QuasiLeak-Bench: Evaluating LLM-Based Privacy Detectors on Policy-Conditioned Quasi-Evidence Group Recovery

1 Introduction

• Existing text privacy tools target explicit PII, while inferential disclosures from ordinary contextual details can be equally harmful and pass screening undetected.A cue may be weak alone yet reveal an attribute when combined with other cues.Source: §1 · p. 1
• Quasi-evidence groups are sets of quasi-identifiers that are individually weak but jointly reveal a private attribute.For example, a juice box by the bed, a cold fridge, and listed carbohydrate grams together point toward diabetes.Source: §1 · pp. 1–2
• A useful screening tool should apply sender policies, explain alerts by identifying the full cue group and attribute, and score group recovery rather than isolated spans.The policy distinguishes KEEP, HIDE, and NEUTRAL attributes for a particular recipient and purpose.Source: §1 · p. 2
• QuasiLeak-Bench provides 5,000 sender–recipient messages paired with profiles and disclosure policies to evaluate policy-conditioned quasi-evidence group recovery.The benchmark addresses a gap left by existing benchmarks that do not cover all three requirements.Source: §1 · p. 2
• Its reverse-construction workflow verifies the quasi-evidence group before generating surrounding text, then applies quality control and expert review.The workflow is designed to ensure each cue is weak alone, the group supports the inference, and surrounding text does not leak the attribute outside the evidence.Source: §1 · p. 2
• The paper reports that existing privacy detectors transfer poorly, local models miss groups, and task-specific supervision lets a 4B model surpass the strongest prompted model on held-out documents.The paper also reports that human reviewers rarely spot these groups unaided and that assisted review is bounded by the detector used.Source: §1 · p. 2

2 Related Work

• Traditional text privacy methods detect PII or quasi-identifiers, while newer work evaluates attribute inference after anonymization or rewriting (Staab et al., 2024, 2025; Li et al., 2026).The cited examples include Microsoft (2021), Zaratiana et al. (2026), Chen et al. (2026), and Sweeney (2002) for traditional methods.Source: §2 · p. 2
• Other benchmarks study evidence accumulation across posts, photo histories, tool interactions, external queries, or agent trajectories, while contextual privacy work studies disclosure by recipient or purpose.These lines of work evaluate evidence aggregation and context-dependent disclosure separately (Peng et al., 2026; Yan et al., 2026; Qiao et al., 2026; Gurung et al., 2026; Xie and Li, 2026; Nissenbaum, 2004; Mireshghallah et al., 2024b; Huang et al., 2026; Shen et al., 2026b).Source: §2 · p. 3
• QuasiLeak-Bench combines recovery of within-document groups of weak cues, attribute binding, and policy-based detection of prohibited disclosures in one task.This differs from benchmarks focused on sensitive-span localization, profile inference, residual inferability, or contextual disclosure (Pilán et al., 2022; Shen et al., 2026a; Staab et al., 2024; Yukhymenko et al., 2024; Oh et al., 2026; Krˇco et al., 2026; Li et al., 2025a; Chang et al., 2025; Jang et al., 2026; Zheng et al., 2026).Source: §2 · p. 3

3.1 Problem Setting

• The screening setting gives a detector the message, sender profile, and disclosure policy, and asks it to return flagged disclosures.The profile covers eight attributes, and the policy assigns each one a disclosure status for the interaction.Source: §3.1 · p. 3
• The detector returns each quasi-evidence group with the attribute it jointly reveals, assuming explicit identifiers have already been removed by standard PII detection.Span-level metrics are not used to measure these inferential disclosures.Source: §3.1 · p. 3

3.2 Quasi-Evidence Groups

• A quasi-evidence group contains non-overlapping contiguous message spans, each individually insufficient to infer the attribute while the complete group supports it.Groups are restricted to pairs, trios, or quads; a gold group includes every cue supporting the inference, with partial credit for subsets and full credit for the complete group.Source: §3.2 · p. 3
• A benchmark instance includes a message, profile, policy, and gold output, and only groups for attributes labeled HIDE should be reported..Source: §3.2 · p. 3

