PaperlayerView exact revision on arXiv

Source-linked AI summary

LLM Anonymization Against Agentic Re-Identification

Ziwen Li, Jianing Wen, Tianshi Li

arXiv:2605.30848v2cs.CRcs.CL

TL;DR

Agentic web-search systems can turn contextual details into re-identification evidence, even though those details support downstream analysis. AURA separates privacy localization from utility-preserving reconstruction and evaluates candidate rewrites against adversarial privacy and utility checks, improving the privacy-utility frontier across attackers while retaining contextual utility.

  • Problem

    Agentic web-search re-identification makes contextual cues risky, while existing defenses leave the operating region between resistance to such attacks and utility retention underexplored.

  • Method

    AURA uses adaptive privacy-scope expansion, mask-reconstruct anonymization, and adversarial privacy and utility-retention checks to select candidate rewrites.

  • Results

    AURA’s adaptive variants reduce re-identification to 0-5/27 transcripts while retaining 74.9-80.3% unit-level utility-grid information across three attacker models.

  • Takeaways & Limitations

    Adaptive privacy scope strengthens resistance to agentic re-identification, while mask-reconstruct rewriting preserves contextual utility under fixed privacy scope.

  • Takeaways & Limitations

    The evaluation uses simulated attacks and utility recovery, so results depend on attacker models, prompting, web evidence, search ranking, and the utility grid’s limited coverage of human judgments.

Abstract

from arXiv · show

Agentic LLMs with web search change the threat model for text anonymization: weak contextual cues can become cross-referenceable evidence for re-identification, yet those same details also carry downstream analytic value of the text. Existing defenses either remove explicit identifiers, perturb text for formal privacy, or test rewritten text against non-web inference models, leaving underexplored the operating region between resistance to agentic web-search re-identification and utility retention. We introduce AURA (\textbf{A}nonymization with \textbf{U}tility-\textbf{R}etention \textbf{A}daptation), an LLM-powered \textit{mask-reconstruct} framework that decouples privacy localization from utility-preserving reconstruction and selects candidates with adversarial privacy and utility-retention checks. We evaluate AURA on real-user interview transcripts using re-identification attacks carried out by web-search agents, along with a utility evaluation based on interviewee-profile facts, codebook facts, and the joint contextual utility grid. Our results show that AURA improves the privacy-utility frontier by using adaptive privacy scope to strengthen resistance to agentic re-identification and using a mask-reconstruct anonymization method to better preserve contextual utility under fixed privacy scope.

1 Introduction

Agentic LLMs can use weak contextual cues and web evidence to re-identify people, creating tension between participant privacy and the analytic value of contextual detail. AURA addresses this tension by separating privacy localization from utility-preserving reconstruction and evaluating both against agentic attacks and utility checks.

  • Agentic LLMs can cross-reference weak contextual cues with public evidence to infer identities, making contextual details privacy-relevant beyond explicit identifiers.
  • AI-use datasets require contextual nuance across respondent background, behavior, expertise, and attitudes, but those same details can enable re-identification.
  • Existing defenses either miss contextual inference cues through explicit-identifier redaction or degrade readability and analytical value through token-level perturbation.
  • AURA separates identifying risky spans from reconstructing them, using an LLM-powered mask-reconstruct framework evaluated with agentic attacks and utility-retention checks.
  • Across three attacker models, adaptive AURA reduces re-identification to 0-5/27 transcripts versus 13-21/27 for NER redaction and 6-7/27 for the prior LLM anonymizer, while retaining 74.9-80.3% unit-level utility-grid information.

2 Related Work

Prior anonymization work spans explicit-identifier detection, LLM-based inferential defenses, and differential-privacy rewriting, but readable, useful, and resistant text remains difficult to achieve simultaneously.

  • NER-based de-identification removes explicit identifiers using predefined taxonomies, but this technical focus does not address contextual cues used for inference.
  • LLM sanitization methods include redaction or abstraction of NER-based PII and iterative rewriting intended to suppress inferable personal attributes.
  • Differentially private text rewriting uses synthetic representations, word-level noise, or DP-fine-tuned generators to provide formal privacy mechanisms.
  • Strong perturbation can damage coherence and analytic value in long-form qualitative text, leaving a gap between readable but leaky rewrites and private but low-utility outputs.

