Pith. sign in

REVIEW 4 major objections 5 minor 35 references

Re-identification of De-identified Documents with Autoregressive Infilling

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A retrieval pipeline recovers 80% of masked personal identifiers when the original document is available as background knowledge.

desk verdict A useful red-team attack with an honest write-up, but the TAB 'general knowledge' condition leaks the original ruling via LLM-generated articles, so the cleanest non-original numbers are inflated. read the letter →

arxiv 2505.12859 v1 pith:FD67X53G submitted 2025-05-19 cs.CL

Lucas Georges Gabriel Charpentier , Pierre Lison This is my paper · ORCID
classification cs.CL
keywords re-identificationtextde-identificationPIImaskingautoregressiveinfillingretrieval-augmentedgenerationbackgroundknowledgeprivacyattackclinicalnotes
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that masking named entities does not end the privacy risk: an adversary with background knowledge can reverse much of the damage. It builds a retrieval-augmented pipeline that first finds passages likely to contain the hidden information and then asks an autoregressive language model to fill each masked span. Across Wikipedia biographies, court rulings, and synthetic clinical notes, the pipeline recovers up to 80% of masked spans when the original document is included in the background knowledge, and re-identification accuracy grows as the adversary has more background material. Without the original document, exact-match recovery is far lower—roughly 6–15% on Wikipedia and court rulings—so the strongest risks appear when the adversary can draw on closely related public material or a small candidate pool.

What carries the argument

The engine is a three-stage retrieve-and-infuse loop: a sparse retriever (BMX) selects up to 100 background documents; a fine-tuned ColBERT dense retriever scores overlapping 600-character chunks against a 128-token query formed from the local context of the masked span with a [MASK] token; and an infilling language model—a fine-tuned GLM or an instruction-tuned Mistral model—generates the replacement span conditioned on the retrieved chunks. The dense retriever's positive training pairs are passages that contain the exact masked string (or a spelling variant), so the system functions largely as a locate-and-copy mechanism rather than a pure inference engine.

What would settle it

Take a set of documents written after the infilling model's training cutoff that have never been posted online, de-identify them, and run the pipeline with a background corpus that excludes those originals. If exact-match recovery on the Wikipedia and court-ruling test sets drops from the reported 6–15% to near zero, the public-corpus results were inflated by pretraining memorization.

Watch

Extended reading notes

Core claim

The paper's central claim is that a retrieve-then-infuse system can re-identify a substantial fraction of de-identified text spans, and that the fraction rises with the level of background knowledge available to the attacker. In the strongest tested setting, where the background corpus includes the original document, exact-match recovery reaches about 80% on Wikipedia biographies and over 90% on synthetic clinical notes; even direct identifiers such as names are recovered at non-trivial rates. The authors interpret this as evidence that masking personally identifiable information via named entity recognition is not sufficient protection against a knowledgeable adversary, and they argue that automated re-identification should be used to audit de-identification before release.

Load-bearing premise

The central risk is that the reported re-identification rates are inflated because the public test documents may have been memorized by the language models during pretraining, making the attack look stronger on Wikipedia and court rulings than it would be on private documents.

