[1]Anthi Papadopoulou

[1]Language Technology Group, University of Oslo, Gaustadalléen 23B, 0373
Oslo, Norway

2]Norwegian Computing Center, Gaustadalléen 23A, 0373 Oslo, Norway

# Neural Text Sanitization with Privacy Risk Indicators: An Empirical Analysis

<EMAIL_ADDRESS>Pierre Lison<EMAIL_ADDRESS>Mark Anderson<EMAIL_ADDRESS>Lilja Øvrelid<EMAIL_ADDRESS>Ildikó Pilán<EMAIL_ADDRESS>*  [

###### Abstract

Text sanitization is the task of redacting a document to mask all occurrences
of (direct or indirect) personal identifiers, with the goal of concealing the
identity of the individual(s) referred in it. In this paper, we consider a
two-step approach to text sanitization and provide a detailed analysis of its
empirical performance on two recently published datasets: the Text
Anonymization Benchmark [39] and a collection of Wikipedia biographies [37].
The text sanitization process starts with a privacy-oriented entity recognizer
that seeks to determine the text spans expressing identifiable personal
information. This privacy-oriented entity recognizer is trained by combining a
standard named entity recognition model with a gazetteer populated by person-
related terms extracted from Wikidata. The second step of the text
sanitization process consists in assessing the privacy risk associated with
each detected text span, either isolated or in combination with other text
spans. We present five distinct indicators of the re-identification risk,
respectively based on language model probabilities, text span classification,
sequence labelling, perturbations, and web search. We provide a contrastive
analysis of each privacy indicator and highlight their benefits and
limitations, notably in relation to the available labeled data.

###### keywords:

text sanitization, data privacy, knowledge graph extraction, sequence
labelling, privacy risk, web search, privacy-enhancing NLP

##  1 Introduction

The volume of text data available online is continuously increasing and
constitutes an essential resource for the development of large language models
(LLM). This trend has important privacy implications. Most text documents do,
indeed, contain personally identifiable information (PII) in one form or
another – that is, information that can directly or indirectly lead to the
identification of a human individual. PII can be split in two main categories
[12]:

Direct identifiers, which are information that can directly and irrevocably
identify an individual. This includes for example a person’s name, passport
number, email address, phone number, username or home address.

Quasi identifiers, also called indirect identifiers, which are not per se
sufficient to single out an individual, but may do so when combined with other
quasi-identifiers. Examples of quasi-identifiers include the person’s
nationality, occupation, gender, place of work or date of birth. A well-known
illustration of the privacy risks posed by quasi-identifiers comes from Golle
[17] who showed that between 63% to 78% of the US population could be uniquely
identified by merely combining their gender, date of birth and zip code.

Although some PII may be benign (if the text conveys e.g. trivial or public
information), it is far from always being the case. Documents such as court
judgments, medical records or interactions with social services are often
highly sensitive, and their disclosure may have catastrophic consequences for
the individuals involved. Editing those documents to conceal the identity of
those individuals is thus often desirable from both an ethical and legal
perspective. This is precisely the goal of text sanitization [3, 47, 29].

In this paper, we present a two-step approach to the problem of text
sanitization and provide a detailed analysis of its performance, based on two
recently released datasets [39, 37]. The approach first seeks to detect text
spans that convey personal information, using a neural sequence labelling
model that combines named entity recognition (NER) with a gazetteer. The
gazetteer is built by inferring from Wikidata a set of properties typically
used to characterize human individuals, such as “position held” or “manner of
death”, and traversing the knowledge graph to extract all possible values for
those properties. In the second step, the privacy risk of the detected text
spans is assessed according to various indicators. Finally, the text spans
that are deemed to constitute an unacceptable risk according to those
indicators are masked. An overview of the approach is illustrated in Figure 1.

The paper makes the following four contributions:

  1. 1.

A privacy-oriented entity recognizer making it possible to detect PII
information beyond named entities, using large lists of person-related terms
extracted from Wikidata, extending previous work by Papadopoulou et al. [38].

  2. 2.

A quantitative and qualitative evaluation of the performance of this privacy-
oriented entity recognizer for various types of PII.

  3. 3.

The development of five privacy risk indicators, based on LLM probabilities,
span classification, perturbations, sequence labelling and web search.

  4. 4.

A comparative analysis of those privacy risk indicators, both in isolation and
in combination, on the two aforementioned datasets.

Figure 1: Overview of the approaches presented and discussed in this paper.
For a text document or a collection of text documents to sanitize, we first
detect text spans expressing PII in the text. This can be done using a
privacy-oriented entity recognizer. A set of five distinct privacy risk
indicators can then be applied to assess whether the detected spans need to be
masked. Finally, the text spans predicted to constitute a high re-
identification risk are masked from the document.

The paper consists of the following sections. Section 2 provides a general
background on data privacy and text sanitization. We then describe in Section
3 the two annotated datasets for text sanitization employed for the empirical
analysis of this paper. In Section 4 we present, evaluate and discuss a
privacy-oriented entity recognizer for the task of detecting PII in text
documents. We present the set of five privacy risk indicators in Section 5.
The empirical performance of those indicators on the two datasets is then
analysed in Section 6. We conclude in Section 7.

##  2 Background

###  2.1 Definitions

The right to privacy is a fundamental human right, as evidenced by its
inclusion in the Universal Declaration of Human Rights and the European
Convention on Human Rights. In the digital sphere, data privacy is enforced
through multiple national and international regulations, such as the General
Data Protection Regulation (GDPR) in Europe, the California Consumer Privacy
Act (CCPA) in the United States or China’s Personal Information Protection Law
(PIPL). Although those regulations differ in both scope and interpretation,
their common principle is that individuals should remain in control of their
own data. In particular, the processing of personal data must have a legal
ground, and cannot be shared to third parties without the explicit and
informed consent of the person(s) the data refers to.

One alternative strategy is to anonymize data to ensure the data is no longer
personal, and therefore out of the scope of privacy regulations.
Anonymization, according to the GDPR, refers to the complete and irrevocable
removal of all information that may directly or indirectly lead to re-
identification. However, as shown by Weitzenboeck et al. [50], transforming
the data to make it completely anonymous is almost impossible to achieve in
practice for unstructured data such as text, unless the content of the text is
radically altered or the original source of the document is deleted.

Although complete anonymization is hard to attain, text sanitization is a
crucial tool to adhere with the general requirement of data minimization which
is enshrined in GDPR and most privacy regulations [16]. The principle of data
minimization states that one should only collect and retain the personal data
that is strictly necessary to fulfill a given purpose.

The process of editing text documents to conceal the identity of a person has
a somewhat confusing terminology [29, 39]. The GDPR makes use of the term
pseudonymization to denote a process of transforming data to conceal at least
some personal identifiers, but in a way that does not amount to complete
anonymization. The term de-identification is also common [4, 21], especially
for work on medical patient records. De-identification approaches are
typically restricted to the recognition of predefined entities, such as the
categories of HIPAA [19]. In contrast, we define text sanitization as the
process of detecting and masking any type of personal information in a text
document that can lead to identification of the individual whose identity we
wish to protect.

Text sanitization is a topic of investigation in several research fields,
notably in natural language processing (NLP) and in privacy-preserving data
publishing (PPDP). Approaches to text rewriting based on differential privacy
have also been proposed. We review below those approaches.

###  2.2 NLP Approaches

NLP approaches to text sanitization have mainly focused on sequence labelling
approaches, inspired by the large body of work on Named Entity Recognition.
Such approaches aim at the detection of text spans containing personal
identifiers [5, 25]. Most research works in this field to date have focused on
the medical domain, where the Health Insurance Portability and Accountability
Act of 1996 [19] offers concrete rules that allow for the standardization of
this task. HIPAA defines a set of Protected Health Information (PHI) data
types that encompass direct identifiers (such as names or social security
numbers) as well as domain-specific demographic attributes including
treatments received and health conditions. A wide variety of NLP methods have
been developed for this task, including rule-based, machine learning-based and
hybrid approaches [46, 35, 51, 53]. Character-based recurrent neural networks
[8, 31] and transformer architectures have also been investigated for this
purpose [21]. A recent initiative focused on replacing sensitive information
is INCOGNITUS [40], a clinical note de-identification tool. The system allows
for redacting documents with either a NER-based method or with an embedding-
based approach substituting all tokens with a semantically related one. Recent
large language models from the GPT family have also been explored. Liu et al.
[32] proposed DeID-GPT for masking PHI categories and showed that, with zero-
shot in-context learning incorporating explicitly HIPAA requirements in the
prompts, GPT-4 outperformed fine-tuned transformer models on the same
annotated medical texts.

Text sanitization outside the medical domain includes approaches such as Juez-
Hernandez et al. [22], who propose AGORA, a document de-identification system
combined with geoparsing (automatic location extraction from text) using LSTMs
and CRFs and trained on Spanish law enforcement data. The authors focus on
offering a complete pipeline and location information, while demographic
attributes are not part of the information to de-identify. Yermilov et al.
[52] compared three systems for detecting and pseudonymizing PII: (1) a NER-
based one relying on Wikidata; (2) a single-step sequence-to-sequence model
trained on a parallel corpus; and (3) a large language model where named
entities are first detected using a 1-shot prompt to GPT-3 and then
pseudonymized with 1-shot prompts using ChatGPT (GPT-3.5). The authors find
that the NER-based approach is best for preserving privacy while LLMs best
preserve utility for a text classification and summarization tasks. Finally,
Papadopoulou et al. [38] present an approach to text sanitization, from
detection of personal information to privacy risk estimation through the use
of language model probabilities, web queries, and a classifier trained on
manually labeled data. The present paper builds upon this work.

###  2.3 Privacy-Preserving Data Publishing

PPDP approaches to text sanitization rely on a privacy model specifying formal
conditions that must be fullfilled to ensure the data can be shared without
harm to the privacy of the registered individuals. The most prominent privacy
model is $k$-anonymity [41], which requires that an individual/entity be
indistinguishable from $k$ -1 other individuals/entities. This model was
subsequently adapted to text data by approaches such as $k$\- safety [3] and
$k$-confusability [7].

$t$-plausibility [1] follows a similar approach, using already detected
personal information and ensuring that those are sufficiently generalized to
ensure that at least $t$ documents can be mapped to the edited text. Sánchez
and Batet [47] present $C$-sanitized, which relies on an information-theoretic
approach that computes the point-wise mutual information (using co-occurrence
counts from web data) between the person or entity to protect and the terms of
the document. Terms whose mutual information ends up above a given threshold
are then masked.

$k$-anonymity was also employed in Papadopoulou et al. [37] in combination
with NLP-based approaches, where based on an assumption of an attacker’s
knowledge, the optimal set of masking decisions was found to ensure
$k$-anonymity.

Finally, Manzanares-Salor et al. [33] provided an approach to the evaluation
of disclosure risks that relies on training a text classifier to assess the
difficulty of inferring the identity of the individual in question based on
the sanitized text.

###  2.4 Differential Privacy

Differential privacy (DP) is a framework for ensuring the privacy of
individuals in datasets [11]. It essentially operates by producing randomized
responses to queries. The level of artificial noise introduced in each
response is optimized such as to provide a guarantee that the amount of
information that can be learned about any individual remains under a given
threshold.

Fernandes et al. [14] applied DP to text data, in combination with ML
techniques by adding noise to the word embeddings of the model. Their work
focused on removing stylistic cues from the text as a way to ensure that the
author of the text could not be identified by it. Feyisetan et al. [15] also
apply noise to word embeddings in a setting where the geolocation data of an
individual is to be protected.

More recently, Sasada et al. [42] tried to address the issue of the noise
needed for DP causing utility loss in the resulting text by creating
duplicates first, and then adding noise, thus reducing the amount of noise
needed. Krishna et al. [24] sought to address the same issue using an
algorithm based on auto-encoders to transform text without losing data
utility. Finally, Igamberdiev and Habernal [20] introduced DP-BART, a DP
rewriting system based on pre-trained BART model, and which seeks to reduce
the amount of artificial noise needed to reach a given privacy guarantee.

DP-oriented approaches generally lead to complete transformations of the text,
at least for reasonable values of the privacy threshold. Those approaches are
therefore well suited to the generation of synthetic texts, in particular to
collect training data for machine learning models. However, they are difficult
to apply to text sanitization, as most text sanitization problems are expected
to retain the core content of the text and only edit out the personal
identifiers. This is particularly the case for court judgments and medical
records, as the sanitized documents should not alter the wording and semantic
content conveyed in the text.

##  3 Datasets

There only exists a few generic (non-medical) datasets that are devoted to the
evaluation of text sanitization approaches. We present below the two datasets
used for training, evaluation and error analysis throughout this paper.

