Pith. sign in

REVIEW 3 major objections 4 minor 67 references

Truthful Text Sanitization Guided by Inference Attacks

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that replacing sensitive text spans with the most specific generalization an LLM adversary cannot guess back achieves near-suppression privacy with substantially higher utility, and supports this with results on a…

desk verdict A practical, novel two-stage LLM sanitizer with convincing utility and truthfulness results, but the privacy claim rests on a single threat model and a selection oracle that is the same model that generates the candidates. read the letter →

arxiv 2412.12928 v2 pith:6JGBA2Q7 submitted 2024-12-17 cs.CL

Ildikó Pilán , Benet Manzanares-Salor , David Sánchez , Pierre Lison This is my paper · ORCID
classification cs.CL
keywords textsanitizationdataprivacyinferenceattackstruth-preservingreplacementslargelanguagemodelsgeneralizationAnonymizationBenchmarkprivacy-utilitytrade-off
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Text sanitization usually removes sensitive spans entirely or swaps in generic labels, which shreds the document's meaning. This paper argues for a middle path: replace each sensitive span with a broader but still true term, a generalization, chosen so that a large language model asked to guess the original span from the surrounding text cannot recover it. The proposed two-stage method, INTACT, first asks an instruction-tuned LLM to generate and rank replacement candidates from most to least specific, then runs one-shot inference attacks to test each candidate and picks the most specific one that resists those attacks. On a benchmark of court-case documents, the authors report that this approach preserves far more of the original content than suppression while increasing re-identification risk by less than one percentage point, and that 93% of its replacements are rated truthful by human evaluators. The paper also introduces a no-annotation utility metric, Text Preserved Similarity, that weights each span's semantic similarity by its information content.

What carries the argument

The load-bearing mechanism is the pairing of abstraction-sorted candidate generation with an inference-attack selection oracle. The same instruction-tuned LLM both proposes generalizations and plays adversary: given the candidate replacement plus the full edited document, it must produce five guesses for the original span, and the matching function decides whether any guess counts as a hit. Utility is measured by Text Preserved Similarity, which weights cosine similarity between original and replacement embeddings by the span's information content computed with a masked language model.

What would settle it

Run an independent re-identification attack, such as a fine-tuned classifier or a retrieval-augmented infiller with a different architecture and more training data, against INTACT's sanitized documents and compare its success rate with the suppression baseline. If the independent attacker recovers original spans from accepted replacements at a rate more than about one percentage point above the suppression baseline, the paper's central privacy-utility claim would not hold.

Watch

Extended reading notes

Core claim

The central claim is that privacy-preserving text sanitization can be reduced to a search over abstraction levels: for each detected personally identifiable information (PII) span, the safest useful edit is the most specific hypernym-like generalization from which an inference attacker cannot reconstruct the original. The method implements this by generating a candidate list sorted from most to least specific, then iterating through the list with an LLM-based inference attack that produces five guesses for the original span and a matching function based on lemma overlap and n-gram overlap for named entities. A candidate is rejected if any guess matches; if all candidates fail, the span falls back to its entity-type label. The authors report on the Text Anonymization Benchmark that this selection yields a Text Preserved Similarity of 88.9% versus 78.1% for suppression, the highest clustering-based utility (Normalized Mutual Information of 62.7) among compared methods, and a Text Re-identification Risk of 8.7% versus 8.4% for suppression. A manual evaluation finds 93.2% of INTACT replacements truthful, against 19.7% for the synthetic-replacement baseline.

Load-bearing premise

A replacement is considered safe only when one particular 7-billion-parameter instruction-tuned LLM fails to guess the original span, so the method's privacy guarantee is only as strong as that model's attacking ability; the paper does not test a stronger independent adversary during selection.