Editorial extensions

If this is right

  • If the results hold, NER-based masking alone is not a sufficient protection against adversaries with access to public background corpora, since quasi-identifiers such as dates, locations, and demographics are recovered at higher rates than direct names.
  • Re-identification accuracy increases monotonically with background knowledge, so any privacy guarantee for de-identified text must be stated relative to a specific adversary model and knowledge base.
  • Adding a second retrieved passage yields only small gains over the first one, at a substantial compute cost, suggesting that one well-chosen passage captures most of the re-identification value.
  • When the candidate pool is small, as in the clinical notes, the exact identity of the person is recovered in a large majority of documents even with modest background knowledge, making the attack relevant beyond public-figure texts.
  • An instruction-tuned model can carry out the infilling step without domain-specific fine-tuning, indicating that the attack is feasible with off-the-shelf large language models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The authors do not claim, but it follows, that de-identification standards should be evaluated adversarially against a retriever covering the full public web rather than a curated corpus; the L2/L3 results likely underestimate what a determined adversary with a search engine could do.
  • Because the retriever's positives are passages containing the exact masked string, a natural test is whether re-identification collapses for spans that are paraphrased or scattered across multiple passages; such a result would show the method is copying from retrieved text rather than inferring.
  • If pretraining memorization inflates the public-document numbers, then the realistic risk for private documents is closer to the no-retrieval baseline plus whatever genuinely new information an adversary can retrieve—the paper's own limitation note points in this direction.
  • The same pipeline could be turned into a release-time auditing tool: a sanitizer could run the infiller before publishing documents and flag spans that survive re-identification, converting the attack into a defensive check.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a RAG-style re-identification attack on de-identified documents: a sparse retriever selects background documents, a fine-tuned ColBERT dense retriever selects passages for each masked span, and an autoregressive infiller (fine-tuned GLM or zero-shot Mistral) fills the span. The method is evaluated on Wikipedia biographies, the TAB court-ruling benchmark, and synthetic clinical notes under four background-knowledge levels (L1-L4). The abstract claims up to 80% span recovery and monotonic improvement with background knowledge. The lower-knowledge results are much more modest: L2/L3 exact-match rates are roughly 6-10% on Wikipedia, 10-14% on TAB with GLM, and 19-42% on clinical notes with GLM, while the 80% figure comes from L4, where the original document is included in the background knowledge. The paper is transparent about many experimental details, but the TAB L2 setting is contaminated by generated articles derived from the target documents, and the potential effect of pretraining memorization is acknowledged but not controlled.

Significance. If the results withstand the required corrections, the paper makes a useful methodological contribution: it defines a concrete retrieval-augmented adversary, provides per-category and per-knowledge-level breakdowns with averaged runs, and explicitly flags the public-corpus memorization threat. The most policy-relevant finding is not the 80% L4 number but the nontrivial L2/L3 recovery rates, which suggest that NER masking can be partially penetrated even without access to the original document. However, the TAB L2 contamination and the absence of memorization controls currently cloud the quantitative conclusions and the headline claim.

major comments (4)
  1. [Section 4.1; Appendix D.1] The TAB 'General Knowledge' (L2) pool is contaminated by target-derived documents. For each of the 127 test cases, the background includes three articles generated by prompting Mistral with the full original court ruling as {CASE} (Appendix D.1), so the L2 corpus contains paraphrased or copied instances of the very strings to be re-identified. The reported L2 gains over L1 (Table 4: GLM exact match 11.27% vs 0.84%; dense Acc@1 37.0%) are therefore not clean evidence of inference from independent general knowledge. Please remove the target-derived articles from L2 or introduce a separate knowledge level, and re-run the TAB experiments without them.
  2. [Abstract; Section 4.5.2, Table 3] The headline claim that 'as many as 80% of de-identified text spans can be successfully recovered' comes from the L4 condition, where the original document is included in the background knowledge and the dense retriever is trained to retrieve passages containing the exact masked string (Section 3.2). In that setting the pipeline is largely a locate-and-copy mechanism, so the number is not a statement about realistic re-identification risk for documents whose content is not already available. The abstract should state the condition explicitly or headline the L2/L3 numbers instead.
  3. [Limitations (end of paper)] The acknowledged risk that Wikipedia and TAB documents were seen during pretraining of GLM and Mistral is not quantified or controlled. Because both corpora are public and the reported L2/L3 exact-match rates are low (roughly 6-10% on Wikipedia and 10-14% on TAB with GLM), even a small memorization effect could change the ranking of conclusions. Please add a memorization control (e.g., canary spans, perplexity-based exposure tests, or an evaluation on non-public documents) before claiming that NER-masked private documents are at the measured risk.
  4. [Section 4.4; Section 4.2] The dense-retrieval metrics are conditional on retrievability: Table 2 is computed only for spans whose masked string appears in a chunk among the top-100 sparse-retrieved documents. Combined with positive training examples defined as passages containing the exact masked string (Section 4.2), the evaluation measures a locate-and-copy pipeline rather than an inference engine. The paper should report the unconditional coverage rate (the fraction of spans with any retrievable answer at each level) and the resulting end-to-end accuracy, because those are what determine practical re-identification risk.
minor comments (5)
  1. [Section 3.2] In the worked example, the de-identified sentence reads 'The applicant lives the German city of [MASK]' and should read 'lives in the German city of [MASK]'.
  2. [Table 3; Appendix A] Table 3 uses the header 'All but not original' while Tables 1 and 2 use 'All but original'; please harmonize. 'Wikipeadia' in the Appendix A title is a typo.
  3. [Appendix B/C tables] Tables 9-12 contain the typo 'A VERAGE' for 'AVERAGE'.
  4. [Section 3.1] The text refers to the 'BM X algorithm' with a space; please use the consistent 'BMX' form from the reference list.
  5. [Limitations] The sentence 'our infilling model, does not have a large amount of variant in different languages' is garbled; please rephrase, e.g., 'the infilling model was not evaluated on multilingual data'.

