Neural Text Sanitization with Privacy Risk Indicators: An Empirical Analysis
Extracted source text · arXiv 2310.14312
%Version 2.1 April 2023
% See section 11 of the User Manual for version history
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %%
%% Please do not use \input{...} to include other tex files. %%
%% Submit your LaTeX manuscript as one .tex document. %%
%% %%
%% All additional figures and files should be attached %%
%% separately and not embedded in the \TeX\ document itself. %%
%% %%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%\documentclass[referee,sn-basic]{sn-jnl}% referee option is meant for double line spacing
%%=======================================================%%
%% to print line numbers in the margin use lineno option %%
%%=======================================================%%
%%\documentclass[lineno,sn-basic]{sn-jnl}% Basic Springer Nature Reference Style/Chemistry Reference Style
%%======================================================%%
%% to compile with pdflatex/xelatex use pdflatex option %%
%%======================================================%%
%%\documentclass[pdflatex,sn-basic]{sn-jnl}% Basic Springer Nature Reference Style/Chemistry Reference Style
%%Note: the following reference styles support Namedate and Numbered referencing. By default the style follows the most common style. To switch between the options you can add or remove Numbered in the optional parenthesis.
%%The option is available for: sn-basic.bst, sn-vancouver.bst, sn-chicago.bst, sn-mathphys.bst. %
%%\documentclass[sn-nature]{sn-jnl}% Style for submissions to Nature Portfolio journals
%%\documentclass[sn-basic]{sn-jnl}% Basic Springer Nature Reference Style/Chemistry Reference Style
%\documentclass[sn-mathphys,Numbered]{sn-jnl}% Math and Physical Sciences Reference Style
%%\documentclass[sn-aps]{sn-jnl}% American Physical Society (APS) Reference Style
%%\documentclass[sn-vancouver,Numbered]{sn-jnl}% Vancouver Reference Style
%%\documentclass[sn-apa]{sn-jnl}% APA Reference Style
% \documentclass[draft,sn-chicago]{sn-jnl}% Chicago-based Humanities
\documentclass[sn-chicago]{sn-jnl}% Chicago-based Humanities
% Reference Style
%%\documentclass[default]{sn-jnl}% Default
%%\documentclass[default,iicol]{sn-jnl}% Default with double column layout
%%%% Standard Packages
%%<additional latex packages if required can be included here>
\usepackage{graphicx}%
\usepackage{multirow}%
\usepackage{amsmath,amssymb,amsfonts}%
\usepackage{amsthm}%
\usepackage{mathrsfs}%
\usepackage{xcolor}%
\usepackage{manyfoot}%
\usepackage{arydshln}
\usepackage{amsmath}
\DeclareMathOperator*{\argmax}{arg\,max}
\usepackage{hyperref}
\usepackage[normalem]{ulem}
\usepackage{booktabs}
\usepackage{subfig}
\usepackage{tabularray}
\makeatletter
\newcommand\uuuline{\bgroup\markoverwith%
{%
\textcolor{black}{\rule[-0.5ex]{2pt}{0.4pt}}%
\llap{\textcolor{red}{\rule[-0.9ex]{2pt}{0.4pt}}}%
\llap{\textcolor{darkgreen}{\rule[-1.3ex]{2pt}{0.4pt}}}%
}%
\ULon}
\makeatother
\makeatletter
\newcommand{\rAB}[2]{\bgroup \UL@setULdepth
\markoverwith{\lower\ULdepth\hbox
{\kern-.03em\vbox{\color{#1}\hrule width.2em\kern1.2\p@\color{#2}\hrule}\kern-.03em}}%
\ULon}
\makeatother
\definecolor{darkblue}{rgb}{0, 0, 0.5}
\definecolor{darkgreen}{rgb}{0, 0.5, 0}
\hypersetup{colorlinks=true,citecolor=darkblue, linkcolor=darkblue, urlcolor=darkblue}
\usepackage{relsize}
\newcommand{\DIRECT}[0]{{\smaller {\sf DIRECT}}}
\newcommand{\QUASI}[0]{{\smaller {\sf QUASI}}}
\newcommand{\NOMASK}[0]{{\smaller {\sf NO\_MASK}}}
\newcommand{\CODE}[0]{{\smaller {\sf CODE}}}
\newcommand{\DATETIME}[0]{{\smaller {\sf DATETIME}}}
\newcommand{\DEM}[0]{{\smaller {\sf DEM}}}
\newcommand{\LOC}[0]{{\smaller {\sf LOC}}}
\newcommand{\MISC}[0]{{\smaller {\sf MISC}}}
\newcommand{\ORG}[0]{{\smaller {\sf ORG}}}
\newcommand{\PERSON}[0]{{\smaller {\sf PERSON}}}
\newcommand{\QUANTITY}[0]{{\smaller {\sf QUANTITY}}}
\newcommand{\ENT}[1]{{\smaller {\sf #1}}}
\setlength{\dashlinedash}{0.4pt}
\setlength{\dashlinegap}{2.5pt}
\setlength{\arrayrulewidth}{0.1pt}
%%%%
%%%%%=============================================================================%%%%
%%%% Remarks: This template is provided to aid authors with the preparation
%%%% of original research articles intended for submission to journals published
%%%% by Springer Nature. The guidance has been prepared in partnership with
%%%% production teams to conform to Springer Nature technical requirements.