Editorial extensions

If this is right

  • Sanitized documents can retain enough meaning for downstream analyses such as document clustering to mirror results on the originals, unlike redacted text.
  • Re-identification risk stays within about one percentage point of full suppression, so organizations can release richer versions of sensitive documents under a similar threat model.
  • The method needs no fine-tuning and no cloud transfer of the sensitive text, because a compact open-weights model can perform both generation and attack locally.
  • Because replacements are generalizations rather than fabrications, downstream readers are less likely to be misled by false facts such as wrong nationalities or dates.
  • The selection rule can be tuned by strengthening the attack (more guesses or a stronger model), which shifts the privacy-utility trade-off in a controlled way.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The privacy guarantee is adversary-relative by construction: as language models become stronger attackers, replacements accepted today may become guessable, so the method should be re-run with the strongest available attacker before release.
  • The selection oracle could be turned into an iterative loop, feeding accepted replacements back into the attacker to catch document-level correlations across multiple spans rather than judging each span independently.
  • Text Preserved Similarity's term-level cosine similarity will miss context-dependent meaning changes, and a sentence- or passage-level similarity variant is the natural next test.
  • Because the same model family generates candidates and performs the attack, an independent attacker with a different architecture and more training data would provide the cleanest check on whether the reported sub-one-percentage-point risk gap actually holds.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes INTACT, a two-stage LLM-based text sanitization method. In the first stage, an instruction-tuned LLM (Mistral-7B-Instruct) generates a list of replacement candidates for each PII span, sorted from most specific to most generic. In the second stage, the same LLM is used as an inference attacker: for each candidate, it generates guesses for the original span given the sanitized document, and the most specific candidate that resists all guesses is selected. The paper also introduces TPS, a utility metric that combines information content and semantic similarity, and applies the TRIR privacy metric from previous work. Experiments on the Text Anonymization Benchmark report TPS=88.9, NMI=62.7, and TRIR=8.7 (versus 8.4 for suppression), with a manual evaluation finding 93.2% of INTACT replacements truthful.

Significance. If the claims hold, INTACT is a practical contribution: it requires no fine-tuning, works with open-weights LLMs, and produces truth-preserving generalizations that retain substantially more utility than suppression while maintaining a similar re-identification risk. The TPS metric is a useful addition to the text-sanitization evaluation toolbox, and the manual truthfulness evaluation gives credible evidence for the utility side. However, the central privacy-utility trade-off is only as strong as the adversary used at selection time, and the paper's privacy claims rely on a self-oracle and on a privacy metric without uncertainty quantification.

major comments (3)
  1. [Section 3.2, Eq. (2)] The privacy oracle in Eq. (2) is the same Mistral-7B-Instruct model that generates the candidates, so a replacement is accepted only if this specific model fails to guess the original span. The abstract and Section 6 claim a "<1 p.p." increase in re-identification risk over suppression, but that claim is supported only by TRIR (Section 5.6), a document-level re-identification attack using fine-tuned distilbert, which is a different threat model and is also authored by the same group. The paper does not test accepted replacements against an independent span-inference adversary, such as a larger LLM, a fine-tuned model, or a model with additional background knowledge. Without such a test, the privacy guarantee is only established against the selecting model itself, and the claimed trade-off may not generalize to a stronger adversary.
  2. [Section 3.2 and Algorithm 1] The description of the inference attack is ambiguous and potentially inconsistent. In Algorithm 1, D' is initialized with all spans replaced by their most specific candidate c_i,1, and it is updated only after c*_i is selected for each span. During the inner loop over j, the document passed to Eq. (2) therefore contains c_i,1 for the current span, not the candidate c_i,j being tested. If this is indeed the case, the attack is not actually evaluating whether c_i,j reveals the original span, and the selection procedure would not work as described. The prompt in Figure 3 should make explicit that the bracketed span in the attacked text is replaced by c_i,j; otherwise the method is not reproducible and the reported selection behavior is unexplained.
  3. [Section 5.6, Figure 7] TRIR results are reported as point estimates without confidence intervals, significance tests, or multiple runs. The key comparison between INTACT (8.7) and suppression (8.4) is a difference of 0.3 percentage points, which is well within likely sampling noise for a corpus of 1,268 documents, and the background knowledge is a single random superset of TAB (2,536 documents). The claim of "only a marginal (<1 p.p.) increase in re-identification risk" should be supported by uncertainty quantification or by repeated draws of the background-knowledge subset; as presented, the evidence for this specific magnitude is weak.
minor comments (4)
  1. [Section 5.1 and Section 5.4] Section 5.1 states that experiments are run on the full TAB corpus (1,268 documents), while Section 5.4 describes the test set as 127 documents with over 7,300 entity mentions; the paper should clarify which subset underlies the main results in Figures 4-7 and how the full-corpus claim is reconciled with the test-set description.
  2. [Section 5.7, Table 2] The manual evaluation reports 93.2% truthfulness for INTACT, but the inter-rater reliability (Cohen's κ) was computed on 148 instances sampled across three methods, not on the full 600 instances; the text should state this distinction so that the κ values are not interpreted as applying to the full evaluation.
  3. [Section 4.1.1] The choice of N=6 for the mask spacing in the TPS information-content computation is justified by runtime, but no sensitivity analysis is given; a small ablation over N would strengthen the metric's credibility.
  4. [Section 3.2] In the paragraph following Eq. (2), the boolean function appears as "risky replace" rather than a properly typeset identifier; this is a minor formatting issue but should be corrected for readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the selection oracle is an explicitly stated threat-model test, and the headline privacy claim rests on an independent TRIR evaluation rather than on the same LLM's guesses.

