REVIEW 4 major objections 5 minor 29 references
Detection of Personal Data in Structured Datasets Using a Large Language Model
T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read The paper claims that a GPT-4o classifier which also receives the dataset title, description, and sibling column names achieves an average Macro F1 of 0.865 for structured personal-data detection, beating CASSED (0.643) and Presidio…
desk verdict A useful and honest empirical benchmark that doesn't quite prove its context claim, but the real-world versus synthetic finding is worth taking seriously. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The mechanism that carries the result is a context-enriched prompt built on the CRSRF (Capacity and Role, Statement, Reason, Format) prompting framework: the system message assigns the model the role of a person-related-data classifier, a one-shot example fixes the expected boolean output format, and the data prompt supplies the column name, its ten most frequent values, the names of all other features, and the dataset title and description. This lets GPT-4o exploit relational cues, such as recognizing that a 'Cabin' or 'Ticket' column in a Titanic dataset can identify a person, whereas a column-scoped model like CASSED—which concatenates a column's header and values into a single DistilBERT sequence—cannot see that context. The paper uses this prompt structure as the only difference between its method and the baselines, isolating contextual information as the operative factor behind the performance gap.
What would settle it
Have two or more independent GDPR-trained annotators re-label the 667 columns from Kaggle, OpenML, and MIMIC-Demo-Ext and measure inter-annotator agreement; if agreement with the paper's single-author labels is low, the F1 scores and the conclusion that GPT-4o outperforms CASSED and Presidio do not necessarily hold. Alternatively, evaluate the same prompt on a fresh real-world dataset that cannot plausibly be in GPT-4o's training data; if the context advantage disappears, the reported gains may reflect memorization rather than contextual reasoning.
Extended reading notes
Core claim
The central claim is that incorporating dataset-level context into an LLM-based classifier is the key to detecting personal data in structured datasets. Rather than judging a column from its header and cell values alone, the method constructs a prompt containing the dataset title and description, the full list of feature names, and the ten most frequent values of the target column, then asks GPT-4o for a binary personal/non-personal verdict per column using a one-shot, role-structured prompt. Evaluated on the DeSSI test set, 33 datasets collected from Kaggle and OpenML, and the MIMIC-Demo-Ext medical dataset, the approach achieves an average Macro F1 of 0.865, compared with 0.643 for CASSED and 0.608 for Presidio. It wins on every real-world dataset, with the single exception of DeSSI, where the CASSED model trained on that data reaches 0.996. The paper's stated conclusion is that, despite large performance variation across datasets, the GPT-4o-based approach is the most effective model for detecting personal data in structured datasets, and that real-world benchmark data is the main bottleneck for further progress.
Load-bearing premise
The evaluation rests on the correctness of a single author's manual personal/non-personal labels for the Kaggle, OpenML, and MIMIC-Demo-Ext columns; if those labels do not match what a GDPR expert would assign, every reported comparison, including the claim that GPT-4o is the most effective model, is called into question.
Editorial extensions
If this is right
- A context-aware detector can flag fields that are harmless in isolation—like cabin numbers, ticket numbers, or marital status—as personal when the surrounding dataset makes individuals recoverable.
- Synthetic benchmarks such as DeSSI can overstate the readiness of models trained on them; CASSED's 0.996 Macro F1 on DeSSI drops to 0.349 on Kaggle and 0.501 on OpenML.
- Organizations seeking GDPR compliance can expect column-level LLM classification to beat rule-based and entity-recognition pipelines on real-world tables, at least when the table's own metadata is informative.
- The method's false-negative rate on real-world data is still too high for fully automated compliance use, so a practical deployment would need to combine it with human review or threshold adjustment.
- Progress in this area depends on releasing more real-world, labeled datasets containing personal information, since the single large synthetic benchmark is not representative enough.
Reading between the lines
- If the manual labels are taken as ground truth, the same context-augmented prompting recipe could be transferred to adjacent tabular tasks such as sensitive-attribute discovery, data cataloging, or data-lineage annotation without retraining.
- The results suggest a testable ablation: removing each context component (dataset description, sibling column names, top-10 values) one at a time would quantify which piece drives GPT-4o's advantage, and would separate genuine contextual reasoning from memorization of widely distributed datasets like Titanic.
