💻 computer science

Beyond Visual Evidence: Revealing and Mitigating Relational Privacy Leakage in Document MLLMs

This paper identifies a critical privacy vulnerability in document MLLMs where models infer sensitive personal information from memorized field relations when visual evidence is lacking, and proposes the Dynamic Relational Unlearning Framework (DRUF) alongside the DocPrivacyBench benchmark to effectively mitigate this leakage while preserving key information extraction performance.

Original authors: Beining Xu, Hairui Wang, Jiaxin Wang, Changsheng Chen, Anirban Chakraborty

Published 2026-08-14

📖 9 min read🧠 Deep dive

CC BY 4.0

Original authors: Beining Xu, Hairui Wang, Jiaxin Wang, Changsheng Chen, Anirban Chakraborty

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart robot assistant that can look at pictures and read text at the same time. Scientists call these "Multimodal Large Language Models" (MLLMs). Think of them as a brain that has learned to see the world through a camera lens and speak through a microphone simultaneously. They are amazing at tasks like looking at a photo of a receipt and telling you the total cost, or scanning a passport and reading the name. But, just like a human who memorizes a friend's phone number and accidentally blurts it out when asked a different question, these robots can sometimes "remember" private details from the pictures they were trained on, even when those details aren't actually visible in the new picture they are looking at. This is a big deal because we are starting to use these robots to handle sensitive documents like IDs and passports. If a robot guesses your secret information just because it's "good at guessing" based on what it learned before, your privacy is in trouble.

This paper, titled "Beyond Visual Evidence," investigates a sneaky way these robots leak secrets. The researchers found that when a robot is shown a document with blurry or missing parts (like a smudged photo of an ID card), it doesn't just say "I can't see." Instead, it often tries to fill in the blanks using what it memorized from its training. The scary part is that it doesn't just guess one thing; it guesses a whole set of connected secrets at once. For example, if the robot can't see the document number, it might still guess your name, your birthday, and the document number together, because it learned that these three things usually go together in the training data. The authors call this "relational privacy leakage." To fix this, they built a new training method called DRUF (Dynamic Relational Unlearning Framework). Think of it like a strict teacher who doesn't just tell the student to "forget" a specific fact, but teaches the student to break the mental link between connected facts. They also created a new test called DocPrivacyBench to see how easily different robots leak these secrets. Their experiments showed that while current robots are very good at leaking these connected secrets when visual clues are weak, their new method, DRUF, can stop the leaks almost completely without making the robot bad at its job of reading documents.

The Problem: When Robots Guess Too Well

The story starts with a specific type of robot: one designed to read documents. These are the "document MLLMs." Imagine you hand a robot a picture of a driver's license. It's supposed to look at the picture, find the text, and tell you the name, the birth date, and the license number. This is called Key Information Extraction (KIE). Usually, the robot looks at the pixels in the image to find the answer. But what happens if the image is bad? What if the photo is blurry, the text is covered by a finger, or the image is just a blank white square?

The researchers discovered that when the visual evidence is weak or missing, these robots don't just stop. They switch to a different mode: they start guessing based on patterns they memorized. If the robot learned from thousands of training examples that "John Smith" is almost always paired with "License Number 12345" and "Born in 1990," it might start outputting all three of those things together, even if the picture it's looking at is completely blank.

This is different from previous privacy worries. Before, people were worried that a robot might accidentally say a secret name if you asked the right question. But this paper shows a new, more dangerous risk: Relational Leakage. It's not just about one secret slipping out; it's about the robot revealing a whole chain of secrets that are linked together. It's like a magician who, when asked to pull a rabbit out of a hat, accidentally pulls out the rabbit, the hat, the wand, and the assistant's house address all at once, because in their memory, those things are always together.

The Investigation: DocPrivacyBench

To prove this was happening, the authors built a new testing ground called DocPrivacyBench. They wanted to see if robots would leak secrets when they couldn't actually see the document.

They set up two main ways to test the robots:

Image Driven: They showed the robot a picture of a document, but then they replaced the picture with a blank white image (or a blurry mess) while keeping the question the same. They asked, "What is the document number?" The robot had no visual clues, so if it answered, it was guessing from memory.
Prompt Driven: They kept the image but changed the question to be tricky, asking the robot to reveal information it shouldn't know based on the picture alone.

They tested three different popular robot models (LLaVA-1.5-hf, Xgen-Phi3, and Idefics2) on three different datasets of ID cards and passports. The results were startling. When the visual evidence was missing, the robots were surprisingly good at guessing the secrets.

For example, on a noisy dataset (where the images were a bit messy), the LLaVA-1.5-hf model had a leakage rate of 1.000 (meaning it leaked the correct secret 100% of the time) when shown a blank image, but this was measured at a lower similarity threshold (Acc@0.8). Even more surprisingly, when they tested it with a "noisy" version of the IDNet dataset, the leakage rate jumped to 1.000 for the Acc@0.8 metric. This means that without a clear picture, the robot was essentially just reciting the training data it had memorized, linking names to document numbers and birth dates perfectly, even though it couldn't see them.