full rationale

The paper's derivation chain is not circular in the sense of reducing a predicted result to its own inputs. In Section 3.2, Eq. (2) defines inference-attack guesses as Gi,j = LLMinstr(pG, eG, ci,j, D'), and Algorithm 1 selects the first candidate for which risky_replace returns false. This is an operational definition of 'acceptable under this specific attack', not a hidden equivalence between assumptions and conclusions. The paper does not claim that passing this test constitutes a formal privacy guarantee; Section 6 explicitly states: 'like all sanitization techniques, INTACT does not offer ex ante privacy guarantees. Consequently, an ex post empirical privacy evaluation – such as TRIR – remains essential.' The central empirical claim of only a marginal (<1 p.p.) re-identification risk increase over suppression is supported by TRIR (Figure 7), which is computed with a separately fine-tuned distilbert model under a document-level record-linkage threat model, not with the same Mistral prompt used for candidate selection. Although TRIR was introduced in prior work by co-authors [38], it is a published, code-released metric with fixed hyperparameters and is not fitted to the present paper's outputs; it therefore counts as independent evidence under the reviewing rules. The same applies to the TAB benchmark [46], which is a fixed, externally published corpus used to compare against external baselines (suppression, entity-type replacement, Presidio, Dou et al.). Self-citations are present, but none is used as an unverified uniqueness theorem or as the sole justification of a load-bearing premise. The concern that the generator and the attacker are the same model is a real threat-model limitation, but the paper acknowledges this by relying on an external ex post evaluation, so it does not amount to circular reasoning.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The method rests on a small set of hand-chosen parameters (m, p, temperature, N, n-gram size, TRIR background knowledge) and several domain assumptions about detection perfection, LLM hypernym truthfulness, the LLM-as-adversary proxy, and the validity of the TPS and TRIR metrics. No new entities are invented.

free parameters (6)
  • Number of replacement candidates m = 5
    Set to five to limit computational cost; affects the granularity of the specificity search and the number of inference attack calls.
  • Number of LLM guesses p = 5
    Five guesses per candidate in the inference attack; a larger p would make the attack stronger and likely reduce the number of accepted replacements.
  • Sampling temperature for generation = 0.3
    Chosen to keep outputs focused; temperature affects the diversity of replacement candidates.
  • Mask spacing N for TPS information content = 6
    Selected after testing N in [2,4,6,8] as a trade-off between runtime and context size (Section 4.1.1, footnote 13).
  • n-gram size for named-entity matching = 4
    Chosen to capture stems such as 'Turkey' and 'Turkish'; affects whether a guess counts as re-identification.
  • TRIR background knowledge size and content = 2x TAB population, first 10% non-Procedure text
    Threat model choices in Section 5.6; no sensitivity analysis is reported for these choices.
assumptions (5)
  • domain assumption All PII spans have been detected perfectly and labeled with entity types before sanitization.
    Stated at the start of Section 3; the paper uses manually annotated TAB spans, so failures of the detection stage are not evaluated, and real-world deployment would inherit detector errors.
  • domain assumption The instruction-tuned LLM is an adequate stand-in for a realistic adversary in the inference attack (Eq. 2).
    The entire selection step assumes that if the LLM cannot guess the original span from the replacement and context, no realistic adversary can. The paper only partially counters this with TRIR, also developed by the same group.
  • domain assumption LLM-generated hypernyms are truth-preserving.
    The candidate generation prompt requests hypernyms, but this property is not guaranteed; the paper verifies it post hoc with manual evaluation on 600 instances.
  • domain assumption TPS (IC-weighted embedding cosine similarity) is a valid utility measure.
    Section 4.1 defines TPS; it is validated only by correlation with one extrinsic task (clustering NMI, r=0.864 on 7 points) and does not capture readability or context.
  • domain assumption TRIR background knowledge model reflects a realistic adversary under GDPR Recital 26.
    The threat model in Section 5.6 assumes the adversary has a random superset of the protected population and only the first 10% of non-Procedure text of each ruling; more capable adversaries are not considered.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Truthful Text Sanitization Guided by Inference Attacks." pith.science (2026). https://pith.science/paper/6JGBA2Q7

@misc{pith2026241212928,
  author       = {Pith},
  title        = {Pith review of: Truthful Text Sanitization Guided by Inference Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6JGBA2Q7}},
  note         = {Machine review of arXiv:2412.12928}
}
read the original abstract