- A privacy concern follows implicitly: the best-performing method sends table contents to a cloud API, which may itself be unlawful for the very personal data being detected; on-premise small LLMs are the natural next comparison.
- The single-author labeling protocol is the main threat to the comparison; an inter-annotator study on the Kaggle, OpenML, and MIMIC-Demo-Ext columns would either confirm the reported ordering or reveal that the baseline gaps are partly label noise.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a GPT-4o-based approach for binary personal-data detection in structured tables. The method augments each column's name and up to ten frequent values with contextual information: the dataset title/description and the names of all other columns. The approach is evaluated on the large synthetic DeSSI test set, 13 Kaggle datasets, 20 OpenML datasets, and a curated MIMIC-Demo-Ext subset, and compared against Microsoft Presidio and a binary-adapted version of CASSED. On DeSSI, CASSED achieves near-perfect macro F1 (0.996) while GPT-4o reaches 0.766. On the real-world datasets, GPT-4o outperforms both baselines (macro F1 0.902 on Kaggle, 0.964 on OpenML, 0.829 on MIMIC-Demo-Ext). The authors conclude that their approach is 'the most effective model for detecting personal data in structured datasets,' based on the unweighted average macro F1 across datasets (0.865 vs 0.643 for CASSED and 0.608 for Presidio).
Significance. The paper addresses a practically relevant problem under GDPR compliance, and its comparison on real-world data is a useful step beyond purely synthetic benchmarks. The implementation is open-source, the confusion matrices are reported, and the authors explicitly discuss several threats to validity (e.g., possible overfitting of CASSED to DeSSI, training-data contamination for GPT-4o). These are genuine strengths. However, the central causal claim—that the inclusion of contextual information drives the performance gain—is not directly tested, the real-world ground truth rests on a single annotator, and the aggregate conclusion is sensitive to the choice of averaging scheme. If these points are addressed, the contribution would be materially stronger; as it stands, the headline conclusion is not fully supported by the evidence.
major comments (4)
- [§4.1, §5.1] The paper repeatedly attributes GPT-4o's superior performance on Kaggle and OpenML to its use of contextual information, but no ablation condition removes the context. The only comparison is GPT-4o-with-context against baselines that do not use context; this does not isolate the effect of context from other properties of GPT-4o (e.g., parametric knowledge or familiarity with these well-known datasets). The authors acknowledge in §5.1 that 'a more detailed analysis is needed' to assess the role of context. To support the central claim, the authors should include a GPT-4o condition without the dataset description and other feature names (i.e., only column name and values), and report the resulting scores.
- [§3.1, Table 2] The ground-truth labels for Kaggle, OpenML, and MIMIC-Demo-Ext were produced by 'one of the authors' with no inter-annotator agreement, no written labeling protocol, and no released label file. GDPR personal-data classification is contestable (e.g., 'Cabin', 'Ticket', 'Reason Absence', 'marital_status' are all labeled personal), and every F1 score in Table 2 for these datasets depends on this single annotator's judgment. The ranking between GPT-4o, CASSED, and Presidio could change under an alternative GDPR-informed labeling. The authors should provide a second independent annotation, report inter-annotator agreement (e.g., Cohen's kappa), and publish the label files so the evaluation is externally verifiable.
- [Table 2] The 'Average' row in Table 2 is an unweighted mean over the four datasets, even though DeSSI's test set contains 6272 columns while Kaggle, OpenML, and MIMIC-Demo-Ext together contain only 667 columns (Table 1). With a column-weighted average, the near-perfect CASSED score on DeSSI dominates: using the reported macro F1 values, the weighted macro F1 is approximately 0.987 for GPT-4o and 0.948 for CASSED (both still favor GPT-4o), but for Micro F1 the weighted average is approximately 0.786 for GPT-4o versus 0.958 for CASSED, and for Balanced Accuracy approximately 0.779 versus 0.954. Thus the 'most effective model' conclusion depends on the unweighted aggregation. The authors should report both unweighted and weighted averages and justify the aggregation choice.
- [§3.2.2, Table 2] GPT-4o responses are stochastic, and the paper reports single point estimates without confidence intervals or repeated runs. The authors note that setting a random seed 'does not guarantee reproducibility of the responses of GPT-4o.' Given the small real-world datasets (e.g., 163 columns in MIMIC-Demo-Ext), the observed gaps (e.g., 0.829 vs. 0.724 macro F1) may not be statistically significant. The paper should include multiple runs, report mean and variance (or confidence intervals), and, where feasible, perform a significance test.
minor comments (5)
- [Author affiliation] There is a typo in the affiliation: 'Germnany' should be 'Germany'.
