PaperlayerView exact revision on arXiv

Source-linked AI summary

I Am No One: Style-Aware Paraphrasing for Text Anonymization

Ahmed Sohair Khan, Estrid He, Monica Wachowicz, Elham Naghizade

arXiv:2609.12341v1cs.CLcs.CR

TL;DR

Authorship attribution can identify people from stylistic cues that survive anonymization, while DP-based approaches can degrade text quality. The paper profiles style with an LLM and rewrites text to suppress those cues while preserving content. Across two datasets, the approach reduces attribution F1 by 60–70% and is reported to outperform DP-based and non-DP baselines.

  • Problem

    Authorship attribution can expose users through stylistic cues that remain after identifiers are removed, while DP anonymization can retain such cues or degrade text utility.

    Source: §1 · p. 1

  • Method

    The approach uses LLM-generated profiles of author style to guide rewriting that suppresses style markers while preserving content.

    Source: §1 · p. 1

  • Results

    60–70%: style-guided rewriting reduces authorship attribution F1 relative to original text across both datasets, and both tested models substantially reduce authorship signal compared with the original and baselines.

    Source: §4 · p. 3

  • Takeaways & Limitations

    The results highlight precise stylistic manipulation as a means of achieving a favorable privacy–utility trade-off while retaining content and meaning.

    Source: §5 · p. 4

    The framework relies on predefined style features that may miss nuanced rhetorical patterns or syntactic idiosyncrasies serving as author fingerprints.

    Source: §5 · p. 4

Abstract

from arXiv · show

Authorship attribution models can re-identify users from seemingly anonymized text by exploiting stable stylistic fingerprints, even after explicit identifiers are removed, posing a growing privacy risk for text publishing and analytics. This risk extends to speech-derived text such as ASR transcripts of meetings and call-center conversations, where stylometric leakage can persist even after acoustic anonymization. Differential privacy-based anonymization often severely degrades text quality and utility. We propose a style-aware, prompt-driven anonymization approach that uses pretrained large language models to construct compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning. Across blog and review datasets, our approach reduces authorship attribution F1 by 60-70% while maintaining content quality and readability, substantially outperforming DP-based and non-DP baselines.

1. Introduction and Related Work

Authorship attribution can expose authors through stylistic patterns that remain after explicit identifiers are removed, including in speech-derived text. The paper proposes targeted stylistic rewriting as an alternative to noise injection and generic paraphrasing.

1. Introduction and Related Work

  • Removing explicit identifiers alone is inadequate because models can exploit subtle stylistic fingerprints such as syntax, vocabulary, and discourse patterns.Authorship attribution can expose identities even when users attempt to remain anonymous.Source: §1 · p. 1
  • Speech-privacy research has largely targeted acoustic speaker traits, although stylometric leakage can persist in speech-derived text.Prior work also examines transcription-based depression detection and transcript paraphrasing to reduce identification while preserving meaning.Source: §1 · p. 1
  • DP methods face a utility–privacy trade-off, and may retain identifying style cues while low-ε settings degrade text readability.The paper attributes this to latent-level mechanisms not disrupting higher-order syntax and token-level noise degrading utility without fully erasing authorship cues.Source: §1 · p. 1
  • Most existing methods rely on random perturbations or general paraphrasing rather than explicitly controlling stylistic markers.Examples include constrained-decoding JAMDEC, style-transformation STYLEREMIX, and style-salient phrase replacement in ALISON.Source: §1 · p. 1
  • The research question is how to anonymize user-generated text through stylistic transformations while preserving utility and avoiding noise injection.The paper posits neutralizing author-specific style attributes rather than applying indiscriminate noise.Source: §1 · p. 1
  • The proposed prompt-driven approach uses LLM-generated profiles of text length, punctuation, vocabulary, and tone to suppress stylistic markers while preserving content.It reports reduced attribution accuracy, near-original meaning, and improved readability across short- and long-form datasets.Source: §1 · p. 1

2. Methodology

The framework treats anonymization as controlled stylistic transformation: it profiles an author's style from samples, then uses that profile to guide rewriting while preserving semantic content. Its modules expose controls over profile dimensions and rewriting mode.

2. Methodology

  • The framework extracts author style from minimal samples and uses it as a control signal to rewrite text toward an output that conceals the author while preserving semantics and fluency.Figure 2 depicts profiling followed by profile-guided rewriting; the stated goal is to make the attribution classifier unable to reliably recover the author.Source: §2 · pp. 1–2, Figure 2 · p. 2
  • Figure 1 shows that stylistic cues remain in the depicted DP-anonymized text and may support re-identification.Source: Figure 1 · p. 2

2.1. Style-Profiling Module

  • The Style-Profiling Module prompts an LLM to describe four human-interpretable dimensions: sentence length, vocabulary choice, tone, and punctuation.The profile size K sets the number of author samples; the authors report K = 5 provides stable, distinctive profiles across both datasets.Source: §2.1 · p. 2

2.2. Style-Guided Rewriting Module

  • The Style-Guided Rewriting Module prompts an LLM to suppress profiled cues while preserving semantic content, with the profile specifying which dimensions to neutralize.The module is attacker-agnostic: it assumes no access to, and does not optimize against, the adversary's classifier.Source: §2.2 · p. 2
  • Rewrite mode controls how style affects generation: Style-guided supplies the explicit profile, Semi-guided requests neutral style without it, and Unguided uses generic paraphrasing.Unguided serves as a lower-bound baseline, while Semi-guided tests whether explicit profiles improve privacy and utility.Source: §2.2 · p. 2

3. Experimental Setup

The experiments compare long-form blogs and short-form reviews against DP and non-DP baselines. They assess utility and privacy with complementary measures and use LLM-based profiling and rewriting settings.