###  3.1 Text Anonymization Benchmark (TAB)

The TAB corpus [39] is a collection of 1268 European Court of Human Rights
(ECHR) court cases, manually annotated to protect the identity of the
individual mentioned in the text. These court cases are documents rich in PII
that are also freely available to use. The documents are in English and each
court case is annotated, among others, with an individual to be protected as
well as with detected PII spans containing the following information:

  * •

The span’s semantic type, according to the 8 categories established in Pilán
et al. [39], described in Table 1.

  * •

Whether that span needs to be masked in order to protect the privacy of the
specified individual, with three possible values: DIRECT, QUASI, or NO_MASK.

  * •

Whether the span is a confidential attribute of the individual, such as
religious or philosophical beliefs, political opinions, sexual orientation or
sex life, racial or ethnic origin, and health, genetic and biometric data.

  * •

Co-reference links between relevant spans that refer to the same entity.

Table 1:  Semantic type along with explanations and selected examples Category |  Explanation |  Examples
---|---|---
CODE |  Identification codes and numbers: flight numbers, phone numbers, license plates, etc. |  3086/23, LH3042, 11/14E.2
ORG |  Names of organizations, such as companies, schools, hospitals, administrations, etc. |  Budapest Police Department, Ministry of Justice
DATETIME |  Description of a specific date, period, time, or duration. |  23 November 2006, 7, 12 and 5 months
LOC |  Places and locations, such as cities, geographical areas, countries or addresses. |  Austria, Martin County, Belfast
QUANTITY |  Description of a quantity, including percentages or monetary values. |  6,932 Ukrainian hryvnyas, two
PERSON |  Names of people, including nicknames/aliases, usernames, and initials. |  Joe Smith, The Rock, YiDA
DEM |  Demographic attributes of a person, such as nationality, occupation, or education |  artist, Italian, MSc in Astrophysics
MISC |  Every other type of personal information associated to an individual and that does not belong to the categories above. |  former patient, high speed car chase, imprisonment

Example 1 illustrates a short excerpt where spans underlined in black were
marked by the annotators, and those underlined in dark green were categorized
by the annotator as denoting a direct or quasi-identifier to mask.

######  Example 1.

The case originated in an application (no.  44521/04) against the  Republic of
Poland lodged with the Court under Article 34 of the Convention for the
Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a
Polish national,  Mr Leszek Kołodziński (“the applicant”), on  19 August 2004.

The documents are, on average, 1,442 tokens long. The majority of the tokens
are labeled as QUASI identifiers (63%), with fewer tokens being masked as
DIRECT identifiers (4.4%) and the rest of the annotated text spans being left
unmasked by the annotators. The majority of the identifiers belonged to the
DATETIME, ORG, and PERSON categories which is in line with the domain of the
texts.

Some of the court cases (274) were also multi-annotated to allow for
evaluation against different solutions since the task is subjective in nature.
The inter-annotator agreement on the identifier type (DIRECT, QUASI, NO-MASK),
calculated both on the span ($k$ = 0.46) and character level ($k$ = 0.79),
shows moderate agreement which is to be expected from a task where multiple
correct solutions can exist. We follow the training, development, and test
split the authors release with 1,014, 127 and 127 documents respectively.

###  3.2 Wikipedia Biographies

Papadopoulou et al. [37] released a collection of 553 Wikipedia biographies
manually annotated for text anonymization. The annotation task was similar to
that of the TAB corpus, except for the absence of annotation for confidential
attributes, which was not relevant for this dataset.

Example 2 shows a manually annotated text, both for detected PII spans
(underlined in black), and also for masking decision (underlined in dark
green).

######  Example 2.

David Sherwood is a  British  tennis coach and retired  tennis player. In his
only live  Davis Cup match,  Sherwood played doubles with  Andy Murray beating
the  Israeli World No 4 doubles team of  Jonathan Erlich and  Andy Ram.

The documents in this dataset are much shorter than those in the TAB corpus. A
large majority of the PII spans were marked by the annotators as QUASI
identifiers to be masked (56%) or DIRECT identifiers (14%), while 30% of the
spans were left as is in the text without needing to be masked, as they were
deemed less specific by the annotators and thus, less risky. Most of the
identifiers in this dataset belong to the DATETIME, ORG, and PERSON semantic
types.

Of the 553 documents, 22 were also doubly-annotated to account for multiple
correct solutions for this task. Cohen’s $k$ calculated both in the span ($k$
= 0.44) and the character level ($k$ = 0.81) on the masking decision showed
moderate agreement, highlighting the subjective nature of the task. We follow
the split proposed in Olstad et al. [36], which includes all the double-
annotated documents in the test set (100 documents), while 453 documents are
available for training purposes.

##  4 Privacy-oriented Entity Recognizer

Identifying PII spans is the first step in text sanitization. Although many
methods rely on some variant of NER, they fail to detect PII spans that are
not named entities but are nevertheless (quasi-)identifying.

We detail here our approach to detecting text spans expressing personal
information. The approach uses knowledge graphs such as Wikidata to create
gazetteers for specific PII types. Those gazetteers are then combined with a
NER model to create a domain-specific silver corpus, which is in turn employed
to fine-tune a neural sequence labelling model. This approach to developing a
“privacy-oriented entity recognizer” builds upon earlier work by Papadopoulou
et al. [38], and provides additional details on various aspects of the
gazetteer construction process, model training and empirical evaluation.

###  4.1 Wikidata Properties

NER models are, as the term indicates, focused on named entities. However,
many instances of the DEM and MISC111It should be noted that the MISC category
employed in this paper does not equate to the MISC category from CoNLL-2003
shared task [49], which is characterized as a named entity (denoted with a
proper name) that is neither a person, organization or place. categories
described in the previous section are not named entities. Examples include
someone’s occupation, educational background, part of their physical
appearance, the manner of their death or an object that is tied to their
identity.

We extract a list of possible values for these two PII categories based on
knowledge graphs. In particular, Wikidata222https://www.wikidata.org is a
structured knowledge graph containing information in property-value pairs,
with a large number of values being adjectives, nouns, or noun phrases. We
operated by retrieving all instances of humans from the Wikidata dump file,
and inspecting Wikidata
properties333https://www.wikidata.org/wiki/Wikidata:Database_reports/List_of_properties/all
to select those that seems to express either DEM or MISC PII based on their
description and their examples.

After filtering, we end up with 44 DEM properties and 196 MISC properties.
Selected examples of each semantic type are shown Table 2, while a detailed
table can be found in Appendix A. Some properties were left out due to the
high level of false positives they might have introduced if included (e.g.
blood type (P1853)) or because they mostly contained named entities that would
already be detected by a generic NER model.

We then use these properties to traverse the Wikidata instances and save all
values into two gazetteers, one for DEM entities444We also manually add
country names and nationalities into the DEM gazetteer to account for cases
when the NER failed to detect those and the gazetteer lacked this information.
and one for MISC entities.

Table 2:  Selected examples of Wikidata properties of type DEM or MISC. Property | ID | Examples | Type
---|---|---|---
hairstyle/hairlength | P8839 | baldness, comb over, curls | DEM
religion or worldview | P140 | agnosticism, occultism, free-thought | DEM
sex or gender | P21 | agender, queer, non-binary | DEM
position held | P39 | U.S. senator, Mayor of Lopigna, chief physician | DEM
vessel | P1876 | Soyuz-TMA, galley, ferry ship | MISC
convicted of | P1399 | forgery, harassment, conspiracy to murder | MISC
manner of death | P1196 | capital punishment, disease, matricide | MISC
genre | P136 | metalcore, war film, icelandic hip hop | MISC

###  4.2 Silver Corpus and Model Fine-tuning

A silver corpus of 5000 documents is then compiled, consisting in our
experiments with the datasets of Section 3 of 2500 European Court of Human
Rights cases and 2500 Wikipedia summaries [26]. To automatically label the
documents, we first run a generic NER model555We used here a RoBERTa model
fine-tuned on the Ontonotes v5 corpus using spaCy’s implementation. to detect
named entities. We then apply the two DEM and MISC gazetteers and tag each
match with their respective label. In case of overlap, we keep the longest
span, e.g. keep “Bachelor in Computer Science” instead of “Bachelor” and
“Computer Science” as two separate spans.

We then employ this silver corpus to fine-tune a RoBERTa [30] model, thus
creating a privacy-oriented entity recognizer. Detailed training parameters
can be found in Table 8 in Appendix B.

###  4.3 Evaluation

The evaluation results of the privacy-oriented entity recognizer are shown in
Table 3. The total precision, recall and $F_{1}$ scores are provided in two
versions: one where we take label types into account and one where we do not.
In the latter case, we thus only consider whether the token was marked as PII
or not666This differs from an earlier evaluation in Papadopoulou et al. [38]
where only a subset of labels such as ORG and LOC or MISC and QUANTITY were
considered interchangeable.. The evaluation is conducted on the test sets of
the TAB corpus and the Wikipedia collection of biographies. As the documents
from those test sets were annotated by several annotators, the results are
calculated using a micro-average over all annotators.

Table 3:  Token-level precision (P), recall (R) and $F_{1}$ score per semantic type on the test sets of the Wikipedia biographies and TAB corpus. We also report micro-averaged performance scores under two conditions: one where we require exact matches on the predicted label, and one where we only distinguish between PII-tokens and non-PII-tokens (thus conflating all PII types into one group). | Wikipedia | TAB
---|---|---
|  P |  R |  $F_{1}$ |  P |  R |  $F_{1}$
CODE |  n/a |  n/a |  n/a |  0.98 |  0.95 |  0.97
PERSON |  0.97 |  0.88 |  0.92 |  0.98 |  0.94 |  0.96
ORG |  0.86 |  0.79 |  0.82 |  0.75 |  0.81 |  0.78
LOC |  0.86 |  0.79 |  0.82 |  0.51 |  0.80 |  0.62
QUANTITY |  0.49 |  0.83 |  0.62 |  0.39 |  0.82 |  0.53
DATETIME |  0.84 |  0.96 |  0.90 |  0.92 |  0.99 |  0.95
DEM |  0.56 |  0.84 |  0.67 |  0.10 |  0.47 |  0.16
MISC |  0.52 |  0.61 |  0.56 |  0.03 |  0.23 |  0.06
Micro-avg. w/ label match |  0.72 |  0.81 |  0.76 |  0.57 |  0.84 |  0.68
Micro-avg. w/o label match |  0.83 |  0.92 |  0.87 |  0.63 |  0.93 |  0.75

We notice a clear difference between the performance with and without label
match. This indicates a label disagreement between the model and the gold
annotations, in particular for categories such as ORG and LOC. This does not,
however, affect the detection of the text spans themselves. We also observe
that the model performs better for the Wikipedia biographies than TAB corpus,
indicating that the PII in Wikipedia are easier to detect than in TAB.

Breaking down the results based on semantic type, we observe that CODE,
PERSON, ORG, and DATETIME seem to consistently exhibit strong results on the
two datasets. This is likely due to those categories being easier to
circumscribe and recognize from surface cues. In contrast, DEM and MISC, as
well as QUANTITY are harder to detect, as those encompass a larger set of
possible spans, include many which are not named entities.

In the annotated collection of Wikipedia biographies, DEM spans are maximum 9
tokens long, with an average of 1.3 tokens, while for MISC the maximum number
of tokens is 42, with an average of 2.3 tokens. For TAB, the maximum number of
tokens is much higher. For DEM it is 24, while for MISC it is 785 (a long
transcript), with an average of 1.6 and 4 respectively. On the silver corpus,
the label outputs from the model for DEM and MISC are at maximum 11 and 26
tokens respectively, while on average they are 1.1 tokens long, being much
closer to Wikipedia standards than TAB ones.

#### Examples

We provide below two examples of text spans from the two corpora, comparing
PII spans annotated by a human annotator (black line) with the ones detected
the generic NER model (red line) and the privacy-oriented entity recognizer
(dark green line).

######  Example 3.

Percy Parke Lewis  (1885-1962) was an  American  architect.

In the above example, the privacy-oriented recognizer detected the demographic
attribute architect, in line with the human annotation, while it was ignored
from the standard NER model.

######  Example 4.

On  1 December 2005 the applicant was arrested and remanded in custody. In
2006 he was convicted of  three counts of  battery and  robbery and received
prison sentences ranging  from two to four years.

We observe in the above example that the privacy-oriented entity recognizer
also labeled battery and robbery as reasons of conviction (MISC) as well as
prison (MISC).

###  4.4 Label Disagreement

As mentioned in Section 4.2, Wikidata properties were used to annotate entity
types in the text to train the entity-recognition model. Wikidata pages are
either generated when a corresponding Wikipedia article is created or they are
set up manually by human editors. Both of these make Wikidata pages prone to
possible inaccuracies, something we encountered while performing an error
analysis on the output of the model when applied to the datasets.

Two cases can be distinguished when there is disagreement between the expert
annotations and the model outputs: either (1) both system and gold labels can
be considered correct or (2) the system made an error, either as a false
positive or false negative. We discuss below some of those disagreements.

The pair LOC and ORG are often confused with one another, which is an error
commonly found in many NER systems as well. In Example 5 below, the underlined
word was labeled as a LOC by the annotator but the predicted label was ORG.

