PaperlayerView exact revision on arXiv

Source-linked AI summary

Adaptive Text Anonymization: Learning Privacy-Utility Trade-offs via Prompt Optimization

Gabriel Loiseau, Damien Sileo, Damien Riquet, Maxime Meyer, Marc Tommasi

arXiv:2602.20743v2cs.CL

TL;DR

Existing text anonymization methods use static or manually designed strategies even though privacy–utility requirements vary across domains and applications. This paper introduces adaptive text anonymization, which optimizes task-specific language-model prompts and evaluates them across five datasets. The framework consistently learns effective trade-offs, compares favorably with existing methods, and discovers multiple Pareto-optimal strategies.

  • Problem

    Existing anonymization methods rely on static, manually designed strategies despite varying privacy–utility requirements across domains, privacy objectives, and downstream applications.

  • Method

    The framework formulates anonymization as a task-specific privacy–utility problem and automatically evolves language-model prompts to learn domain- and task-specific strategies.

  • Results

    Across five datasets, the approach consistently learns effective privacy–utility trade-offs and compares favorably with existing LLM-based anonymization methods.

  • Takeaways & Limitations

    The method discovers multiple Pareto-optimal anonymization strategies, allowing deployment choices aligned with different privacy–utility requirements.

  • Takeaways & Limitations

    The evaluation pipeline still relies on closed-source LLMs for some privacy and utility metrics, leaving the safety of externally shared anonymized text unresolved.

Abstract

from arXiv · show

Anonymizing textual documents is a highly context-sensitive problem: the appropriate balance between privacy protection and utility preservation varies with the data domain, privacy objectives, and downstream application. However, existing anonymization methods rely on static, manually designed strategies that lack the flexibility to adjust to diverse requirements and often fail to generalize across domains. We introduce adaptive text anonymization, a new task formulation in which anonymization strategies are automatically adapted to specific privacy-utility requirements. We propose a framework for task-specific prompt optimization that automatically constructs anonymization instructions for language models, enabling adaptation to different privacy goals, domains, and downstream usage patterns. To evaluate our approach, we present a benchmark spanning five datasets with diverse domains, privacy constraints, and utility objectives. Across all evaluated settings, our framework consistently achieves a better privacy-utility trade-off than existing baselines, while remaining computationally efficient and effective on open-source language models, with performance comparable to larger closed-source models. Additionally, we show that our method can discover novel anonymization strategies that explore different points along the privacy-utility trade-off frontier.

1 Introduction

Text anonymization must balance privacy protection with domain- and application-specific utility, but existing approaches use fixed strategies and manual prompt design. The paper introduces adaptive text anonymization, which automatically optimizes task-specific instructions to discover diverse privacy–utility trade-offs.

  • Motivation: Text anonymization protects sensitive information while preserving useful content, but applying formal privacy guarantees to free-form text remains difficult.Challenges include defining neighboring datasets, calibrating noise, and preserving semantic utility.
  • Motivation: Anonymization requirements vary with adversary capabilities, domains, privacy objectives, and downstream utility, so no single strategy fits every use case.Medical records and casual online comments require different protections and preserved information.
  • Limitations: Existing LLM-based pipelines use fixed scenario-specific strategies and manual prompt engineering, making them inflexible, labor-intensive, and brittle across domains.These limitations increase adaptation costs and hinder practical deployment.
  • Proposed framework: The paper formulates adaptive text anonymization as automatic learning of domain- and task-specific strategies through prompt optimization.Privacy and utility requirements are explicitly specified, and optimization can run on medium-sized language models.
  • Contributions: The framework uses agentic collaboration and prompt optimization to let open-source models navigate diverse privacy–utility trade-offs without manual prompt design.The evaluation spans five anonymization tasks across distinct domains, privacy objectives, and utility constraints.
  • Contributions: The method achieves state-of-the-art performance with open-source models, outperforms traditional anonymization methods across target and new domains, and discovers multiple operating points.Practitioners can select anonymization strategies aligned with deployment requirements.