3 Method

AURA decomposes anonymization into privacy-scope initialization, risky-span masking, and reconstruction of only the masked spans. It selects among candidate rewrites with privacy, specificity, and utility checks, prioritizing privacy before utility.

  • Phase 0: Initialization: AURA initializes an adaptive privacy scope by adding transcript-specific attributes and evidence spans to a base set of eight personal-attribute types.
  • Phase 1: Converge on risky spans to mask: The masking phase iteratively rewrites the transcript using privacy-inference feedback, then diffs the original and converged text to identify risky spans.
  • Phase 2: Reconstruct, Evaluate, and Select: The reconstruction phase generates N replacement dictionaries only for masked spans, using the masked context and utility profile rather than rewriting the full transcript.
  • Phase 2: Reconstruct, Evaluate, and Select: Each candidate is scored for privacy severity, specificity, and utility loss using an attribute attacker, specificity checklist, and utility keeper.
  • Phase 2: Reconstruct, Evaluate, and Select: AURA filters candidates by a specificity cap, then minimizes privacy severity with utility loss as a tie-breaker; if none qualify, it minimizes specificity, severity, and utility loss in order.

4 Experimental Setup

The evaluation uses verified re-identifiable interview transcripts, agentic web-search attacks across multiple models, and utility benchmarks designed around contextual qualitative analysis. AURA is compared with NER, LLM rewriting, adversarial anonymization, DP rewriting, and local or API backbones.

  • Dataset: The benchmark contains 27 interview transcripts from Anthropic Interviewer that produced verifiable identification evidence when attacked across the original 1,250 transcripts.
  • Privacy evaluation: Privacy is measured by whether web-search-enabled agentic LLMs re-identify interviewees, with counts and percentages reported across three attacker models.
  • Utility evaluation: Utility is operationalized at interviewee-profile, codebook, and joint contextual levels to reflect how qualitative researchers combine participant identity, occupational context, and behavioral patterns.
  • Baselines: Baselines span Presidio NER detection, minimal and detailed one-shot rewriting, iterative adversarial anonymization, and differentially private masked-language-model rewriting.
  • Model backbones: The study includes proprietary and open-weight backbones, including web-search-enabled Deepseek-V4-Flash5 for privacy-scope expansion and Qwen models for other tasks.

5 Results

Across three attacker models, adaptive AURA variants achieved the lowest non-DP re-identification rates while preserving substantial utility. Pareto analysis placed adaptive and fixed-scope AURA variants near the privacy-utility frontier.

  • Agentic re-identification: Adaptive AURA variants limited re-identification to 0–5/27 transcripts across all three attackers, below fixed-scope AURA, the anonymizer, Presidio, and one-shot rewriting.The comparison used GPT-5.1, GPT-5.4-mini, and Gemini-3-Flash; attacks were repeated three times and the highest rate reported.
  • Cross-attacker robustness: GPT-5.4-mini was the strongest attacker overall, yet adaptive AURA variants maintained low re-identification rates under it.AURA’s relative protection was not specific to GPT-5.1, despite GPT-5.1 being used to generate adaptive privacy scopes during masking.
  • Utility preservation: Within API-powered AURA, the 8-attribute run achieved 77.1% unit-level utility-grid recovery, while its adaptive-privacy variant retained 74.9%.The 8-attribute run recovered 80.6% of profile facts and 93.3% of codebook facts; the adaptive variant retained 95.1% codebook recovery.
  • Utility preservation: On-device 8-attribute AURA reached 80.2% unit-grid recovery with Qwen3.5-35B-A3B, while adaptive variants preserved 80.3% with Qwen3.5-27B and 76.7% with Qwen3.5-35B-A3B.The corresponding 8-attribute codebook recoveries were 96.2%, 96.8%, and 96.5%, respectively.
  • Baseline comparison: DP-MLM’s unit-level utility-grid recovery ranged from 0.0% at ε=10 to 60.1% at ε=140, whereas lighter rewriting methods reached 92.8%–98.2%.The anonymizer baseline reached 72.1%, while Presidio, minimal one-shot rewriting, and detailed one-shot rewriting reached 96.7%, 92.8%, and 98.2%.
  • Privacy-utility trade-off: Adaptive and API-powered 8-attribute AURA variants lay on or near the Pareto front, achieving higher privacy than non-DP baselines at comparable utility.The advanced anonymizer reached 72.1% and 77.1% unit-grid recovery in the cited comparisons, below the corresponding AURA variants.