######  Example 5.

”… in the Government of Gujarat”.

The QUANTITY-MISC and MISC-DEM label pairs are also often confused:

######  Example 6.

”… and sentenced to life imprisonment.”

######  Example 7.

”Quinn co-founded Crash Override.”

######  Example 8.

”… was suffering from depression and memory loss …”

In Example 6, the underlined span was labeled as QUANTITY by the annotator,
potentially interpreting the span as a time duration. The entity recognizer,
on the other hand, labeled the same span as MISC due to properties such as
penalty or cause of death that were used to form the MISC gazetteer.
Similarly, in Examples 7 and 8, the human annotators decided to mark these
spans as DEM, viewing job titles and diagnosis are demographic attributes. The
entity recognizer detected both spans and labeled them as MISC, since, medical
related properties or cause of death and properties containing job related
words that are not nouns were used for the MISC gazetteer.

Figure 4 in Appendix C shows a detailed breakdown of all pairs of label
disagreements, common between the two datasets. The MISC semantic type is
often found in many cases of label disagreements. In the following section we
make an effort to analyze this semantic type in more detail.

###  4.5 MISC Semantic Type

The MISC category was defined in Section 3 as a type of personal information
that cannot be assigned to any of the other categories, namely PERSON, ORG,
LOC, CODE, DATETIME, QUANTITY or DEM. We conducted a qualitative analysis of
this category in both the TAB corpus and the collection of Wikipedia
biographies to better understand the coverage of this PII type.

We found that most MISC spans could be mapped to the following 6 sub-
categories:

  * EVENTS: four-man, mixed doubles, Second World War

  * QUOTES: “the need for further exploration of your insight into, and responsibility for, the index offence and the apparent lack of empathy towards the victim”

  * HEALTH: bullet entry hole on the face, multiple sclerosis, blood poisoning

  * WORKS OF ART: (only in Wikipedia) Star Trek: The Original Series, The Book and the Brotherhood

  * OFFENSES: (only in TAB) tax asset stripping, seriously injured, a charge of attempted murder

  * LAWS: (only in TAB) sections 1 and 15 of the Theft Act 1968, Article 125 of the Criminal Code, 19 § 4

Some of those categories are quite general and can be found in a large number
of text domains, such as EVENTS or HEALTH. Others are specific to a text
domain, such as OFFENSES, which are most likely to be observed in court cases.

Finally, there were also examples of MISC that could not be grouped into the 6
categories above. These include, for example, various types of objects or
occupation related words, or anything else that is difficult to assign to a
specific group:

  * ITEM: gold metal, weekly newspaper, car, motorcycle, police vehicle

  * OCCUPATION RELATED: science policy, basketball skills, captained, coached

  * OTHER: empowering the backward classes, responsibility for child poverty and childcare, premeditated murder [assassinat] and in the alternative with murder [meurtre]

The above analysis is constrained to the two datasets employed in this paper.
A privacy-oriented entity recognizer may, of course, be enriched with other
sub-categories. As pointed out by Pilán et al. [39], MISC was also the PII
category human annotators found most difficult to agree on. Despite this
difficulty, recognizing MISC spans remains an important part of text
sanitization, as many of those text spans do provide detailed information
about the individual in question.

##  5 Privacy Risk Indicators

Many text sanitization approaches simply operate by masking all detected PII
spans. This may, however, lead to overmasking, as the actual risk of re-
identification may vary greatly from one span to another. In many documents, a
substantial fraction of the detected text spans may be kept in clear text
without notably increasing the re-identification risk. For instance, in the
TAB corpus, only 4.4 % of the entities were marked by the annotators as direct
identifiers, and 64.4 % as quasi-identifiers, thus leaving 31.2 % of the
entities in clear text. To assess which text spans should be masked, we need
to design privacy risk indicators able to determine which text spans (or
combination of text spans) actually constitute a re-identification risk.

We present 5 possible approaches for inferring the re-identification risk
associated with text spans in a document. Those 5 indicators are respectively
based on:

  1. 1.

LLM probabilities,

  2. 2.

Span classification,

  3. 3.

Perturbations,

  4. 4.

Sequence labelling,

  5. 5.

Web search.

The web search approach can be applied in a zero-short manner without any
fine-tuning. The two methods respectively based on LLM probabilities and
perturbations require a small number of labeled examples to adjust a
classification threshold or fit a simple binary classification model. Finally,
the span classification and sequence labelling approaches operate by fine-
tuning an existing language model, and are thus the methods that are most
dependent on getting a sufficient amount of labeled training data to reach
peak performance. This training data will typically take the form of human
decisions to mask or keep in clear text a given text span.

We present each method in turn and provide an evaluation and discussion of
their relative benefits and limitations in Section 6.

###  5.1 LLM Probabilities

The probability of a span as predicted by a language model is inversely
correlated with its informativeness: a text span that is harder to predict is
more informative/surprising than one that the language model can easily infer
from the context [54]. The underlying intuition is that text spans that are
highly informative/surprising are also associated with a high re-
identification risk, as they often correspond to specific names, dates or
codes that cannot be predicted from the context.

Concretely, we calculate the probability of each detected PII span given the
entire context of the text by masking all the (sub)words of the span, and
returning a list with all log-probabilities (one per token) referring to the
span as calculated by a large, bidirectional language model, in our case BERT
(large, cased) [9]. Those probabilities are then aggregated and employed as
features for a binary classifier that outputs the probability of the text span
being masked by a human annotator.

The list of log-probabilities for each span has a different length depending
on the number of tokens comprised in the text span. We therefore aggregate
this list by reducing it to 5 features, namely the minimum, maximum, median
and mean log-probability as well as the sum of log-probabilities in the list.
In addition, we also include as feature an encoding of the PII type assigned
to the span by the human annotators (see Table 1).

For the classifier itself, we conduct experiments using a simple logistic
regression model as well as a more advanced classification framework based on
AutoML. AutoML [18] provides a principled approach to hyper-parameter tuning
and model selection, efficiently searching for the hyper-parameters and model
combination that yield the best performance. We use the Autogluon toolkit [13]
in our experiments, and more specifically AutoGluon’s Tabular predictor [13],
which consists of an ordered sequence of base models. After each model is
trained and hyper-parameter optimization is performed on each, a weighted
ensemble model is trained using a stacking technique. A list of all base
models of the Tabular predictor is shown in Table 9, in Appendix D. We use the
training splits of the Wikipedia biographies and the TAB corpus to fit the
classifier.

###  5.2 Span Classification

The approach in the previous section has the benefit of being relatively
general, as it only considers the aggregated LLM probabilities and predicted
PII type. However, it does not take into account the text content of the span
itself. We now present an indicator that includes this text information to
predict whether a text span constitutes a high privacy risk, and should
therefore be masked.

Concretely, we enrich the classifier from the previous section by adding to
the features a vector representation of the text span derived from a large
language model. The classifier thus relies on a combination of numerical
features (the aggregated LLM probabilities discussed above, to which we add
the number of words and subwords of the span), a categorical feature (an
encoding of the PII type), and a vector representation of the text span.
Crucially, the transformer-based language model that produces this vector
representation is fine-tuned to this prediction task.

The resulting model architecture is illustrated in Figure 2. Concretely, the
model training is done using AutoGluon’s Multimodal predictor [45], making it
easier to incorporate a wide range of feature types, including textual content
processed with a neural language model. We employ here the Electra
Discriminator model due to its good encoding performance [6, 45]. The
categorical and numerical features are processed by a standard MLP. After each
model is trained separately, their output is pooled (concatenation) by a MLP
model using a fuse-late strategy near the output layer. Table 4 provides some
examples of input.

Figure 2: Overview of the model architecture for span classification, including both numerical, text and categorical features. Adapted from Shi et al. [45]. Table 4: Selected examples of input features for the span classification model. The aggregated LLM probabilities are in logarithmic form. nbw and nbsw respectively correspond to the number of words and subwords (token) in the span. span text | PII type | pmin | pmax | pavg | pmdn | psum | nbw | nbsw | label
---|---|---|---|---|---|---|---|---|---
36244/06 | CODE | -5.7 | -1.9 | -3.7 | -3.3 | -18.4 | 3 | 2 | MASK
Kingdom of Denmark | ORG | -4.3 | -3.9 | -4.1 | -4.2 | -12.4 | 3 | 0 | NO_MASK
winger | MISC | -1.5 | -1.5 | -1.5 | -1.5 | -1.5 | 1 | 0 | NO_MASK
Reniers | PERSON | -8.6 | -4.2 | -6.4 | -6.4 | -12.8 | 1 | 1 | MASK

For our experiments, we again fit the classifier using the training datasets
of the annotated collection of Wikipedia biographies and the TAB corpus.

###  5.3 Perturbations

The two previous risk indicators use features extracted from the text span to
emulate masking decisions from human annotators. They are not, however, able
to quantify how much information a PII span can contribute to the re-
identification. They also consider each PII span in isolation, thereby
ignoring the fact that quasi-identifiers constitute a privacy risk precisely
because of their combination with one another. We now turn to a privacy risk
indicator that seeks to address those two challenges.

This approach is inspired by saliency methods [27, 10] used to explain and
interpret the outputs of large language models. One such method is
perturbation when one changes the input to the model by either modification or
removal, and observes how this change affects the downstream predictions [23,
28, 44]. In our case, we perturb the input by altering one or more PII spans
and analyse the consequences of this change on the probability produced by the
language model for another PII span in the text.

Consider the following text:

######  Example 9.

“Michael Linder is an American television producer and broadcast journalist
based in Los Angeles […] In 1995-6 Linder created and produced “Berserkistan”
[..] From 2004 through 2009, Linder served as a radio journalist for KNX-AM.
[…]”

The target span American has a log probability of -0.006 given the rest of the
document. However, if the span “television producer” ends up being masked, its
log probability becomes -2.062, indicating that the latter is informative to
the target.

To assess which spans to mask, we use a RoBERTa large model [30] and all
possible combinations of PII in the text in a perturbation-based setting. We
begin by calculating the probability of a target span with the rest of the
context available in the text. We then mask in turn every other PII span in
the document and recompute the probability of the target span to determine how
the absence of the PII span affects the probability of the target span.

To obtain sensible estimates, we must mask all spans that refer to the same
entity while calculating the probabilities. In Example 9, Michael Linder and
Linder refer to the same entity. We use in our experiments the co-reference
links already annotated in the TAB corpus and the collection of Wikipedia
biographies.

Based on the difference between the original and the new target probability,
we select the PII spans that make the target span more difficult to predict.
To determine a threshold for deciding which spans constitute an unacceptable
risk, we devise an objective function based on the privacy-oriented precision
and recall metrics outlined in Section 6.1. More precisely, assuming that PII
spans are masked when the difference between the original and new target
probability is greater than a threshold $t$, we look for the optimal threshold
value $t^{*}$ that maximises the sum of three scores, namely the precision
$p^{t}$, recall on direct identifiers $r_{\textrm{direct}}^{t}$ and recall on
quasi identifiers $r_{\textrm{quasi}}^{t}$:

$t^{*}=\operatorname*{arg\,max}_{t}\left(p^{t}+r_{\textrm{direct}}^{t}+r_{\textrm{quasi}}^{t}\right)$
(1)

The three above scores $p^{t}$, $r_{\textrm{direct}}^{t}$ and
$r_{\textrm{quasi}}^{t}$ are obtained using a threshold $t$ on the difference
of probabilities to decide which spans to mask. Those scores are computed in
our experiments using the training set of our corpora. The resulting
thresholds are different for the Wikipedia biographies (approximately 3.5) and
the TAB corpus (approximately 10). Figure 6 in Appendix F shows the
performance of this risk indicator at different thresholds for both datasets.

###  5.4 Sequence Labelling

Yet another approach to indirectly assess the re-identification risk based on
masking decisions from experts is to estimate a sequence labelling model.
Compared to the previous methods, this method is the one that is most
dependent on the availability of in-domain, labeled training data.

For this approach, we fine-tune a encoder-type language model on a token
classification objective, each token being assigned to either MASK or NO_MASK.
For the Wikipedia biographies, we rely on a RoBERTa model [30], while we
switch to a Longformer model [2] for TAB given the length of the court cases,
as proposed in Pilán et al. [39]. Due to discrepancies between the manually
labeled spans or detected by the privacy-oriented entity recognizer, and the
ones created by the fine-tuned model, we operate under two possible setups:

  * •

Full match: We assume that a span constitutes a high re-identification risk if
all of its tokens are marked as MASK by the fine-tuned Longformer/RoBERTa.

  * •

Partial match: We consider that the span has a high risk if at least one token
is marked as MASK by the Longformer/RoBERTa model.