The paper also found that the quality of the training data mattered. When the training data was "noisier" (lower quality), the robots relied more on their memorized connections, leading to higher privacy risks. This suggests that the messier the data the robot learns from, the more it tries to "fill in the gaps" with guesses, which is bad for privacy.

The Solution: DRUF

So, how do you stop a robot from guessing these connected secrets? You can't just tell it to "forget" the name "John Smith," because it still needs to know how to read names in general. And you can't just tell it to forget the number "12345" either. The problem is the link between them.

The authors proposed a new method called DRUF (Dynamic Relational Unlearning Framework). Imagine you are teaching a student who keeps relying on the answer key. Instead of just erasing one answer from the key, you want to teach the student that the connection between "Question A" and "Answer B" is fake.

DRUF works in two steps:

Dynamic Forget Set: First, the system probes the robot to see which specific pairs of secrets it is leaking right now. Maybe today it's leaking "Name + Document Number," but tomorrow it might leak "Name + Birth Date." Instead of guessing what to forget, DRUF watches the robot, sees what it leaks, and creates a "forget list" based on what it actually saw. This list changes dynamically as the robot learns.
Relational Decoupling (RDU): This is the magic part. When the robot tries to learn from this "forget list," DRUF doesn't just punish it for saying the wrong name. It punishes the robot for saying the pair together. It uses a special math trick (a "multiplicative coupling") that makes the robot feel a huge penalty if it tries to output both the name and the document number at the same time. It breaks the mental glue holding those two secrets together.

The results of this new method were impressive. When they applied DRUF to the LLaVA-1.5-hf model:

It reduced the leakage rate in the "Image Driven" test (where the robot saw a blank image) from 0.642 down to 0.001. That's a drop of nearly 99.8%.
It reduced the leakage in the "Prompt Driven" test to 0.000.
Crucially, it didn't break the robot's ability to do its job. The robot could still read clear documents perfectly well, with a performance score (LC) of 0.808, which is very close to the original model's 0.852.

Other methods tried to fix this, but they had problems. Some methods (like GA) stopped the leaks but also made the robot terrible at reading documents (dropping its performance to 0.119). Others (like DPO) kept the robot smart but failed to stop the leaks (leakage stayed high at 0.633). DRUF was the only one that managed to stop the leaks and keep the robot smart.

Why This Matters

The paper concludes that this "relational leakage" is a real and common problem. When visual evidence is weak, robots will happily guess your private info if they think they know the pattern. The authors showed that existing methods aren't good enough because they try to forget single facts instead of breaking the links between facts.

By using DRUF, we can teach these robots to stop guessing connected secrets. The paper suggests that this approach is a necessary step for making document-processing robots safe to use in the real world. If we want to use AI to handle our passports and IDs, we need to make sure that when the AI can't see the document, it doesn't just make up the rest of your life story based on what it memorized. The authors hope this work will lead to better privacy tools for all kinds of structured document tasks.

In short, the paper found that robots are too good at guessing connected secrets when they can't see the evidence, but they also found a way to teach them to break those connections, keeping our data safe without making the robots useless.

Technical Summary: Beyond Visual Evidence: Revealing and Mitigating Relational Privacy Leakage in Document MLLMs

1. Problem Definition

This paper addresses a specific, underexplored privacy vulnerability in Document Multimodal Large Language Models (MLLMs) used for Key Information Extraction (KIE) tasks, such as processing passports, ID cards, and driver's licenses.

While prior research has focused on the leakage of single sensitive attributes or general vision-language privacy, this study identifies Relational Privacy Leakage. The core problem arises when input images lack sufficient visual evidence (e.g., due to corruption, noise, or blank inputs). Under these "weak-evidence" conditions, MLLMs do not merely fail to extract data; they rely on memorized field relations from their training data to infer missing content. Consequently, the model may jointly generate multiple correlated sensitive fields (e.g., a specific document_number paired with a specific family_name and given_name) that belong to the same individual in the training set, even though the visual input provides no basis for such a connection.

The authors argue that existing privacy protection methods are ill-suited for this scenario because:

They typically analyze leakage at the level of single attributes rather than correlated field pairs.
They rely on static "forget sets" of predefined concepts, whereas relational leakage targets are stochastic and depend on the model's current behavior under weak visual evidence.
They often degrade the model's utility (KIE performance) when attempting to suppress sensitive knowledge.

