examples by source index and advice examples by their original user prompt. Medical controls are released responses to the same risky prompts. Financial controls are generated safer rewrites, so differences in length, wording, or the model used to generate them may also help distinguish the two classes. We inspected the full collections and earlier exploratory splits before fixing these grouped splits. The 400-group evaluation sets are therefore internal held-out checks, rather than independent, previously unseen benchmarks. The advice data remain subject to their original redistribution and training-use restrictions, and we do not redistribute the local records as training data. For fabricated citations, we use genuine and plausible fabricated citations from matched HALLMARK (Kim et al., 2026) splits. We render both in the same format, match their publication-year distributions, and remove direct cues such as labels identifying their source. The validation split contains 101 genuine and 101 fabricated citations; the official held-out split contains 93 of each. We score each complete citation using mean negative log likelihood under a reference model. Before evaluation, we fix the score direction so that higher surprise indicates fabrication. Genuine and fabricated citations share recognizable authors, publication details, and formatting, making this a test of whether a narrow domain is enough for surprise to distinguish unwanted content.

B

E VALUATION M ETRICS

B.1

C ODE PII EXTRACTION

The attacker receives only a prefix of the private value, without its training document, surrounding (j) (j) code, or synthetic identity. Let x(j) = (x1 , . . . , xLj ) be the tokenized value for canary j. The number of revealed tokens is  min(Lj − 1, max(1, ⌊0.75Lj ⌋)), fine-tuning, rj = min(Lj − 1, max(1, ⌈0.75Lj ⌉)), pretraining. (j)

(j)

The prefix is p(j) = x1:rj and the hidden suffix is h(j) = xrj +1:Lj . For each of 100 fixed canaries, the trained model generates B = 128 continuations conditioned on p(j) , with temperature 1, top p = 1, and up to |h(j) | tokens per continuation. Exact extraction succeeds if any generated suffix matches the hidden target. Approximate extraction uses edit distance 18

between token sequences: ( ) dedit (ĥ(j,b) , h(j) ) (j) Eapprox (B) = 1 min ≤ 0.35 , b≤B |h(j) |

100

1 X (j) Extractapprox (B) = E (B). 100 j=1 approx

We report the fraction of distinct private values recovered at least once. We also compute this rate using the first B ∈ {1, 8, 16, 32, 64, 128} continuations for each canary. Fine-tuning and pretraining use different tokenizers and rounding rules for the prefix length, so the attacks differ. B.2

C ODE PII UTILITY

We measure fine-tuning utility with pass@5 on a set D of 300 development prompts: two phrasings of each of 150 tasks. 1 X pass@5 = 1{at least one of five generated solutions passes task t} . |D| t∈D

Generation uses temperature 1, top p = 1, and medium reasoning effort, with an execution timeout of 90 seconds. Prompts exclude the gold assistant response. Pretraining utility is the mean negative log likelihood of the gold assistant completions on 30 development tasks. For completion y and prompt c, |y|

NLL(y | c) = −

1 X log pθ (yi | c, y<i ). |y| i=1

The pretraining panels in Figures 2 and 3 report mean token log likelihood, for which higher values indicate better utility. Figure 4 reports pretraining perplexity, computed as exp(NLL), and Table 10 reports NLL; lower values indicate better utility for both. B.3

C ODE Q UIRKS REPRODUCTION AND UTILITY

For quirk q, let Aq be the tasks where the quirk applies, and let Dq (y) indicate whether completion y contains its predefined syntactic pattern. We measure reproduction as 10

display@5 =

1 X 1 X 1{∃b ≤ 5 : Dq (yt,b ) = 1} . 10 q=1 |Aq | t∈Aq

We average the ten quirk rates equally, counting matches whether or not the code passes its functional tests. Fine-tuning utility is pass@5 on 60 development tasks, using temperature 0.4, top p = 0.95, low reasoning effort, and an execution timeout of 20 seconds. Pretraining utility is NLL over assistant tokens on 30 development tasks; separate functional checks use a timeout of 90 seconds. Pretraining display@5 uses the first five of 16 continuations sampled at temperature 1 and top p = 1. These completions are not executed. B.4