###  5.5 Web Search

Web query results can also be used to approximate the re-identification risk.
This approximation relies on the assumption that text spans with an
inadmissible level of re-identification risk will have web results that
mention the individual we are trying to protect. Building from earlier work in
Papadopoulou et al. [38], we first query the person’s name to obtain URLs
related to that person. We then query the PII spans of the document. For each
span, we then compare the resulting URLs with those from querying the search
engine with the person’s name. If the intersection of these two sets of URLs
is not empty, the text span is considered to pose a high re-identification
risk. More formally, whether a text span poses a risk of re-identification,
$R_{web}$, is defined as:

$R_{web}=\begin{cases}0,&\text{ if
}\\{URLs_{e}\\}\cap\\{URLs_{i}\\}=\emptyset\\\ 1,&\text{ otherwise
}\end{cases}$ (2)

where $\\{URLs_{e}\\}$ is the set of URLs resulting from querying the web
search engine with the text span and $\\{URLs_{i}\\}$ is the set of URLs
mentioning the person to protect.

We used the Google API to query for each target individual in a given document
and the unique text spans that occur in a given document777Web searches are
from the period spanning July 2023 to September 2023.. The Google API provides
10 results per page. We limit the experiment to the top 20 results (i.e. first
two pages from the web search). To avoid a prohibitively high number of API
calls, we also constrain the search to individual text spans, although the
same approach can in principle be extended to combinations of PII spans.

We also used the total number of hits reported by the Google search API for
each PII span query. The assumption here is that if a search yields a larger
number of responses, there is a higher chance that one of those responses will
contain information about the target individual. However, generic search
queries are also likely to return many responses. Therefore we considered
applying an upper and lower bound on the total number hits. These thresholds
were set experimentally to maximize the token-level $F_{1}$ scores on the TAB
development set. This resulted in a lower limit of 100 hits and no upper
limit. This method is limited by the potential unreliable nature of the total
responses reported by web search engines, as shown in Sánchez et al. [48].

##  6 Analysis of Privacy Risk Indicators

We now evaluate the privacy risk indicators detailed in the previous section,
both in isolation (Section 6.2) and in combination (Section 6.4) and discuss
the main findings.

###  6.1 Evaluation Metrics

The evaluation of text sanitization must strike a balance between two
competing considerations:

  * •

Privacy risk: text spans that have a high risk of leading, directly or
indirectly, to the re-identification of the individual should be masked.

  * •

Data utility: the sanitized text should preserve as much semantic content as
possible.

The traditional approach to evaluating text sanitization is to rely on a
manually labeled set of documents and use metrics such as precision, recall
and $F_{1}$ score to measure the overlap between the human decisions and the
system outputs. The recall is associated with the privacy risk, as a high
recall indicates that most of the PII spans that should have been masked, are
indeed masked. Similarly, the precision is correlated with the data utility,
as a high precision expresses that the resulting sanitization did not mask
unnecessary text spans.

As argued in Pilán et al. [39], the use of standard precision and recall
measures has, however, a number of important shortcomings. They do not capture
the fact that some identifiers have a more important influence on the privacy
risk than others (for instance, omitting to mask a full person name is a more
serious threat than omitting a vague quasi-identifier). They also ignore the
fact that a personal identifier is only protected if all its occurrences are
masked: if a person name is mentioned 4 times in a document, and 3 of those
occurrences are masked, the re-identification risk remains unchanged, as the
identifier remains available in clear text in one occurrence. Finally, text
sanitization may admit several, equally correct solutions.

To provide a more fine-grained assessment of the text sanitization quality,
Pilán et al. [39] present a set of three privacy-oriented metrics, micro-
averaged over multiple annotators:

Entity recall on direct identifiers Micro-averaged, entity-level recall score
calculated only for direct identifiers. If an entity is mentioned multiple
times in the text, all mentions must to be masked for it to be considered
correct.

Entity recall on quasi identifiers Micro-averaged, entity level recall score
calculated only for quasi identifiers. In case of multiple mentions of the
same entity, all mentions must again be masked.

Weighted Precision Micro-averaged, token-level precision where each token is
weighted by its information content (measured using a language model such as
BERT).

The evaluation results below are computed according to those three metrics.

###  6.2 Experimental Results

We first evaluate the five privacy risk indicators using PII spans manually
labeled by human annotators from both the TAB corpus and the Wikipedia
biographies. The results are shown in Table 5. The approaches based on LLM
probabilities and span classification were trained on the corresponding
training set (either Wikipedia or TAB), and the threshold of the perturbation-
based method was similarly adjusted from the training set. The web search
results rely on the two alternatives techniques presented in Section 5.5,
respectively based on the intersection of URLs or the estimated number of
hits. We also provide the results obtained with a simple baseline that masks
all PII spans.

We then evaluate the risk indicators with the PII spans actually detected by
the privacy-oriented entity recognizer described in Section 4, thereby
enabling us to assess the end-to-end performance of the proposed approaches.
The results are shown in Table 6. Note that, in this setup, the majority rule
baseline (which masks all PII spans) leads to recall scores lower than 1 due
to detection errors arising from the privacy-oriented entity recognizer.

Table 5:  Evaluation of the privacy risk indicators with manually labeled text spans. The results are obtained by comparing the text spans predicted as risky by each method against the masking decisions of human experts. We report token-level and entity-level scores. P denotes the token-level precision, $\mathbf{P_{w}}$ the token-level precision weighted by information content (see Pilán et al. [39] for details), $\mathbf{R}_{\textrm{all}}$ the token-level recall of all personal identifiers, and $\mathbf{F_{1}}$ the token-level $F_{1}$ score on all identifiers. $\mathbf{R}_{\textrm{ent}}$ denotes the entity-level recall for all identifiers, while $\mathbf{R}_{\textrm{direct}}$ the entity-level recall of direct identifiers and $\mathbf{R}_{\textrm{quasi}}$ the entity-level recall of quasi-identifiers. The results for a given document are micro-averaged over all annotators. | P | $\mathbf{P_{w}}$ | $\mathbf{R}_{\textrm{all}}$ | $\mathbf{F_{1}}$ | $\mathbf{R}_{\textrm{ent}}$ | $\mathbf{R}_{\textrm{direct}}$ | $\mathbf{R}_{\textrm{quasi}}$
---|---|---|---|---|---|---|---
Wikipedia biographies (test set)
Majority rule (mask everything) | 0.80 | 0.84 | 1.00 | 0.89 | 1.00 | 1.00 | 1.00
|  |  |  |  |  |  |
LLM probabilities (logistic regression) | 0.87 | 0.89 | 0.92 | 0.89 | 0.85 | 1.00 | 0.84
LLM probabilities (AutoML model) | 0.89 | 0.91 | 0.93 | 0.91 | 0.89 | 1.00 | 0.88
|  |  |  |  |  |  |
Span classification (AutoML model) | 0.93 | 0.94 | 0.87 | 0.90 | 0.82 | 0.99 | 0.81
|  |  |  |  |  |  |
Perturbations (threshold $\approx 3.5$) | 0.80 | 0.84 | 1.00 | 0.89 | 1.00 | 0.99 | 1.00
|  |  |  |  |  |  |
Sequence labelling (RoBERTa, strict match) | 0.84 | 0.89 | 0.81 | 0.82 | 0.78 | 0.85 | 0.77
Sequence labelling (RoBERTa, partial match) | 0.83 | 0.86 | 0.97 | 0.89 | 0.97 | 1.00 | 0.96
|  |  |  |  |  |  |
Web search (URL $\cap$) | 0.98 | 0.99 | 0.22 | 0.36 | 0.08 | 0.52 | 0.03
Web search (# of hits) | 0.80 | 0.84 | 0.99 | 0.88 | 0.99 | 0.95 | 0.99
Text Anonymization Benchmark (test set)
Majority rule (mask everything) | 0.52 | 0.56 | 1.00 | 0.69 | 1.00 | 1.00 | 1.00
|  |  |  |  |  |  |
LLM probabilities (logistic regression) | 0.53 | 0.57 | 0.96 | 0.68 | 0.93 | 0.91 | 0.93
LLM probabilities (AutoML model) | 0.61 | 0.64 | 0.93 | 0.73 | 0.93 | 1.00 | 0.92
|  |  |  |  |  |  |
Span classification (AutoML model) | 0.74 | 0.77 | 0.92 | 0.83 | 0.93 | 1.00 | 0.92
|  |  |  |  |  |  |
Perturbations (threshold $\approx 10)$ | 0.52 | 0.56 | 1.00 | 0.69 | 1.00 | 1.00 | 1.00
|  |  |  |  |  |  |
Sequence labelling (Longformer, strict match) | 0.90 | 0.91 | 0.87 | 0.88 | 0.88 | 0.96 | 0.87
Sequence labelling (Longformer, partial match) | 0.87 | 0.88 | 0.95 | 0.90 | 0.95 | 1.00 | 0.95
|  |  |  |  |  |  |
Web search (URL $\cap$) | 0.95 | 0.96 | 0.13 | 0.22 | 0.04 | 0.41 | 0.01
Web search (# of hits) | 0.52 | 0.56 | 0.98 | 0.68 | 0.97 | 0.93 | 0.98

Table 6:  Evaluation of the privacy risk indicators with PII spans detected by the privacy-oriented entity recognizer of Section 4, using the same metrics as in Table 5. | P | $\mathbf{P_{w}}$ | $\mathbf{R}_{\textrm{all}}$ | $\mathbf{F_{1}}$ | $\mathbf{R}_{\textrm{ent}}$ | $\mathbf{R}_{\textrm{direct}}$ | $\mathbf{R}_{\textrm{quasi}}$
---|---|---|---|---|---|---|---
Wikipedia biographies (test set)
Majority rule (mask everything) | 0.66 | 0.75 | 0.93 | 0.77 | 0.91 | 0.88 | 0.91
|  |  |  |  |  |  |
LLM probabilities (logistic regression) | 0.82 | 0.86 | 0.83 | 0.82 | 0.75 | 0.87 | 0.74
LLM probabilities (AutoML model) | 0.83 | 0.87 | 0.84 | 0.84 | 0.78 | 0.87 | 0.78
|  |  |  |  |  |  |
Span classification (AutoML model) | 0.87 | 0.90 | 0.78 | 0.83 | 0.72 | 0.85 | 0.71
|  |  |  |  |  |  |
Perturbations (threshold $\approx 3.5$) | 0.66 | 0.75 | 0.93 | 0.77 | 0.91 | 0.87 | 0.91
|  |  |  |  |  |  |
Sequence labelling (RoBERTa, strict match) | 0.80 | 0.87 | 0.70 | 0.75 | 0.65 | 0.81 | 0.63
Sequence labelling (RoBERTa, partial match) | 0.76 | 0.82 | 0.91 | 0.83 | 0.88 | 0.88 | 0.88
|  |  |  |  |  |  |
Web search (URL $\cap$) | 1.00 | 1.00 | 0.11 | 0.20 | 0.02 | 0.20 | 0.00
Web search (# of hits) | 0.66 | 0.75 | 0.92 | 0.77 | 0.90 | 0.85 | 0.91
Text Anonymization Benchmark (test set)
Majority rule (mask everything) | 0.43 | 0.52 | 0.96 | 0.60 | 0.93 | 0.98 | 0.94
|  |  |  |  |  |  |
LLM probabilities (logistic regression) | 0.44 | 0.53 | 0.91 | 0.60 | 0.85 | 0.93 | 0.85
LLM probabilities (AutoML model) | 0.51 | 0.60 | 0.88 | 0.65 | 0.87 | 0.98 | 0.86
|  |  |  |  |  |  |
Span classification (AutoML model) | 0.68 | 0.76 | 0.88 | 0.77 | 0.87 | 0.98 | 0.86
|  |  |  |  |  |  |
Perturbations (threshold $\approx 10)$ | 0.43 | 0.52 | 0.96 | 0.60 | 0.94 | 0.98 | 0.94
|  |  |  |  |  |  |
Sequence labelling (Longformer, strict match) | 0.87 | 0.88 | 0.83 | 0.85 | 0.83 | 0.95 | 0.82
Sequence labelling (Longformer, partial match) | 0.82 | 0.84 | 0.91 | 0.86 | 0.90 | 0.98 | 0.90
|  |  |  |  |  |  |
Web search (URL $\cap$) | 0.99 | 0.99 | 0.12 | 0.22 | 0.03 | 0.43 | 0.01
Web search (# of hits) | 0.43 | 0.51 | 0.94 | 0.59 | 0.91 | 0.90 | 0.92

###  6.3 Discussion

We now discuss the experimental results of each privacy risk indicator one by
one.

#### LLM probabilities

We can observe that the AutoML model, which consists of an ensemble of
supervised classifiers such as decision trees with hyper-parameters optimized
on the development set, outperforms a simpler logistic regression model. In
other words, the task of predicting high-risk text spans given the aggregated
probabilities obtained from a large language model seems to require a non-
linear decision boundary.