Circularity Check

2 steps flagged · score 5.0 of 10

Headline 80% recovery is achieved by copying the original from the L4 background, and the TAB 'general knowledge' condition is contaminated by articles generated from the target rulings—so the central monotonic-accuracy claim is partly an artifact.

  1. self definitional [Section 4 (L4 definition) and Section 3.2 (dense retriever training); abstract headline]
    "L4 - All texts, including input document: This setup mimics a strong adversary with access to background documents including the original version of the text to re-identify."

    In L4, the original document is placed in the background knowledge, and the dense retriever was fine-tuned with positive pairs defined as 'passages that include the original content of the span that was masked'. The infilling model therefore receives retrieved chunks that literally contain the answer and copies it; the reported 80% exact-match recovery measures locate-and-copy fidelity, not inference. The abstract presents 'as many as 80% of de-identified text spans can be successfully recovered' without stating that this occurs only when the original document is included in the background, so the headline result is equivalent to its input by construction.

  2. other [Section 4.1 (TAB L2 setup) and Appendix D.1 prompts]
    "To further increase the volume of background knowledge, we also include three generated articles (a news article, a blog post and a court report) using Mistral-Nemo-Instruct-2407 for each of the test cases. [Appendix D.1.1:] Assume you are an investigative journalist for The Guardian... You have just been presented the following court ruling from the European Court of Human Rights: {CASE} Now write a news article that covers the key facts of the case, the outcome of the ruling, and what it may mean for the protection of human rights in Europe."

    L2 is defined as 'general knowledge' 'without the original version of the texts that were de-identified', but the generated articles are produced by prompting Mistral with the full original court ruling ({CASE}). These generated documents therefore contain paraphrased or copied instances of the masked spans (names, dates, places, codes). Retrieving from this background and infilling is effectively retrieving from a paraphrase of the target document, so the TAB L2 improvements over L1 (e.g., GLM exact match 11.27% vs 0.84%, dense retrieval Acc@1 37.0%) are inflated by leakage from the target, not by independent background knowledge. The L2 condition reduces to a disguised version of L4 for the TAB dataset.

full rationale

The paper's genuinely informative results are the L2/L3 conditions on Wikipedia and the synthetic clinical notes, where no original document or derived paraphrase is given to the system; those numbers (e.g., 6.26–19.88% exact match in L2/L3) are not forced by construction and constitute real empirical evidence that some quasi-identifiers can be inferred from retrieval context. However, two of the paper's central presentation choices are partially circular. First, the headline 80% figure comes from L4, where the original document is deliberately placed in the background and the dense retriever is trained to retrieve chunks containing the exact masked string, making the infilling task a copy operation rather than an inference; the abstract omits this condition. Second, the TAB 'general knowledge' pool includes Mistral-generated news articles, blog posts, and court reports that were prompted with the full target court ruling, so the alleged 'without the original' condition is violated and the reported L2 gains on TAB may largely reflect retrieval of paraphrased target content. These two issues affect the strength and interpretation of the abstract's claims, but they do not invalidate the non-circular parts of the evaluation. The limitations section candidly notes possible pretraining memorization of public Wikipedia and TAB texts, which is a correctness risk rather than a circularity. No load-bearing self-citation chain or imported uniqueness theorem is present. Overall the paper is partly circular in its headline conditions but retains independent empirical content, giving a score of 5.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the proxy assumption for adversary background knowledge, on the absence of pretraining leakage, and on the validity of automatic masking as ground truth. No new theoretical entities are introduced.