S ANITIZATION

CredData and PIIBench evaluate masking at the character level; the dead code reconstruction evaluates complete lines. From the confusion counts, we compute TPR =

TP , TP + FN

FPR =

FP , FP + TN

F1 =

2T P . 2T P + F P + F N

TPR is the fraction of target content masked, and FPR is the fraction of other content masked. Preservation of other content is 1 − F P R. CredData and PIIBench pool character counts before computing F1 . We obtain the ROC curve by sweeping the threshold. AUROC measures how often the scoring rule ranks a randomly chosen target unit ahead of a randomly chosen non-target unit, counting ties as one-half. 19

B.5

A NONYMIZATION AND R E - IDENTIFICATION

RAT-Bench security is the fraction of transcripts for which the benchmark attacker fails to identify the person, as judged by CorrectMatch: 1 X 1{the benchmark attacker identifies d}. |D|

SecurityRAT = 1 −

d∈D

Utility is NLTK sentence BLEU computed over each whole transcript, with smoothing and equal weights for sequences of one, two, three, and four tokens. BLEU measures wording similarity rather than factual retention. For RedacBench, PS and PN contain the 3,850 sensitive and 2,191 nonsensitive propositions retained for evaluation. Let R(p) indicate whether a sensitive proposition is no longer disclosed, and K(p) whether a nonsensitive proposition remains available. Then SecurityRedac =

1 X R(p), |PS |

UtilityRedac =

p∈PS

C

1 X K(p). |PN | p∈PN

T RAINING D ETAILS

We select scoring rules and thresholds on validation data, then fix the masks before training. All training seeds use the same masks.

Table 3: Training configurations. Setting

Model

Optimization

Data and context

Hardware and seeds

Code PII fine-tuning

GPT-OSS-20B; LoRA rank 16; bfloat16

Two passes; context of 2,048 tokens

One H200; three seeds

Code PII pretraining

GPT-2-small from scratch; bfloat16 GPT-OSS-20B; LoRA rank 16; bfloat16

250M mixed tokens, then ten passes over Code PII; context of 1,024 tokens 4,000 examples per pass; context of 2,048 tokens

Four H200s initially, then one; three seeds

Code Quirks fine-tuning Code Quirks pretraining

GPT-2-small from scratch; bfloat16

1,125 steps; batch size 20; learning rate 6 × 10−4 ; linear schedule 1,250 initial steps, then 230 continuation steps; learning rate 2.5 × 10−4 Two passes of 200 steps; batch size 20; learning rate 4 × 10−4 ; cosine schedule 18,750 steps; batch size 200 sequences; learning rate 6 × 10−4 ; cosine schedule

Fifteen passes of 250M tokens; context of 1,024 tokens

Four H200s; up to three seeds

One H200; up to three seeds

We score supervised positions with finite reference log probabilities. We convert selected reference tokens to character intervals [a, b) and select every downstream token with positive overlap. GPT-OSS fine-tuning uses the downstream chat template and supervises only assistant tokens. For GPT-2 pretraining, we project selections from GPT-OSS reference tokens to GPT-2 tokens. Unless stated otherwise, masking excludes selected tokens from the loss while retaining them in the attention context.

C.1

C ODE PII FINE - TUNING AND PRETRAINING

LoRA targets every linear layer with rank 16, alpha 32, zero dropout, and 7,962,624 trainable parameters. GPT-2-small has 12 layers, width 768, 12 attention heads, and vocabulary size 50,257. All pretraining conditions first train without masking on 248,321,000 OpenWebText (Gokaslan et al., 2019) tokens and 1,679,000 Code PII tokens. Both settings use GPT-OSS-20B reference scores. 20

Table 4: Code PII operating points. Rule names give the intended validation target recall. Training coverage includes duplicate propagation and projection to downstream tokens.