4.1 Profiles, Contexts, and Policies

• The corpus uses 500 profiles, eight attributes, and 20 recipient-purpose contexts, with human-verified policies that vary by context.Every attribute is kept in at least four contexts and hidden in at least four others.Source: §4.1 · p. 4

4.2 Reverse Construction

• Reverse construction mines individually weak cues, verifies groups that jointly reveal attributes, then writes documents with distractors and planned cue placement.Groups are checked for secondary attributes, while document-level screening checks cue validity, residual leakage, and realism.Source: §4.2 · pp. 4–5

4.4 Construction Ablations

• Acceptance rises from 55.5% with one-shot generation to 73.5% without internal verification and 78.0% with the full pipeline.Reverse staging captures most of the gain; internal verification adds 4.5 acceptance-rate points under the common quality check.Source: Table 1 · p. 5, §4.4 · p. 6

4.3 Quality Control

• Quality control checks whether cues remain weak alone and revealing together, whether unmarked text leaks profile information, and whether documents are realistic.A multi-LLM panel accepts, rejects, or refers unresolved cases to human reviewers, who can repair documents for another check.Source: §4.3 · p. 5

4.4 Construction Ablations

• Only 20 of 104 candidate groups extracted from 700 naturally authored documents pass the quality check, limiting their use for benchmark-scale coverage.The authors report that few audited corpora combine redistributable text with reliable author ground truth.Source: §4.4 · p. 5
• The construction ablation finds that one-shot generation often makes intended weak cues revealing on their own, while reverse staging improves acceptance.The full pipeline adds internal verification after reverse staging.Source: §4.4 · p. 6

4.5 Evaluation Metrics

• P-GF1 evaluates recovery at evidence, binding, and policy levels, rewarding complete localized groups with the correct attribute while crediting only HIDE disclosures.Evidence-level scoring gives partial groups graded credit; binding purity penalizes merging cues from multiple gold groups.Source: §4.5 · p. 6

5 Experimental Evaluation

• Only 39.4% of revealed attributes are labeled HIDE, so policy-agnostic detection reports more permitted than prohibited disclosures.Source: §5 · p. 7

5.1 Prompted Model Performance

• 75.4 P-GF1 for the strongest proprietary model contrasts with 24.2 for the best locally runnable model, which misses most HIDE groups.The proprietary model is served through a hosted API that crosses the sender-side trust boundary.Source: §5.1 · p. 7

5.2 Error Analysis

• 14 of 17 local entries miss more than 75% of HIDE groups outright, while local groups are less complete and less accurately bound to attributes than proprietary models.Among aligned groups, every local entry has EL above 55, but EC is below 71 for all but one; every proprietary model has EC of at least 83 and BA above 87.Source: §5.2 · p. 7
• P-GR varies with attribute and group properties: proprietary mean P-GR is 76.5 for education versus 33.9 for income, and rises with group margin.Trios outscore pairs in every band; quads show no uniform trend, while more surfaced attributes and greater cue distance correspond to mild declines.Source: §5.2 · p. 8

5.3 Existing Privacy Detector Transfer

• Every transferred privacy-detector entry stays below 10 P-GF1, and their outputs contain at most 27.4% of HIDE cues by ER.The shared grouping step therefore has little evidence to assemble.Source: §5.3 · p. 8, Table 4 · p. 8

5.4 Human-as-Detector Study

• LLM-assisted reviewers improve substantially over unaided reviewers but still trail the model alone, usually keeping its proposal rather than recovering missed groups.The study covers four reviewers and 200 accepted documents.Source: §5.4 · p. 8, Table 5 · p. 8

5.5 Task-Specific Supervision

• 79.8 P-GF1 with own-policy supervision surpasses the strongest prompted reference at 75.6 P-GF1 on the same test documents.Reassigned-policy augmentation adds a smaller, model-dependent change.Source: Table 6 · p. 8, §5.5 · p. 8

• QuasiLeak-Bench measures policy-conditioned inferential privacy leakage through individually weak cues that jointly reveal attributes.The benchmark provides evidence groups with span-level provenance, verified attributes, and sender-specified policies, with validation intended to separate annotated evidence from residual leakage.Source: §6 · p. 8