2 Related Work

Prior work includes entity-based anonymization, LLM attacker–defender pipelines, and automated prompt optimization. This paper combines evolutionary prompt optimization with privacy-sensitive anonymization to generate task-specific instructions without manual prompt design.

  • Text Anonymization: Traditional text anonymization detects and masks predefined sensitive-entity categories using sequence-labeling models trained on annotated datasets.These methods are effective in structured privacy settings.
  • Anonymization via LLM Pipelines: Figure 1 describes reflective prompt optimization with GEPA, adapting a base seed prompt into an optimized prompt under a fixed budget.The optimized prompt defines the privacy and utility requirements for the anonymization task.
  • Anonymization via LLM Pipelines: LLMs serve both as realistic privacy attackers that can re-identify sensitive attributes and as context-aware anonymizers.Their broad world knowledge and ability to exploit contextual cues motivate adversarial evaluation and LLM-based defenses.
  • Anonymization via LLM Pipelines: Adversarial LLM methods refine anonymization using attacker feedback, while related extensions add synthetic information or utility judgments.These approaches represent alternatives to static entity masking.
  • Prompt Optimization: Automated prompt optimization uses search-based and evolutionary methods to refine instructions through mutation and selection.Before this work, its use for privacy-sensitive text anonymization and explicit privacy–utility objectives remained largely unexplored.
  • Prompt Optimization: The paper bridges this gap by applying evolutionary prompt optimization to adaptive, context-aware anonymization without manual prompt design.The approach targets instructions aligned with task-specific privacy objectives and utility constraints.

3 Our Approach

The framework treats anonymization as task-conditioned text generation and evolves prompts for explicit privacy–utility requirements. GEPA-based optimization combines Pareto selection, reflective mutation, rich feedback, and adaptive validation within a fixed budget.

  • 3.1 Problem Formulation: Adaptive task anonymization defines each task by a privacy specification p and a utility specification u.The model receives these objectives as inputs, allowing multiple acceptable anonymizations for the same raw text.
  • 3 Our Approach: The anonymizer is an LLM guided by a natural-language prompt Π that is learned automatically from task specifications and empirical feedback.A universal seed prompt Π0 is evolved into a task-adapted instruction instead of retraining models for each domain.
  • Optimization Framework: The framework operates under a fixed computational budget using one locally deployable model as both anonymization agent and proposer agent.The model produces anonymized text and generates instruction variants during optimization.
  • Optimization Framework: GEPA evolves a prompt population through selection, reflective mutation, and evaluation, retaining diverse candidates via Pareto-based privacy–utility selection.The proposer analyzes execution traces and feedback to make targeted prompt modifications.
  • Two-Phase GEPA: The initial phase evaluates candidates with a scalar base feedback function, uses training and validation splits, and stops when the budget is exhausted or validation performance plateaus.Dominated candidates are removed through Pareto pruning.
  • Two-Phase GEPA: A refinement phase adds rich task-specific feedback and round-robin validation-subset sampling to improve targeted exploration and budget efficiency.Final selection uses the full validation set, and the returned system is the highest-scoring prompt under the specified configuration.

4 Experiments

The evaluation covers five anonymization tasks with varied domains, threat models, and utility requirements, using diverse traditional, adversarial, and manually prompted baselines. Experiments use locally deployable open-source models alongside closed-source evaluators and comparison models.