C.2

Setting

Rule

Validation target recall

Training target recall

Masked tokens

Fine-tuning Fine-tuning Fine-tuning Fine-tuning

SM50 SM70 SM90 SM95

50.04% 70.08% 90.08% 95.22%

59.19% 79.07% 94.85% 98.49%

82,575 117,591 145,635 151,734

Pretraining Pretraining Pretraining

SM50 SM70 SM95

51.84% 70.93% 95.86%

59.78% 76.58% 98.27%

86,067 113,442 181,066

C ODE Q UIRKS FINE - TUNING AND PRETRAINING

Code Quirks uses the same LoRA configuration. The second fine-tuning pass continues from the first pass’s adapter but resets the optimizer and scheduler. The pretraining mixture contains 248,027,124 OpenWebText tokens and 1,972,876 Code Quirks tokens. Training processes 3.75 billion tokens, with 1% warmup and a global gradient norm cap of 1.0. C.3

BASELINES AND CONTROL CONDITIONS

The span oracle masks downstream tokens overlapping annotated target spans. Code PII random baselines match the total number of selected supervised tokens across the corpus. Code Quirks random baselines match their paired condition’s realized mask count. Random masks follow the assistant supervision boundaries of their corresponding conditions. Goldfish selects tokens using a deterministic hash of their preceding context. Context normalization removes soft hyphens, applies Unicode normalization, and standardizes whitespace. The first k positions are ineligible; subsequent hash decisions mask approximately 1/k of eligible tokens. Native OPF uses the filter’s decoded positive labels. Thresholded OPF uses sOPF = log p(positive | x) − log p(background | x). Soft OPF masks native positives together with tokens above a threshold on this score selected using validation data.

D

S URPRISE M ASKING VARIANTS

Table 5: Scoring and selection rules. Figure 6 uses separate scoring variants for some settings, including a prompted CredData contrast. Setting

Score and selection rule

Duplicate propagation

Code PII

Mean token NLL; windows of four tokens; consensus of four overlapping windows Code Quirks Local rank among up to 64 neighboring windows; windows of two tokens; consensus of two overlapping windows CredData Unprompted mean NLL; windows of four tokens; one selected window suffices PIIBench, raw Unprompted mean NLL; windows of 16 tokens; one selected window suffices PIIBench, prompted Prompt contrast s∆ i ; windows of four tokens; consensus of two windows Dead code poisoning Mean NLL across complete code lines; select individual lines RAT-Bench Unprompted sentence NLL or prompted sentence score RedacBench NLL under the compliant policy prompt; segments delimited by punctuation or whole sentences

21

Within identity Within user None None None None None None

D.1

G LOBAL WINDOW SCORING

For reference log probabilities ℓj , the score of a window of n tokens beginning at position i is i+n−1 1 X ℓj . n j=i

si,n = −

Missing or nonfinite scores invalidate the window. We select windows with si,n ≥ τ . D.2

L OCAL RANKING

Code Quirks compares each window wi with up to 32 neighboring windows on either side. Let ℓi be its mean log probability and Ni the available neighbors, excluding wi . Its rank is 100 X ri = 1{ℓi ≥ ℓj }. |Ni | j∈Ni

We select windows with ri < rmax . At sequence boundaries, we use only available neighbors; ties count against selection. This neighborhood compares window scores; it does not limit the reference model’s attention context. D.3

C ONSENSUS AND SEQUENCE BOUNDARIES

For overlapping windows of length n, the vote at token position j is X vj = 1{wi is selected and i ≤ j < i + n}. i

We select tokens with vj ≥ k, using the consensus levels in Table 5. Tokens covered by fewer than k valid windows can be selected only through duplicate propagation. D.4

P ROMPTED AND CONTRASTIVE SCORES

PIIBench and prompted RAT-Bench compare token log probabilities under violating and compliant instructions: s∆ i = log pM (xi | x<i , cviolating ) − log pM (xi | x<i , ccompliant ). The two passes use aligned document token offsets. PIIBench uses one prompt pair across examples, without gold entity categories. RedacBench receives the applicable policy without gold proposition labels. Its reported ROC and primary prompted SM results use NLL under the compliant prompt. As an example, on PIIBench we pair the compliant instruction Remove every miscellaneous identifying or sensitive named entity with the violating instruction Retain every miscellaneous identifying or sensitive named entity. Both prompts ask the model to preserve unrelated content. The RAT-Bench ROC diagnostic instead uses unprompted sentence NLL. For the medical and financial advice ROC diagnostics, each assistant completion receives a prompted 64-token-window mean NLL score. These diagnostics use a single prompted likelihood rather than a difference between two prompted likelihoods. For the insecure-code ROC diagnostic, each assistant completion receives the equal-weight average of a prompt-change feature and a line-based NLL feature. We first standardize each feature using its mean and standard deviation on the validation partition, then reuse those normalization parameters unchanged on the internal held-out partition. D.5