• Indirect-evidence associations may vary across populations or reflect stereotypes, and benchmark results do not validate them as social or demographic facts.Source: Limitations · p. 9
• The corpus is synthetic and calibrated to proprietary-model observers; it covers English, within-document evidence, eight profile attributes, twenty contexts, and explicitly supplied policies.Natural text, broader attributes and populations, cross-document or interaction leakage, and context-inferred preferences remain future extensions.Source: Limitations · p. 9

• The benchmark could be misused for profiling or surveillance; the authors intend it for privacy detection, sanitization, and policy-compliance research.Human reviewers exclude demeaning or gratuitously stereotyped content, and systems should present uncertainty and supporting evidence to the sender.Source: Ethical Considerations · p. 9

Open Science

• The code repository provides the scorer, evaluation prompts, construction and quality-check prompts, and fine-tuning recipe with model and decoding configurations.These materials are released to support reproduction and extension.Source: Open Science · p. 9
• The dataset release includes the full corpus, profiles, policies, evidence annotations, Train, Validation, and Test splits, and evaluation views.Source: Open Science · p. 9
• The leaderboard ranks prompted and fine-tuned detectors and accepts new submissions.Source: Open Science · p. 9

A Comparison with Existing Privacy Benchmarks

• Table 7 compares existing privacy benchmarks across disclosure signals, aggregation, context, policy, utility, cross-source and interaction settings, and evidence granularity.Explicit and inferential signals concern evaluated text or observations, excluding trusted auxiliary profiles.Source: A Comparison with Existing Privacy… · p. 13
• The comparison qualifies how benchmarks encode localization and relations, including cue groups for QuasiLeak-Bench, and notes protocol-specific exceptions.For example, TOP-Bench uses support sets, while PAL-Bench uses identity relations.Source: A Comparison with Existing Privacy… · p. 13

B Benchmark Construction Details

• The construction-details section expands on profile–context compatibility and reverse construction from mined cues to completed documents.Source: B Benchmark Construction Details · p. 13

B.1 Profiles, Contexts, and Compatibility

• The pool contains 500 profiles—300 adapted from SynthPAI and 200 newly generated—and human-authored policies assign each of eight attributes KEEP, HIDE, or NEUTRAL labels for each context’s recipient and purpose.All 200 new profiles satisfy hard criteria under separate evaluations by Gemini-3.5-Flash and Claude-Opus-4.8, with one human reviewer auditing each profile; policy checks enforce an exhaustive, disjoint partition and require every attribute to appear under both KEEP and HIDE in at least four contexts.Source: §B.1 · pp. 13–14
• Mean criterion-wise agreement is κ = 0.250 for human–human, 0.315 for human–LLM, and 0.264 for LLM–LLM, supporting use of the three LLM judges’ mean scores for all 10,000 profile–context pairs.The authors characterize human–LLM agreement as comparable to within-group agreement, consistent with subjectivity in related annotation tasks; the scoring approach follows Zhao et al. (2025; Haldar and Hockenmaier, 2025).Source: §B.1 · p. 15, Figure 7 · p. 17
• Balanced assignment places every profile in ten contexts and each context in 150–350 documents, avoiding counts of 2–496 while reducing mean compatibility only from 82.6 to 81.0.Compatibility-only assignment leaves five contexts with fewer than 60 documents.Source: §B.1 · p. 16, Table 10 · p. 16

B.2 Reverse Construction Details

• All 23,041 released cue spans fall above chance but below the singleton threshold, with median lift 0.24, while all 9,099 groups clear the joint threshold relative to the construction verifier.The guarantee is relative to the proposer and verifier; the appendix separately tests how far other readers share these judgments.Source: §B.2 · p. 17
• Cue mining filters candidate cues for chance-level and singleton leakage, cross-attribute disclosure, and repeated use; group search then progressively extends pairs into trios and quads, favoring complementary cues and preserving each attribute’s strongest group.Groups are capped at four cues: the third cue raises mean verifier confidence by 0.19 and carries 90% of trios across the joint threshold, while the fourth adds 0.07 and 63% of quads extend a trio already above threshold.Source: §B.2 · pp. 18–19

