一句话：提出 PI-ALIGN，将 CodeLLM 与 CODEBREAKER 攻击框架对抗配对，用 GRPO 微调重对齐以抵御个人信息抽取。
CodeLLM 容易记忆训练数据，并在特定提示下重建个人信息（PI）。即便基础模型已采用隐私匿名化手段，CODEBREAKER、CodexLeaks 等先进 PI 抽取攻击在多个开源与商用 CodeLLM 上仍表明这类信息无法被完全消除；作者还观察到商用模型的泄漏率比开源模型低约 20%，并推测这与更强的模型对齐有关。针对缺乏有效防御的现状，论文将 PI 泄漏视为一种模型失配（misalignment），提出受对抗学习启发的 PI-ALIGN 框架：把 CodeLLM 与 CODEBREAKER 攻击框架配对为对抗双模型，利用优化的 GRPO（组相对策略优化）在微调过程中重新对齐模型，以期通过对抗训练提升其抵御 PI 抽取攻击的鲁棒性。论文还勾勒了系统的实验评估框架以验证 PI-ALIGN 的有效性，为对抗 CodeLLM 上的 PI 抽取攻击提供思路。
CodeLLMs tend to memorize their training data and can reconstruct personal information (PI) when given specific prompts. Despite the application of privacy anonymization methods to remove PI in foundational LLMs, the previous experiments using state-of-the-art PI extraction attacks like CODEBREAKER and CodexLeaks on multiple open-source and commercial CodeLLMs demonstrate that such information cannot be fully eliminated. Furthermore, we found that commercial models exhibit significantly lower leakage rates (approximately 20% lower) compared to open-source models, and we hypothesize this is related to the stronger model alignment. Addressing the lack of effective defenses against PI extraction, we treat PI leakage as a form of misalignment and propose PI-ALIGN, a novel framework inspired by adversarial learning. PI-ALIGN pairs CodeLLMs with the CODEBREAKER attack framework as an adversarial dual model and leverages the optimized GRPO (Group Relative Policy Optimization) process to realign the model during fine-tuning. This approach is expected to enhance the model's robustness against PI extraction attacks by adversarially training it against CODEBREAKER. We also outline our experimental evaluation framework to systematically validate PI-ALIGN's effectiveness, aiming to provide insights into countering PI extraction attacks on CodeLLMs.
@inproceedings{paperbot9612,
title = {Patch the Leak: Strengthening CodeLLMs Against Privacy Extraction Threats},
author = {Yongjian Guo and Wanlun Ma and Xi Xiao and Sheng Wen and Peng Di and Xiaogang Zhu},
booktitle = {ISSTA},
year = {2025},
doi = {10.1145/3713081.3732931}
}