  • Evaluation Setup: The benchmark spans five anonymization tasks with distinct domains, privacy threat models, and utility requirements.The evaluation retains the original protocols from prior datasets and tests different privacy–utility balances.
  • Evaluation Setup: Medical-task utility is measured by diagnosis-selection accuracy, while privacy includes stylometric distance between original and sanitized texts.The stylometric measure uses LUAR embeddings to reduce patient re-identification risk.
  • Comparison Methods: The comparison includes entity-based OpenPII, differential-privacy DP-Prompt, adversarial-feedback AF and RUPTA, and task-specific manual prompting.These baselines represent traditional, adversarial LLM, and manually engineered approaches.
  • Comparison Methods: RUPTA is evaluated exclusively on DB-BIO because it was designed for classification-oriented utility objectives.DP-Prompt uses a privacy budget of ϵ = 100 because noise harms utility.
  • Implementation Details: Experiments use open-source Gemma-3-27B and Qwen3-30B-A3B models with 111 training and 111 validation examples per task.All remaining examples are reserved for testing, and optimization uses a maximum budget of B = 1500 LLM forward passes.
  • Implementation Details: Gemini-2.5-flash serves as the evaluator backbone, while GPT-5-chat is used as a reference closed-source comparison model.The implementation uses DSPy and reports additional computational and ablation details elsewhere in the paper.

5 Experimental Results

Across five anonymization tasks, prompt optimization consistently improves privacy–utility trade-offs over static and seed strategies, while discovering multiple deployable operating points in one run.

  • Overall Performance: Prompt optimization consistently improves privacy over seed prompts across open-source models, often with minimal utility loss.The optimizer discovers task-appropriate trade-offs rather than optimizing a single objective.
  • Overall Performance: Privacy gains are largest on TAB and PUPA, while DB-BIO preserves near-perfect utility and SYNTHPAI and MEDQA retain improvements despite stronger trade-offs.The reported pattern varies with each task’s privacy–utility landscape.
  • Overall Performance: Optimized models exhibit distinct behaviors: Mistral favors steep privacy gains, Gemma makes conservative improvements, and Qwen often achieves high privacy and utility simultaneously.These patterns suggest adaptation to model-specific inductive biases rather than convergence to one strategy.
  • Overall Performance: Optimized Qwen is competitive with GPT-5-based methods across tasks, matches GPT-5 on MEDQA, and achieves higher utility at comparable privacy on PUPA.It also attains the strongest overall utility scores, narrowing the gap between open- and closed-source pipelines.
  • Trade-off Discovery: Each optimization run discovers multiple anonymization prompts spanning privacy-focused and utility-preserving configurations along a trade-off frontier.Prompts are represented as inexpensive natural-language strings rather than separate model checkpoints.
  • Trade-off Discovery: Practitioners can select among validated prompts according to regulatory requirements, risk tolerance, or downstream task priorities.The frontier exposes a spectrum from high privacy with reduced utility to high utility with moderate privacy.
  • Qualitative Analysis: On MedQA, the optimized Qwen prompt separates diagnostic invariance from stylistic obfuscation to protect against inference while preserving clinical reasoning.It retains pathognomonic findings, clinical relationships, and temporal or anatomical patterns while rewriting nonessential content.

6 Conclusion

The paper introduces adaptive text anonymization as a task-specific framework for learning privacy–utility trade-offs. Its string-level prompt optimization explores multiple Pareto-optimal solutions across five datasets and compares favorably with existing LLM-based methods.

  • Adaptive text anonymization uses large language models to learn task-specific privacy–utility trade-offs.
  • The framework formulates anonymization as string discovery and extends GEPA with a three-stage pipeline for exploring multiple Pareto-optimal solutions in one run.
  • Experiments across five datasets show that the approach consistently learns effective trade-offs and compares favorably with existing LLM-based anonymization methods.

Limitations

The framework has several limitations involving objective formulation, supervision requirements, evaluation safety, model scope, and optimization stability. These constraints motivate future work on more flexible objectives, reduced supervision, safer evaluation, reasoning models, and reproducibility.