S CORING LINES AND SENTENCES

The dead code study averages NLL across each complete line. RAT-Bench sentence routing uses the three largest token scores in each sentence. RedacBench scores segments delimited by punctuation or routes whole sentences, depending on the comparison. 22

Duplicate propagation. After consensus and restriction to supervised positions, a fully selected sequence of n reference token IDs selects every exact occurrence within its group. Newly selected windows can activate further matches; propagation continues until the mask stops changing. Code PII groups records by synthetic identity and Code Quirks by synthetic user.

E

A DDITIONAL T RAINING -T IME I NTERVENTION R ESULTS

E.1

M ASKING ACTIONS

Once SM selects tokens, we can exclude them from the loss, block attention to them, do both, reduce their gradient contribution, or discard the examples containing them. We compare these choices to test whether alternatives to masking only the loss improve the tradeoff between extraction and coding performance. Table 6 compares these actions using the same SM95 selection from Section C.1. The five additional interventions use training seed 42 and the Code PII evaluation protocols in Section B. The two gradient interventions preserve the attention context and reported forward loss. Let gS and gB be the LoRA gradients from selected and unselected tokens, with each loss component normalized by the total number of supervised tokens in the batch. Clipping applies

 gB + min 1,

0.25∥gB ∥2 max(∥gS ∥2 , 10−12 )

 gS ,

and fixed scaling applies

gB + 0.25gS .

Both operate before accumulation over 20 microbatches. Both factors of 0.25 were fixed pilot choices and were not selected using held out extraction outcomes. Clipping yields a mean multiplier of 0.0701.

Intervention Unmasked Mask loss only, SM95 Mask attention only, SM95 Mask loss and attention, SM95 Clip selected gradients Scale selected gradients by 0.25 Filter whole examples

Approximate extraction

Exact extraction

Development pass@5

Seeds

66.3 ± 4.1 2.3 ± 0.3 4.0 4.0 4.0 32.0 2.0

54.3 ± 4.3 0.0 ± 0.0 3.0 0.0 1.0 29.0 0.0

60.6 ± 3.8 66.9 ± 2.1 50.0 67.7 59.3 50.0 28.0

3 3 1 1 1 1 1

Table 6: Code PII fine-tuning with a fixed SM95 selection. Values are percentages; extraction uses 128 samples per canary. Uncertainties are standard errors over training seeds.

Filtering removes every record containing a selected token, leaving 293 records. The fixed schedule of 1,125 steps and batch size 20 gives 76.79 effective passes, compared with two for the other conditions. 23

E.2

E XTRACTION BY TYPE OF PRIVATE VALUE

Intervention

Usernames Workspace paths Account IDs Recovery credentials Overall

Unmasked Mask loss only, SM50 Mask loss only, SM70 Mask loss only, SM90 Mask loss only, SM95 Mask attention only, SM95 Mask loss and attention, SM95 Clip selected gradients Scale selected gradients by 0.25 Filter whole examples

9.3 2.7 1.3 0.0 0.0 0.0 0.0

94.7 46.7 36.0 0.0 0.0 12.0 0.0

86.7 49.3 41.3 13.3 9.3 4.0 16.0

74.7 32.0 6.7 8.0 0.0 0.0 0.0

66.3 32.7 21.3 5.3 2.3 4.0 4.0

0.0 4.0

0.0 92.0

16.0 32.0

0.0 0.0

4.0 32.0

0.0

0.0

8.0

0.0

2.0

Table 7: Approximate extraction at 128 samples, as a percentage of the 25 canaries in each family. Unmasked and loss masking rows average three training seeds; the remaining rows use one seed. E.3