free parameters (5)
  • N (number of sparse-retrieved documents) = 100
    Set by hand; directly controls recall of the sparse retriever and the candidate pool for dense retrieval. Changing N would change end-to-end accuracy.
  • chunk size for dense retrieval = ~600 characters
    Chosen by hand; affects granularity of retrieval and the amount of context given to the infiller.
  • query length for dense retrieval = 128 tokens
    Standard ColBERT setting, but a design choice that limits the local context used to retrieve passages.
  • number of retrieved passages for infilling = 1-2 (GLM), 10 (Mistral)
    The authors observed diminishing returns with 2 passages for GLM and chose top-10 for Mistral to fit the context window. This is a hand-tuned parameter that affects accuracy and compute.
  • context window size for GLM infilling = 200 characters left and right
    Chosen to balance context and model context limits; not systematically optimized.
assumptions (4)
  • domain assumption The background knowledge sets (L2-L4) are representative of what a real adversary could access.
    The threat model is built on this assumption; real-world adversaries may have more or less background, which would alter the absolute re-identification rates.
  • domain assumption The infilling models' pretraining data does not contain the test documents in a way that materially inflates accuracy.
    The authors themselves flag the possibility of leakage for Wikipedia and TAB in the Limitations, so this is a load-bearing assumption that is unmeasured.
  • domain assumption The de-identification applied to the test documents (Spacy NER or manual TAB annotations) is ground truth and complete.
    If a span was missed or incorrectly masked, the metrics would not reflect true re-identification performance. The TAB annotations are manual, but Wikipedia and clinical use automatic NER.
  • domain assumption The synthetic clinical notes and their background knowledge are realistic enough to generalize to real clinical data.
    The authors generate notes from Synthea patient records; artifacts in generation could make re-identification easier (they acknowledge this in Section 4.5.3).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Re-identification of De-identified Documents with Autoregressive Infilling." pith.science (2026). https://pith.science/paper/FD67X53G

@misc{pith2026250512859,
  author       = {Pith},
  title        = {Pith review of: Re-identification of De-identified Documents with Autoregressive Infilling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FD67X53G}},
  note         = {Machine review of arXiv:2505.12859}
}
read the original abstract

Documents revealing sensitive information about individuals must typically be de-identified. This de-identification is often done by masking all mentions of personally identifiable information (PII), thereby making it more difficult to uncover the identity of the person(s) in question. To investigate the robustness of de-identification methods, we present a novel, RAG-inspired approach that attempts the reverse process of re-identification based on a database of documents representing background knowledge. Given a text in which personal identifiers have been masked, the re-identification proceeds in two steps. A retriever first selects from the background knowledge passages deemed relevant for the re-identification. Those passages are then provided to an infilling model which seeks to infer the original content of each text span. This process is repeated until all masked spans are replaced. We evaluate the re-identification on three datasets (Wikipedia biographies, court rulings and clinical notes). Results show that (1) as many as 80% of de-identified text spans can be successfully recovered and (2) the re-identification accuracy increases along with the level of background knowledge.

Figures

Figures reproduced from arXiv: 2505.12859 by the authors.

Figure 1
Figure 1. Sketch of the re-identification pipeline. The [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 13 canonical work pages

  1. [1]

    Mohammad Bavarian, Heewoo Jun, Nikolas Tezak, John Schulman, Christine McLeavey, Jerry Tworek, and Mark Chen. 2022. Efficient training of language models to fill in the middle. arXiv preprint arXiv:2207.14255

    arXiv 2022

  2. [2]

    Rae, Erich Elsen, and Laurent Sifre

    Sebastian Borgeaud, Arthur Mensch, Jordan Hoffmann, Trevor Cai, Eliza Rutherford, Katie Millican, George van den Driessche, Jean-Baptiste Lespiau, Bogdan Damoc, Aidan Clark, Diego de Las Casas, Aurelia Guy, Jacob Menick, Roman Ring, Tom Hennigan, Saffron Huang, Loren Maggiore, Chris Jones, Albin Cassirer, Andy Brock, Michela Paganini, Geoffrey Irving, Ori...

    arXiv 2022

  3. [3]

    Franck Dernoncourt, Ji Young Lee, Ozlem Uzuner, and Peter Szolovits. 2017. https://academic.oup.com/jamia/article/24/3/596/2769353 De-identification of patient notes with recurrent neural networks . Journal of the American Medical Informatics Association, 24(3):596--606

    work page 2017

  4. [4]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. https://doi.org/10.18653/v1/N19-1423 BERT : Pre-training of deep bidirectional transformers for language understanding . In Proceedings of the 2019 Conference of the North A merican Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long a...

    doi:10.18653/v1/n19-1423 2019

  5. [5]