%%%% Editorial and presentation requirements differ among journal portfolios and
%%%% research disciplines. You may find sections in this template are irrelevant
%%%% to your work and are empowered to omit any such section if allowed by the
%%%% journal you intend to submit to. The submission guidelines and policies
%%%% of the journal take precedence. A detailed User Manual is available in the
%%%% template package for technical guidance.
%%%%%=============================================================================%%%%
%\jyear{2021}%
\newtheorem{example}{Example}%
\raggedbottom
%%\unnumbered% uncomment this for unnumbered level heads
\begin{document}
\title[Article Title]{Neural Text Sanitization with Privacy Risk Indicators: An Empirical Analysis}
%%=============================================================%%
%% Prefix -> \pfx{Dr}
%% GivenName -> \fnm{Joergen W.}
%% Particle -> \spfx{van der} -> surname prefix
%% FamilyName -> \sur{Ploeg}
%% Suffix -> \sfx{IV}
%% NatureName -> \tanm{Poet Laureate} -> Title after name
%% Degrees -> \dgr{MSc, PhD}
%% \author*[1,2]{\pfx{Dr} \fnm{Joergen W.} \spfx{van der} \sur{Ploeg} \sfx{IV} \tanm{Poet Laureate}
%% \dgr{MSc, PhD}}\email{iauthor@gmail.com}
%%=============================================================%%
\author*[1]{\fnm{Anthi} \sur{Papadopoulou}}\email{anthip@ifi.uio.no}
\author[2]{\fnm{Pierre} \sur{Lison}}\email{plison@nr.no}
\author[2]{\fnm{Mark} \sur{Anderson}}\email{anderson@nr.no}
\author[1]{\fnm{Lilja} \sur{\O{}vrelid}}\email{liljao@ifi.uio.no}
\author[2]{\fnm{Ildik\'{o}} \sur{Pil\'{a}n}}\email{pilan@nr.no}
\affil*[1]{\orgdiv{Language Technology Group}, \orgname{University of Oslo}, \orgaddress{\street{Gaustadalléen 23B}, \postcode{0373} \city{Oslo}, \country{Norway}}}
\affil[2]{\orgdiv{Norwegian Computing Center}, \orgaddress{\street{Gaustadalléen 23A}, \postcode{0373} \city{Oslo}, \country{Norway}}}
%%==================================%%
%% sample for unstructured abstract %%
%%==================================%%
\abstract{Text sanitization is the task of redacting a document to mask all occurrences of (direct or indirect) personal identifiers, with the goal of concealing the identity of the individual(s) referred in it. In this paper, we consider a two-step approach to text sanitization and provide a detailed analysis of its empirical performance on two recently published datasets: the Text Anonymization Benchmark \citep{benchmark} and a collection of Wikipedia biographies \citep{bootstrapping}. The text sanitization process starts with a privacy-oriented entity recognizer that seeks to determine the text spans expressing identifiable personal information. This privacy-oriented entity recognizer is trained by combining a standard named entity recognition model with a gazetteer populated by person-related terms extracted from Wikidata. The second step of the text sanitization process consists in assessing the privacy risk associated with each detected text span, either isolated or in combination with other text spans. We present five distinct indicators of the re-identification risk, respectively based on language model probabilities, text span classification, sequence labelling, perturbations, and web search. We provide a contrastive analysis of each privacy indicator and highlight their benefits and limitations, notably in relation to the available labeled data.}
\keywords{text sanitization, data privacy, knowledge graph extraction, sequence labelling, privacy risk, web search, privacy-enhancing NLP}
%%\pacs[JEL Classification]{D8, H51}
%%\pacs[MSC Classification]{35A01, 65L10, 65L12, 65L20, 65L70}
\maketitle
\section{Introduction}
\label{sec:intro}
The volume of text data available online is continuously increasing and constitutes an essential resource for the development of large language models (LLM). This trend has important privacy implications. Most text documents do, indeed, contain \textit{personally identifiable information} (PII) in one form or another -- that is, information that can directly or indirectly lead to the identification of a human individual. PII can be split in two main categories \citep{soton399692}:
\begin{description}
\item \textbf{Direct identifiers}, which are information that can directly and irrevocably identify an individual. This includes for example a person's name, passport number, email address, phone number, username or home address.