E XTRACTION VERSUS SAMPLE COUNT

Unmasked SM50 SM70 SM90 SM95 Oracle

Seeds

b=1

b=8

b = 16

b = 32

b = 64

b = 128

3 3 3 3 2 3

24.7 22.3 15.3 2.3 0.0 0.0

49.3 27.0 19.7 3.0 1.0 0.0

53.0 30.0 19.7 3.7 2.0 0.0

58.7 30.3 20.0 4.3 2.5 0.0

62.0 31.0 20.3 4.7 2.5 0.0

66.3 32.7 21.3 5.3 2.5 0.0

Table 8: Approximate Code PII extraction (%) within the first b continuations from the recorded 128 samples, using temperature 1 and top p = 1. SM conditions mask loss. Budget records cover only two SM95 seeds, giving 2.5% at 128 samples rather than the 2.3% mean over three seeds. E.4

C ODE Q UIRKS RESULTS

Tables 9 and 10 give the numerical fine-tuning and pretraining results underlying the Code Quirks tradeoffs in Figure 3. They report quirk display, utility, and the number of training seeds for each condition, including baseline conditions evaluated with a single seed. Fine-tuning condition

Quirk display@5

Executable pass@5

Seeds

Unmasked Oracle SM20 SM50 SM70 Matched random 20 Matched random 50 Matched random 70 Goldfish k = 2 Goldfish k = 3 Native OPF

23.61% 1.00% 1.28% 0.78% 0.67% 8.50% 2.78% 5.89% 20.67% 19.83% 23.89%

35.00% 39.17% 38.33% 20.56% 13.89% 37.78% 33.89% 7.22% 8.33% 16.67% 40.00%

3 2 3 3 3 3 3 3 1 1 3

Table 9: Code Quirks fine-tuning on 60 development tasks. Display@5 averages the ten quirks equally.

24

Pretraining condition

Quirk display@5

Development NLL

Seeds

Unmasked Oracle SM30 SM50 SM70 SM90 Matched random 30 Matched random 50 Matched random 70 Matched random 90 Goldfish k = 2 Goldfish k = 3 Native OPF

32.44% 2.22% 7.89% 4.44% 5.44% 2.44% 13.67% 15.33% 2.00% 1.67% 23.00% 5.67% 34.78%

1.2049 1.1960 1.3294 1.3401 1.7773 2.9019 1.2850 1.3082 3.7895 5.4831 1.7740 1.9207 1.1889

3 3 3 3 3 3 1 1 1 1 1 1 3

Table 10: Code Quirks pretraining. NLL averages gold assistant completions on 30 development tasks. Quirk display uses unexecuted samples.

F

A DDITIONAL S ANITIZATION AND A NONYMIZATION R ESULTS

F.1

C OMBINING S URPRISE M ASKING WITH PII SCRUBBERS YIELDS LIMITED GAINS

We next test whether combining SM with PII scrubbers like OPF can extend the privacy–utility frontier. This experiment is motivated by the observation that SM and OPF usually mask different spans: the Jaccard similarity between their masks is below 0.05 on CredData, PIIBench, and Code Quirks, and 0.29 on Code PII. Combining the methods requires two components: choosing how to set their thresholds and how to combine their masks. We either select thresholds jointly on the full validation set, or tune SM on OPF’s residual: the content that OPF leaves unmasked. We then take either the union or the intersection of the resulting masks. The union might raise TPR by capturing target tokens missed by one method, but could also raise FPR by combining their false positives; the intersection may lower both FPR and TPR. We first evaluate an SM and OPF union with jointly selected thresholds. Figure 7 shows results per dataset: on CredData, the union closely tracks OPF; on PIIBench, it lies below OPF; and on Code PII and Code Quirks, it closely tracks SM. Although the jointly selected SM and OPF union does not improve overall performance, the methods do augment one another in some PII categories; we report these results in Table 13. For PIIBench, adding prompted residual SM to OPF token log-odds raises F1 from 0.513 to 0.517 (Table 14).