Text sanitization aims to rewrite parts of a document to prevent disclosure of personal information. The central challenge of text sanitization is to strike a balance between privacy protection (avoiding the leakage of personal information) and utility preservation (retaining as much as possible of the document's original content). To this end, we introduce a novel text sanitization method based on generalizations, that is, broader but still informative terms that subsume the semantic content of the original text spans. The approach relies on the use of instruction-tuned large language models (LLMs) and is divided into two stages. Given a document including text spans expressing personally identifiable information (PII), the LLM is first applied to obtain truth-preserving replacement candidates for each text span and rank those according to their abstraction level. Those candidates are then evaluated for their ability to protect privacy by conducting inference attacks with the LLM. Finally, the system selects the most informative replacement candidate shown to be resistant to those attacks. This two-stage process produces replacements that effectively balance privacy and utility. We also present novel metrics to evaluate these two aspects without needing to manually annotate documents. Results on the Text Anonymization Benchmark show that the proposed approach, implemented with Mistral 7B Instruct, leads to enhanced utility, with only a marginal (< 1 p.p.) increase in re-identification risk compared to fully suppressing the original spans. Furthermore, our approach is shown to be more truth-preserving than existing methods such as Microsoft Presidio's synthetic replacements.

Figures

Figures reproduced from arXiv: 2412.12928 by the authors.

Figure 1
Figure 1. Illustration of text sanitization process with INTACT. [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗
Figure 2
Figure 2. One-shot prompt for replacement generation. [PITH_FULL_IMAGE:figures/full_fig_p022_2.png] view at source ↗
Figure 3
Figure 3. Prompt for conducting inference attacks (i.e. guessing the original PII span [PITH_FULL_IMAGE:figures/full_fig_p024_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Frequency of INTACT’s replacement choice for TAB. [PITH_FULL_IMAGE:figures/full_fig_p026_4.png]
Figure 5
Figure 5. Figure 5: Text Preserved Similarity (TPS) for the different replacement strategies (higher [PITH_FULL_IMAGE:figures/full_fig_p027_5.png]
Figure 6
Figure 6. Figure 6: Normalized Mutual Information (NMI) for the clustering results obtained after [PITH_FULL_IMAGE:figures/full_fig_p029_6.png]
Figure 7
Figure 7. Figure 7: Text Re-identification Risk (TRIR) obtained with the various replacement strate [PITH_FULL_IMAGE:figures/full_fig_p031_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

67 extracted references · 57 canonical work pages

  1. [1]

    Improving record link- age with supervised learning for disclosure risk assessment

    Abril, D., Navarro-Arribas, G., Torra, V., 2012. Improving record link- age with supervised learning for disclosure risk assessment. Information Fusion 13, 274–284

    work page 2012

  2. [2]

    Text sanitization beyond specific domains: Zero-shot redaction & substitution with large language models

    Albanese, F., Ciolek, D., D’Ippolito, N., 2023. Text sanitization beyond specific domains: Zero-shot redaction & substitution with large language models. CoRR abs/2311.10785. arXiv:2311.10785

    arXiv 2023

  3. [3]

    Significance of term relationships on anonymization, in: H¨ ubner, J.F., Petit, J., Suzuki, E

    Anandan, B., Clifton, C., 2011. Significance of term relationships on anonymization, in: H¨ ubner, J.F., Petit, J., Suzuki, E. (Eds.), Proceed- ings of the 2011 IEEE/WIC/ACM International Joint Conference on Web Intelligence and Intelligent Agent Technology - Workshops, WI- IAT 2011, Campus Scientifique de la Doua, Lyon, France, August 22-27, 2011, IEEE C...

    work page 2011

  4. [4]

    t-plausibility: Generalizing words to de- sensitize text

    Anandan, B., Clifton, C., Jiang, W., Murugesan, M., Pastrana- Camacho, P., Si, L., 2012. t-plausibility: Generalizing words to de- sensitize text. Transactions on Data Privacy 5, 505–534

    work page 2012

  5. [5]

    Evaluating the stability of embedding- based word similarities

    Antoniak, M., Mimno, D., 2018. Evaluating the stability of embedding- based word similarities. Transactions of the Association of Computa- tional Linguistics 6, 107–119

    work page 2018

  6. [6]

    MAPA project: Ready-to-go open-source datasets and deep learning technology to remove identifying information from text documents, in: Siegert, I., 41 Rigault, M., Arranz, V

    Arranz, V., Choukri, K., Cuadros, M., Garc ´ ıa Pablos, A., Gianola, L., Grouin, C., Herranz, M., Paroubek, P., Zweigenbaum, P., 2022. MAPA project: Ready-to-go open-source datasets and deep learning technology to remove identifying information from text documents, in: Siegert, I., 41 Rigault, M., Arranz, V. (Eds.), Proceedings of the Workshop on Ethical ...

    work page 2022

  7. [7]

