Source-linked AI summary
Aggregation-Aware Synthetic Text Generation Against Authorship Re-Identification
Qian Ma, Anna Squicciarini, Sarah Rajtmajer
TL;DR
Existing document-level obfuscation overlooks linkability created when attackers aggregate multiple texts from one account. AAST jointly selects synthetic texts at the bundle level for attribution and verification settings, including cross-genre attacks. Across evaluated attack types, it reduces account-level linkability as bundle size grows while preserving semantic, linguistic, and sentiment utility.
Problem
Existing authorship obfuscation methods optimize documents independently, although aggregated texts can expose account-level author signals.
Method
AAST generates and jointly selects synthetic texts at the bundle level, using abstraction and bundle-level candidate scoring to weaken aggregated author signals.
Results
Across same-genre, cross-genre, neural, and independent non-neural stylometric attacks, AAST reduces account-level linkability as bundle size grows while maintaining semantic, linguistic, and sentiment utility.
Takeaways & Limitations
AAST shifts authorship privacy from isolated rewrites toward reducing linkability across a released account history.
Takeaways & Limitations
AAST is not complete anonymization, and automatic utility metrics may not fully reflect human fluency or downstream usefulness.
Abstract
from arXiv · showhide
Online users often release multiple texts under the same identity, giving attackers an author profile that can reveal more than any single text. Existing authorship obfuscation methods optimize privacy independently for each document, leaving them blind to cross-document correlations that make aggregation dangerous. We propose Aggregation-Aware Synthetic Text Generation (AAST), a framework that addresses this gap by jointly selecting synthetic texts at the bundle level rather than optimizing each text in isolation. AAST targets attribution and verification attacks, including cross-genre settings where attacker references come from a genre not observed during generation or selection. Experiments across same-genre, cross-genre, neural, and independent non-neural stylometric attacks show that AAST lowers account-level linkability as bundle size grows, while preserving semantic quality, linguistic acceptability, and sentiment alignment.
1 Introduction
Pseudonyms separate online participation from legal identity but do not prevent authorship linkability. AAST addresses the aggregation gap by jointly selecting synthetic texts at bundle level, reducing account-level risk while preserving utility.
- Pseudonymous writing supports public participation while separating posts from legal identity, especially for sensitive communities and identity management.
- Authorship signals in word choice, syntax, punctuation, function words, and other expression habits can expose identity from text.
- Existing obfuscation methods must balance privacy against meaning, fluency, and downstream usefulness because minor edits may preserve style while aggressive rewriting can degrade utility.
- 2% to 93%: top-eight author identification rises from 2% with one unmodified Reddit comment to 93% with 16 comments.
- AAST jointly selects synthetic texts at the bundle level to weaken aggregated author signals used in attribution and verification attacks.
- Across same-genre and cross-genre evaluations, AAST lowers attribution and verification risk as bundle size grows while maintaining semantic, linguistic, and sentiment utility.
2 Related Work
Related work frames authorship analysis through attribution, verification, stylometry, and neural author representations. Privacy research further shows that linkage can persist despite identifier masking, motivating aggregation-aware protection.
- Authorship attribution identifies an author from a candidate set, whereas verification decides whether two texts share an author.
- Evaluation realism depends on candidate set, domain, and genre because attribution and verification settings can change across these conditions.
- Classical authorship models use character n-grams, function words, punctuation, and compression-based scores, while neural models learn author representations directly from text.
- Authorship obfuscation rewrites text to make the original author harder to identify while retaining usefulness, differing from ordinary paraphrasing and target-style transfer.
- Privacy risk includes linkage to other information, and masking direct identifiers may not prevent recovery through background knowledge, retrieval, or infilling.
3 AAST Methodology
AAST transforms private texts into abstracted candidates, generates synthetic alternatives, preselects stylistically dissimilar candidates, and selects one per slot using bundle-level objectives. The method models aggregation by embedding whole bundles and balancing partner and crowd similarity.
- System Overview: AAST groups each account’s texts into query and target bundles, with larger K representing a stronger aggregation threat.
- Abstraction candidate generation: An abstraction model produces candidates that preserve core meaning and sentiment while reducing direct correspondence with private surface forms.