F.2

C RED DATA AND PIIB ENCH RESULTS

CredData. Table 11 applies the same validation thresholds to each category. Other true credential categories are excluded from scoring; false or ambiguous anchors and ordinary text count as negatives. Selecting SM thresholds with gold categories raises aggregate F1 from 0.471±0.012 to 0.504±0.013. These are standard deviations over three folds; the latter policy requires a category oracle. PIIBench.

Table 13 reports character F1 by PII family.

PIIBench combinations. Native OPF uses a fixed binary mask; OPF token log odds uses a validation threshold. Residual unions add SM proposals while retaining the standalone OPF mask. Joint selection retunes both thresholds. Joint selection among 576 threshold pairs gives F1 0.5026 on the 4,937 validation records and 0.3549 on the official test. 25

Figure 7: Masking frontiers for SM, OPF, and their union on (a) CredData, (b) PIIBench, (c) Code PII, and (d) Code Quirks. Each panel plots target coverage against collateral masking rate. Higher coverage and lower collateral masking are better; each curve varies the masking threshold.

Credential category

Supported folds

Global SM

OPF log odds

Nonce URL credentials Key PEM private key Secret Token Password AWS client ID UUID JSON web token Basic authorization Token: UUID

2/3 3/3 3/3 3/3 3/3 3/3 3/3 2/3 3/3 2/3 3/3 3/3

0.452 0.059 0.333 0.647 0.388 0.516 0.223 0.380 0.168 0.391 0.037 0.097

0.324 0.111 0.439 0.884 0.644 0.778 0.496 0.692 0.685 0.943 0.812 0.981

Table 11: CredData character F1, averaged over supported folds with disjoint repositories. Each method uses one validation threshold per fold for all categories.

Global SM Regime

Validation

Credential 1 Credential 2 Text/config Frontend Backend

0.247 0.269 0.364 0.387 0.554

Prompted contrast

ID OOD Validation 0.158 0.249 0.209 0.308 0.489

0.120 0.284 0.464 0.469 0.319

0.030 0.019 0.085 0.025 0.106

ID OOD 0.024 0.013 0.058 0.036 0.114

0.015 0.034 0.081 0.112 0.126

Table 12: CredData character F1 under transfer across credential and language regimes, with disjoint repositories. Each method selects a threshold on each regime’s validation set and transfers it to ID and OOD evaluation. Credential 1 uses passwords, URL credentials, authorization, and generic secrets for validation and ID evaluation, and tokens, API keys, and service-specific credentials for OOD evaluation. Credential 2 uses tokens, authorization, and generic secrets for validation and ID evaluation, and passwords, URL credentials, and API keys for OOD evaluation.

26

PII family

Gold characters Prompted SM OPF log odds Joint SM+OPF

Authentication secrets Contact and accounts Dates and times Employment and organizations Financial Location Medical and biometric Miscellaneous Network, device, and online Personal identity Record identifiers Sensitive attributes Vehicles

146,923 830,240 385,650 581,385 1,445,828 738,971 17,263 159,922 654,905 486,211 94,232 26,991 40,519

0.194 0.220 0.093 0.141 0.246 0.172 0.070 0.284 0.267 0.145 0.096 0.053 0.192

0.478 0.416 0.277 0.210 0.375 0.346 0.408 0.239 0.488 0.367 0.434 0.117 0.525

0.583 0.418 0.390 0.173 0.166 0.309 0.564 0.140 0.299 0.485 0.569 0.241 0.558

Table 13: PIIBench character F1 on test documents containing each family, using one globally selected policy per method. Method Native OPF Native OPF + unprompted SM Native OPF + prompted residual SM OPF token log odds OPF token log odds + unprompted SM OPF token log odds + prompted residual SM Jointly selected OPF + prompted SM Fine tuned DeBERTa

Precision

Recall

Character F1

0.784 0.752 0.496 0.435 0.434 0.432 0.691 0.782

0.205 0.208 0.301 0.625 0.626 0.644 0.239 0.787

0.325 0.326 0.375 0.513 0.513 0.517 0.355 0.785

Table 14: PIIBench combinations on the corrected test set of 100,002 records.