3.1. Datasets and Baselines

  • AUTHOR10 contains 15,070 long-form blogs from 10 authors, while ILLINOIS9 contains 3,959 Google Reviews from the 9 most frequent reviewers in Illinois.The comparison includes DP-Prompt at ε ∈ {25, 100, 250}, Quasi-DP, non-DP paraphrasing, and ALISON.Source: §3.1 · p. 2

3.2. Evaluation Metrics

  • Utility is measured with averaged embedding cosine similarity, GPT-2 perplexity, and weighted KL divergence, which penalizes losses of rare, informative tokens.Cosine similarity averages embeddings from three pretrained models; weighted KL is intended to capture information loss that cosine similarity may miss.Source: §3.2 · pp. 2–3
  • Privacy measures include BLEU and authorship attribution F1; relative gain combines attribution F1 and cosine similarity, while fluency-aware gain also penalizes perplexity degradation.Higher relative gain indicates a better privacy–utility trade-off, and the fluency-aware metric guards against gains achieved by severely degrading readability.Source: §3.2 · p. 3

3.3. Parameter Settings

  • LLAMA-3.2-3B-INSTRUCT is used for profiling and rewriting, with K = 5 samples per author; MINICPM3-4B is also evaluated to test model agnosticism.Source: §3.3 · p. 3

4. Results and Discussion

Style-guided rewriting reduces authorship attribution while retaining utility across the tested settings. Results vary with style profile and rewrite mode, and evaluations report robustness across models and datasets.

4. Results and Discussion

  • 60–70% lower authorship attribution F1 across both datasets; on AUTHOR10, F1 is 26.02 versus 29.53 for ALISON.On AUTHOR10, non-DP paraphrasing has F1 53.10; strict DP (ε = 25) has F1 ≈ 7.13 but PPL ≈ 8,770, versus this method’s PPL 42.47 and original PPL 41.Source: §4 · p. 3, Table 2 · p. 4
  • LLAMA performs more aggressive stylistic neutralization, while MINICPM favors surface-level content preservation; both reduce authorship signal, indicating effectiveness is not bound to one architecture.Source: §4 · p. 3

4.1. Full vs. Single-Dimension Style Profiles

  • The Full four-feature profile has the most stable privacy–utility trade-off; Length-only nearly matches it on ILLINOIS9, while several cues come within 0.2–0.3 pt on AUTHOR10.On ILLINOIS9, Length-only matches or slightly exceeds Full in privacy gain while preserving marginally higher cosine similarity.Source: §4.1 · p. 3, Table 3 · p. 4

4.2. Style-Guided, Semi-Guided, and Unguided Rewrites

  • On AUTHOR10, semi-guided rewrites slightly improve Author-F1 but worsen PPL, CS, and weighted KL; unguided paraphrasing incurs the largest utility loss and retains sizable authorship signal.Supplementary analyses report that style-guided rewriting retains more informational content while reaching nearly the same privacy levels as semi-guided rewriting.Source: §4.2 · p. 3, Table 4 · p. 4

4.3. Qualitative Insights and Robustness

  • 55% lower attacker F1 (from 77 to 35) on ILLINOIS9 under a retrained white-box classifier accompanies drops of more than 85% on Yelp and IMDB.Source: §4.3 · p. 4

5. Conclusion

The framework uses explicit, prompt-driven stylistic profiles to mask author identity while preserving semantic content. It reports stronger content retention than noise-based approaches and identifies limitations in style profiling, evaluation, and deployment scope.

5. Conclusion

  • The framework uses explicit, prompt-driven stylistic profiling to mask author identity while preserving semantic content across long-form and short-form text datasets.The conclusion describes its performance as robust and says it significantly outperforms differential-privacy-based and paraphrasing baselines.Source: §5 · p. 4
  • The style-guided approach better retains original content and meaning than noise-based approaches and remains effective against a method-aware white-box adversary.The conclusion also reports performance against differential-privacy-based and paraphrasing baselines.Source: §5 · p. 4
  • The framework may miss nuanced rhetorical or syntactic fingerprints, while current experiments leave ASR-transcribed text, fairness, and multimodal contexts for future work.The conclusion also notes that authorship F1 can conflate style obfuscation with content loss, motivating evaluation frameworks that disentangle them.Source: §5 · p. 4
Loading 2609.12341v1…