- Noisy abstraction selection: Noisy abstraction selection provides a randomized scoring step before candidate generation, but its formal privacy statement is limited to that step.
- Synthetic Candidate Generation: For each abstraction, an LLM generates a candidate pool whose prompt preserves meaning while varying writing style.
- Candidate Preselection: Candidate preselection encodes sources and candidates in a shared stylistic space, retaining the half with lowest source similarity.
- Bundle-level candidate scoring: During bundle-level selection, candidates are scored by replacing one temporary slot at a time and recomputing the resulting bundle embedding.
- Bundle-level candidate scoring: The objective combines partner similarity between the user’s two bundles with crowd similarity to nearby bundles from other users, where lower is better.
- Candidate refinement: Near-optimal candidates are refined using a character n-gram bundle-similarity surrogate, selecting the lowest score and updating the bundle embedding.
4 Experimental Methodology
The experiments cover same-genre Reddit and Blog benchmarks plus cross-genre news–Twitter/X matching. They compare AAST with strong rewriting baselines under attribution and verification attacks, measuring privacy alongside semantic, linguistic, and sentiment utility.
- Datasets: The Reddit corpus contains 103,587 posts from up to 268 users, each providing two bundles of up to K=16 posts.
- Datasets: The Blog Authorship Corpus contains 681,288 posts from 19,320 bloggers, with bundle sizes capped at K=16.
- Datasets: Same-genre Reddit and Blog experiments use 250 users, allowing two bundles totaling 2K=32 texts per user at the largest size.
- Cross-genre evaluation: CROSSNEWS links 500 journalists’ news articles and Twitter/X posts, enabling Article–Tweet and Tweet–Article cross-genre settings.
- Cross-genre evaluation: In cross-genre evaluation, AAST observes only input-genre text during generation and selection while attacker references come from another genre.
- Baselines: AAST is compared with KiP, JAMDEC, and RUPTA to test aggregation-level privacy against recent authorship-obfuscation and LLM-rewriting baselines.
- Metrics: Same-genre privacy uses LUAR and PAN22 metrics, while cross-genre evaluation uses SELMA metrics for attribution and verification.
- Utility metrics: Utility is measured with NLI for semantic quality, CoLA for linguistic acceptability, and sentiment-label agreement for sentiment alignment.
5 Results
Across same-genre and cross-genre evaluations, AAST lowers attribution and verification risk as bundle-level aggregation increases, while preserving semantic, linguistic, and sentiment utility. Its privacy gains transfer to independent classical stylometric attacks, with AASTΦ and AASTM showing complementary strengths.
- Same-genre attribution: At K=16, AASTΦ lowers Reddit attribution risk to 39.8 MRR, compared with 54.7 for JAMDEC and 92.7 for KiP.AASTM remains below both rewriting baselines, although attribution becomes harder to suppress as K increases.
- Same-genre attribution: At K=16, AASTΦ keeps Blog attribution at 61.4 R@8, versus 83.6 for JAMDEC and 94.0 for KiP.AAST has the lowest attribution risk across all Blog bundle sizes.
- Same-genre verification: At the largest Reddit bundle size, AASTM limits verification AUC to 64.1, while JAMDEC and KiP reach 81.4 and 92.6.AASTM is usually strongest for verification, and AASTΦ improves over both rewriting baselines for most K.
- Same-genre verification: At K=16 on Blog, AASTM achieves 68.6 AUC and 50.3 c@1, below JAMDEC’s 73.3 AUC and 61.4 c@1.KiP reaches 85.3 AUC and 68.1 c@1 in the same setting.
- Transfer attacks: Under independent classical stylometric attacks, AAST variants retain the lowest or second-lowest attribution and verification risks on Reddit and Blog.At K=16, AASTM reaches 71.6 AUC on Reddit versus 90.1 for JAMDEC and 84.2 for KiP; on Blog, AASTΦ reaches 68.6 AUC and 54.8 c@1.
- Model variants: AASTΦ is often stronger for larger-K attribution, whereas AASTM is usually more stable for verification and cross-genre settings.The paper attributes these complementary strengths to differences in candidate distributions, including semantic preservation, style shift, and candidate diversity.
