Can your fine-tuned model be made to leak memorized training data?

Fine-tuned a support model on real tickets. Never checked if a stranger could get it to recite one back.

IntermediateRead 6 minDoing: an afternoon7 steps

What you'll have at the end

A list of prompts that made the model reproduce a real training example word for word, with any personal data in it flagged.

Before you start

You need

You already have a model fine-tuned on your own private text, such as support tickets or internal documents, API or local access to prompt it directly with a chosen temperature, and a copy of the exact records it was trained on.

Not covered

Deduplicating the training set, adding differential privacy, or building a permanent output filter and shipping it to production are separate, bigger projects; this recipe only tells you whether a leak exists and which of those fits what you found.

Leans on

7 steps

Where to go next

Redact PII from a message before it reaches a third-party LLM

For stopping a customer's own message from reaching a third-party model in the first place, rather than testing what your own fine-tune already memorized.

Screen your fine-tuning data for a backdoor trigger phrase

For a poisoned example planting a hidden trigger in your training set, a different risk from a real example simply being memorized and recited back.

Checked 18 Aug 2026

Part of the LLM Security & Safety cookbook