6 Discussion

The discussion frames AURA as a dedicated process for jointly optimizing privacy and utility against agentic deanonymization. It also emphasizes that the evaluation is a controlled stress test and that protection is not futureproof.

  • Discussion: Adaptive-scope AURA reduced re-identification to 0–5/27 across attackers, while stricter scope mainly suppressed profile recovery rather than codebook recovery.Fixed-scope methods clustered at higher re-identification rates, and AURA uses the active privacy scope only during masking.
  • Discussion: NER redaction and one-shot rewriting offered limited protection against LLM-based deanonymization, whereas effective anonymization requires optimizing privacy and utility together.Formal DP mechanisms provide mathematical privacy guarantees but can damage utility, motivating empirical privacy-utility evaluation.
  • Pareto analysis: Figure 3 positions adaptive AURA variants between DP-MLM’s high-privacy, low-utility region and lighter methods’ high-utility, low-privacy region.The plot uses privacy success against unit-level utility-grid recovery under GPT-5.4-mini; fixed 8-attribute variants cluster on the privacy axis.
  • Implications: AURA combines LLM-guided rewriting with proactive re-identification testing, while open-weight variants demonstrate feasibility for local deployment.The discussion presents this combination as a direction for empirically pushing the privacy-utility frontier.
  • Limitations and deployment: Protection is difficult to make futureproof because stronger or differently aligned attackers may expose residual risks absent under a single evaluation model.The paper recommends multi-stage risk management, including participant warnings, monitoring high-risk attributes, safeguards, and multi-attacker evaluation.
  • Limitations and ethics: The reported results are controlled stress-test outcomes rather than anonymity guarantees, and the utility grid cannot fully capture readability, nuance, or open-ended interpretive value.Attack success also depends on the attacker model, prompting protocol, available web evidence, and search ranking at evaluation time.

7 Conclusion

AURA separates privacy localization from utility-preserving reconstruction, aiming to protect contextual details that support agentic re-identification while retaining downstream analytic value. Its adaptive privacy scope and mask-reconstruct design improve the privacy-utility frontier, while fixed-scope results indicate gains from reconstruction effectiveness.

  • 7 Conclusion: AURA separates privacy localization from utility-preserving reconstruction in a mask-reconstruct anonymization framework.The method localizes risky context before reconstructing affected spans, rather than generically rewriting the entire transcript.
  • 7 Conclusion: Adaptive privacy scope improves privacy protection without compromising utility across multiple attackers.The conclusion characterizes adaptive-privacy AURA as often approaching or dominating existing methods on the Pareto frontier.
  • 7 Conclusion: Under fixed privacy scope, the 8-attribute AURA variant outperforms competing approaches in contextual utility recovery.This comparison indicates that the gains are not solely due to expanded scope coverage, but also reflect more effective anonymization.
  • 7 Conclusion: The framework supports tuning the separation between privacy protection and utility preservation for LLM-era text release.Its stated scope is practical study and adjustment of the privacy-utility tradeoff rather than generic full-text rewriting.
  • 7 Conclusion: AURA preserves high-level reasoning and emotion while permitting slight abstraction or loss in occupation, expertise, AI usage, region type, and life stage.The reconstruction constraints prioritize privacy when fidelity conflicts with privacy and prohibit restoring cross-referenceable details.

D Baseline Details

The baselines span NER-based replacement, one-shot LLM rewriting, and perturbation-based anonymization, exposing different privacy, utility, and readability trade-offs under agentic attackers.

  • Baseline configurations: Presidio detects and replaces explicit PII with NER, while one-shot baselines rewrite transcripts using minimal or detailed instructions.The detailed prompt specifies identifying details to generalize while preserving meaning, dialogue structure, and subjective content.
  • Baseline behavior: Detailed one-shot rewriting preserves more analytic content but is consistently more re-identifiable than minimal rewriting across three attackers.This reflects the privacy–utility tension that AURA separates into masking and reconstruction.
  • Baseline behavior: Presidio yields 13/27 to 21/27 re-identifications across GPT-5.1, GPT-5.4-mini, and Gemini-3-Flash, showing strong attacker sensitivity.Removing explicit PII does not address quasi-identifiers that stronger agents combine through web search.
  • Illustrative outputs: The baseline setup includes representative rewritten excerpts, with DP-MLM examples drawn from one transcript position because heavy perturbation can corrupt speaker labels.Table 4 covers the on-device 8-attribute and adaptive-privacy variants alongside other configurations.