\item \textbf{Quasi identifiers}, also called \textit{indirect} identifiers, which are not \textit{per se} sufficient to single out an individual, but may do so when combined with other quasi-identifiers. Examples of quasi-identifiers include the person's nationality, occupation, gender, place of work or date of birth. A well-known illustration of the privacy risks posed by quasi-identifiers comes from \citet{golle2006} who showed that between 63\% to 78\% of the US population could be uniquely identified by merely combining their gender, date of birth and zip code. %Even though, thus, this kind of information can be shared among many individuals, only specific combinations of such information can pose a privacy risk.
\end{description}
Although some PII may be benign (if the text conveys e.g.~trivial or public information), it is far from always being the case. Documents such as court judgments, medical records or interactions with social services are often highly sensitive, and their disclosure may have catastrophic consequences for the individuals involved. Editing those documents to conceal the identity of those individuals is thus often desirable from both an ethical and legal perspective. This is precisely the goal of text sanitization \citep{chakaravarthy2008efficient,Sanchez2016,lison-etal-2021-anonymisation}.
In this paper, we present a two-step approach to the problem of text sanitization and provide a detailed analysis of its performance, based on two recently released datasets \citep{benchmark,bootstrapping}. The approach first seeks to detect text spans that convey personal information, using a neural sequence labelling model that combines named entity recognition (NER) with a gazetteer. The gazetteer is built by inferring from Wikidata a set of properties typically used to characterize human individuals, such as ``\textit{position held}" or ``\textit{manner of death}", and traversing the knowledge graph to extract all possible values for those properties. In the second step, the privacy risk of the detected text spans is assessed according to various indicators. Finally, the text spans that are deemed to constitute an unacceptable risk according to those indicators are masked. An overview of the approach is illustrated in Figure \ref{fig:overview}.
The paper makes the following four contributions:
\begin{enumerate}
\item A privacy-oriented entity recognizer making it possible to detect PII information beyond named entities, using large lists of person-related terms extracted from Wikidata, extending previous work by \citet{papadopoulou-etal-2022-neural}.
\item A quantitative and qualitative evaluation of the performance of this privacy-oriented entity recognizer for various types of PII.
\item The development of five privacy risk indicators, based on LLM probabilities, span classification, perturbations, sequence labelling and web search.
\item A comparative analysis of those privacy risk indicators, both in isolation and in combination, on the two aforementioned datasets.
\end{enumerate}
\begin{figure}[t]
\centering
\includegraphics[width = 0.95\textwidth]{figures/overall_figure.pdf}
\vspace{2mm}
\caption{Overview of the approaches presented and discussed in this paper. For a text document or a collection of text documents to sanitize, we first detect text spans expressing PII in the text. This can be done using a privacy-oriented entity recognizer. A set of five distinct privacy risk indicators can then be applied to assess whether the detected spans need to be masked. Finally, the text spans predicted to constitute a high re-identification risk are masked from the document.}
\label{fig:overview}
\end{figure}
The paper consists of the following sections. Section \ref{sec:bg} provides a general background on data privacy and text sanitization.
%We also describe in this section a set of evaluation metrics tailored to data sanitization that we adopt and use in this paper.
We then describe in Section \ref{sec:data} the two annotated datasets for text sanitization employed for the empirical analysis of this paper. In Section \ref{sec:er} we present, evaluate and discuss a privacy-oriented entity recognizer for the task of detecting PII in text documents. We present the set of five privacy risk indicators in Section \ref{sec:indicators}. The empirical performance of those indicators on the two datasets is then analysed in Section \ref{sec:eval}. We conclude in Section \ref{sec:conclusion}.
\section{Background}
\label{sec:bg}
\subsection{Definitions}
The right to privacy is a fundamental human right, as evidenced by its inclusion in the Universal Declaration of Human Rights and the European Convention on Human Rights. In the digital sphere, data privacy is enforced through multiple national and international regulations, such as the General Data Protection Regulation (GDPR) in Europe, the California Consumer Privacy Act (CCPA) in the United States or China's Personal Information Protection Law (PIPL). Although those regulations differ in both scope and interpretation, their common principle is that individuals should remain in control of their own data. In particular, the processing of personal data must have a legal ground, and cannot be shared to third parties without the explicit and informed consent of the person(s) the data refers to.
One alternative strategy is to \textit{anonymize} data to ensure the data is no longer personal, and therefore out of the scope of privacy regulations. Anonymization, according to the GDPR, refers to the complete and irrevocable removal of all information that may directly or indirectly lead to re-identification. However, as shown by \citet{weitzenboeck2022gdpr}, transforming the data to make it completely anonymous is almost impossible to achieve in practice for unstructured data such as text, unless the content of the text is radically altered or the original source of the document is deleted.
