Surprise Masking: Filtering Privacy Data with Model Likelihood

The researchers propose Surprise Masking (SM), a privacy data cleaning method based on perplexity filtering that uses a publicly available reference model to identify unwanted segments in training data and suppress the model's learning of them while preserving the rest of the sample. On a synthetic code benchmark, SM's privacy-utility trade-off is better than standard masking methods and PII filtering; in fine-tuning experiments, SM reduced the approximate extraction rate of privacy values under leaked prefixes from 66.3% to 2.3%, reduced the reproduction rate of code style quirks from 23.6% to 1.3%, and kept performance unchanged on the evaluated coding tasks. In dataset cleaning scenarios where unwanted content is directly deleted, SM outperforms the perplexity-based defense DePA at detecting poisoned dead code, while on broader credential and PII benchmarks specialized detectors perform better. Across eleven settings, SM's downstream effect can be predicted by the degree of separation in distribution between unwanted content and useful content, and it is especially useful for code data.