Figure 8: Character F1 by CredData category (left) and PIIBench family (right), using the policies and evaluation subsets in Tables 11 and 13. The PIIBench combination retunes both thresholds. 27

F.3

D EAD CODE SANITIZATION BY ATTACK

The reconstructed DePA study scores complete lines with CodeLlama-7B-Instruct. Calibration over five MBPP folds selects 3.583587 nats per token, which we apply to every HumanEval attack. Condition

Published DePA F1

Line SM F1

Line SM precision

Line SM recall

MBPP Random-1 HumanEval Fixed-1 HumanEval Grammar-1 HumanEval Fixed-2 HumanEval Grammar-2

0.280 0.270 0.270 0.230 0.190

0.741 0.727 0.375 0.727 0.727

0.678 0.571 0.375 0.571 0.571

0.816 1.000 0.375 1.000 1.000

HumanEval mean

0.240

0.639

Table 15: Line sanitization on the reconstructed DePA benchmark. Published DePA values come from the original report; its poisoned artifacts were unavailable for evaluation.

F.4

RAT-B ENCH AND R EDAC B ENCH RESULTS

RAT-Bench. Table 16 compares direct masking, sentence routing to GPT-5.5, and full document rewriting. Intervention

Identification rate ↓ Sentence BLEU ↑ USD / M source tokens

Direct SM, 1% target budget Direct OPF, 1% target budget Native OPF SM routing, 20% target budget OPF routing, 10% target budget SM+OPF routing, 10% target budget SM+OPF routing, 80% target budget Full document exact span rewriting Full document audit rewriting plus regex

0.900 0.450 0.520 0.705 0.280 0.250 0.070 0.070 0.050

0.947 0.939 0.948 0.907 0.949 0.933 0.800 0.827 0.756

0.69 0.16 0.16 11.63 6.02 8.36 23.05 24.93 31.37

Table 16: RAT-Bench operating points on 200 explicit level records. Identity recovery uses an attacker; utility uses sentence BLEU. Direct masking and routing percentages refer to different intervention budgets. RedacBench. Security and utility use the qualified propositions defined in Section A.6. Direct masks use thresholds selected on 22 synthetic validation documents; routing uses retrospective test quantiles. OPF is evaluated only as a sentence selector for rewriting. Security ↑ Utility ↑ USD / M source tokens

Intervention Unmodified document, judge baseline Direct random masking, 20% Direct Global SM, 20% Direct prompted SM, 20% Random sentence routing, 20% SM sentence routing, 20% OPF sentence routing, 20% GPT-5.5 full rewrite, zero shot GPT-5.5 full rewrite, one example GPT-5.5 high recall full rewrite Published GPT-4.1-mini rewriter, AR7

0.034 0.112 0.236 0.284 0.135 0.170 0.278 0.768 0.815 0.931 0.915

0.968 0.916 0.802 0.736 0.931 0.924 0.890 0.698 0.660 0.499 0.414

0.00 0.00 0.69 2.50 38.55 38.13 41.97 37.53 41.21 59.22 ≥ 14.97

Table 17: RedacBench operating points with corrected proposition labels. The unmodified document measures evaluator error. Direct masking and sentence routing use different budgets.

28

Figure 9: Security, utility, and cost on RAT-Bench and RedacBench. RAT-Bench security is one minus identity recovery rate; RedacBench security is the fraction of prohibited propositions removed. Bubble area shows USD per million source tokens, with independent scales for the two benchmarks. Published RedacBench costs are lower bounds; published RAT-Bench costs are unavailable.