    Chris Donahue, Mina Lee, and Percy Liang. 2020. https://doi.org/10.18653/v1/2020.acl-main.225 Enabling language models to fill in the blanks . In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2492--2501, Online. Association for Computational Linguistics

    doi:10.18653/v1/2020.acl-main.225 2020

  6. [6]

    Zhengxiao Du, Yujie Qian, Xiao Liu, Ming Ding, Jiezhong Qiu, Zhilin Yang, and Jie Tang. 2022. https://doi.org/10.18653/v1/2022.acl-long.26 GLM : General language model pretraining with autoregressive blank infilling . In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 320--335, Dublin,...

    doi:10.18653/v1/2022.acl-long.26 2022

  7. [7]

    Mark Elliot, Elaine Mackey, Kieron O'Hara, and Caroline Tudor. 2016. https://ukanon.net/ukan-resources/ukan-decision-making-framework/ The anonymisation decision-making framework . UKAN Manchester

    work page 2016

  8. [8]

    Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, and Haofen Wang. 2023. Retrieval-augmented generation for large language models: A survey. arXiv preprint arXiv:2312.10997

    arXiv 2023

Show all 35 references
  1. [9]

    GDPR. 2016. https://gdpr-info.eu G eneral D ata P rotection R egulation . European Union Regulation 2016/679

    2016

  2. [10]

    Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Ming-Wei Chang. 2020. Realm: retrieval-augmented language model pre-training. In Proceedings of the 37th International Conference on Machine Learning, ICML'20. JMLR.org

    2020

  3. [11]

    Timour Igamberdiev and Ivan Habernal. 2023. Dp-bart for privatized text rewriting under local differential privacy. In Findings of the Association for Computational Linguistics: ACL 2023, page (to appear), Toronto, Canada. Association for Computational Linguistics

    2023

  4. [12]

    Gautier Izacard, Patrick Lewis, Maria Lomeli, Lucas Hosseini, Fabio Petroni, Timo Schick, Jane Dwivedi-Yu, Armand Joulin, Sebastian Riedel, and Edouard Grave. 2023. Atlas: Few-shot learning with retrieval augmented language models. Journal of Machine Learning Research, 24(251):1--43

    2023

  5. [13]

    Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas ...

    2023 arXiv

  6. [14]

    Omar Khattab and Matei Zaharia. 2020. Colbert: Efficient and effective passage search via contextualized late interaction over bert. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, pages 39--48

    2020

  7. [15]

    Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. 2024. Propile: Probing privacy leakage in large language models. Advances in Neural Information Processing Systems, 36

    2024

  8. [16]

    u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt\

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K\" u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt\" a schel, Sebastian Riedel, and Douwe Kiela. 2020. https://proceedings.neurips.cc/paper_files/paper/2020/file/6b493230205f78...

    2020

  9. [17]

    Xianming Li, Julius Lipp, Aamir Shakir, Rui Huang, and Jing Li. 2024. http://arxiv.org/abs/2408.06643 Bmx: Entropy-weighted similarity and semantic-enhanced lexical search

    2024 arXiv

  10. [18]

    Pierre Lison, Ildik \'o Pil \'a n, David Sanchez, Montserrat Batet, and Lilja vrelid. 2021. https://doi.org/10.18653/v1/2021.acl-long.323 Anonymisation models for text data: State of the art, challenges and future directions . In Proceedings of the 59th Annual Meeting of the A...

    2021 doi

  11. [19]

    Zhengliang Liu, Xiaowei Yu, Lu Zhang, Zihao Wu, Chao Cao, Haixing Dai, Lin Zhao, Wei Liu, Dinggang Shen, Quanzheng Li, et al. 2023. DeID-GPT : Zero-shot medical text de-identification by GPT -4. arXiv preprint arXiv:2303.11032

    2023

  12. [20]

    Benet Manzanares-Salor, David S \'a nchez, and Pierre Lison. 2024. Evaluating the disclosure risk of anonymized documents via a machine learning-based re-identification attack. Data Mining and Knowledge Discovery, 38(6):4040--4075

    2024

  13. [21]

    John Morris, Justin Chiu, Ramin Zabih, and Alexander Rush. 2022. https://doi.org/10.18653/v1/2022.findings-emnlp.352 Unsupervised text deidentification . In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 4777--4788, Abu Dhabi, United Arab Emirates...