We also notice a substantial difference between the Wikipedia biographies and
the TAB corpus. A closer look at the token log-probabilities factored by
masking decision, as shown in Figure 3, is particularly instructive. While the
PII spans from the Wikipedia biographies show a clear difference between the
log-probabilities of the masked and non-masked tokens, this is not the case
for the TAB corpus888At least when aggregating over all PII types. If we do,
however, factor those log-probabilities by PII type, we do notice a difference
in log-probabilities for a number of PII types..

The classifier reaches its optimal performance relatively quickly, after
observing about 1 % of the total training set size in both corpora. Ablation
experiments also show that the most important feature for the classifier is
the PII type, as some types are masked by human annotators much more often
than others.

Figure 3: Token log-probabilities depending on the expert-annotated masking
decision (MASK or NO_MASK) of the corresponding span for Wikipedia and TAB.

#### Span classification

The span classification approach improves the classification performance
compared to the classifier trained only on the aggregated probabilities from
the LLM, in particular for the Text Anonymization Benchmark.

As training this classifier includes fine-tuning a large language model, it
requires slighly more training data than the classifier based exclusively on
LLM probabilities and PII types. We observe experimentally that the classifier
performance stabilizes at around 10% of training instances for both datasets.
Based on ablation experiments, we also see that the outputs of the fine-tuned
language model play a major role in the final prediction, along with the PII
type.

#### Perturbations

Despite its theoretical benefits (such as the possibility to directly assess
the extent to which a PII span contributes to predicting a direct personal
identifier), the perturbation-based method performs poorly, and does not seem
to improve upon the majority rule baseline. Indeed, the perturbation
mechanism, in combination with the cost function employed to fix the threshold
on the log-probabilities, leads to masking the vast majority of text spans.

#### Sequence labelling

Overall, this approach seems to provide the best balance between precision and
recall scores, which is to be expected from a large language model fined-tuned
on manually labeled data. In contrast to the span classification method, which
only considers the tokens inside the PII span itself, the sequence labelling
approach can take into account the surrounding context of each span.

One should note that the results in Tables 5 and 6 are obtained with a default
threshold of 0.5 on the masking probability. This threshold can, of course, be
adjusted to increase the relative importance of recall scores, as is often
done in text sanitization to increase the cost of false negatives.

The method based on partial matches, which considers a PII span as risky if at
least one constituting token is marked as risky, provides the best results. We
also observe that the results on the Wikipedia biographies are lower than
those obtained for TAB. This is likely to be due to the smaller number of
biographies available for training (453 short texts) compared to the 1014
documents in the training set of TAB.

#### Web Search

Table 5 shows a clear difference between using intersection of URLs and using
the estimated number of hits, with the first showing a very low recall score
while the latter shows a more balanced performance between precision and
recall. The intersection of URLs, though, provides better explainability than
the number of hits, as one can point the user to the actual URL(s) that
contribute to the re-identification.

While using the intersection of URLs is hampered by the limitation on the
number of pages, the chances of a meaningful crossover between target and
entities in a text diminishes the deeper into the tail of web results we
delve. A possible solution is to try to analyze the text found in the URLs in
order to evaluate whether the target individual is mentioned or not.

On the other hand, the number of hits up to a limit is a better approximation
of risky entities, despite the unreliability of the number of hits as given by
the API. Note, though, the restrictions we have already mentioned in Section
5.5 that are bound to affect the performance. Even though the web can be seen
as a very useful and detailed approximation of potential background knowledge
an attacker could have and use for re-identification purposes, the technical
details of utilizing this make it hard to explain clearly the reason behind
the performance.

#### Summary

As can be expected, privacy risk indicators trained on manually labelled data,
in particular sequence labelling, provide the best performance when comparing
the spans identified as high risk with expert annotations. Text data annotated
with masking decisions is, however, scarce to non-existent for many text
sanitization domains.

When it comes to data utility, we also observe that the precision score
weighted by information content ($\mathbf{P}_{w}$) is higher than the regular
precision score for all privacy risk indicators. As argued in Pilán et al.
[39], this weighted score is more informative than the basic precision score
as it takes into account the informativeness of each token. As a consequence,
a higher weighted precision score means that overmasking tends to occur on
less informative tokens.

###  6.4 Combination of Risk Indicators

Finally, we also evaluate the performance of the privacy risk indicators in
combination. More specifically, we consider a manually detected PII span as
high-risk if it has been marked as such by at least one, two or three risk
indicators.999For the web query risk indicator described in Section 5.5, we
use the hit-based one since it shows more interesting results. For the
sequence labelling model described in Section 5.4, we use the spans that were
masked under the partial offset match. The resulting performance is shown in
Table 7.

Table 7:  Evaluation results (on manually labelled PII spans) for the combination of the privacy risk indicators where a PII span is masked if it is considered risky by at least one, two, or three of the five privacy risk indicators presented in the paper. | P | Pw | Rall | F1 | Rent | Rdirect | Rquasi
---|---|---|---|---|---|---|---
Wikipedia biographies (test set)
$\geq$ 1 | 0.78 | 0.82 | 1.00 | 0.87 | 1.00 | 1.00 | 1.00
$\geq$ 2 | 0.80 | 0.84 | 1.00 | 0.89 | 1.00 | 1.00 | 1.00
$\geq$ 3 | 0.84 | 0.87 | 0.98 | 0.90 | 0.96 | 1.00 | 0.96
Text Anonymization Benchmark (test set)
$\geq$ 1 | 0.52 | 0.56 | 1.00 | 0.68 | 1.00 | 1.00 | 1.00
$\geq$ 2 | 0.52 | 0.56 | 1.00 | 0.69 | 1.00 | 1.00 | 1.00
$\geq$ 3 | 0.61 | 0.64 | 0.98 | 0.75 | 0.99 | 1.00 | 0.99

Although the combination of privacy risk indicators with $\geq 3$ positive
signals leads to overmasking, it does detect all direct identifiers and
virtually all quasi-identifiers while retaining a higher precision than the
majority rule baseline. This high recall is important in text sanitization, as
the cost of ignoring a high-risk PII span is much higher than the cost of a
false positive. While overmasking does slightly reduce the data utility (by
making the text less readable or stripped of some useful content), the
presence of a false negative implies that it remains possible to re-identify
the individual(s) in question, and that their privacy is therefore not fully
ensured.

##  7 Conclusions and Future Work

This paper presented a thorough empirical analysis of two key components of
text sanitization methods, namely entity recognition and privacy risk
indicators.

Our experimental results, based on two complementary corpora, indicate that
the entity detection task is the most straightforward step to automate. We
highlighted the need to go beyond the mere detection of named entities and
identify other types of text spans that may provide identifying information.
To this end, we showed how to extract large lists of person-related attributes
extracted from a knowledge graph such as Wikidata, and thereby apply those
lists, along with a standard NER model, to automatically annotate a silver
corpus of PII spans. This silver corpus can, in turn, serve as training data
to fine-tune a domain-specific, privacy-oriented entity recognizer.

Determining text spans associated with a high re-identification risk is the
most challenging part of the task. A system that masks all detected spans
leads to a low privacy risk, but also a comparatively low data utility. We
presented five distinct indicators of privacy risk, respectively based on LLM
probabilities, span classification, perturbations, sequence labelling and web
search. Evaluation results comparing the outputs of those approaches with
human annotations demonstrate the difficulty of the task. Sequence labelling
leads to masking decisions that are most in line with expert annotations, but
this approach hinges upon the availability of labelled training data, a
requirement that is rarely satisfied in text sanitization tasks. The use of
web search also constitutes a promising direction, but suffers from technical
constraints arising from the reliance on search engine APIs.

The present paper did not elaborate on how masking should be performed. A
common option is to simply replace the selected spans by a black box or a
generic string such as “***”. However, to mitigate the loss of data utility ,
it is often preferable to replace those PII spans with other, less specific
spans, such as editing “Oslo” into “[city in Norway]” or “January 6, 2022”
into “2022”. Olstad et al. [36] explore an approach for selecting suitable
replacements for different types of PII spans, which we evaluated against
human decisions. Such an approach could be extended to different domains and
different types of PII spans.

Evaluating text sanitization tasks is a challenging problem, notably due to
the presence of multiple equally correct solutions for a given document [29].
In this work we evaluate against manually annotated documents, using several
expert annotators for each document to ensure a reasonable set of possible
solutions. Relying on manual annotations is, however, not always feasible, so
alternative evaluation methods suitable for the task should also be explored.
Re-identification constitutes a promising approach [43, 34, 33], and operates
by carrying out an attack aiming to determine whether an individual was part
of the sanitized collection of documents, often having access to additional,
external resources. Future work will look at the use of such re-identification
attacks as an alternative measure of the text sanitization strength.

## Declarations

### Author Contribution

A.P: conceptualization, implementation of privacy risk indicators (apart from
web search), evaluation of privacy-aware entity recognition, evaluation of
privacy risk indicators alone and in combination, creation of figures,
creation of table, writing and editing of the final manuscript. P.L:
supervision, writing and editing of the final manuscript. M.A: web search risk
indicator, writing. L.Ø: supervision, writing. I.P: supervision, writing. All
authors reviewed the manuscript prior to submission.

### Funding

The research leading to these results received funding from the Research
Council of Norway (CLEANUP project) under Grant nr. 308904.

### Conflict of Interest

The authors have no conflict of interest to declare.

### Data Availability Statement

No datasets were generated during the current study.

### Acknowledgment

We acknowledge support from the Norwegian Research Council (CLEANUP project,
grant nr.308904).

##  Appendix A Human properties from Wikidata

The two tables below show the selected Wikidata properties mentioned in
Section 4.1 that constitute the DEM and MISC gazetteers.

### DEM-related properties

—p28mm—p28mm—p63mm— Property Example Description
hairstyle / hairlength (P8839) afro style of cutting, arranging, or combing
the hair on the subject’s scalp
grants (P5460) Bachelor of Arts confers degree, honor, award, prize, title,
certificate or medal denoting achievement to a person or organization
next lower rank (P3729) General “lower rank or level in a ranked hierarchy
like sport league, military ranks. If there are several possible, list each
one and qualify with ““criterion used”” (P1013), avoid using ranks and date
qualifiers. For sports leagues/taxa, use specific properties instead.”
special rank (P5012) General of the Police of the Russian Federation non-
military rank given to a civil office holder in Russia
political ideology (P1142) social liberalism political ideology of an
organization or person or of a work (such as a newspaper)
office held by head of the organization (P2388) Chief Justice of the United
States position of the head of this item
ethnic group (P172) Ashkenazi Jews subject’s ethnicity (consensus is that a
VERY high standard of proof is needed for this field to be used. In general
this means 1) the subject claims it themselves, or 2) it is widely agreed on
by scholars, or 3) is fictional and portrayed as such)
facial hair (P8852) chin curtain style of cutting, arranging, or combing the
hair on the subject’s face (usually on the chin, cheeks, and upper lip
region); beard
language used (P2936) Catalan language widely used (spoken or written) in this
place or at this event
writing language (P6886) French language in which the writer has written their
work
religion (P8929) agnosticism religious or world view affiliation of a person,
organization or religious building
sex or gender (P21) male organism sex or gender identity of human or animal.
For human: male, female, non-binary, intersex, transgender female, transgender
male, agender. For animal: male organism, female organism. Groups of same
gender use subclass of (P279)
languages spoken, written or signed (P1412) Old Chinese language(s) that a
person or a people speaks, writes or signs, including the native language(s)
noble title (P97) baron titles held by the person
position held (P39) President of the United States subject currently or
formerly holds the object position or public office
Y-DNA Haplogroup (P4426) Haplogroup R1b Y-DNA haplogroup of a person or
organism
original language of film or TV show (P364) italian “language in which a film
or a performance work was originally created. Deprecated for written works and
songs; use P407 (““language of work or name””) instead.”
canonization status (P411) saint stage in the process of attaining sainthood
per the subject’s religious organization
occupation (P106) writer “occupation of a person; see also ““field of work””
(Property:P101), ““position held”” (Property:P39)”
eye color (P1340) blue-green color of the irises of a person’s eyes
culture (P2596) Inca Empire human culture or people (or several cultures)
associated with this item
practiced by (P3095) cheerleader type of agents that study this subject or
work in this profession
official language (P37) English language designated as official by this item
dialect of (P4913) Northern Sami “language of which an item with this property
is a dialect. Use in addition to ““subclass of”” (P279) if a languoid is also
considered a dialect.”
political alignment (P1387) left-wing political position within the left-right
political spectrum
educational stage (P7374) undergraduate education “educational stage of a
specific school; qualifier of ““educated at”” (P69): the education stage of
someone’s attendance of school”
substitute (P2098) Lieutenant Governor of the United States Virgin Islands
function that serves as deputy/replacement of this function/office
(scope/conditions vary depending on office)
professorship (P803) Lucasian Professor of Mathematics professorship position
held by this academic person
official religion (P3075) Islam official religion in this administrative
entity
office contested (P541) Chief Executive of Hong Kong title of office which
election will determine the next holder of
sexual orientation (P91) homosexuality the sexual orientation of the person –
use IF AND ONLY IF they have stated it themselves, unambiguously, or it has
been widely agreed upon by historians after their death
kinship to subject (P1039) daughter-in-law “qualifier of ““relative”” (P1038)
to indicate less usual family relationships (ancestor, son-in-law, adoptions,
etc). Indicate how the qualificator item is related to the main item.”
next higher rank (P3730) pope “higher rank or level in a ranked hierarchy like
sport league, military ranks. If there are several possible, list each one and
qualify with ““criterion used”” (P1013), avoid using ranks and date
qualifiers. For sports leagues/taxa, use specific properties instead.”
academic degree (P512) Doctor of Philosophy academic degree that the person
holds
religion or worldview (P140) Hinduism religion of a person, organization or
religious building, or associated with this subject
office held by head of government (P1313) Prime Minister of the United Kingdom
political office that is fulfilled by the head of the government of this item
native language (P103) Russian language or languages a person has learned from
early childhood
members have occupation (P3989) lawyer all members of this group share the
occupation
language of work or name (P407) Italian “language associated with this
creative work (such as books, shows, songs, or websites) or a name (for
persons use ““native language”” (P103) and ““languages spoken, written or
signed”” (P1412))”
office held by head of state (P1906) President of Israel political office that
is fulfilled by the head of state of this item
military rank (P410) General “military rank achieved by a person (should
usually have a ““start time”” qualifier), or military rank associated with a
position”
medical condition (P1050) spina bifida any state relevant to the health of an
organism, including diseases and positive conditions
hair color (P1884) brown hair person’s hair color. Use P585 as qualifier if
there’s more than one value
title of chess person (P2962) Grandmaster title awarded by a chess federation
to a person