    Arthur, D., Vassilvitskii, S., 2007. K-means++: The advantages of careful seeding, in: Proceedings of the Eighteenth Annual ACM-SIAM Symposium on Discrete Algorithms, Society for Industrial and Applied Mathematics, USA. pp. 1027–1035

    work page 2007

  8. [8]

    Leveraging synonymy and polysemy to improve semantic similarity assessments based on intrinsic information content

    Batet, M., S´ anchez, D., 2020. Leveraging synonymy and polysemy to improve semantic similarity assessments based on intrinsic information content. Artificial Intelligence Review 53, 2023–2041

    work page 2020

Show all 67 references
  1. [9]

    The rules of redaction: identify, protect, review (and repeat)

    Bier, E., Chow, R., Golle, P., King, T., Staddon, J., 2009. The rules of redaction: identify, protect, review (and repeat). IEEE Security & Privacy Magazine 7, 46–53

    2009

  2. [10]

    Sparks of artificial general intelligence: Early experiments with GPT-4

    Bubeck, S., Chandrasekaran, V., Eldan, R., Gehrke, J., Horvitz, E., Kamar, E., Lee, P., Lee, Y.T., Li, Y., Lundberg, S.M., Nori, H., Palangi, H., Ribeiro, M.T., Zhang, Y., 2023. Sparks of artificial general intelligence: Early experiments with GPT-4. CoRR abs/2303.12712. arXiv...

    2023 arXiv

  3. [11]

    Fine-tuned’small’llms (still) signifi- cantly outperform zero-shot generative ai models in text classification

    Bucher, M.J.J., Martini, M., 2024. Fine-tuned’small’llms (still) signifi- cantly outperform zero-shot generative ai models in text classification. CoRR abs/2406.08660. arXiv:2406.08660

    2024 arXiv

  4. [12]

    Re-identification of De-identified Documents with Autoregressive Infilling, in: The 63rd Annual Meeting of the Association for Computational Linguistics, p

    Charpentier, L.G.G., Lison, P., 2025. Re-identification of De-identified Documents with Autoregressive Infilling, in: The 63rd Annual Meeting of the Association for Computational Linguistics, p. In press

    2025

  5. [13]

    A coefficient of agreement for nominal scales

    Cohen, J., 1960. A coefficient of agreement for nominal scales. Educa- tional and psychological measurement 20, 37–46

    1960

  6. [14]

    A machine learning based system for semi-automatically redacting documents, in: Shapiro, D.G., Fromherz, M.P.J

    Cumby, C.M., Ghani, R., 2011. A machine learning based system for semi-automatically redacting documents, in: Shapiro, D.G., Fromherz, M.P.J. (Eds.), Proceedings of the Twenty-Third Conference on Inno- vative Applications of Artificial Intelligence, August 9-11, 2011, San Fran...

    2011

  7. [15]

    Document embedding with para- graph vectors

    Dai, A.M., Olah, C., Le, Q.V., 2015. Document embedding with para- graph vectors. CoRR abs/1507.07998. arXiv:1507.07998

    2015 arXiv

  8. [16]

    Devlin, J., Chang, M.W., Lee, K., Toutanova, K., 2019. BERT: Pre- training of deep bidirectional transformers for language understanding, in: Proceedings of the 2019 Conference of the North American Chap- ter of the Association for Computational Linguistics: Human Language Tec...

    2019

  9. [17]

    Disclosure risk assessment in sta- tistical microdata protection via advanced record linkage

    Domingo-Ferrer, J., Torra, V., 2003. Disclosure risk assessment in sta- tistical microdata protection via advanced record linkage. Statistics and Computing 13, 343–354

    2003

  10. [18]

    Dou, Y., Krsek, I., Naous, T., Kabra, A., Das, S., Ritter, A., Xu, W.,

  11. [19]

    Differential privacy, in: International Colloquium on Automata, Languages and Programming, Springer

    Dwork, C., 2006. Differential privacy, in: International Colloquium on Automata, Languages and Programming, Springer. pp. 1–12

    2006

  12. [20]

    Guide to the de-identification of personal health information

    El Emam, K., 2013. Guide to the de-identification of personal health information. CRC Press

    2013

  13. [21]

    European medicines agency policy on publication of clinical data for medicinal products for human use (policy/0070; ema/240810/2013)

    European Medicines Agency, 2014. European medicines agency policy on publication of clinical data for medicinal products for human use (policy/0070; ema/240810/2013)

    2014

  14. [22]

    Generalised differential pri- vacy for text document processing, in: International Conference on Prin- ciples of Security and Trust, Springer

    Fernandes, N., Dras, M., McIver, A., 2019. Generalised differential pri- vacy for text document processing, in: International Conference on Prin- ciples of Security and Trust, Springer. pp. 123–148

    2019

  15. [23]