  • Unweighted metric aggregation does not explicitly model lexicographic ordering, weighted objectives, or hard privacy constraints.Alternative formulations could better align optimization with domain- or regulation-specific requirements.
  • Each task requires a small annotated training and validation set, creating computational overhead compared with fully zero-shot anonymization.The authors describe limited supervision as enabling stronger privacy–utility operating points, but reducing this requirement remains future work.
  • The evaluation pipeline still relies on closed-source LLMs for certain privacy and utility metrics, and the safety of externally shared anonymized text remains unresolved.Local deployment reduces the amount of sensitive data leaving the local boundary, but does not fully resolve evaluator-sharing risks.
  • Reasoning-oriented models are excluded because per-input strategy derivation would increase computational costs and current models generally require very large parameter scales.The paper leaves smaller reasoning models and hybrid prompt-optimization approaches for future study.
  • Non-deterministic LLM generation can destabilize optimization through variance in training trajectories or convergence behavior.Evolutionary optimization is relatively robust when the rollout budget is large enough, but stability and reproducibility remain open challenges.

Ethical Considerations

The paper identifies ethical risks in automated anonymization, including evaluator blind spots, misuse for obscuring accountability, loss of forensic signals, and biased or unstable evaluation. It therefore frames anonymization as risk reduction rather than a privacy guarantee.

  • Automated LLM evaluators may obscure failure modes or systematically underweight rare but consequential privacy leaks.
  • Optimized anonymization prompts could be misused to obfuscate accountability, attribution, or provenance where transparency is required.
  • Stylometric and contextual obfuscation may remove signals valuable for forensic analysis, content moderation, or safety monitoring.
  • Heavy reliance on LLM-based evaluation risks encoding evaluator biases and instability.
  • Anonymization should be treated as risk reduction rather than a guarantee of privacy, especially for sensitive health, legal, or personal data.Deployment should include consent considerations, clear intended-use statements, and alignment with applicable frameworks such as GDPR or HIPAA.

A Prompt Optimization Ablation Study

The ablation compares full two-stage GEPA optimization with warm-start-only, refinement-only, and MIPROV2 under the same rollout budget on SYNTHPAI and TAB. The full method is consistently the strongest final performer.

  • Experimental setup: Figure 4 compares four optimizers under the same rollout budget and task score on SYNTHPAI/Gemma-3-27B-it and TAB/Mistral-Small-3.2-24B.The variants are full two-stage GEPA, GEPA SIMPLE FEEDBACK, GEPA RICH FEEDBACK, and MIPROV2.
  • Overall findings: Across both tasks, the full two-stage method is consistently the best final performer and the most reliable.
  • SYNTHPAI: ∼0.62 is the SYNTHPAI plateau reached by both single-component variants, whereas two-stage GEPA reaches ∼0.70 and maintains its advantage.The reported pattern suggests warm-start finds a strong prompt region, while refinement escapes the early plateau.
  • TAB: ∼0.74 is the best final TAB score achieved by the full method, exceeding GEPA SIMPLE FEEDBACK at later ∼0.69, GEPA RICH FEEDBACK at ∼0.56, and MIPROV2 at ∼0.62.Warm-start provides early gains, while refinement supplies additional progress beyond strong plateaus.

B Backbone Evaluation Robustness

The robustness evaluation checks original-text baselines and whether prompt optimization transfers across model scales. Original texts show very low privacy, while optimization yields privacy gains on both mid-size and smaller backbones.

  • Evaluation protocol: The evaluation uses Gemini-2.5-flash as the LLM-based judge and repeats the pipeline on nonanonymized inputs to contextualize the reported improvements.
  • Original-text baselines: Unmodified texts exhibit near-maximal privacy leakage across tasks, while utility remains high on tasks where the text already preserves task information.Privacy is close to zero for SYNTHPAI, TAB, and MEDQA; DB-BIO and PUPA remain very low.
  • Original-text baselines: Table 4 reports original-text privacy/utility scores, with tasks requiring a backbone LLM identified in the table.
  • Model scaling: Optimization yields consistent privacy gains on both Qwen-2.5-7B and the larger Qwen3-30B-A3B backbone, supporting transfer beyond large models.
  • Model scaling: On Qwen-2.5-7B, privacy increases from 5.88→17.6 on SYNTHPAI and 34.3→90.6 on TAB after optimization.The smaller model often shows stronger privacy–utility coupling, while larger backbones provide more favorable trade-offs on harder tasks.