- Cross-genre evaluation: In cross-genre attribution, AASTM gives the lowest Accuracy and R@8 across both genre directions and both SELMA settings.For Tweet–Article under SELMA+LIP, AASTM reduces R@8 to 5.0 and ranks the true author 192 on average; cross-genre verification follows the same pattern.
- Utility: AAST preserves utility while reducing linkability: AASTΦ reaches 72.9 NLI at Reddit K=16, maintains the best CoLA at every K, and keeps sentiment alignment between 83% and 85.5%.On cross-genre utility, AASTM has the highest CoLA and AASTΦ is consistently second best; AAST also maintains strong Blog linguistic quality and sentiment alignment.
6 Conclusion
AAST reframes authorship privacy as a bundle-level problem, selecting synthetic texts jointly to reduce account-level linkability. Across attack types and growing bundle sizes, it reduces linkability while preserving semantic quality, linguistic acceptability, and sentiment alignment.
- AAST shifts the privacy target from isolated text rewriting to bundle-level selection over a released account history.
- AAST reduces account-level linkability across same-genre, cross-genre, neural, and independent non-neural stylometric attacks as bundle size grows.
- AAST maintains semantic quality, linguistic acceptability, and sentiment alignment while reducing account-level authorship linkability.
Limitations
The evaluation leaves important boundaries around AAST’s claims: its generator behavior remains incompletely analyzed, short metadata-heavy texts constrain effectiveness, and attacker independence is limited in one setting.
- AAST is less effective for very short, metadata-heavy texts because bundle-level selection has less semantic and stylistic material.
- Same-genre LUAR attribution is not fully independent because AAST uses a LUAR-based episode encoder during bundle-level selection.
Ethical Considerations
The paper describes privacy, safety, and methodological considerations for releasing synthetic text. It limits data access and claims, acknowledges residual linkage and dual-use risks, and specifies the selection and privacy-analysis procedures.
- The Reddit corpus is treated as sensitive despite public accessibility, with data minimization and no collection of real names or external profile information.
- Dataset access is restricted to verified researchers who agree not to re-identify users, contact them, redistribute data, or link posts externally.
- AAST may increase mistaken association with nearby users, so deployments should monitor false-attribution concentration and avoid outputs mimicking identifiable individuals.
- AAST is a defensive risk-reduction tool rather than a guarantee of anonymity and should be deployed with privacy review and safeguards.
- The paper recognizes dual-use risks and recommends restricting AAST to legitimate privacy preservation, research, and controlled synthetic-text release.
- The selection procedure scores candidates using semantic similarity, sentiment alignment, and mismatch penalties before generation.
- The noisy score-selection analysis is conditional on the candidate set and does not claim end-to-end differential privacy for generated candidates or the final corpus.
- Coordinate descent replaces exponential bundle search by updating one slot at a time, using one pass in the experiments.
C.1 Privacy Metrics Details
The paper evaluates privacy and utility across bundle sizes using neural and classical attribution and verification metrics, alongside semantic, grammaticality, and sentiment measures. These metrics support comparisons across same-genre and cross-genre settings.
- LUAR attribution reports MRR and R@8, with lower values indicating lower attribution risk.
- Independent classical stylometric attacks test whether attribution and verification gains transfer beyond neural or selector-aware evaluation.
- PAN22 verification reports AUC and c@1, where AUC nearer random chance 50% and lower c@1 indicate weaker verification.
- Bundle sizes K ∈ {1, 2, 4, 6, 8, 10, 12, 14, 16} measure how privacy risk changes as attackers observe more texts jointly.
- Cross-genre evaluation reports attribution Accuracy, R@8, and Average Rank, plus verification Accuracy and F1, using SELMA task variants.
- NLI measures preservation of core meaning, CoLA indicates grammaticality and fluency, and sentiment alignment measures matched sentiment labels.
E Additional Same-genre Stylometric Attribution Results
AAST remains effective against an unseen classical stylometric attribution attacker. At K=16, both AAST variants achieve the lowest or second-lowest risk metrics on Reddit and Blog, outperforming KiP and JAMDEC.