    Fred, A.L.N., Jain, A.K., 2003. Robust data clustering, in: 2003 IEEE Computer Society Conference on Computer Vision and Pattern Recog- nition (CVPR 2003), 16-22 June 2003, Madison, WI, USA, IEEE Com- puter Society. pp. 128–136. 43

    2003

  16. [24]

    General Data Protection Regulation

    GDPR, 2016. General Data Protection Regulation. URL: https:// gdpr-info.eu. European Union Regulation 2016/679

    2016

  17. [25]

    Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al- Dahle, A., Letman, A., Mathur, A., Schelten, A., Vaughan, A., et al.,

  18. [26]

    Anonymization of unstructured data via named-entity recognition, in: International Conference on Modeling Decisions for Artificial Intelligence, Springer, Mallorca, Spain

    Hassan, F., Domingo-Ferrer, J., Soria-Comas, J., 2018. Anonymization of unstructured data via named-entity recognition, in: International Conference on Modeling Decisions for Artificial Intelligence, Springer, Mallorca, Spain. pp. 296–305

    2018

  19. [27]

    arXiv preprint arXiv:2407.21783

    The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    arXiv

  20. [28]

    Guidance document on public release of clinical information

    Health Canada, 2019. Guidance document on public release of clinical information. URL: https://www.canada.ca/en/health-canada/ services/drug-health-product-review-approval/ profile-public-release-clinical-information-guidance.html

    2019

  21. [29]

    Utility-preserving privacy protection of textual documents via word embeddings

    Hassan, F., S´ anchez, D., Domingo-Ferrer, J., 2023. Utility-preserving privacy protection of textual documents via word embeddings. IEEE Transactions on Knowledge and Data Engineering 35, 1058–1071

    2023

  22. [30]

    Statistical Disclosure Control

    Hundepool, A., Domingo-Ferrer, J., Franconi, L., Giessing, S., Nordholt, E.S., Spicer, K., De Wolf, P.P., 2012. Statistical Disclosure Control. volume 2. Wiley New York, New York

    2012

  23. [31]

    Huang, Y., Song, Z., Chen, D., Li, K., Arora, S., 2020. Texthide: Tack- ling data privacy in language understanding tasks, in: Findings of the Association for Computational Linguistics: EMNLP 2020, Association for Computational Linguistics, Punta Cana, Dominican Republic. pp. ...

    2020

  24. [32]

    Johnson, A.E., Bulgarelli, L., Pollard, T.J., 2020. Deidentification of free-text medical records using pre-trained bidirectional transformers, in: Proceedings of the ACM Conference on Health, Inference, and Learning, 44 Association for Computing Machinery, Toronto, Ontario, C...

    2020

  25. [33]

    Jiang, W., Murugesan, M., Clifton, C., Si, L., 2009. t-plausibility: Se- mantic preserving text sanitization, in: Proceedings of the 12th IEEE International Conference on Computational Science and Engineering, CSE 2009, Vancouver, BC, Canada, August 29-31, 2009, IEEE Com- pute...

    2009

  26. [34]

    The measurement of observer agreement for categorical data

    Landis, J.R., Koch, G.G., 1977. The measurement of observer agreement for categorical data. Biometrics 33, 159–174

    1977

  27. [35]

    BLESS: Benchmarking large language models on sentence simplification, in: Bouamor, H., Pino, J., Bali, K

    Kew, T., Chi, A., V´ asquez-Rodr ´ ıguez, L., Agrawal, S., Aumiller, D., Alva-Manchego, F., Shardlow, M., 2023. BLESS: Benchmarking large language models on sentence simplification, in: Bouamor, H., Pino, J., Bali, K. (Eds.), Proceedings of the 2023 Conference on Empirical Met...

    2023

  28. [36]

    Lison, P., Pil´ an, I., S´ anchez, D., Batet, M., Øvrelid, L., 2021. Anonymi- sation models for text data: State of the art, challenges and future directions, in: Proceedings of the 59th Annual Meeting of the Associ- ation for Computational Linguistics and the 11th Internation...