### MISC-related properties

—p28mm—p28mm—p63mm— Property Example Description
classification of race (P2502) 2015 Schaal Sels race for which this
classification applies
contributing factor of (P1537) critical thinking thing that is significantly
influenced by this cause, but does not directly result from it. See
’Help:Modeling causes’ for examples and discussion.
length (P2043) 15 centimeters measured dimension of an object
conflict (P607) Battle of Dennewitz battles, wars or other military
engagements in which the person or item participated
school of (P1780) Ain AlBaraha for a creative work with author with a style
influenced by the known author or circle, active in the same period, but a
student or follower
bowling style (P2545) Left-arm orthodox spin type of bowling employed by a
cricketer
field of training (P8258) bookselling profession, position or activity someone
learnt during a training, traineeship or apprenticeship
used by (P1535) television watcher item or concept that makes use of the
subject (use sub-properties when appropriate)
studied by (P2579) egyptology subject is studied by this science or domain
hashtag (P2572) BlackLivesMatter “hashtag associated with this item. Format:
do not include the ““#”” symbol”
worshipped by (P1049) Zoroastrianism religion or group/civilization that
worships a given deity
motto (P1546) Florebo quocumque ferar description of the motto of the subject
statement is subject of (P805) death of Osama bin Laden (qualifying) item that
describes the relation identified in this statement
GitHub topic (P9100) bitcoin GitHub topic for a repository or subject
original spelling (P1353) Aloe steffaniana original spelling of a scientific
name
armament (P520) AIM120 AMRAAM equippable weapon item for the subject
architectural style (P149) French Gothic architecture architectural style of a
structure
academic major (P812) political science major someone studied at
college/university
in opposition to (P5004) Plan Juppé, 1995 qualifier to indicate the purpose of
a social action
astronaut mission (P450) Soyuz TMA-8 space mission that the subject is or has
been a member of (do not include future missions)
field of this occupation (P425) bodyboarding activity corresponding to this
occupation or profession (use only for occupations/professions - for people
use Property:P101, for companies use P452)
vessel (P1876) Soyuz-TMA vessel involved in this mission, voyage or event
test taken (P5021) SAT subject took the test or exam, or was assessed per test
or method
trophy awarded (P4622) Oscar statuette trophy awarded at the end of a
selection process or of a competition, usually to winners or finishers under
the form of a cup, a medal, a diploma
sport number (P1618) 27 number worn on a player’s (competitor’s) uniform,
equipment, etc
Twitter username (P2002) NASA this item’s username on Twitter; do not include
the ??? symbol
programming language (P277) C++ the programming language(s) in which the
software is developed
advertises (P6291) Michelin cause, organization or product targeted by the
advertising campaign, character, jingle or slogan
uses (P2283) paintbrush item or concept used by the subject or in the
operation (see also instrument [P1303] and armament [P520])
study or design for (P6606) Birds and Irises finished work of art for which
the subject is a preliminary study, design, or conceptual drawing
manner of death (P1196) capital punishment general circumstances of a person’s
death; e.g. natural causes, accident, suicide, homicide, etc. Use ’cause of
death’ (P509) for the specific physiological mechanism, e.g. heart attack,
trauma, pneumonia…
evaluation of (P5134) heart rate the subject finding is an evaluation or
interpretation of the object attribute or test
Eight Banner register (P470) Manchu Bordered Yellow Banner Manchu household
register for people of the Qing Dynasty
title of broader work (P6333) Revue des Deux Mondes “title of website, journal
or other work in which an article (or other publication) is published in. Use
““published in”” (P1433) instead if possible.”
genre (P136) war film creative work’s genre or an artist’s field of work
(P101). Use main subject (P921) to relate creative works to their topic
applies to jurisdiction (P1001) Eurozone the item (institution, law, public
office, public register…) or statement belongs to or has power over or applies
to the value (a territorial jurisdiction: a country, state, municipality, …)
playing hand (P741) left-handedness hand used to play a racket sport
fictional analog of (P1074) spacecraft used to link an entity or class of
entities appearing in a creative work with the analogous entity or class of
entities in the real world
inscription (P1684) O U O S V A V V inscriptions, markings and signatures on
an object
broader concept (P4900) hat qualifier to indicate a broader concept that the
present item is part of, as mapped by an external source. The statement being
qualified should be an exact match.
legal citation of this text (P1031) 384 U.S. 436 legal citation of legislation
or a court decision
exhibition history (P608) Saint Anne, Leonardo da Vinci ultimate masterpiece
exhibitions where the item is or was displayed
form of creative work (P7937) novel structure of a creative work, type of
music release
has edition or translation (P747) Orgoglio e pregiudizio link to an edition of
this item
nominated for (P1411) BRIT Awards “award nomination received by a person,
organisation or creative work (inspired from ““award received””
(Property:P166))”
voice type (P412) lyric spinto tenor person’s voice type. expected values:
soprano, mezzo-soprano, contralto, countertenor, tenor, baritone, bass (and
derivatives)
platform (P400) Xbox 360 platform for which a work was developed or released,
or the specific platform version of a software product
drug used for treatment (P2176) dabrafenib drug, procedure, or therapy that
can be used to treat a medical condition
owner of (P1830) SPY Records entities owned by the subject
fabrication method (P2079) sericulture method, process or technique used to
grow, cook, weave, build, assemble, manufacture the item
connects with (P2789) Rokin item with which the item is physically connected
totem (P2831) Siluriformes in many indigenous cultures an individual or group
has a particular totem (e.g. a type of animal)
field of work (P101) linguistic purism specialization of a person or
organization; see P106 for the occupation
definition domain (P1568) set of real numbers “set of ““input”” or argument
values for which a mathematical function is defined”
parliamentary term (P2937) 13th legislature of the Fifth French Republic term
of a parliament or any deliberative assembly
exonerated of (P7781) murder crime of which the subject was found not to be
guilty after having previously been found guilty by a court for that crime
carries scientific instrument (P1202) Astro scientific instruments carried by
a vessel, satellite, or device that are not required for propelling or
navigating
distribution format (P437) Blu-ray Disc method (or type) of distribution for
the subject
use (P366) source of information main use of the subject (includes current and
former usage)
end cause (P1534) resignation qualifier to use together with the end date
qualifier (P582) to specify the cause
source of income (P2770) donation source of income of an organization or
person
participant in (P1344) 1992 Winter Olympics event in which a person or
organization was/is a participant; inverse of P710 or P1923
depicted by (P1299) Traveler Over The Mist Sea object depicting this subject
(creative works, books of the bible)
member of the crew of (P5096) Titanic person who has been a member of a crew
associated with the vessel or spacecraft. For spacecraft, inverse of crew
member (P1029), backup or reserve team or crew (P3015)
victory (P2522) 2015 Internationale Wielertrofee Jong Maar Moedig competition
or event won by the subject
elected in (P2715) 1999 German presidential election qualifier for statements
in position held to link the election in which a person gained a position
from, or reelection in which the position was confirmed
has effect (P1542) mercury poisoning effect of this item
corrigendum / erratum (P2507) Evolution in Mendelian Populations published
notice that corrects or amends a previous publication
electoral district (P768) Ohio’s 8th congressional district “electoral
district this person is representing, or of the office that is being
contested. Use as qualifier for ““position held”” (P39) or ““office
contested”” (P541) or ““candidacy in election”” (P3602)”
mascot (P822) Scotty the Scottie Dog mascot of an organization, e.g. a sports
team or university
facet of (P1269) general relativity topic of which this item is an aspect,
item that offers a broader perspective on the same topic
has cause (P828) mercury underlying cause, thing that ultimately resulted in
this effect
direction (P560) north qualifier to indicate the direction of the object
relative to the subject item (for direction to the object, see P654)
part of (P361) head “object of which the subject is a part (if this subject is
already part of object A which is a part of object B, then please only make
the subject part of object A). Inverse property of ““has part”” (P527, see
also ““has parts of the class”” (P2670)).”
lifestyle (P1576) vegetarianism typical way of life of an individual, group,
or culture
writing system (P282) English alphabet alphabet, character set or other system
of writing used by a language, supported by a typeface
follows (P155) Star Wars: Episode IV A New Hope “immediately prior item in a
series of which the subject is a part, preferably use as qualifier of P179 [if
the subject has replaced the preceding item, e.g. political offices, use
““replaces”” (P1365)]”
flag (P163) flag of Slovakia subject’s flag
part of the series (P179) The Chronicles of Narnia series which contains the
subject
means of locomotion (P3512) bipedalism method that the subject uses to move
from one place to another
color (P462) black color of subject
constellation (P59) Andromeda the area of the celestial sphere of which the
subject is a part (from a scientific standpoint, not an astrological one)
medical examinations (P923) medical radiography examinations that might be
used to diagnose and/or prognose the medical condition
partially coincident with (P1382) Interstate 76 object that is partially part
of, but not fully part of (P361), the subject
catchphrase (P6251) Did I do that? commonly used phrase by which someone or
something may be recognized
stock exchange (P414) New York Stock Exchange exchange on which this company
is traded
motto text (P1451) Un Dieu, un roy, une foy, une loy (French) short motivation
sentence associated to item
level of description (P6224) record group position of the unit of description
in the hierarchy of the fonds
instrumentation (P870) piano combination of musical instruments employed in a
composition or accompanying a (folk) dance
footedness (P8006) left-footedness dominant foot or preferred stance of this
person
subclass of (P279) fruit next higher class or type; all instances of these
items are instances of those items; this item is a class (subset) of that
item. Not to be confused with P31 (instance of)
domain of saint or deity (P2925) sea domain(s) which this saint or deity
controls or protects
charted in (P2291) Billboard 200 chart where the element reached a position
radio format (P415) rhythmic contemporary describes the overall content
broadcast on a radio station
category contains (P4224) architectural structure category contains elements
that are instances of this item
theme music (P942) St. Anger the theme music/song used by the item
sport (P641) trail running sport that the subject participates or participated
in or is associated with
mount (P3091) Rocinante creature ridden by the subject, for instance a horse
notable work (P800) Hamlet notable scientific, artistic or literary work, or
other work of significance among subject’s works
movement (P135) Frankfurt School literary, artistic, scientific or
philosophical movement or scene associated with this person or work
has pattern (P5422) stripe pattern, design, or motif intrinsic to,
incorporated into, or applied to the surface of the subject
history of topic (P2184) history of Germany “item about the historical
development of an subject’s topic, sample: ““history of Argentina”” for
““Argentina””. To list key events of the topic, use ““significant event””
(P793)”
position played on team / speciality (P413) centre position or specialism of a
player on a team
basic form of government (P122) unitary state subject’s government
call sign (P2317) Freedom 7 short form identifier for a radio operator or
broadcaster and (as flag signal) previous for watercrafts
statistical unit (P2353) country member of a dataset
cabinet (P5054) Florida Cabinet “qualifier for ““position held”” (P39) to
indicate the cabinet to which belongs a minister”
main subject (P921) Rocco Granata primary topic of a work (see also P180:
depicts)
Artsy gene (P2411) cubism generalization of artwork type, technique, material,
genre, movement, etc. from artsy.net
template has topic (P1423) Syngnathiformes topic related to template
candidacy in election (P3602) 2012 Finnish municipal elections election where
the subject is a candidate
does not have part (P3113) control tower expected part that the item does not
have (for qualities, use P6477)
commemorates (P547) Johann Sebastian Bach what the place, monument, memorial,
or holiday, commemorates
alternate names (P4970) hankies qualifier for alternative name(s) given for a
subject in a database entry
iconographic symbol (P4185) Keys of Heaven identifying element typically
depicted as accompanying or worn by this religious figure, hero, fictional or
historical character
cuisine (P2012) Indian cuisine type of food served by a restaurant or
restaurant chain or national food culture
possible medical findings (P5131) mid-systolic click possible medical findings
of a medical condition
parent taxon (P171) Sus scrofa closest parent taxon of the taxon in question
presented in (P5072) TED2010 event at which a talk, film, paper, or poster was
presented
title (P1476) Nature published name of a work, such as a newspaper article, a
literary work, piece of music, a website, or a performance work
affiliation string (P6424) Southampton University qualifier to provide the
published string form of affiliation attached to an author
quotation or excerpt (P7081) who would these fardels bear[…] quotation or
excerpt from this work. No quotation marks needed
subject has role (P2868) antineoplastic “role/generic identity of the item
(““subject””), also in the context of a statement. For the role of the value
of the statement (““object””), use P3831 (““object has role””). For acting
roles, use P453 (““character role””). For persons, use P39.”
item operated (P121) transport infrastructure equipment, installation or
service operated by the subject
sports competition competed at (P5249) 2012 UEFA Champions League edition of
sports competitions at which the club or team that played a season competed
at. Use this to link items for team seasons to items for specific seasons of
competitions.Sample: 2012 ??? 13 FC Barcelona season ??? 13 UEFA Champions
League
literal translation (P2441) first son (English) direct or word-for-word
translation of a name or phrase (qualifier for name, title, inscription, and
quotation properties)
from narrative universe (P1080) Tolkien’s legendarium subject’s fictional
entity is in the object narrative. See also P1441 (present in work) and P1445
(fictional universe described in)
seal description (P418) Great Seal of the United States links to the item for
the subject’s seal
anthem (P85) State Anthem of the Soviet Union subject’s official anthem
taxon name (P225) Panthera leo correct scientific name of a taxon (according
to the reference given)
wears (P3828) engagement announcement dress of Catherine Middleton clothing or
accessory worn on subject’s body
studies (P2578) Ancient Egypt the object that an academic field studies;
distinct from field of work (P101), which is used for human, organization,
etc.
business model (P7936) free-to-play business model a business enterprise or
creative work operates under
social classification (P3716) commoner social class as recognized in
traditional or state law
record held (P1000) men’s pole vault world record notable record achieved by a
person or entity, include qualifiers for dates held
named after (P138) Camembert “entity or event that inspired the subject’s
name, or namesake (in at least one language). Qualifier ““applies to name””
(P5168) can be used to indicate which one”
general classification of race participants (P2321) Nacer Bouhanni
classification of race participants
tracklist (P658) Wanna Be Startin’ Somethin’ audio tracks contained in this
release
nickname (P1449) The Golden State informal name (for a pseudonym use P742)
shooting handedness (P423) left-handed shot whether the hockey player passes
or shoots left- or right-handed
significant event (P793) Battle of Dennewitz significant or notable events
associated with the subject
followed by (P156) April “immediately following item in a series of which the
subject is a part, preferably use as qualifier of P179 [if the subject has
been replaced, e.g. political offices, use ““replaced by”” (P1366)]”
manner of inhumane treatment (P7160) sleep deprivation manner of torture and
other cruel, inhumane or degrading treatment or punishments as covered by the
UN Convention experienced by the subject
possessed by spirit (P4292) Pazuzu item which is spiritually possessing this
item
fandom (P8693) A.I Troops fan group name of a celebrity, musical group, or an
artist
input method (P479) computer keyboard input method or device used to interact
with a software product
damaged (P3081) Upper Basilica of San Francesco d’Assisi physical items
damaged by this event
plea (P1437) guilt whether a person pleaded guilty, not guilty, etc.
derivative work (P4969) MX Linux new work of art (film, book, software, etc.)
derived from major part of this work
dataset distribution (P2702) Art & Architecture Thesaurus LOD Dataset
particular manner of distribution of a data set (database or file) that is
publicly available
real estate developer (P6237) Strabag Real Estate person or organization
responsible for building this item
product or material produced (P1056) uranium material or product produced by a
government agency, business, industry, facility, or process
contributed to creative work (P3919) Dictionary of National Biography “person
is cited as contributing to some creative or published work or series (qualify
with ““subject has role””, P2868)”
military casualty classification (P1347) killed in action allowed values:
killed in action (Q210392), missing in action (Q2344557), died of wounds
(Q16861372), prisoner of war (Q179637), killed in flight accident (Q16861407),
others used in military casualty classification
separated from (P807) Presbyterian Church in the United States subject was
founded or started by separating from identified object
results (P2501) general classification of the 2015 Coupe Sels results of a
competition such as sports or elections
ritual object (P8706) corpse powder ceremonial or ritual objects associated
with, and used as part of, rites and rituals practiced in everyday life and in
rarer cultic and communal rites
edition or translation of (P629) Pride and Prejudice is an edition or
translation of this entity
Catholic rite (P3501) Roman Rite Christian liturgical rite associated with
this item
academic minor (P811) political science minor someone studied at
college/university
intangible cultural heritage status (P3259) inventory of intangible cultural
heritage in France status of an item that is designated as intangible heritage
opposite of (P461) peace item that is the opposite of this item
reward (P4444) travel insurance reward, bonus, or prize received as part of a
membership or loyalty program
award received (P166) Theodor Haecker Price award or recognition received by a
person, organisation or creative work
legal form (P1454) GmbH & Co. KG legal form of an entity
Bharati Braille (P9021) braille script transcription of Indic scripts in a
national standard Braille script
vehicle normally used (P3438) popemobile vehicle the subject normally uses
coat of arms (P237) Coat of arms of Liechtenstein subject’s coat of arms
convicted of (P1399) murder crime a person was convicted of
made from material (P186) chocolate liquor material the subject or the object
is made of or derived from
competition class (P2094) Group R official classification by a regulating body
under which the subject (events, teams, participants, or equipment) qualifies
for inclusion
shape (P1419) pyramid shape of an object
academic thesis (P1026) Pan, Sinking: for Steelpan and Nine Instruments thesis
or dissertation written for a degree
audio system (P7501) bell audio system hardware used in the item
first appearance (P4584) A Study in Scarlet work in which a fictional/mythical
character or entity first appeared
last words (P3909) I want nothing but death. last words attributed to a person
before their death
strand orientation (P2548) software orientation of gene on double stranded DNA
molecule
female form of label (P2521) autora female form of name or title
penalty (P1596) capital punishment penalty imposed by an authority
handedness (P552) right-handedness handedness of the person
Google Play developer slug (P8939) Facebook human-readable identifier for a
developer on the Google Play Store
instrument (P1303) drum musical instrument that a person plays or teaches or
used in a music occupation
index case of (P1677) Ebola virus disease in the United States primary case,
patient zero: initial patient in the population of an epidemiological
investigation
reward program (P4446) Chase Ultimate Rewards reward program associated with
the item
charge (P1595) seditious libel offence with which someone is charged, at a
trial
had as last meal (P3902) ice cream components of the last meal had by a person
before death
relevant qualification (P4968) Project Management Professional practitioners
of this industry get this degree, licence or certification after specialist
education, apprenticeship, or professional review. This includes
qualifications that one needs to obtain in order to join the industry or
qualifications that one obtains after a certain level of experience in the
industry in order to progress further in their career.
for work (P1686) Little Life qualifier of award received (P166) to specify the
work that an award was given to the creator for
interested in (P2650) The Holocaust item of special or vested interest to this
person or organisation
health specialty (P1995) ophthalmology main specialty that diagnoses, prevent
human illness, injury and other physical and mental impairments
appears in the form of (P4675) bull this fictional or mythical entity takes
the form of that entity
vessel class (P289) Concordia-class cruise ship series of vessels built to the
same design of which this vessel is a member
medical condition treated (P2175) non-small-cell lung carcinoma disease that
this pharmaceutical drug, procedure, or therapy is used to treat
sports discipline competed in (P2416) marathon discipline an athlete competed
in within a sport
madhhab (P9929) Shafi‘i Islamic school of thought within Fiqh
cause of death (P509) nitric acid poisoning underlying or immediate cause of
death. Underlying cause (e.g. car accident, stomach cancer) preferred. Use
’manner of death’ (P1196) for broadest category, e.g. natural causes,
accident, homicide, suicide

