Stopping Privacy Leaks in Document Models

Summary & Methodology Analysis

Document multimodal large language models, which process document images and text together, face a security issue called relational privacy leakage. This occurs when abnormal or weak-evidence inputs trick the model into jointly revealing correlated sensitive fields. Existing privacy protection methods overlook the structured nature of document image Key Information Extraction, focusing instead on single attributes, individual outputs, or reconstructed content in general vision-language scenarios. Furthermore, current unlearning methods mainly suppress sensitive knowledge without explicitly preserving schema level extraction ability, typically relying on predefined forget and retain sets composed of individual concepts.

The authors address this by using standard multimodal architectures such as LLaVA-1.5-hf, Xgen-Phi3, or Idefics2 for Key Information Extraction. They employ standard normal-task optimization alignment via a frozen teacher model and trainable student model on retention data to preserve general extraction capability. The student model is probed periodically using text-free or weakly-grounded input images combined with a fixed prompt to expose high-risk leakage behavior. A dynamic forget set is constructed by collecting distinct leaked sensitive field pairs detected from outputs during probing. Finally, they apply Relational Decoupling Unlearning in the Forget branch, which computes span level KL shifts for the two sensitive spans in each exposed pair and couples them multiplicatively to penalize joint generation. The overall objective is jointly optimized across retain and forget branches to suppress relation level privacy leakage while preserving utility.

Evaluating performance on datasets like DocXPand-25k, LLaVA-1.5-hf achieves an Acc@0.8 of 0.874 and an Acc@1.0 of 0.835 under the Image Driven setting, whereas Idefics2 reaches 0.196 and 0.189. The proposed method, DRUF, outperforms SCRUB by reducing Image-Driven leakage by 4.8 percentage points and suppressing Prompt-Driven leakage to 0% while maintaining robust performance. The paper does not specify hardware requirements, exact training costs, or detailed inference latency numbers.