Although complete anonymization is hard to attain, text sanitization is a crucial tool to adhere with the general requirement of \textit{data minimization} which is enshrined in GDPR and most privacy regulations \citep{goldsteen2021data}. The principle of data minimization states that one should only collect and retain the personal data that is strictly necessary to fulfill a given purpose.
The process of editing text documents to conceal the identity of a person has a somewhat confusing terminology \citep{lison-etal-2021-anonymisation,benchmark}. The GDPR makes use of the term \textit{pseudonymization} to denote a process of transforming data to conceal at least some personal identifiers, but in a way that does not amount to complete anonymization. The term \textit{de-identification} is also common \citep{article,johnson2020deidentification}, especially for work on medical patient records. De-identification approaches are typically restricted to the recognition of predefined entities, such as the categories of \citet{HIPAA}. In contrast, we define \textit{text sanitization} as the process of detecting and masking \textit{any} type of personal information in a text document that can lead to identification of the individual whose identity we wish to protect.
Text sanitization is a topic of investigation in several research fields, notably in natural language processing (NLP) and in privacy-preserving data publishing (PPDP). Approaches to text rewriting based on differential privacy have also been proposed. We review below those approaches. % as well as the evaluation metrics that can be employed to assess their performance.
\subsection{NLP Approaches}
\label{ssec:nlp}
NLP approaches to text sanitization have mainly focused on sequence labelling approaches, inspired by the large body of work on Named Entity Recognition. Such approaches aim at the detection of text spans containing personal identifiers \citep{Chi:Nic:16,Lam:Bal:Sub:16}. Most research works in this field to date have focused on the medical domain, where the Health Insurance Portability and Accountability Act of 1996 \citep{HIPAA} offers concrete rules that allow for the standardization of this task. HIPAA defines a set of Protected Health Information (PHI) data types that encompass direct identifiers (such as names or social security numbers) as well as domain-specific demographic attributes including treatments received and health conditions. A wide variety of NLP methods have been developed for this task, including rule-based, machine learning-based and hybrid approaches \citep{sweeney1996replacing,neamatullah2008automated,YANG2015S30,Yog:May:Pfa:2018}.
Character-based recurrent neural networks \citep{dernoncourt2017identification,liu2017identification} and transformer architectures have also been investigated for this purpose \citep{johnson2020deidentification}. A recent initiative focused on replacing sensitive information is INCOGNITUS \citep{ribeiro-etal-2023-incognitus}, a clinical note de-identification tool. The system allows for redacting documents with either a NER-based method or with an embedding-based approach substituting all tokens with a semantically related one. Recent large language models from the GPT family have also been explored. \citet{liu2023deid} proposed DeID-GPT for masking PHI categories and showed that, with zero-shot in-context learning incorporating explicitly HIPAA requirements in the prompts, GPT-4 outperformed fine-tuned transformer models on the same annotated medical texts.
Text sanitization outside the medical domain includes approaches such as \citet{JUEZHERNANDEZ2023110540}, who propose AGORA, a document de-identification system combined with geoparsing (automatic location extraction from text) using LSTMs and CRFs and trained on Spanish law enforcement data. The authors focus on offering a complete pipeline and location information, while demographic attributes are not part of the information to de-identify. \citet{yermilov-etal-2023-privacy} compared three systems for detecting and pseudonymizing PII: (1) a NER-based one relying on Wikidata; (2) a single-step sequence-to-sequence model trained on a parallel corpus; and (3) a large language model where named entities are first detected using a 1-shot prompt to GPT-3 and then pseudonymized with 1-shot prompts using ChatGPT (GPT-3.5). The authors find that the NER-based approach is best for preserving privacy while LLMs best preserve utility for a text classification and summarization tasks. Finally, \citet{papadopoulou-etal-2022-neural} present an approach to text sanitization, from detection of personal information to privacy risk estimation through the use of language model probabilities, web queries, and a classifier trained on manually labeled data. The present paper builds upon this work.
\subsection{Privacy-Preserving Data Publishing}
\label{ssec:ppdp}
PPDP approaches to text sanitization rely on a privacy model specifying formal conditions that must be fullfilled to ensure the data can be shared without harm to the privacy of the registered individuals. The most prominent privacy model is $k$-anonymity \citep{Samarati98}, which requires that an individual/entity be indistinguishable from $k$ -1 other individuals/entities. This model was subsequently adapted to text data by approaches such as $k$- safety \citep{chakaravarthy2008efficient} and $k$-confusability \citep{Cumby2011AML}. %To meet this privacy model's requirements an individual/entity needs to be indistinguishable by $k$ -1 other individuals/entities, which are then generalized.
$t$-plausibility \citep{anandan} follows a similar approach, using already detected personal information and ensuring that those are sufficiently generalized to ensure that at least $t$ documents can be mapped to the edited text. \citet{Sanchez2016} present $C$-sanitized, which relies on an information-theoretic approach that computes the point-wise mutual information (using co-occurrence counts from web data) between the person or entity to protect and the terms of the document. Terms whose mutual information ends up above a given threshold are then masked.
