How do we measure privacy in text? A survey of text anonymization metrics

Motivation

• Evaluating text anonymization remains challenging because studies adopt divergent privacy notions and metrics that often connect poorly to legal and social concepts of privacy.This leaves limited guidance about which risks an evaluation measures and what level of protection is sufficient in practice.Source: §1 · p. 1

Approach

• The survey manually identifies 47 papers published since 2019 that report quantitative privacy metrics for anonymized text, using keyword searches and citation links.It targets metrics rather than surveys of anonymization techniques and also considers relevance to privacy in models trained on text.Source: §1 · p. 1

Contributions

• The analysis identifies six privacy notions: identifier removal, dataset membership, attribute inference, reconstruction attacks, semantic inference, and theoretical privacy bounds.These notions are examined in relation to HIPAA, GDPR, user-centered research, model privacy, and open evaluation challenges.Source: §1 · pp. 1–2
• The survey structures what existing metrics capture and overlook, offering guidance for metric selection while revealing gaps in legal alignment, social relevance, and evaluation consistency.It aims to support more consistent evaluation and development of standardized metrics.Source: §1 · p. 2

Scope

• The review evaluates privacy in anonymized text outputs by asking how much sensitive information remains exposed after modification or generation.The scope generally assumes that original and anonymized versions are available for comparison.Source: §2.1 · p. 2

Search and screening

• The authors search ACL Anthology and Google Scholar using keywords and backward citation tracking, then manually screen thousands of results and retain 47 relevant papers.The review includes papers published from 2019 onward that explicitly report quantitative privacy metrics.Source: §2.1 · p. 2

Inclusion criteria

• Included studies must use natural-language text, contain anonymized or privatized outputs, report a privacy metric beyond utility measures, and primarily use English-language data.Papers focused exclusively on non-English datasets are excluded because of differing annotation schemes and accessibility.Source: §2.1 · p. 2

Overview

• The survey identifies six privacy objectives: identifier removal, dataset membership, attribute inference, reconstruction attacks, semantic inference, and theoretical bounds.Each objective corresponds to distinct metric families, and some studies evaluate multiple categories.Source: §2.2 · p. 2

2.2.1 Identifier Removal Effectiveness

• Identifier-removal metrics commonly use token- or span-level precision, recall, and F1, while newer edit-distance, lexical-divergence, entailment, and human-judgment measures assess deeper obfuscation.Span-level F1 remains common, but semantic or corpus-level assessments may better capture residual risk when anonymization rewrites text.Source: §2.2.1 · pp. 2–3

2.2.2 Dataset Membership

• Dataset-membership metrics test whether an adversary can determine whether a record contributed to training or generation, commonly using attack accuracy, F1, AUC, or canary-injection leakage tests.Membership attacks are fragile and context-sensitive, depending strongly on attack design, dataset construction, and reference data; empirical leakage is sometimes paired with (ε, δ) budgets.Source: §2.2.2 · pp. 3–4

2.2.3 Attribute Inference Risk

• Attribute-inference metrics measure whether anonymized text still reveals sensitive traits, typically by comparing classifiers’ predictions on original and anonymized text.They expose leakage missed by identifier masking, but reduced inference accuracy alone does not ensure protection against reconstruction or membership disclosure.Source: §2.2.3 · pp. 4–5

2.2.4 Reconstruction Attacks

• Reconstruction attacks range from coarse retrieval to fine-grained recovery of verbatim or near-verbatim content, with metric choice depending on the target party and the recovery concern.The relevant risk may involve linking recovered content to the author, mentioned individuals, or both.Source: §2.2.4 · p. 5

2.2.6 Theoretical Privacy Bounds

• Theoretical privacy bounds provide mathematical upper limits on leakage, but they require correct implementation and assumptions, do not replace empirical testing, and are often difficult to interpret for human privacy risk.For example, ε = 4 indicates stronger protection than ε = 8 without specifying what either value means in practice.Source: §2.2.6 · p. 6