- AAST remains effective under an independent classical stylometric attribution attack.The transfer attacker uses a different attack family from the LUAR model used for bundle-level selection.
- At K=16, both AAST variants achieve the lowest or second-lowest MRR and R@8 on Reddit and Blog.KiP and JAMDEC remain substantially more linkable at this bundle size.
F Additional Same-genre Stylometric Verification Results
AAST lowers same-genre verification risk under a classical stylometric transfer attack across Reddit and Blog. The advantage becomes clearer at larger bundle sizes while preserving useful synthetic content.
- AAST keeps verification risk lower than JAMDEC and KiP across most bundle sizes on Reddit and Blog.These results are consistent with the main PAN22 verification findings.
- At K=16 on Reddit, AASTM gives 71.6 AUC and 52.4 c@1, below JAMDEC’s 90.1 AUC and 75.3 c@1.
- At K=16 on Blog, AASTΦ gives the lowest AUC at 68.6, while JAMDEC gives 94.0 AUC and 84.0 c@1.KiP gives 96.1 AUC and 74.4 c@1 on Blog at the same bundle size.
- The transfer results indicate that AAST’s verification gains persist under classical stylometric attacks rather than only neural authorship models.The stated design goal is to reduce account-level linkability while preserving useful text content.
G.2 Blog Utility Results
AAST preserves semantic, linguistic, and sentiment utility while reducing authorship linkability in Blog and related aggregation settings. The results also show that bundle-level selection is central to this privacy–utility balance, though short metadata-heavy tweets constrain it.
- Blog Utility Results: AASTΦ achieves the best CoLA on Blog, while its NLI is strongest or tied strongest from K=4 onward.JAMDEC has lower NLI across bundle sizes, while KiP’s CoLA is much lower despite competitive small-bundle NLI.
- Blog Utility Results: AASTM maintains sentiment alignment around 88% on Blog, while AASTΦ remains around 85% on average across bundle sizes.Both variants preserve sentiment while reducing authorship linkability.
- Privacy–Utility Tradeoff: AAST maintains substantially lower R@8 and MRR than RUPTA at K=8 and K=16, while keeping AUC closer to 50 and c@1 lower in most large-bundle settings.
- Article–Tweet Boundary: Short tweet inputs containing handles, URLs, hashtags, and brief reactions leave less semantic and stylistic content for AAST to preserve.This makes the bundle-level signal weaker or noisier in the Article–Tweet setting, although AASTM remains strongest there.
- Bundle-Level Selection: Removing Bundle-Level Selection increases attribution and verification risk while leaving NLI and CoLA similar to AASTΦ.On Reddit, NoBundleSelΦ reaches 85.8 AUC and 65.6 c@1 at K=16, compared with AASTΦ’s 66.7 AUC and 49.8 c@1.
- Noisy Selection: Stronger selection noise generally lowers attribution risk at K=8 and K=16, but no noise usually gives the highest NLI.The tradeoff occurs because noise can move selection away from the candidate with the strongest semantic and sentiment score.
O.1 Computational Efficiency Results
AAST is the fastest evaluated method across bundle sizes and scales more practically than KiP or JAMDEC. At K=16, it completes generation in 5.8 hours, while JAMDEC requires about 120 hours.
- AAST is consistently the fastest method across all evaluated bundle sizes.Runtime was measured for 250 Blog users using the same three GPUs, with runtime reported relative to AAST.
- At K=16, AAST completes generation in 5.8 hours, compared with 11.3 hours for KiP and about 120 hours for JAMDEC.JAMDEC averages about 18.5× AAST’s runtime, while KiP requires about 1.5× to 2.3×.
- Runtime gaps exceed output-length differences: in Reddit K=1, KiP outputs are about 1.3× longer and JAMDEC outputs about 1.1× longer than AAST outputs.The corresponding runtime gaps are about 1.9× for KiP and much larger for JAMDEC.
- AASTM token usage grows almost linearly with bundle size because larger K requires rewriting more private texts.At K=16, 8,000 private texts produce about 7.97 million input and output tokens.