$k$-anonymity was also employed in \citet{bootstrapping} in combination with NLP-based approaches, where based on an assumption of an attacker's knowledge, the optimal set of masking decisions was found to ensure $k$-anonymity.
Finally, \citet{10.1007/978-3-031-13945-1_12} provided an approach to the evaluation of disclosure risks that relies on training a text classifier to assess the difficulty of inferring the identity of the individual in question based on the sanitized text.
\subsection{Differential Privacy}
\label{ssec:dp}
Differential privacy (DP) is a framework for ensuring the privacy of individuals in datasets \citep{dwork}. It essentially operates by producing randomized responses to queries. The level of artificial noise introduced in each response is optimized such as to provide a guarantee that the amount of information that can be learned about any individual remains under a given threshold.
\citet{DBLP:conf/post/FernandesDM19} applied DP to text data, in combination with ML techniques by adding noise to the word embeddings of the model. Their work focused on removing stylistic cues from the text as a way to ensure that the author of the text could not be identified by it. \citet{feyisetan2019leveraging} also apply noise to word embeddings in a setting where the geolocation data of an individual is to be protected.
More recently, \citet{9415242} tried to address the issue of the noise needed for DP causing utility loss in the resulting text by creating duplicates first, and then adding noise, thus reducing the amount of noise needed. \citet{krishna2021adept} sought to address the same issue using an algorithm based on auto-encoders to transform text without losing data utility. Finally, \citet{igamberdiev2023dpbart} introduced DP-BART, a DP rewriting system based on pre-trained BART model, and which seeks to reduce the amount of artificial noise needed to reach a given privacy guarantee.
DP-oriented approaches generally lead to complete transformations of the text, at least for reasonable values of the privacy threshold. Those approaches are therefore well suited to the generation of synthetic texts, in particular to collect training data for machine learning models. However, they are difficult to apply to text sanitization, as most text sanitization problems are expected to retain the core content of the text and only edit out the personal identifiers. This is particularly the case for court judgments and medical records, as the sanitized documents should not alter the wording and semantic content conveyed in the text.
\section{Datasets}
\label{sec:data}
There only exists a few generic (non-medical) datasets that are devoted to the evaluation of text sanitization approaches. We present below the two datasets used for training, evaluation and error analysis throughout this paper.
%This type of evaluation requires a collection of texts, one or more individuals whose identity should be concealed, and a number of annotated text spans containing PII. %The masking decisions will depend on how risky the personal identifier expressed in each text is in combination with the rest of the information in the text.
%: the Text Anonymization Benchmark (TAB) \citep{benchmark} (Section \ref{ssec:tab}) and a collection of manually annotated Wikipedia summaries \citep{bootstrapping} (Section \ref{ssec:wiki}). The TAB dataset belongs to the legal domain and Wikipedia data is a more generic dataset taken from Wikipedia biographies, both containing different types of PII spans.
\subsection{Text Anonymization Benchmark (TAB)}
\label{ssec:tab}
The TAB corpus \citep{benchmark} is a collection of 1268 European Court of Human Rights (ECHR) court cases, manually annotated to protect the identity of the individual mentioned in the text. These court cases are documents rich in PII that are also freely available to use. The documents are in English and each court case is annotated, among others, with an individual to be protected as well as with detected PII spans containing the following information:
\begin{itemize}
\item The span's semantic type, according to the 8 categories established in \citet{benchmark}, described in Table \ref{tbl:categories}.
\item Whether that span needs to be masked in order to protect the privacy of the specified individual, with three possible values: \ENT{DIRECT}, \ENT{QUASI}, or \ENT{NO\_MASK}.
\item Whether the span is a confidential attribute of the individual, such as religious or philosophical beliefs, political opinions, sexual orientation or sex life, racial or ethnic origin, and health, genetic and biometric data.
\item Co-reference links between relevant spans that refer to the same entity.