HIPAA

• Identifier-removal metrics align well with HIPAA Safe Harbor, appearing in 15 reviewed papers and directly measuring detection and masking of identifiable tokens.Source: §3.1 · p. 6
• Current datasets rarely follow HIPAA annotations, so generic entity labels miss quasi-identifiers such as geographic information and dates.Entity-level recall can better quantify compliance than span-level metrics, but few evaluations use it.Source: §3.1 · p. 6
• HIPAA Expert Determination calls for holistic, adversary-aware risk modeling, yet few studies simulate re-identification or compare attack models with real experts.Human-in-the-loop motivated-intruder tests are an exception.Source: §3.1 · pp. 6–7

GDPR

• Reconstruction metrics are among the most legally aligned with GDPR because they simulate adversarial behavior, but fixed attackers and narrow background assumptions limit their evidentiary robustness.Source: §3.2 · p. 7
• Attribute-inference metrics address GDPR concerns by testing recovery of sensitive traits, although few evaluations test multiple attributes.Source: §3.2 · p. 7
• Semantic-similarity proxies capture residual information indirectly but do not directly test whether an attacker can infer private information, as GDPR requires.GDPR compliance therefore requires contextual identifiability and diversified adversarial evaluation beyond identifier removal.Source: §3.2 · p. 7

• HCI research indicates that privacy perceptions depend on information context, user agency, and whether privatized text remains coherent, not only on masking names or attributes.Source: §4 · p. 7
• Contextual Integrity defines privacy as appropriate information flows among senders, recipients, content, conditions, and purposes rather than secrecy or control alone.Source: §4 · p. 7
• User-facing systems such as Rescriber, CLEAR, and Contextual Privacy Policies adapt disclosure or data handling to user judgments and situational factors.Source: §4 · pp. 7–8
• Text-privacy evaluations could incorporate context, user control, and acceptability because current benchmarks may score well while failing to earn trust or meet real-world privacy expectations.Future metrics could define the applicable scenario or use context and user preferences as inputs.Source: §4 · p. 8

• The survey argues that reconciling text and model privacy could advance both areas, despite their differing evaluation targets.Source: §5 · p. 8
• Both fields study membership inference and reconstruction, while model-privacy work also uses canary attacks and membership-inference success rates on generated or trained outputs.Source: §5 · p. 8
• LLM attribute-inference risks overlap with anonymization metrics and suggest using language models as strong adversaries for reconstruction and attribute-inference evaluations.Source: §5 · p. 8
• Model-privacy benchmarks and probes provide standardized tasks for contextual expectations, PII exposure, attribute inference, and black-box leakage assessment.Source: §5 · p. 8

• Metrics should match intended privacy guarantees: re-identification goals require more than identifier-removal F1, while semantic-inference goals need task-specific probes or classifiers.Source: §6 · pp. 8–9
• Standardized, use-case-grounded pipelines are needed because redaction and synthetic-generation methods are often evaluated under different privacy notions, hindering practical comparison.Source: §6 · p. 9
• Human-centered methods such as motivated-intruder tests, contextual judgments, and scenario-based probing can reveal violations missed by token-level scores, despite their expense.Source: §6 · p. 9
• Technical evaluations should be interpretable against legal identifiability and risk definitions through adversarial simulations, auxiliary-knowledge tests, and plausibility-based linkage metrics.Source: §6 · p. 9
• Human-in-the-loop studies need annotation protocols, intruder-test guidelines, hybrid automation, and reporting norms to become more reproducible and scalable.Source: §6 · p. 9
• Addressing these issues could produce a more comprehensive, reliable, and socially grounded framework for evaluating privacy in text anonymization.Source: §6 · p. 9

• Six privacy objectives underlie existing metrics, but current practices remain misaligned with broader legal, social, and practical standards for meaningful privacy protection.Source: §7 · p. 9
• More rigorous evaluation should align stated privacy goals with chosen metrics and incorporate adversarial, contextual, and human-centered perspectives.The survey connects these priorities to responsible data sharing and model deployment as privacy risks grow with increasingly powerful generative models.Source: §7 · p. 9

• The survey reviews post hoc privacy evaluation metrics but does not assess the effectiveness of anonymization methods themselves.Source: Limitations · p. 9
• Requiring explicit privacy metrics may bias the surveyed sample toward works using quantifiable evaluation practices.Source: Limitations · p. 9
• The legal and social privacy analysis is interpretive and does not constitute formal legal guidance.Source: Limitations · p. 9