##  Appendix B Training parameters of entity recognizer

Table 8 details the parameters employed to train the privacy-oriented entity
recognition model from Section 4.

Table 8:  Training Parameters for the RoBERTa model Optimizer |  AdamW
---|---
Learning rate |  2e-5
Loss function |  CrossEntropy
Inference layer |  Linear
Epochs |  3
Full fine-tuning |  yes
GPU |  yes
Early stopping |  yes

##  Appendix C Label Agreement

Frequently confused label pairs (see Section 4.4) are shown in Figure 4.

Figure 4: Most common label confusion pairs common in the test sets of the
annotated Wikipedia biographies and the TAB corpus. The first element of the
pair corresponds to the gold standard label and the second to the output from
the entity recognizer.

##  Appendix D LLM probabilities: base models

Table 9 describes the (ordered) based models the Autogluon tabular predictor
employs for the LLM-probability based approach of Section 5.1

Table 9:  Base models of the Tabular predictor in the order they are trained when using the AutoGluon library. This order based on training time and reliability to ensure efficient training time [13]. Model name |  Description
---|---
KNeighborsUnif |  k-nearest neighbors classifier with uniform weighting
KNeighborsDist |  k-nearest neighbors classifier with distance weighting (the inverse of their distance)
LightGBMXT |  LightGMB model that enables extra trees
LightGBM |  default light gradient-boosting machine implementation
RandomForestGini |  random forest classifier with Gini impurity loss function
RandomForestEntr |  random forest classifier with entropy loss function
CatBoost |  algorithm that performs gradient boosting on decision trees
ExtraTreesGini |  extra-trees classifier with Gini impurity loss function
ExtraTreesEntr |  extra-trees classifier with entropy loss function
NeuralNetFastAI |  fast AI neural network for classification of tabular data
XGBoost |  an optimized distributed gradient boosting decision tree model
LightGBMLarge |  LightGMB model that enables larger models
NeuralNetTorch |  PyTorch neural network for classification of tabular data
WeightedEnsemble_L2 |  meta-model that implements Ensemble Selection of the above models

##  Appendix E Training size and performance

Figure 5 shows the $F_{1}$ score of both the Tabular and the Multimodal
Autogluon predictors (LLM probabilities Section 6.3 and span classification
Section 6.3 respectively) at different training sizes for both datasets. We
use a random sample of 1% to 100% for each training dataset split.

Figure 5: Performance of the tabular and multimodal predictors when different
training sizes are used during training. We report the F1 score for the
annotated Wikipedia test dataset and the TAB test dataset as well.

##  Appendix F Perturbation thresholds

Figure 6 shows the performance of different perturbation thresholds for both
datasets for the training dataset split, with the black line indicating the
threshold used in Section 5.3 for evaluation.