D Comparison with DP-based Methods

The framework is compared with differentially private rewriting methods across privacy budgets, highlighting the trade-off between stronger privacy and utility preservation. Across datasets, DP-based rewriting often sacrifices substantial utility, while the optimized model achieves stronger balanced performance in several settings.

  • Privacy–utility trade-offs: DP-based rewriting generally improves privacy as ϵ becomes more restrictive, but substantially reduces utility.The strongest privacy settings show especially severe utility losses on DB-Bio, SynthPAI, and MedQA.
  • Cross-dataset comparison: On DB-Bio, SynthPAI, and MedQA, the strongest DP settings achieve substantially higher privacy than the optimized model but collapse utility.
  • Cross-dataset comparison: On TAB, DP methods reach privacy comparable to or slightly above the optimized model but still trail it in utility.
  • Cross-dataset comparison: On PUPA, the optimized model outperforms all DP baselines on both privacy and utility.

E Human Evaluation

A small-scale human study evaluated anonymized outputs from DB-BIO and PUPA on privacy, utility, content preservation, and hallucination avoidance. The results broadly support the automatic evaluations, with the optimized model achieving one of the strongest overall balances across these criteria.

  • Study design: 100 examples from DB-BIO and PUPA were evaluated by seven annotators, with each output judged independently by at least three annotators.Judgments used four binary criteria: privacy, utility, content preservation, and hallucination avoidance.
  • Results: Methods achieving stronger privacy often sacrifice faithfulness or task usefulness, whereas the optimized model attains one of the best overall balances.
  • Results: OpenPII preserves utility relatively well and avoids hallucinations strongly, but its low privacy score shows that entity-level masking can leave identifying information.
  • Results: The optimized prompt improves over RUPTA on content preservation and hallucination avoidance.The authors interpret this as evidence of a better compromise between removing sensitive information and preserving meaning and factual consistency.
  • Interpretation: The human study provides complementary evidence that the LLM-evaluation gains transfer to human judgment, although the study is limited in scale.

F.2 Comparison Methods

The comparison uses adversarial LLM pipelines, manual task-specific prompts, and domain-specific benchmark settings to assess adaptive anonymization. The evaluation spans diverse privacy threats and utility requirements, while also considering deployment cost and model assumptions.

  • Baseline configuration: Adversarial Feedback and RUPTA use k = 3 refinement hops, matching the multi-turn interaction budget of their original implementations.
  • Baseline configuration: GPT-5-chat is used as the base model for these closed-source comparison baselines because other GPT-5 variants showed no meaningful or consistent improvements.
  • Baseline configuration: Task-specific manual prompts explicitly encode privacy and utility requirements and serve as upper bounds for expert human effort without optimization.The prompts are presented in Figures 6–10.
  • Deployment considerations: The framework's local open-source deployment incurs costs only for the external evaluation backbone, with outsourced mid-sized-model inference costing less than $0.10 per task at the time of writing.
  • Benchmark settings: The benchmark covers five anonymization tasks spanning diverse domains, privacy threat models, and utility requirements.DB-Bio evaluates resistance to re-identification while preserving occupation information, and SynthPAI targets inference from distributed demographic signals.
  • Benchmark settings: DB-Bio measures privacy by whether an attacker LLM excludes the true identity from its top-three candidates and utility by occupation-classification accuracy.
  • Benchmark settings: SynthPAI measures successful anonymization when attacker and verifier inferences differ, while utility is ROUGE-1 F-measure.
  • Benchmark settings: The MedQA prompt prioritizes privacy against LLM inference attacks while preserving diagnostic reasoning, including pathognomonic findings and clinically meaningful relationships.
Loading 2602.20743v2…