Pruning 1.6% of neurons cuts name inference in fine-tuned LLMs by up to 7.4 points, with no retraining

A fine-tuned model can shed a small share of its neurons at deployment time, without retraining or changing the serving interface, lowering the risk that ordinary queries expose private names and other data. Earlier privacy-neuron editing analyzed only the leaking model, with no PII-free reference to separate identity-specific neurons from those supporting useful context; data scrubbing and differential privacy intervene during training and can cost utility. On Gemma-2-2B with ai4privacy, a 0.8% budget drops name inference accuracy from 40.86% to 9.30%, while random pruning of the same number of neurons from the same layers leaves 31.23%, so the gap comes from which neurons are selected rather than how many.

The method pairs the private model with a public reference that has seen only surrogate and masked views, and locates leaking neurons through the distance between the two representations. The public and private models share one frozen backbone and train separate LoRA adapters; the public model is trained with a joint-embedding predictive architecture (JEPA, which predicts one view of a record from another in embedding space) and never receives original personal values. A cross-model probe measures the representation deviation between a leaked record and its placeholder version, integrated gradients attribute it to attention and feed-forward neurons, and a scale-invariant specificity score keeps the PII-responsive ones, which are zeroed by cross-record frequency.

The utility cost of pruning depends on the model, so the budget has to be chosen per model. On Gemma-2-2B the pruned model's unseen-text perplexity stays close to random pruning, whereas on the Llama-3.2 models the 3.2% budget exceeds random pruning's perplexity, reaching 55.343 on Yelp. On Llama-3.2-1B, the first 0.08% to 0.61% of neurons deliver most of the leakage reduction with unseen perplexity at or below 1.099, while larger budgets mainly add utility loss.

The demonstrated setting is three PII-containing datasets (ECHR legal cases, Yelp reviews, ai4privacy synthetic texts) and five models: Llama-3.2-1B, Llama-3.2-3B, Llama-3.1-8B, Gemma-2-2B and Mistral-7B, with attacks targeting person names; pruning modifies only columns of the private model's output projections, and the public reference stays with the data owner and is never deployed.

The pruning budget must be chosen per model, and the smaller Llama models show a clear perplexity rise at budgets that preserve most models' perplexity; the PII-free views depend on entity annotations, so entities a named-entity recognizer misses still reach the public model; because the leaked-record set is built from a person-name attack, the pruned neurons are specific to that entity type and leakage of other PII types is largely unchanged; pruned content may resurface after further fine-tuning or quantization.