\end{itemize}
\raggedbottom
\begin{table}[t]
\centering
\caption{\label{tbl:categories} Semantic type along with explanations and selected examples}
\begin{tabular}{lp{58mm}p{42mm}}
\textbf{Category} & \textbf{Explanation} & \textbf{Examples}\\
\toprule
\textbf{CODE} & Identification codes and numbers: flight numbers, phone numbers, license plates, etc. & 3086/23, LH3042, 11/14E.2\\
\textbf{ORG} & Names of organizations, such as companies, schools, hospitals, administrations, etc. & Budapest Police Department, Ministry of Justice\\
\textbf{DATETIME} & Description of a specific date, period, time, or duration. & 23 November 2006, 7, 12 and 5 months\\
\textbf{LOC} & Places and locations, such as cities, geographical areas, countries or addresses. & Austria, Martin County, Belfast\\
\textbf{QUANTITY} & Description of a quantity, including percentages or monetary values. & 6,932 Ukrainian hryvnyas, two\\
\textbf{PERSON} & Names of people, including nicknames/aliases, usernames, and initials.& Joe Smith, The Rock, YiDA\\
\textbf{DEM} & Demographic attributes of a person, such as nationality, occupation, or education & artist, Italian, MSc in Astrophysics\\
\textbf{MISC} & Every other type of personal information associated to an individual and that does not belong to the categories above. & former patient, high speed car chase, imprisonment\\
\end{tabular}
\end{table}
%This categorization is an extension of the NER types of information which, on their own, do not cover all possible types of spans that might refer to an individual. A \ENT{PERSON} or \ENT{CODE} PII piece of information is, thus, potentially riskier than a date (\ENT{DATETIME}) or someone's occupation (\ENT{DEM}), since those are typically \ENT{QUASI} identifiers that can be shared by many individuals.
Example \ref{tab_detect_mask} illustrates a short excerpt where spans underlined in \textit{black} were marked by the annotators, and those underlined in \textit{dark green} were categorized by the annotator as denoting a direct or quasi-identifier to mask.
\bigskip
\begin{example}
The case originated in an application (no. \rAB{black}{darkgreen}{44521/04}) against the \rAB{black}{white}{Republic of Poland} lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a \rAB{black}{white}{Polish} national, \rAB{black}{darkgreen}{Mr Leszek Kołodziński} (“the applicant”), on \rAB{black}{white}{19 August 2004}.
\label{tab_detect_mask}
\end{example}
\bigskip
%Here the annotator decide to mask only the name of the individual and the court case, since these are highly specific spans that can directly identify an individual. The rest of the information is left in the text as it is not deemed risky by the annotator as general enough.
The documents are, on average, 1,442 tokens long. The majority of the tokens are labeled as \ENT{QUASI} identifiers (63\%), with fewer tokens being masked as \ENT{DIRECT} identifiers (4.4\%) and the rest of the annotated text spans being left unmasked by the annotators. The majority of the identifiers belonged to the \ENT{DATETIME}, \ENT{ORG}, and \ENT{PERSON} categories which is in line with the domain of the texts.
Some of the court cases (274) were also multi-annotated to allow for evaluation against different solutions since the task is subjective in nature. The inter-annotator agreement on the identifier type (\ENT{DIRECT}, \ENT{QUASI}, \ENT{NO-MASK}), calculated both on the span ($k$ = 0.46) and character level ($k$ = 0.79), shows moderate agreement which is to be expected from a task where multiple correct solutions can exist. We follow the training, development, and test split the authors release with 1,014, 127 and 127 documents respectively.
\subsection{Wikipedia Biographies}
\label{ssec:wiki}
\citet{bootstrapping} released a collection of 553 Wikipedia biographies manually annotated for text anonymization. The annotation task was similar to that of the TAB corpus, except for the absence of annotation for confidential attributes, which was not relevant for this dataset.
% mentioned in Section \ref{ssec:tab} and the annotators were familiar with the task since they had previously worked on the annotation effort for the TAB corpus.
%Each span in the annotated dataset includes the same information apart from whether the span is a confidential attribute, which was not relevant for this dataset.
%Wikipedia articles are good candidates for the task of text sanitization since they are publicly available, rich in PII and are documents where the majority of the information is related to a single individual, with less information concerning secondary individuals.
%In this sense they approximate other texts like patient records or customer service conversations where one would also expect most of the PII to be about the individual in question.
Example \ref{wiki_detect_span} shows a manually annotated text, both for detected PII spans (underlined in \textit{black}), and also for masking decision (underlined in \textit{dark green}).
%As in TAB, we note that not all PII spans were considered risky by the annotator, and thus, left as is in the text.
%We see, however, in this text how more spans seem to be masked than not, compared to Example \ref{tab_detect_mask}.
\bigskip
\begin{example}
\rAB{black}{darkgreen}{David Sherwood} is a \rAB{black}{white}{British} \rAB{black}{darkgreen}{tennis coach} and retired \rAB{black}{white}{tennis player}. In his only live \rAB{black}{darkgreen}{Davis Cup match}, \rAB{black}{darkgreen}{Sherwood} played doubles with \rAB{black}{darkgreen}{Andy Murray} beating the \rAB{black}{darkgreen}{Israeli} World No 4 doubles team of \rAB{black}{darkgreen}{Jonathan Erlich} and \rAB{black}{darkgreen}{Andy Ram}.