- [§3.3.1] The sentence 'For each dataset, the best presidio analyzer approach was used for comparing Presidio's performance' is ambiguous: it is unclear whether 'best' was chosen by evaluating on the test set, which would be a form of test-set selection and could overestimate Presidio's performance. The selection procedure should be described explicitly, and ideally the choice should be made on a validation split.
- [§3.3.2] The phrase 'we modified and retrained the model' is ambiguous: it could mean fine-tuning the public CASSED weights or training a new DistilBERT model from scratch. Clarify the initialization and the number of trainable parameters.
- [Appendix A] The data prompt in Appendix A contains a Python representation 'Index(['ID', 'Reason for absence', ...], dtype='object')' which is not standard prose; a clean list of feature names would be easier to read and would not assume the reader's familiarity with Python repr output.
- [§5, last paragraph] The sentence 'However, the requirements for data protection complicate the access to such datasets' has a stylistic issue ('complicate the access'); consider revising to 'complicate access to such datasets'.
Circularity Check
No circularity: frozen GPT-4o is benchmarked against external labels; remaining concerns are label reliability and training-data contamination, not circular derivation.
full rationale
The paper contains no fitted derivation: GPT-4o is used as a frozen black-box prompt and is not trained on the evaluation labels, so there is no fitted parameter renamed as a prediction. CASSED is retrained on the DeSSI train/validation split and then evaluated on the held-out DeSSI test split, which is standard benchmarking rather than circularity; the paper itself notes possible train/test leakage in DeSSI as a limitation, but that is a data-quality concern, not a definitional reduction. Presidio thresholds are per-dataset tuned, which if anything biases in favor of Presidio, not toward the headline GPT-4o claim. The manual binary labels for Kaggle, OpenML, and MIMIC-Demo-Ext are external ground truth constructed by one author; any labeling unreliability affects all compared models symmetrically and is a validity/reliability issue, not a case where the prediction is equivalent to its input. The paper explicitly acknowledges that well-known Kaggle/OpenML datasets may have been in GPT-4o's training data (Sec. 5), which is a contamination risk for soundness, not a circularity. No equation defines the output in terms of the label it predicts, and no load-bearing result is justified by a self-citation chain. Therefore no circular step meets the evidentiary bar required by the review rules.
Assumptions & free parameters
free parameters (3)
- Number of exemplar values per column (top-k) =
10
- Presidio minimum occurrence threshold =
not reported
- Presidio confidence threshold =
not reported
assumptions (4)
- domain assumption The GDPR Article 4 definition of personal data, including indirect identifiability via context, is the correct ground truth for labeling columns as personal or non-personal.
- domain assumption A single author's manual binary labeling of Kaggle, OpenML, and MIMIC-Demo-Ext columns is accurate enough to serve as ground truth.
- domain assumption The public CASSED model without rule-based components is a faithful proxy for the full CASSED system.
- domain assumption GPT-4o's advantage is attributable to contextual prompting rather than to memorization of well-known Kaggle and OpenML datasets from pretraining.
Cite this review
Pith. "Pith review of Detection of Personal Data in Structured Datasets Using a Large Language Model." pith.science (2026). https://pith.science/paper/N6CHABOU
@misc{pith2026250622305,
author = {Pith},
title = {Pith review of: Detection of Personal Data in Structured Datasets Using a Large Language Model},
year = {2026},
howpublished = {\url{https://pith.science/paper/N6CHABOU}},
note = {Machine review of arXiv:2506.22305}
}
read the original abstract
We propose a novel approach for detecting personal data in structured datasets, leveraging GPT-4o, a state-of-the-art Large Language Model. A key innovation of our method is the incorporation of contextual information: in addition to a feature's name and values, we utilize information from other feature names within the dataset as well as the dataset description. We compare our approach to alternative methods, including Microsoft Presidio and CASSED, evaluating them on multiple datasets: DeSSI, a large synthetic dataset, datasets we collected from Kaggle and OpenML as well as MIMIC-Demo-Ext, a real-world dataset containing patient information from critical care units. Our findings reveal that detection performance varies significantly depending on the dataset used for evaluation. CASSED excels on DeSSI, the dataset on which it was trained. Performance on the medical dataset MIMIC-Demo-Ext is comparable across all models, with our GPT-4o-based approach clearly outperforming the others. Notably, personal data detection in the Kaggle and OpenML datasets appears to benefit from contextual information. This is evidenced by the poor performance of CASSED and Presidio (both of which do not utilize the context of the dataset) compared to the strong results of our GPT-4o-based approach. We conclude that further progress in this field would greatly benefit from the availability of more real-world datasets containing personal information.