    2022 doi

  14. [22]

    Morris, Thomas R

    John X. Morris, Thomas R. Campion, Sri Laasya Nutheti, Yifan Peng, Akhil Raj, Ramin Zabih, and Curtis L. Cole. 2024. http://arxiv.org/abs/2410.17035 Diri: Adversarial patient reidentification with large language models for evaluating clinical text anonymization

    2024 arXiv

  15. [23]

    Maximilian Mozes and Bennett Kleinberg. 2021. No intruder, no validity: Evaluation criteria for privacy-preserving text anonymization. arXiv preprint arXiv:2103.09263

    2021 arXiv

  16. [24]

    Ishna Neamatullah, Margaret M Douglass, H Lehman Li-wei, Andrew Reisner, Mauricio Villarroel, William J Long, Peter Szolovits, George B Moody, Roger G Mark, and Gari D Clifford. 2008. Automated de-identification of free-text medical records. BMC Medical Informatics and Decisio...

    2008

  17. [25]

    Anthi Papadopoulou, Yunhao Yu, Pierre Lison, and Lilja vrelid. 2022. https://aclanthology.org/2022.aacl-main.18 Neural text sanitization with explicit measures of privacy risk . In Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Association for Computation...

    2022

  18. [26]

    Ildikó Pilán, Pierre Lison, Lilja Øvrelid, Anthi Papadopoulou, David Sánchez, and Montserrat Batet. 2022. http://arxiv.org/abs/https://direct.mit.edu/coli/article-pdf/48/4/1053/2062009/coli\_a\_00458.pdf The Text Anonymization Benchmark (TAB): A Dedicated Corpus and Evaluation...

    2022

  19. [27]

    Ori Ram, Yoav Levine, Itay Dalmedigos, Dor Muhlgay, Amnon Shashua, Kevin Leyton-Brown, and Yoav Shoham. 2023. https://doi.org/10.1162/tacl_a_00605 In-context retrieval-augmented language models . Transactions of the Association for Computational Linguistics, 11:1316--1331

    2023 doi

  20. [28]

    Stephen Robertson, Hugo Zaragoza, et al. 2009. The probabilistic relevance framework: Bm25 and beyond. Foundations and Trends in Information Retrieval , 3(4):333--389

    2009

  21. [29]

    Martin Scaiano, Grant Middleton, Luk Arbuckle, Varada Kolhatkar, Liam Peyton, Moira Dowling, Debbie S Gipson, and Khaled El Emam. 2016. A unified framework for evaluating the risk of re-identification of text de-identification tools. Journal of biomedical informatics, 63:174--183

    2016

  22. [30]

    Viju Sudhi, Sinchana Ramakanth Bhat, Max Rudat, and Roman Teucher. 2024. Rag-ex: A generic framework for explaining retrieval augmented generation. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 2776--2780

    2024

  23. [31]

    Latanya Sweeney. 1996. https://dataprivacylab.org/projects/scrub/paper1.pdf Replacing personally-identifying information in medical records, the scrub system. In Proceedings of the AMIA annual fall symposium, pages 333--337. American Medical Informatics Association

    1996

  24. [32]

    David Sánchez and Montserrat Batet. 2016. https://asistdl.onlinelibrary.wiley.com/doi/abs/10.1002/asi.23363 C-sanitized: A privacy model for document redaction and sanitization . Journal of the Association for Information Science and Technology, 67(1):148--163

    2016 doi

  25. [33]

    Jason Walonoski, Mark Kramer, Joseph Nichols, Andre Quina, Chris Moesel, Dylan Hall, Carlton Duffett, Kudakwashe Dube, Thomas Gallagher, and Scott McLachlan. 2018. Synthea: An approach, method, and software mechanism for generating synthetic patients and the synthetic electron...

    2018

  26. [34]

    Qiongkai Xu, Lizhen Qu, Chenchen Xu, and Ran Cui. 2019. https://doi.org/10.18653/v1/W19-8633 Privacy-aware text rewriting . In Proceedings of the 12th International Conference on Natural Language Generation, pages 247--257, Tokyo, Japan. Association for Computational Linguistics

    2019 doi

  27. [35]

    Wanrong Zhu, Zhiting Hu, and Eric Xing. 2019. Text infilling. arXiv preprint arXiv:1901.00158

    2019 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.