\label{wiki_detect_span}
\end{example}
\bigskip
The documents in this dataset are much shorter than those in the TAB corpus. A large majority of the PII spans were marked by the annotators as \ENT{QUASI} identifiers to be masked (56\%) or \ENT{DIRECT} identifiers (14\%), while 30\% of the spans were left as is in the text without needing to be masked, as they were deemed less specific by the annotators and thus, less risky. Most of the identifiers in this dataset belong to the \ENT{DATETIME}, \ENT{ORG}, and \ENT{PERSON} semantic types. %, which is in line with the type of documents and the information one would expect in a Wikipedia article (e.g. names, dates of birth or death, occupation or education institutions etc.)
Of the 553 documents, 22 were also doubly-annotated to account for multiple correct solutions for this task. Cohen’s $k$ calculated both in the span ($k$ = 0.44) and the character level ($k$ = 0.81) on the masking decision showed moderate agreement, highlighting the subjective nature of the task. We follow the split proposed in \citet{olstad-etal-2023-generation}, which includes all the double-annotated documents in the test set (100 documents), while 453 documents are available for training purposes.
\section{Privacy-oriented Entity Recognizer}
\label{sec:er}
Identifying PII spans is the first step in text sanitization. Although many methods rely on some variant of NER, they fail to detect PII spans that are not named entities but are nevertheless (quasi-)identifying.
We detail here our approach to detecting text spans expressing personal information. The approach uses \textit{knowledge graphs} such as Wikidata to create \textit{gazetteers} for specific PII types. Those gazetteers are then combined with a NER model to create a domain-specific silver corpus, which is in turn employed to fine-tune a neural sequence labelling model. This approach to developing a ``privacy-oriented entity recognizer" builds upon earlier work by \citet{papadopoulou-etal-2022-neural}, and provides additional details on various aspects of the gazetteer construction process, model training and empirical evaluation.
% How the work differs from previous work
%As we mentioned, this paper is based on our previous work in \citet{papadopoulou-etal-2022-neural}. We here expand on that work in several important ways. More specifically, we provide a more detailed explanation of the process we followed in using Wikidata as a source of PII and also supplementing it with a the list properties included in two tables in the Appendix. Apart from more detailed information on the training of the model and the silver corpus used, we also perform a different evaluation of the model's performance and supplement this choice of evaluation with an detailed error analysis and examples. Finally, we focus on an analysis of the cases of PII that do not fit into previously formulated semantic categories, with the goal of contributing to a better understanding of what exactly can be considered PII as well as informing future text sanitization annotation and model training efforts.
\subsection{Wikidata Properties}
\label{sec:properties}
NER models are, as the term indicates, focused on named entities. However, many instances of the \ENT{DEM} and \ENT{MISC}\footnote{It should be noted that the \ENT{MISC} category employed in this paper does not equate to the \ENT{MISC} category from CoNLL-2003 shared task \citep{tjong-kim-sang-de-meulder-2003-introduction}, which is characterized as a named entity (denoted with a proper name) that is neither a person, organization or place.} categories described in the previous section are not named entities. Examples include someone's occupation, educational background, part of their physical appearance, the manner of their death or an object that is tied to their identity.
We extract a list of possible values for these two PII categories based on knowledge graphs. In particular, Wikidata\footnote{\url{https://www.wikidata.org}} is a structured knowledge graph containing information in property-value pairs, with a large number of values being adjectives, nouns, or noun phrases. We operated by retrieving all instances of humans from the Wikidata dump file,
%\footnote{See \url{https://dumps.wikimedia.org/wikidatawiki/entities/}. Dump file downloaded on Feb. 2022.}
and inspecting Wikidata properties\footnote{\url{https://www.wikidata.org/wiki/Wikidata:Database_reports/List_of_properties/all}} to select those that seems to express either \ENT{DEM} or \ENT{MISC} PII based on their description and their examples.
%There are NER models that can identify some of the types that express PII. For example, one of Standford NER model's \citep{manning-etal-2014-stanford} which was trained on data from the CoNLL-2003 shared task \citep{tjong-kim-sang-de-meulder-2003-introduction} can detect four types of named entities, namely \ENT{PERSON}, \ENT{ORG}, \ENT{LOC} as well as \ENT{MISC}. In this case \ENT{MISC} is used to refer to anything that does not belong to the first three categories, and is thus, a rather large and undefined category. Some other models consist of label schemes that include \textit{some} named entities that could belong to a \ENT{MISC} category (e.g. \ENT{WORK-OF-ART} or \ENT{PRODUCT} in most of spaCy's\footnote{\url{https://spacy.io/}} NER components).
%Even though, thus, some of these categories can also be detected by regular NER models, the combination of all the types mentioned in Table \ref{tbl:categories} falls outside of most of these models' scope. For this reason in \citet{papadopoulou-etal-2022-neural} we briefly presented how we combined a generic NER system along with specific Wikidata properties that expressed \ENT{DEM} and \ENT{MISC} PII and trained a \textit{privacy-oriented entity recognizer} which is able to detect all 8 of these categories.