C.1 Quality Check Rubric

• Quality control independently checks marked-group cue quality, residual leakage after cue masking, and realism of the unmarked document, using two primary LLM judges and a blind third arbiter when threshold decisions disagree.Seven of the 15 criteria are hard inclusion requirements; unresolved hard criteria lead to review, and residual leakage requires at least two judges to recover the same attribute and leak type at the specified confidence threshold.Source: §C.1 · pp. 19–20
• Surface-naturalness objections rise from 23% to 77% across evidence-density quintiles, while objection rates across document-length quintiles stay between 47% and 56%.R3 objections rise from 18.6% with no evidence group to 41.1%, 59.7%, and 69.6% when the largest group is a pair, trio, or quad; other realism criteria remain stable, and objections are strongly judge-dependent.Source: §C.1 · p. 20, Table 15 · p. 21
• On 2,172 documents without a surface-naturalness objection, all 28 entries retain their full-corpus ranking (Spearman ρ = 0.97); proprietary models score 49.1–70.1 P-GF1 and the best ≤14B entry reaches 20.6.The best ≤14B entry is Gemma-4-12B with thinking off.Source: §C.1 · p. 21

C.2 Human-in-the-Loop Validation

• The weighted estimate that reviewers passed every applicable hard criterion was 82.2% (95% CI 79.2%–85.2%), while document-level agreement was 70.0% (κ = 0.198).The estimate uses a stratified audit of 400 documents; reviewers split on C2 in 111 of 349 documents with groups, an agreement of 68.2%.Source: §C.2 · pp. 21–22
• Reviewers agreed with panel majorities on 14,505/15,314 criterion slots, and 802 of the 809 differences were human failures against panel passes.Reviewers explicitly adopted 14,451 majority votes, of which 348 differed from their final judgments, an edit rate of 2.4%.Source: §C.2 · p. 22
• Rescoring predictions on documents both reviewers passed yielded a model-ranking correlation of 0.95 with the full corpus; rankings on documents with at least one reviewer failure correlated 0.99.The four leading proprietary models retained their order, and the proprietary–local band gap remained intact.Source: §C.2 · p. 22
• Across 795 audited groups, both reviewers confirmed C1 for 99.2%, at least one confirmed C2 for 95.3%, and proprietary models averaged 63.8 P-GR versus 35.4 for the best ≤14B entry on human-confirmed groups.Both reviewers confirmed C2 for 76.6% of groups and both rejected it for 4.7%; on the 237 HIDE groups both reviewers confirmed on both criteria, GPT-5.6 Sol scored 80.5 P-GR versus 65.1 on 83 disputed groups, and confirmed-group recall rankings correlated 0.996 with the full-corpus rankings.Source: §C.2 · p. 22

C.3 Construction Ablations

• Natural-text extraction requires independently recorded author attributes: among 49 screened corpora, access or release restrictions, missing or incompatible ground truth, and unsuitable text left only eight eligible, of which six were used.Without independently recorded attributes, the gold labels would themselves be inferences whose reliability would need to be established.Source: §C.3 · p. 23
• Among 700 documents from six datasets, 20 candidate groups pass quality checks, all concerning occupation and covering only 4 of QuasiLeak-Bench’s 72 attribute, arity, and distance cells.The accepted groups establish that quasi-evidence occurs in natural text, but natural text does not provide benchmark-scale coverage or control.Source: §C.3 · p. 23, Figure 9 · p. 23
• Four proprietary detectors overlap the annotated group on 17 to 19 of 20 accepted natural documents, while fine-tuned Qwen3.5-4B overlaps on 9 to 12 and the base model touches none.Detectors often complete groups with other genuine occupation cues, so complete-group scoring relies on the controlled provenance of reverse construction.Source: §C.3 · p. 23
• Acceptance rises from 55.5% for one-shot generation to 73.5% for reverse construction without internal verification and 78.0% for the full pipeline.Reverse staging accounts for most of the 22.5-point full-pipeline gain; internal verification adds 4.5 acceptance-rate points under the common final check.Source: §C.3 · p. 24
• One-shot generation most often fails C1, while both staged conditions fail almost entirely on C2, where the complete group falls short of the target value.The matched conditions share profiles, style, context, disclosure policy, target length, writing constraints, surfaced attributes, and group arities and cue-distance bands.Source: §C.3 · pp. 23–24
• At a 40% sentence budget, the surface-only locator recovers every cue in 39.6% of groups versus 12.2% for random selection, yet selects distractors almost as readily as cues.The locator has AUC 0.733; much of the surface regularity is shared by distractors, leaving semantic and inferential reasoning necessary for reliable group recovery.Source: §C.3 · p. 24, Table 18 · p. 25