Figures
Reference graph
Works this paper leans on
-
[1]
Paul Azunre, Craig Corcoran, Numa Dhamani, Jeffrey Gleason, Garrett Honke, David Sullivan, Rebecca Ruppel, Sandeep Verma, and Jonathon Morgan. 2019. Semantic Classification of Tabular Datasets via Character-Level Convolutional Neural Networks. doi:10.48550/arXiv.1901.08456
work page Pith review arXiv doi:10.48550/arxiv.1901.08456 2019
-
[2]
California Attorney General. [n. d.]. California Consumer Privacy Act (CCPA). https://oag.ca.gov/privacy/ccpa Accessed: January 26, 2025
work page 2025
-
[3]
Sensitive Detection. 2022. DeSSI Dataset for Structured Sensitive Informa- tion. https://www.kaggle.com/datasets/sensitivedetection/dessi-dataset-for- structured-sensitive-information. Accessed: December 14, 2024
work page 2022
-
[4]
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), Jill Burstein, Christy...
2019
-
[5]
European Union. [n. d.]. General Data Protection Regulation (GDPR). https: //gdpr.eu/ Accessed: January 26, 2025
work page 2025
-
[6]
Faker Community. [n. d.]. Welcome to Faker’s Documentation! https://faker. readthedocs.io/ Accessed: January 26, 2025
work page 2025
-
[7]
Matthias Feurer, Jan N. van Rijn, Arlind Kadra, Pieter Gijsbers, Neeratyoy Mallik, Sahithya Ravi, Andreas Müller, Joaquin Vanschoren, and Frank Hutter. 2021. OpenML-Python: an extensible Python API for OpenML. Journal of Machine Learning Research 22, 100 (2021), 1–5. http://jmlr.org/papers/v22/19-920.html
work page 2021
-
[8]
Michèle Finck and Frank Pallas. 2020. They who must not be identi- fied—distinguishing personal from non-personal data under the GDPR. Interna- tional Data Privacy Law 10, 1 (03 2020), 11–36. doi:10.1093/idpl/ipz026
Show all 29 references
-
[9]
Somchart Fugkeaw, Ananya Chaturasrivilai, Pitchayapa Tasungnoen, and Weer- apat Techaudomthaworn. 2021. AP2I: Adaptive PII Scanning and Consent Dis- covery System. In 2021 13th International Conference on Knowledge and Smart Technology (KST) (2021). 231–236. doi:10.1109/KST512...
2021
-
[10]
GDPR EU. [n. d.]. GDPR personal data – what information does this cover? https://www.gdpreu.org/the-regulation/key-concepts/personal-data/ Accessed: January 26, 2025
2025
-
[11]
Goldberger, Luis A
Ary L. Goldberger, Luis A. N. Amaral, Leon Glass, Jeffrey M. Hausdorff, Pla- men Ch. Ivanov, Roger G. Mark, Joseph E. Mietus, George B. Moody, Chung-Kang Peng, and H. Eugene Stanley. 2000. PhysioBank, PhysioToolkit, and PhysioNet. Circulation 101, 23 (2000), e215–e220. doi:10....
2000 doi
-
[12]
Graham Greenleaf. 2023. Global Data Privacy Laws 2023: 162 National Laws and 20 Bills. Privacy Laws and Business International Report 181 (2023), 1, 2–4. doi:10.2139/ssrn.4426146 UNSW Law Research Paper No. 23-48
2023 doi
-
[13]
Madelon Hulsebos, Kevin Hu, Michiel Bakker, Emanuel Zgraggen, Arvind Satya- narayan, Tim Kraska, Çagatay Demiralp, and César Hidalgo. 2019. Sherlock: A Deep Learning Approach to Semantic Data Type Detection. In Proceedings of the 25th ACM SIGKDD International Conference on Kno...
