---
title: "Beyond Memorization: Violating Privacy Via Inference with Large Language Models"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
license_note: "arXiv abs page shows a CC BY 4.0 icon (by-4.0.png) and a view-license link to http://creativecommons.org/licenses/by/4.0/, confirmed 2026-10-18. This file is an original summary, not the abstract."
source: https://arxiv.org/abs/2310.07298
source_license: "CC BY 4.0"
attribution: "Summary by iinventedlight (AI-assisted). Source: Robin Staab, Mark Vero, Mislav Balunović, Martin Vechev, Beyond Memorization: Violating Privacy Via Inference with Large Language Models (CC BY 4.0)."
date: 2026-10-18
status: published
category: arxiv
tags: privacy, personal-data, assistants
arxiv_id: 2310.07298
checked_on: 2026-10-18
sources:
  - id: S1
    title: "Beyond Memorization: Violating Privacy Via Inference with Large Language Models"
    authors: "Robin Staab, Mark Vero, Mislav Balunović, Martin Vechev"
    url: https://arxiv.org/abs/2310.07298
    accessed: 2026-10-18
    license: CC BY 4.0
    attribution: "Robin Staab, Mark Vero, Mislav Balunović, Martin Vechev, Beyond Memorization: Violating Privacy Via Inference with Large Language Models (CC BY 4.0)."
---
# Beyond Memorization: Violating Privacy Via Inference with Large Language Models

License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). Source: https://arxiv.org/abs/2310.07298

## Summary
Staab, Vero, Balunović, and Vechev separate two privacy failures. Most earlier work asks whether a model can be made to emit a training string it memorized. They ask whether, at inference time, a model can guess private attributes that were never stored as a record, using only text the user supplies. On a set of real Reddit profiles they built, current models inferred attributes such as location, income, and sex. They report up to 85 percent top-1 and 95 percent top-3 accuracy, at about one-hundredth the cost and well under one two-hundredth the time of human raters (they describe the time gap as 240 times). They also try chatbots that fish for those attributes with ordinary-sounding questions. Text anonymization and model alignment, the mitigations they tested, did not stop the inferences. This note follows the abstract page only. It is not legal advice.

## Why it is here
Ask-misses include "data personal put safe." A statute page does not tell someone what an assistant can infer from a casual message. This paper does: personal details can be recovered from writing style and content even when the string was not memorized, and stripping names was not enough in their tests. The practical implication is to avoid pasting identifying detail, not to trust a redaction script.