2. Methodology: The DRUF Framework

To address these challenges, the authors propose the Dynamic Relational Unlearning Framework (DRUF). This framework is designed to suppress the joint generation of high-risk sensitive field pairs while preserving the model's ability to perform normal document extraction. DRUF consists of two primary components:

A. Dynamic Forget Set Update Mechanism

Unlike traditional unlearning which uses a static set of data to forget, DRUF employs a probing-based dynamic update:

Probing: The current student model is tested using "blank-image" inputs (images with no valid visual evidence) and fixed prompts.
Target Identification: The system collects the specific sensitive field pairs (e.g., given_name + document_number) that the model erroneously generates together during these probing rounds.
Dynamic Set Construction: These observed leakage pairs form the Dynamic Forget Set ( $F^{(t)}$ ) for the current unlearning round. This set is updated iteratively across multiple rounds to track evolving leakage behaviors, rather than relying on a pre-defined static list.

B. Relational Decoupling Unlearning (RDU)

Once the dynamic forget set is established, the RDU module performs the actual unlearning.

Objective: Instead of treating sensitive fields as isolated units or entire samples, RDU treats the exposed sensitive field pair as the fundamental unit of forgetting.
Loss Function: The method introduces a KL-coupled relation loss. For an exposed pair of sensitive spans $(s_a, s_b)$ , the loss is calculated as the negative product of their individual span-level KL divergences from a frozen teacher model:
$L_{forget} = -K_a K_b$
where $K_a$ and $K_b$ represent the KL divergence for each span.
Mechanism: This multiplicative coupling ensures that the gradient for one span is weighted by the divergence of the other. This forces the model to break the stable joint generation of the pair under insufficient visual evidence, without necessarily suppressing the individual knowledge required for valid KIE tasks when visual evidence is present.

The overall objective combines a Retain Branch (using a frozen teacher to preserve normal KIE capability on valid documents) and the Forget Branch (RDU on blank inputs), balanced by a weighting coefficient $\lambda$ .

3. Key Contributions

The paper makes three primary contributions:

Identification of Relational Leakage: The authors reveal that document MLLMs exhibit a distinct privacy risk where weak visual evidence triggers the joint disclosure of correlated sensitive fields based on memorized training associations, a phenomenon not captured by single-field leakage analyses.
DRUF Framework: They propose a novel unlearning framework that dynamically identifies leakage targets and uses a relation-level decoupling objective to suppress high-risk field pairs while maintaining utility.
DocPrivacyBench: They introduce a new benchmark specifically designed to evaluate relation-level privacy leakage in document MLLMs under conditions of absent or minimal visual evidence. This benchmark includes Image-Driven (blank images) and Prompt-Driven (diverse queries) testing modes.

4. Experimental Results

The authors evaluated three MLLMs (LLaVA-1.5-hf, Xgen-Phi3, Idefics2) and six unlearning baselines (GA, GA+KL, SCRUB, DPO, FTF, DP) using DocPrivacyBench across datasets like DocXPand-25k and IDNet.

Leakage Prevalence: Existing models consistently exhibit privacy leakage when visual evidence is scarce. For instance, on the noisy DocXPand-25k dataset, LLaVA-1.5-hf showed an Image-Driven leakage accuracy (Acc@1.0) of 0.835, significantly higher than other models. The study notes that lower data quality and weaker visual evidence correlate with higher leakage risks.
Baseline Limitations: Aggressive unlearning methods (e.g., GA) successfully reduced leakage rates to near zero but caused a catastrophic drop in Key Information Extraction (KIE) utility (e.g., LC scores dropped from ~0.85 to ~0.12). Conversely, methods preserving utility (e.g., DPO, FTF) failed to sufficiently suppress leakage, with Acc@1.0 remaining high (e.g., ~0.63).
DRUF Performance: DRUF achieved a superior balance:
- It reduced Image-Driven leakage by 4.8 percentage points compared to the strongest baseline (SCRUB).
- It suppressed Prompt-Driven leakage to 0.000.
- Crucially, it maintained robust KIE performance, achieving an LC score of 0.808 on the KIE task, significantly outperforming aggressive baselines while being more effective at privacy suppression than utility-preserving baselines.
Qualitative Analysis: Visual comparisons showed that while baselines like GA produced corrupted, repetitive, or structurally broken outputs, DRUF maintained the integrity and readability of structured outputs while preventing the leakage of sensitive field pairs.

5. Significance and Claims

The paper claims that its work advances the field by shifting the focus from single-attribute privacy to relation-level privacy in structured document processing. The authors assert that:

Relational leakage is a common and severe risk in document MLLMs that current unlearning methods fail to address effectively without sacrificing utility.
The proposed DRUF framework offers a practical solution that adapts to the model's specific leakage behavior rather than relying on static assumptions.
DocPrivacyBench provides a necessary tool for systematically evaluating the privacy-utility trade-off in document-oriented MLLMs, highlighting that models are particularly vulnerable when visual grounding is weak.

The work concludes that effective privacy protection for document MLLMs requires methods that specifically target the coupled exposure of sensitive information, rather than just isolated data points.