D.1 Metrics and Scoring

• The scorer matches predicted spans to annotated cues, aligns groups before scoring, and gives partial completeness credit that disproportionately rewards recovering the full annotated group.With γ = 2, recovering two cues from a four-cue group earns (2/4)^2 = 0.25 completeness credit; KEEP reports incur an additional cost, with λK = 1 by default.Source: §D.1 · pp. 25–27
• Across every scoring setting tested, the main comparisons hold: varying completeness and overlap thresholds shifts absolute P-GF1 scores without changing system ordering, while secondary-attribute credit has negligible effect.Scores remain stable around θ = 0.75.Source: §D.1 · p. 27, Figure 10 · p. 28
• Few-shot P-GF1 intervals have half-widths of at most 1.4 points; proprietary entries’ intervals are above 52, ≤14B entries’ are below 26, and paired intervals separate every adjacent pair among the eleven strongest entries.The twelve unresolved adjacent pairs all lie below 8 P-GF1.Source: §D.1 · p. 27
• Subset robustness checks preserve the findings: pair-only evaluation barely changes rankings, and sufficient-evidence and residual-evidence credit rules raise scores while retaining the top ten entries’ order.The pair-only documents still cover every context and attribute; local models retain their widest gap at attribute binding.Source: §D.1 · p. 27, Table 21 · p. 28

D.2 Corpus Statistics

• The corpus contains 9,099 evidence groups with 23,041 cue spans; 72.3% of cues contain three words, and documents average 628.0 ± 60.5 words, 4.61 cue spans, and 2.45 distractors.Only 46 groups support a verified secondary attribute, while the corpus has 20,601 distinct cue forms and open-vocabulary attributes span hundreds of target values.Source: §D.2 · pp. 28–29

D.3 Models, Prompts, and Output Format

• Evaluation uses the same three few-shot examples for all models, covering all eight attributes, three policy classes, group arities of 2–4, and all cue distances; local models up to 14B parameters fit the stated consumer-device constraints at 4-bit precision.Zero-shot prompts omit the examples, and few-shot prompts insert solved examples without changing the instructions or input format.Source: §D.3 · p. 29
• The output contract permits at most one group per attribute, with 2 to 4 distinct, non-overlapping verbatim spans for a HIDE attribute and a rationale.Parsed evidence objects remain predictions even when they receive zero credit; unparseable responses are treated as empty, and outputs are parsed without repair.Source: §D.3 · pp. 30–31

D.4 Larger Local Models

• Gemma-4-31B reaches 46.0 P-GF1 in the 24–32B local band, above every ≤14B model but below the proprietary band.OLMo-3.1-32B stays near zero, while Mistral-Small-24B over-reports; enabling thinking lowers Gemma-4-31B from 46.0 to 7.6 and Qwen3.5-27B from 33.4 to 3.8 P-GF1 as both emit far fewer groups. The band is nearly flat across group arity, unlike Figure 4’s trio preference, and recall rises with group margin most steeply in the two strongest bands.Source: §D.4 · p. 31, Table 22 · p. 32, Figure 12 · p. 32

D.5 Zero-Shot Ablation

• Gemini-3.8-Flash leads zero-shot performance at 66.4 P-GF1, while 13 of 23 local-model entries score below 1.Only Gemma-4-31B and Gemma-4-12B with thinking off exceed 20 among local models; the comparison indicates that many local models struggle to infer the task structure from instructions alone, while stronger models recover substantial evidence without examples.Source: §D.5 · p. 31, Table 23 · p. 32

D.6 Policy Conditioning

• Under policy reassignment, proprietary models suppress 95 to 99% of found groups whose attribute is no longer HIDE, versus 69% for the median ≤14B local model.Proprietary models usually suppress evidence when its attribute becomes non-HIDE and surface it when the same attribute becomes HIDE; reassignment does not induce a consistent change in aggregate P-GF1.Source: §D.6 · pp. 31–32