Figure 6: Precision and recall score for direct and quasi identifiers at
different thresholds of probability difference for the Wikipedia and TAB train
datasets. The black line indicates the threshold where the cost function is
maximized. This is approximately 3.5 for Wikipedia and 10 for TAB)

## References

  *   * Anandan et al. [2012] Anandan, B., C. Clifton, W. Jiang, M. Murugesan, P. Pastrana-Camacho, and L. Si. 2012, December.  T-plausibility: Generalizing words to desensitize text.  Transactions on Data Privacy 5(3): 505–534 .
  * Beltagy et al. [2020] Beltagy, I., M.E. Peters, and A. Cohan. 2020.  Longformer: The long-document transformer.  arXiv preprint arXiv:2004.05150 .
  * Chakaravarthy et al. [2008] Chakaravarthy, V.T., H. Gupta, P. Roy, and M.K. Mohania 2008.  Efficient techniques for document sanitization.  In Proceedings of the 17th ACM conference on Information and knowledge management, pp. 843–852. ACM.
  * Chevrier et al. [2019] Chevrier, R., V. Foufi, C. Gaudet-Blavignac, A. Robert, and C. Lovis. 2019, 05.  Use and understanding of anonymization and de-identification in the biomedical literature: Scoping review.  Journal of Medical Internet Research 21\.  10.2196/13484 .
  * Chiu and Nichols [2016] Chiu, J.P. and E. Nichols. 2016.  Named entity recognition with bidirectional LSTM-CNNs.  Transactions of the Association for Computational Linguistics 4: 357–370.  10.1162/tacl_a_00104 .
  * Clark et al. [2020] Clark, K., M. Luong, Q.V. Le, and C.D. Manning 2020.  ELECTRA: pre-training text encoders as discriminators rather than generators.  In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net.
  * Cumby and Ghani [2011] Cumby, C. and R. Ghani. 2011, August.  A machine learning based system for semi-automatically redacting documents.  Proceedings of the AAAI Conference on Artificial Intelligence 25(2): 1628–1635.  10.1609/aaai.v25i2.18851 .
  * Dernoncourt et al. [2017] Dernoncourt, F., J.Y. Lee, O. Uzuner, and P. Szolovits. 2017.  De-identification of patient notes with recurrent neural networks.  Journal of the American Medical Informatics Association 24(3): 596–606 .
  * Devlin et al. [2019] Devlin, J., M.W. Chang, K. Lee, and K. Toutanova 2019, June.  BERT: Pre-training of deep bidirectional transformers for language understanding.  In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), Minneapolis, Minnesota, pp. 4171–4186. Association for Computational Linguistics.
  * Ding et al. [2019] Ding, S., H. Xu, and P. Koehn 2019, August.  Saliency-driven word alignment interpretation for neural machine translation.  In Proceedings of the Fourth Conference on Machine Translation (Volume 1: Research Papers), Florence, Italy, pp. 1–12. Association for Computational Linguistics.
  * Dwork et al. [2006] Dwork, C., F. McSherry, K. Nissim, and A. Smith 2006.  Calibrating noise to sensitivity in private data analysis.  In S. Halevi and T. Rabin (Eds.), Theory of Cryptography, Berlin, Heidelberg, pp. 265–284. Springer Berlin Heidelberg.
  * Elliot et al. [2016] Elliot, M., E. Mackey, K. O’Hara, and C. Tudor. 2016.  The anonymisation decision-making framework.  UKAN Manchester.
  * Erickson et al. [2020] Erickson, N., J. Mueller, A. Shirkov, H. Zhang, P. Larroy, M. Li, and A. Smola. 2020\.  Autogluon-tabular: Robust and accurate automl for structured data.  arXiv preprint arXiv:2003.06505 .
  * Fernandes et al. [2019] Fernandes, N., M. Dras, and A. McIver 2019.  Generalised differential privacy for text document processing.  In F. Nielson and D. Sands (Eds.), Principles of Security and Trust - 8th International Conference, POST 2019, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2019, Prague, Czech Republic, April 6-11, 2019, Proceedings, Volume 11426 of Lecture Notes in Computer Science, pp. 123–148. Springer.
  * Feyisetan et al. [2019] Feyisetan, O., T. Diethe, and T. Drake 2019.  Leveraging hierarchical representations for preserving privacy and utility in text.  In 2019 IEEE International Conference on Data Mining (ICDM), pp. 210–219. IEEE.
  * Goldsteen et al. [2021] Goldsteen, A., G. Ezov, R. Shmelkin, M. Moffie, and A. Farkash. 2021, September.  Data minimization for GDPR compliance in machine learning models.  AI and Ethics 2(3): 477–491.  10.1007/s43681-021-00095-8 .
  * Golle [2006] Golle, P. 2006.  Revisiting the uniqueness of simple demographics in the US population.  In Proceedings of the 5th ACM workshop on Privacy in electronic society, pp. 77–80. ACM.
  * He et al. [2021] He, X., K. Zhao, and X. Chu. 2021, January.  AutoML: A survey of the state-of-the-art.  Knowledge-Based Systems 212: 106622.  10.1016/j.knosys.2020.106622 .
  * HIPAA [2004] HIPAA. 2004.  The Health Insurance Portability and Accountability Act.  U.S. Dept. of Labor, Employee Benefits Security Administration.
  * Igamberdiev and Habernal [2023] Igamberdiev, T. and I. Habernal 2023.  Dp-bart for privatized text rewriting under local differential privacy.  In Findings of the Association for Computational Linguistics: ACL 2023, Toronto, Canada, pp. (to appear). Association for Computational Linguistics.
  * Johnson et al. [2020] Johnson, A.E., L. Bulgarelli, and T.J. Pollard 2020.  Deidentification of free-text medical records using pre-trained bidirectional transformers.  In Proceedings of the ACM Conference on Health, Inference, and Learning, pp. 214–221.
  * Juez-Hernandez et al. [2023] Juez-Hernandez, R., L. Quijano-Sánchez, F. Liberatore, and J. Gómez. 2023.  Agora: An intelligent system for the anonymization, information extraction and automatic mapping of sensitive documents.  Applied Soft Computing 145: 110540.  https://doi.org/10.1016/j.asoc.2023.110540 .
  * Kindermans et al. [2019] Kindermans, P.J., S. Hooker, J. Adebayo, M. Alber, K.T. Schütt, S. Dähne, D. Erhan, and B. Kim 2019.  The (Un)reliability of Saliency Methods, pp. 267–280.  Cham: Springer International Publishing.
  * Krishna et al. [2021] Krishna, S., R. Gupta, and C. Dupuy 2021, April.  ADePT: Auto-encoder based differentially private text transformation.  In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, Online, pp. 2435–2439. Association for Computational Linguistics.
  * Lample et al. [2016] Lample, G., M. Ballesteros, S. Subramanian, K. Kawakami, and C. Dyer 2016.  Neural architectures for named entity recognition.  In Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, San Diego, California, pp. 260–270.
  * Lebret et al. [2016] Lebret, R., D. Grangier, and M. Auli 2016, November.  Neural text generation from structured data with application to the biography domain.  In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing, Austin, Texas, pp. 1203–1213. Association for Computational Linguistics.
  * Li et al. [2016] Li, J., X. Chen, E. Hovy, and D. Jurafsky 2016, June.  Visualizing and understanding neural models in NLP.  In Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, San Diego, California, pp. 681–691. Association for Computational Linguistics.
  * Li et al. [2017] Li, J., W. Monroe, and D. Jurafsky. 2017.  Understanding neural networks through representation erasure.  arXiv preprint arXiv:1612.08220 .
  * Lison et al. [2021] Lison, P., I. Pilán, D. Sánchez, M. Batet, and L. Øvrelid 2021, August.  Anonymisation models for text data: State of the art, challenges and future directions.  In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), Online, pp. 4188–4203. Association for Computational Linguistics.
  * Liu et al. [2019] Liu, Y., M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov. 2019.  Roberta: A robustly optimized BERT pretraining approach.  CoRR abs/1907.11692.  1907.11692 .
  * Liu et al. [2017] Liu, Z., B. Tang, X. Wang, and Q. Chen. 2017.  De-identification of clinical notes via recurrent neural network and conditional random field.  Journal of Biomedical Informatics 75: S34–S42 .
  * Liu et al. [2023] Liu, Z., X. Yu, L. Zhang, Z. Wu, C. Cao, H. Dai, L. Zhao, W. Liu, D. Shen, Q. Li, et al. 2023.  DeID-GPT: Zero-shot medical text de-identification by GPT-4.  arXiv preprint arXiv:2303.11032 .
  * Manzanares-Salor et al. [2022] Manzanares-Salor, B., D. Sánchez, and P. Lison 2022.  Automatic evaluation of disclosure risks of text anonymization methods.  In Privacy in Statistical Databases: International Conference, PSD 2022, Paris, France, September 21–23, 2022, Proceedings, Berlin, Heidelberg, pp. 157–171. Springer-Verlag.
  * Mozes and Kleinberg [2021] Mozes, M. and B. Kleinberg. 2021.  No intruder, no validity: Evaluation criteria for privacy-preserving text anonymization.  arXiv preprint arXiv:2103.09263 .
  * Neamatullah et al. [2008] Neamatullah, I., M.M. Douglass, H.L. Li-wei, A. Reisner, M. Villarroel, W.J. Long, P. Szolovits, G.B. Moody, R.G. Mark, and G.D. Clifford. 2008.  Automated de-identification of free-text medical records.  BMC Medical Informatics and Decision Making 8(1): 32 .
  * Olstad et al. [2023] Olstad, A.W., A. Papadopoulou, and P. Lison 2023, May.  Generation of replacement options in text sanitization.  In Proceedings of the 24th Nordic Conference on Computational Linguistics (NoDaLiDa), Tórshavn, Faroe Islands, pp. 292–300. University of Tartu Library.
  * Papadopoulou et al. [2022] Papadopoulou, A., P. Lison, L. Øvrelid, and I. Pilán 2022, June.  Bootstrapping text anonymization models with distant supervision.  In Proceedings of the Thirteenth Language Resources and Evaluation Conference, Marseille, France, pp. 4477–4487. European Language Resources Association.
  * Papadopoulou et al. [2022] Papadopoulou, A., Y. Yu, P. Lison, and L. Øvrelid 2022, November.  Neural text sanitization with explicit measures of privacy risk.  In Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 12th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), Online only, pp. 217–229. Association for Computational Linguistics.
  * Pilán et al. [2022] Pilán, I., P. Lison, L. Øvrelid, A. Papadopoulou, D. Sánchez, and M. Batet. 2022, 12.  The Text Anonymization Benchmark (TAB): A Dedicated Corpus and Evaluation Framework for Text Anonymization.  Computational Linguistics 48(4): 1053–1101.  https://direct.mit.edu/coli/article-pdf/48/4/1053/2062009/coli_a_00458.pdf .
  * Ribeiro et al. [2023] Ribeiro, B., V. Rolla, and R. Santos 2023, May.  INCOGNITUS: A toolbox for automated clinical notes anonymization.  In Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics: System Demonstrations, Dubrovnik, Croatia, pp. 187–194. Association for Computational Linguistics.
  * Samarati and Sweeney [1998] Samarati, P. and L. Sweeney 1998.  Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression.  Technical report, SRI International.
  * Sasada et al. [2021] Sasada, T., M. Kawai, Y. Taenaka, D. Fall, and Y. Kadobayashi 2021.  Differentially-private text generation via text preprocessing to reduce utility loss.  In 2021 International Conference on Artificial Intelligence in Information and Communication (ICAIIC), pp. 042–047.
  * Scaiano et al. [2016] Scaiano, M., G. Middleton, L. Arbuckle, V. Kolhatkar, L. Peyton, M. Dowling, D.S. Gipson, and K. El Emam. 2016.  A unified framework for evaluating the risk of re-identification of text de-identification tools.  Journal of biomedical informatics 63: 174–183 .
  * Serrano and Smith [2019] Serrano, S. and N.A. Smith 2019, July.  Is attention interpretable?  In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, Florence, Italy, pp. 2931–2951. Association for Computational Linguistics.
  * Shi et al. [2021] Shi, X., J. Mueller, N. Erickson, M. Li, and A. Smola 2021.  Multimodal automl on structured tables with text fields.  In 8th ICML Workshop on Automated Machine Learning (AutoML).
  * Sweeney [1996] Sweeney, L. 1996.  Replacing personally-identifying information in medical records, the scrub system.  In Proceedings of the AMIA annual fall symposium, pp. 333–337. American Medical Informatics Association.
  * Sánchez and Batet [2016] Sánchez, D. and M. Batet. 2016.  C-sanitized: A privacy model for document redaction and sanitization.  Journal of the Association for Information Science and Technology 67(1): 148–163 .
  * Sánchez et al. [2018] Sánchez, D., L. Martínez-Sanahuja, and M. Batet. 2018.  Survey and evaluation of web search engine hit counts as research tools in computational linguistics.  Information Systems 73: 50–60 .
  * Tjong Kim Sang and De Meulder [2003] Tjong Kim Sang, E.F. and F. De Meulder 2003.  Introduction to the CoNLL-2003 shared task: Language-independent named entity recognition.  In Proceedings of the Seventh Conference on Natural Language Learning at HLT-NAACL 2003, pp. 142–147.
  * Weitzenboeck et al. [2022] Weitzenboeck, E.M., P. Lison, M. Cyndecka, and M. Langford. 2022, March.  The GDPR and unstructured data: is anonymization possible?  International Data Privacy Law 12(3): 184–206.  10.1093/idpl/ipac008 .
  * Yang and Garibaldi [2015] Yang, H. and J.M. Garibaldi. 2015.  Automatic detection of protected health information from clinic narratives.  Journal of Biomedical Informatics 58: 30 – 38.  https://doi.org/10.1016/j.jbi.2015.06.015 .
  * Yermilov et al. [2023] Yermilov, O., V. Raheja, and A. Chernodub 2023, July.  Privacy- and utility-preserving NLP with anonymized data: A case study of pseudonymization.  In Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing (TrustNLP 2023), Toronto, Canada, pp. 232–241. Association for Computational Linguistics.
  * Yogarajan et al. [2018] Yogarajan, V., M. Mayo, and B. Pfahringer. 2018.  A survey of automatic de-identification of longitudinal clinical narratives.  arXiv preprint arXiv:1810.06765 .
  * Zarcone et al. [2016] Zarcone, A., M. Van Schijndel, J. Vogels, and V. Demberg. 2016.  Salience and attention in surprisal-based accounts of language processing.  Frontiers in psychology 7: 844 .