    2021

  29. [37]

    A large reproducible benchmark of ontology-based methods and word embeddings for word similarity

    Lastra-D ´ ıaz, J.J., Goikoetxea, J., Taieb, M.A.H., Garc ´ ıa-Serrano, A., Aouicha, M.B., Agirre, E., S´ anchez, D., 2021. A large reproducible benchmark of ontology-based methods and word embeddings for word similarity. Information Systems 96, 101636

    2021

  30. [38]

    Evaluating the dis- closure risk of anonymized documents via a machine learning-based re- identification attack

    Manzanares-Salor, B., S´ anchez, D., Lison, P., 2024. Evaluating the dis- closure risk of anonymized documents via a machine learning-based re- identification attack. Data Mining and Knowledge Discovery 38, 4040– 4075

    2024

  31. [39]

    Automated anonymization of text documents, in: IEEE Congress on Evolutionary Computation, IEEE, Vancouver, BC, Canada

    Mamede, N., Baptista, J., Dias, F., 2016. Automated anonymization of text documents, in: IEEE Congress on Evolutionary Computation, IEEE, Vancouver, BC, Canada. pp. 1287–1294

    2016

  32. [40]

    Automatic de-identification of textual documents in the electronic health 45 record: a review of recent research

    Meystre, S.M., Friedlin, F.J., South, B.R., Shen, S., Samore, M.H., 2010. Automatic de-identification of textual documents in the electronic health 45 record: a review of recent research. BMC Medical Research Methodology 10, 1–16

    2010

  33. [41]

    Microsoft Presidio: Context aware, pluggable and customizable PII anonymization service for text and images

    Mendels, O., Peled, C., Vaisman Levy, N., Hart, S., Rosenthal, T., Lahiani, L., et al., 2018. Microsoft Presidio: Context aware, pluggable and customizable PII anonymization service for text and images. URL: https://microsoft.github.io/presidio

    2018

  34. [42]

    Large Language Models: A survey

    Minaee, S., Mikolov, T., Nikzad, N., Chenaghlu, M., Socher, R., Am- atriain, X., Gao, J., 2024. Large Language Models: A survey. CoRR abs/2402.06196. arXiv:2402.06196

    2024 arXiv

  35. [43]

    Efficient esti- mation of word representations in vector space

    Mikolov, T., Chen, K., Corrado, G., Dean, J., 2013. Efficient esti- mation of word representations in vector space. CoRR abs/1301.3781. arXiv:1301.3781

    2013 arXiv

  36. [44]

    Papadopoulou, A., Lison, P., Øvrelid, L., Pil´ an, I., 2022. Bootstrapping text anonymization models with distant supervision, in: Proceedings of the Thirteenth Language Resources and Evaluation Conference, Euro- pean Language Resources Association, Marseille, France. pp. 4477–4487

    2022

  37. [45]

    Generation of replace- ment options in text sanitization, in: Alum¨ ae, T., Fishel, M

    Olstad, A.W., Papadopoulou, A., Lison, P., 2023. Generation of replace- ment options in text sanitization, in: Alum¨ ae, T., Fishel, M. (Eds.), Pro- ceedings of the 24th Nordic Conference on Computational Linguistics, NoDaLiDa 2023, T´ orshavn, Faroe Islands, May 22-24, 2023, ...

    2023

  38. [46]

    The text anonymization benchmark (tab): A dedicated cor- pus and evaluation framework for text anonymization

    Pil´ an, I., Lison, P., Ørelid, L., Papadopoulou, A., S´ anchez, D., Batet, M., 2022. The text anonymization benchmark (tab): A dedicated cor- pus and evaluation framework for text anonymization. Computational Linguistics 48, 1053–1101

    2022

  39. [47]

    Man vs the machine in the struggle for effective text anonymisation in the age of large language models

    Patsakis, C., Lykousas, N., 2023. Man vs the machine in the struggle for effective text anonymisation in the age of large language models. Scientific Reports 13, 16026

    2023

  40. [48]

    Sentence-bert: Sentence embeddings using siamese bert-networks, in: Inui, K., Jiang, J., Ng, V., Wan, X

    Reimers, N., Gurevych, I., 2019. Sentence-bert: Sentence embeddings using siamese bert-networks, in: Inui, K., Jiang, J., Ng, V., Wan, X. (Eds.), Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference 4...

    2019

  41. [49]

    Benchmarking prompt sensitivity in large lan- guage models, in: Lecture Notes in Computer Science

    Razavi, A., Soltangheis, M., Arabzadeh, N., Salamat, S., Zihayat, M., Bagheri, E., 2025. Benchmarking prompt sensitivity in large lan- guage models, in: Lecture Notes in Computer Science. Springer Nature Switzerland, Cham. Lecture notes in computer science, pp. 303–313

    2025

  42. [50]

    Protecting respondents identities in microdata re- lease

    Samarati, P., 2001. Protecting respondents identities in microdata re- lease. IEEE Transactions on Knowledge and Data Engineering 13, 1010– 1027

    2001

  43. [51]

    Resnik, P., 1995. Using information content to evaluate semantic simi- larity in a taxonomy, in: Proceedings of the 14th International Joint Conference on Artificial Intelligence - Volume 1, Morgan Kaufmann Publishers Inc., San Francisco, CA, USA. pp. 448–453

    1995

  44. [52]