2019
-
[15]
Alistair EW Johnson, Tom J Pollard, Lu Shen, Li-wei H Lehman, Mengling Feng, Mohammad Ghassemi, Benjamin Moody, Peter Szolovits, Leo Anthony Celi, and Roger G Mark. 2016. MIMIC-III, a freely accessible critical care database.Scientific data 3, 1 (2016), 1–9. doi:10.13026/C2HM2Q
2016 doi
-
[16]
Kaggle Inc. [n. d.]. How to use Kaggle. https://www.kaggle.com/docs/api Ac- cessed: January 26, 2025
2025
-
[17]
Poornima Kulkarni and N. K. Cauvery. 2021. Personally Identifiable Infor- mation (PII) Detection in the Unstructured Large Text Corpus using Nat- ural Language Processing and Unsupervised Learning Technique. Inter- national Journal of Advanced Computer Science and Applications...
2021
-
[18]
Vjeko Kuzina. [n. d.]. CASSED github implementation. https://github.com/ VKuzina/CASSED Accessed: January 26, 2025
2025
-
[19]
Vjeko Kužina, Ana-Marija Petric, Marko Barišić, and Alan Jović. 2023. CASSED: Context-based Approach for Structured Sensitive Data Detection. Expert Systems with Applications 223 (2023), 119924. doi:10.1016/j.eswa.2023.119924
2023
-
[20]
Han Liu, Alexander Gegov, and Frederic Stahl. 2014. Categorization and Con- struction of Rule Based Systems. In Engineering Applications of Neural Networks (Cham, 2014), Valeri Mladenov, Chrisina Jayne, and Lazaros Iliadis (Eds.). Springer International Publishing, 183–194. do...
2014 doi
-
[21]
GDPR Local. [n. d.]. GDPR Fines: Understanding Percentages and Penalties. https://gdprlocal.com/gdpr-fines-understanding-percentages-and-penalties/ Ac- cessed: March 23, 2025
2025
-
[22]
Microsoft. 2023. Presidio: Open-source tool for personal data detection. https: //github.com/microsoft/presidio Accessed: January 26, 2025
2023
-
[23]
Microsoft contributors. [n. d.]. PII entities supported by Presidio. https:// microsoft.github.io/presidio/supported_entities/ Accessed: January 26, 2025
2025
-
[24]
Chris Moschovitis. 2021. Privacy, regulations, and cybersecurity: The essential business guide. John Wiley & Sons. 416 pages. doi:10.1002/9781119660156
2021 doi
-
[25]
Ji-sung Park, Gun-woo Kim, and Dong-ho Lee. 2020. Sensitive Data Identification in Structured Data through GenNER Model based on Text Generation and NER. In Proceedings of the 2020 International Conference on Computing, Networks and Internet of Things (Sanya, China, 2020) (CNI...
2020
- [26]
-
[27]
Md Hasan Shahriar, Anne V. D. M. Kayem, David Reich, and Christoph Meinel
-
[28]
van Rijn, Bernd Bischl, and Luis Torgo
Joaquin Vanschoren, Jan N. van Rijn, Bernd Bischl, and Luis Torgo. 2014. OpenML: networked science in machine learning. ACM SIGKDD Explorations Newsletter 15, 2 (June 2014), 49–60. doi:10.1145/2641190.2641198
2014
-
[29]
As a comprehensive identifier of personal information within text-based archives
Jianliang Yang, Xiya Zhang, Kai Liang, and Yuenan Liu. 2023. Exploring the Application of Large Language Models in Detecting and Protecting Personally Identifiable Information in Archival Data: A Comprehensive Study*. In 2023 IEEE International Conference on Big Data (BigData)...
2023
-
[2024]
InDatabase and Expert Systems Applications, Christine Strauss, Toshiyuki Amagasa, Giuseppe Manco, Gabriele Kotsis, A
Identifying Personal Identifiable Information (PII) in Unstructured Text: A Comparative Study on Transformers. InDatabase and Expert Systems Applications, Christine Strauss, Toshiyuki Amagasa, Giuseppe Manco, Gabriele Kotsis, A. Min Tjoa, and Ismail Khalil (Eds.). Springer Nat...
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.