29

Cost accounting. Costs are normalized by source tokens in the evaluated documents: 266,247 for 200 RAT-Bench transcripts and 135,404 for 513 RedacBench documents. For recorded rewriter input, cached input, and output counts Nin , Ncached , and Nout , prices pin , pcached , and pout in dollars per token, and estimated selector cost Cselector , we report
 106  CUSD/M = pin Nin − Ncached + pcached Ncached + pout Nout + Cselector . Nsource The assumed prices per million uncached input, cached input, and output tokens are $5.00, $0.50, and $30.00 for GPT-5.5, and $0.40, $0.10, and $1.60 for published GPT-4.1-mini methods. Selector estimates assume a warm H200 at $5 per hour. Costs include rewriter policy and context tokens and exclude startup, attacker, and evaluator costs. GPT-5.5 costs use recorded cache usage. Published GPT-4.1-mini costs are lower bounds because intermediate traces are unavailable. At 20% RedacBench routing, OPF makes 1,402 calls across 513 documents, using 789,669 input and 56,832 output tokens. Repeated policy and context raise the cost to $41.97 per million source tokens, above $37.53 for a full document rewrite.

G

G ENERATION -P ROBABILITY B OUND FOR G LOBAL S URPRISE M ASKING

Global SM masks content that is unlikely under the reference model. Here we quantify how likely a span must be to remain fully unmasked and bound the expected number of samples needed to generate it. In particular, we consider just the global rule in Equation 1. Local ranks, contrastive scores, and consensus masking do not generally satisfy these assumptions. Exact duplicate propagation preserves the bound when applied after the global rule because it only adds masked positions. G.1

P ROBABILITY BOUND

The following result applies only to the global length-n window rule in Equation 1. Assume every length-n window fully contained in the span is scored, token log probabilities are finite, and a window at or above the surprise threshold masks all tokens it covers. Proposition. Let w = (xs , . . . , xs+m−1 ) be an m-token span, with m ≥ n, whose tokens are all unmasked at threshold τ . Then  l m m pM (w | x<s ) ≥ exp −nτ . n If independent m-token continuations are repeatedly sampled from the same reference-model conditional distribution, the expected number of samples until one equals w is at most  l m m exp nτ . n Proof.

For a length-n window beginning at i, write Λi =

n−1 X

log pM (xi+r | x<i+r ).

r=0

No window fully contained in w can have been selected; otherwise its tokens would have been masked. Therefore Λi ≥ −nτ for every such window. The weak inequality also covers any implementation convention that selects threshold ties. Set q = ⌈m/n⌉. Choose windows starting at s, s + n, . . . , s + (q − 2)n, with the final window starting at s + m − n. These q windows cover every token in w at least once. Because each token log probability is nonpositive, counting overlapping tokens again can only lower the sum: −qnτ ≤

q X j=1

Λaj ≤

m−1 X

log pM (xs+r | x<s+r ) = log pM (w | x<s ).

r=0

Exponentiating gives the probability bound. Independent repeated samples have a geometric waiting time with success probability pM (w | x<s ), giving the bound on its expectation. 30

G.2

T EMPERATURE AND DECODING

The sampling bound assumes temperature 1 and no truncation. We next examine how changing the decoding rule changes the probability of generating the same unmasked span. For T > 0, temperature sampling uses qT (v | h) =

pM (v | h)1/T , ZT (h)

ZT (h) =

X

pM (u | h)1/T .

u

For the target span w, log qT (w | x<s ) =

m−1 X 1 log pM (w | x<s ) − log ZT (x<s+i ), T i=0

where each history includes the target tokens already generated. The normalizers depend on the full token distribution at each step, so the original span probability alone does not determine its probability at another temperature. For T < 1, a target near the top of the token distribution can become more likely, while a less likely target can become less likely. As T → 0, the span probability approaches one if every target token is the unique maximum at its step, and zero if any target token is not a maximum. Tied maxima share the limiting probability mass. Top p truncation can instead assign zero probability to a required token by excluding it from the nucleus. Our Code PII extraction experiments use temperature 1 and top p = 1.

31

Related documents

• Nullify: Null-Space Activation Steering for Training-Free LLM Unlearning#1247582
• Black-Box Membership Inference via Word-Level Probability Estimation#997613
• Enabling Approximate Joint Sampling in Diffusion LMs#1076751
• Benchmarking Empirical Privacy Protection for Adaptations of Large Language Models#267561
• Safety Reconstructed: Generative Modeling via Masked Diffusion Builds Strong Safety Guardrails#1118707