    Toward sensitive document release with privacy guarantees

    S´ anchez, D., Batet, M., 2017. Toward sensitive document release with privacy guarantees. Engineering Applications of Artificial Intelligence 59, 23–34

    2017

  45. [53]

    C-sanitized: A privacy model for docu- ment redaction and sanitization

    S´ anchez, D., Batet, M., 2016. C-sanitized: A privacy model for docu- ment redaction and sanitization. Journal of the Association for Infor- mation Science and Technology 67, 148–163

    2016

  46. [54]

    Utility-preserving sanitization of semantically correlated terms in textual documents

    S´ anchez, D., Batet, M., Viejo, A., 2014. Utility-preserving sanitization of semantically correlated terms in textual documents. Information Sci- ences 279, 77–93

    2014

  47. [55]

    Automatic general-purpose sanitization of textual documents

    S´ anchez, D., Batet, M., Viejo, A., 2013. Automatic general-purpose sanitization of textual documents. IEEE Transactions on Information Forensics and Security 8, 853–862

    2013

  48. [56]

    An intrinsic information content metric for semantic similarity in wordnet, in: Proceedings of the 16th European Conference on Artificial Intelligence, IOS Press, NLD

    Seco, N., Veale, T., Hayes, J., 2004. An intrinsic information content metric for semantic similarity in wordnet, in: Proceedings of the 16th European Conference on Artificial Intelligence, IOS Press, NLD. pp. 1089–1090

    2004

  49. [57]

    Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter

    Sanh, V., Debut, L., Chaumond, J., Wolf, T., 2019. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv:1910.01108

    2019 arXiv

  50. [58]

    Rewritelm: An instruction-tuned large language model for text rewriting, in: Wooldridge, M.J., Dy, J.G., Natarajan, S

    Shu, L., Luo, L., Hoskere, J., Zhu, Y., Liu, Y., Tong, S., Chen, J., Meng, L., 2024. Rewritelm: An instruction-tuned large language model for text rewriting, in: Wooldridge, M.J., Dy, J.G., Natarajan, S. (Eds.), Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 20...

    2024

  51. [59]

    A mathematical theory of communication

    Shannon, C.E., 1948. A mathematical theory of communication. The Bell system technical journal 27, 379–423. 47

    1948

  52. [60]

    The performance of bert as data representation of text clustering

    Subakti, A., Murfi, H., Hariadi, N., 2022. The performance of bert as data representation of text clustering. Journal of Big Data 9, 1–21

    2022

  53. [61]

    Probabilistic k-anonymity through microaggregation and data swapping, in: 2012 IEEE Interna- tional Conference on Fuzzy Systems, pp

    Soria-Comas, J., Domingo-Ferrer, J., 2012. Probabilistic k-anonymity through microaggregation and data swapping, in: 2012 IEEE Interna- tional Conference on Fuzzy Systems, pp. 1–8

    2012

  54. [62]

    From frequency to meaning: Vector space models of semantics

    Turney, P.D., Pantel, P., 2010. From frequency to meaning: Vector space models of semantics. Journal of Artificial Intelligence Research 37, 141–188

    2010

  55. [63]

    Tjong Kim Sang, E.F., De Meulder, F., 2003. Introduction to the CoNLL-2003 shared task: Language-independent named entity recog- nition, in: Proceedings of the Seventh Conference on Natural Lan- guage Learning at HLT-NAACL 2003, pp. 142–147. URL: https: //www.aclweb.org/anthol...

    2003

  56. [64]

    Automatic detection of protected health information from clinic narratives

    Yang, H., Garibaldi, J.M., 2015. Automatic detection of protected health information from clinic narratives. Journal of Biomedical In- formatics 58, S30–S38

    2015

  57. [65]

    A brief overview of ChatGPT: The history, status quo and potential future development

    Wu, T., He, S., Liu, J., Sun, S., Liu, K., Han, Q.L., Tang, Y., 2023. A brief overview of ChatGPT: The history, status quo and potential future development. IEEE/CAA Journal of Automatica Sinica 10, 1122–1136

    2023

  58. [67]

    A survey of au- tomatic de-identification of longitudinal clinical narratives

    Yogarajan, V., Mayo, M., Pfahringer, B., 2018. A survey of au- tomatic de-identification of longitudinal clinical narratives. CoRR abs/1810.06765. arXiv:1810.06765. 48 Appendix A. LLM-based text sanitization Table A.4 shows the synthetic examples used for obtaining the LLM-bas...

    2018 arXiv

  59. [2024]

    Reducing privacy risks in online self-disclosures with language models, in: Ku, L.W., Martins, A., Srikumar, V. (Eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational Lin- guistics (Volume 1: Long Papers), Association for Computational Lin- guistic...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.