E Diff Analysis: AURA vs. Anonymizer

The diff analysis contrasts AURA’s localized substitutions with the Anonymizer’s sentence-level rewriting, showing how each method balances privacy edits against preserved conversational and domain context.

  • Diff presentation: The supplementary diff report compares original turns with adaptive-privacy AURA and Anonymizer rewrites using amber edits, green insertions, and red deletions.The original text is synthesized from the transcript for ethical reasons.
  • AURA edits: AURA makes surgical span-level substitutions, replacing specific entities with category-level terms while preserving surrounding conversational context verbatim.For example, “ChatGPT” becomes “an AI tool.”
  • Anonymizer edits: The Anonymizer rewrites entire sentences to remove first-person voice, disrupting qualitative flow.Its transformation changes active personal statements into impersonal constructions.
  • Context preservation: Both methods remove discipline-specific jargon, but AURA retains more domain vocabulary when the insight profile marks that dimension as highly valuable.This reflects differentiated preservation rather than uniform deletion of specialized language.

F Utility Benchmark Construction Methodological Details

The utility benchmark measures whether anonymized transcripts preserve profile facts, coded themes, and their joint contextual combinations used in downstream qualitative analysis.

  • Benchmark components: Human experts build a hierarchical codebook with 13 codes across five categories, and an LLM judges whether rewritten text recovers those codebook facts.The categories include trust and delegation, interaction patterns, limitations, professional identity, and future outlook.
  • Benchmark components: An LLM extracts interviewee-profile facts such as occupation, specialization, and education from each transcript for recovery evaluation.The reference set summarizes each profile dimension and decomposes supported summaries into deduplicated atomic facts.
  • Illustrative materials: Representative turn-level excerpts compare adaptive-privacy AURA and Anonymizer rewrites using colored edit annotations in the supplementary diff report.These excerpts illustrate how the benchmark’s preserved information relates to concrete transcript changes.
  • Utility-grid construction: The contextual utility grid uses validated code facts as rows and validated profile facts as columns, granting credit only when both constituent facts remain recoverable.This approximates downstream questions that combine respondent identity context with coded behavior.
  • Utility-grid construction: For transcript i, per-transcript grid-unit recovery g_i equals the product of profile-fact and code-fact recovery accuracy.Reported unit-level recovery is a weighted average of per-transcript grid-unit recovery rates.
  • Utility-grid construction: Example grid units pair profile facts such as “health services researcher” with code facts such as AI delegation criteria or skill preservation.The cross-product retains combinations relevant to qualitative analysis rather than evaluating profile and code facts independently.

H Pareto Frontier Views for Component Utility Metrics

Component-wise Pareto views separate preservation of interviewee context from preservation of coded content, revealing an asymmetry between profile leakage and thematic utility.

  • Component-wise asymmetry: Privacy-oriented rewriting suppresses interviewee-profile recovery more sharply than code-fact recovery because re-identification cues are concentrated in background attributes.Substantive behaviors and themes are comparatively less affected.
  • Operating points: The GPT-4.1 8-attribute AURA run recovers 80.6% of profile facts and 93.3% of code facts, while adaptive privacy keeps code recovery at 95.1% with lower profile leakage.The component frontiers make this separation visible beyond the unit-level utility-grid view.
  • Operating points: The anonymizer remains comparatively competitive on code preservation but falls behind on unit-level utility because each unit requires both a profile fact and a code fact.The joint metric therefore exposes losses hidden by component-wise recovery.

I Limitations

The evaluation has important scope limitations: utility is estimated through model-based recoverability and a utility grid rather than human or end-to-end analyst performance, while privacy counts do not constitute a formal guarantee.

  • Utility is judged by gpt-4.1 recoverability rather than by human raters.
  • The utility grid approximates downstream question formation by intersecting profile facts with codebook facts, but does not directly measure real-study analyst performance.
  • Privacy counts use a reported direct-intent re-identification protocol rather than providing a formal privacy guarantee.
  • Profile recovery falls more sharply than code-fact recovery because many re-identification cues reside in respondent background details.
  • Code-fact preservation remains comparatively high for several systems, but joint profile–code utility is harder to preserve.
  • Adaptive AURA variants occupy a middle ground between DP-MLM’s low-utility privacy and lighter rewriting methods’ high-utility, high-leakage behavior.
Loading 2605.30848v2…