D.7 Outcomes of HIDE Groups

• Among ≤14B entries, 14 of 17 leave more than 75% of HIDE groups unaligned, indicating that most local-model loss occurs before a group is assembled.Proprietary models almost never misbind (at most 0.4%) and instead lose groups as unaligned or incomplete. Under 2% of finished thinking-off responses fail to parse for every entry; output-length stops occur only with thinking enabled, and Gemma-4-E4B with thinking off returns an empty evidence list on 4,999 of 5,000 documents.Source: §D.7 · p. 33, Figure 14 · p. 33

D.8 Existing Privacy Detector Transfer

• The transfer evaluation restricts predicted evidence to spans detectors return, then compares native detector grouping with a shared LLM grouping step that cannot invent or recover missing spans.The shared module receives the document, profile, policy, and numbered located spans, and returns candidate identifiers; comparing conditions separates failures in the detector’s span inventory from grouping and attribute binding. Pre-policy evidence recall measures located-span matches to HIDE gold cues before mapping, grouping, or disclosure filtering.Source: §D.8 · p. 34

D.9 Human-as-Detector Study

• Assistance raises pooled human P-GF1 by 30.7 points over unaided answers, while assisted answers remain 6.4 points below model-only predictions.Evidence F1 rises from 28.4 unaided to 59.2 assisted, compared with 63.5 for the model alone. Reviewers recover only 2 of the 32 target groups the model misses, and retain 80 of the 94 it recovers; they accept 78.2% of proposed spans, retaining 82.4% of proposed cues but 56.8% of proposed unrelated spans.Source: §D.9 · p. 35, Table 25 · p. 35

Supervision design

• The target contains only HIDE groups, so KEEP and NEUTRAL groups provide negative supervision through omission.Policy-and-label augmentation also assigns the same evidence group positive or negative targets under reassigned policies.Source: §D.10 · pp. 35–36

Learning results

• Qwen3.5-4B rises from 7.7 P-GF1 under few-shot prompting to 79.8, while GPT-5.6 Sol reaches 75.6 on the same test documents.Figure 15 summarizes the learning curves.Source: §D.10 · pp. 35–36, Figure 15 · p. 36

Training protocol

• Evaluation uses 3,500/500/1,000 profile-disjoint training, development, and test documents, with three prespecified seeds contributing to reported aggregates.Local backbones use LoRA and the same inference runner and scorer as prompted models.Source: §D.10 · p. 36

Learning results

• Fine-tuning sharply reduces missed groups, but incomplete or contaminated grouping remains a more persistent failure mode.Policy-and-label augmentation yields smaller, model-dependent changes than direct supervision of the evidence task.Source: §D.10 · p. 36

Generalization tests

• Qwen3.5-4B reaches 78.1 P-GR on 451 groups with unseen cue strings versus 86.0 on 26 fully familiar groups; performance also stays close on unseen contexts.Both forms of generalization are within the reverse-construction distribution.Source: §D.10 · p. 36

E Lessons Learned

• The best ≤14B entry scores 80.0 on EL but 65.1 on EC and 60.8 on BA, indicating that locating cues is easier than assembling them.Source: E Lessons Learned · p. 36
• Under reassigned policies, proprietary models suppress 95 to 99% of found groups whose attribute is no longer HIDE; filtering to HIDE attributes helps some small models and hurts others.Source: E Lessons Learned · pp. 36–37
• Existing privacy tools’ span inventories contain at most 27.4% of HIDE cues, leaving most compositional disclosures outside their inventories.Source: E Lessons Learned · p. 37
• Enabling thinking lowers Gemma-4-31B from 46.0 to 7.6 and Qwen3.5-27B from 33.4 to 3.8 P-GF1 because both emit fewer groups, while Qwen reaches the output cap on most documents.Source: E Lessons Learned · p. 37
• Unaided reviewers rarely spot quasi-evidence groups, while LLM-assisted reviewers keep most proposed groups and seldom recover those the model misses.Source: E Lessons Learned · p. 37
• A fine-tuned 4B model overtakes the strongest prompted model on held-out documents and overlaps annotated groups in 9 to 12 of 20 human-authored documents, versus none for the base model and 17 to 19 for proprietary models.Source: E Lessons Learned · p. 37