% \begin{figure}[t]
% \centering
% \includegraphics[width = 0.95\textwidth]{figures/wikidata_example.png}
% \caption{Example of the \textit{statements section} of a Wikidata page about \textit{Bruce Springsteen (Q1225)}. The properties \textit{occupation} and \textit{field of work} denote \ENT{DEM} and \ENT{MISC} PII respectively, as also seen by their values, e.g. \textit{pianist}, and \textit{folk music}.}
% \label{fig:wikidata_example}
% \end{figure}
After filtering, we end up with 44 \ENT{DEM} properties and 196 \ENT{MISC} properties. Selected examples of each semantic type are shown Table \ref{tbl:example_props}, while a detailed table can be found in Appendix \ref{human_properties}. Some properties were left out due to the high level of false positives they might have introduced if included (e.g. \textit{blood type (P1853)}) or because they mostly contained named entities that would already be detected by a generic NER model.
We then use these properties to traverse the Wikidata instances and save all values into two gazetteers, one for \ENT{DEM} entities\footnote{We also manually add country names and nationalities into the \ENT{DEM} gazetteer to account for cases when the NER failed to detect those and the gazetteer lacked this information.} and one for \ENT{MISC} entities.
\begin{table}[t]
\caption{\label{tbl:example_props} Selected examples of Wikidata properties of type \ENT{DEM} or \ENT{MISC}.}
\begin{tabular}{*4l}
\textbf{Property} & \textbf{ID} & \textbf{Examples} & \textbf{Type}\\
\toprule
hairstyle/hairlength & P8839 & baldness, comb over, curls & DEM \\
religion or worldview & P140 & agnosticism, occultism, free-thought & DEM \\
sex or gender & P21 & agender, queer, non-binary & DEM \\
position held & P39 & U.S. senator, Mayor of Lopigna, chief physician & DEM \\
\midrule
vessel & P1876 & Soyuz-TMA, galley, ferry ship & MISC \\
convicted of & P1399 & forgery, harassment, conspiracy to murder & MISC \\
manner of death & P1196 & capital punishment, disease, matricide & MISC \\
genre & P136 & metalcore, war film, icelandic hip hop & MISC \\
\end{tabular}
\end{table}
\subsection{Silver Corpus and Model Fine-tuning}
\label{sec:corpus}
A silver corpus of 5000 documents is then compiled, consisting in our experiments with the datasets of Section \ref{sec:data} of 2500 European Court of Human Rights cases and 2500 Wikipedia summaries \citep{lebret2016neural}. To automatically label the documents, we first run a generic NER model\footnote{We used here a RoBERTa model fine-tuned on the Ontonotes v5 corpus using \href{https://spacy.io/}{spaCy}'s implementation.} to detect named entities. We then apply the two \ENT{DEM} and \ENT{MISC} gazetteers and tag each match with their respective label. In case of overlap, we keep the longest span, e.g. keep ``Bachelor in Computer Science" instead of ``Bachelor" and ``Computer Science" as two separate spans.
We then employ this silver corpus to fine-tune a RoBERTa \citep{DBLP:journals/corr/abs-1907-11692} model, thus creating a \textit{privacy-oriented entity recognizer}. Detailed training parameters can be found in Table \ref{tbl:Params} in Appendix \ref{parameters}.
\subsection{Evaluation}
\label{ssec:er_results}
The evaluation results of the privacy-oriented entity recognizer are shown in Table \ref{tbl:perf1}. The total precision, recall and $F_1$ scores are provided in two versions: one where we take label types into account and one where we do not. In the latter case, we thus only consider whether the token was marked as PII or not\footnote{This differs from an earlier evaluation in \citet{papadopoulou-etal-2022-neural} where only a subset of labels such as \ENT{ORG} and \ENT{LOC} or \ENT{MISC} and \ENT{QUANTITY} were considered interchangeable.}. The evaluation is conducted on the test sets of the TAB corpus and the Wikipedia collection of biographies. As the documents from those test sets were annotated by several annotators, the results are calculated using a micro-average over all annotators.
% \begin{table}[t!]
% \centering
% \caption{\label{tbl:perf1} Token-level precision (\textit{P}), recall (\textit{R}) and $F_1$ score calculated per semantic type for the test set of the TAB corpus, as well as the test set of the annotated Wikipedia dataset. We also report overall (micro-averaged) performance scores in two settings: one where we require exact matches on the predicted label, and one where we only distinguish between PII-tokens and non-PII-tokens (thus conflating all PII types into one).}
% \begin{tabular}{lcc|cc|cc }
% \toprule
% & \multicolumn{2}{c|}{\textbf{P}} & \multicolumn{2}{c|}{\textbf{R}} & \multicolumn{2}{c}{\textbf{$F_1$}} \\
% & \textbf{ Wiki } & \textbf{TAB} & \textbf{Wiki} & \textbf{TAB} & \textbf{Wiki} & \textbf{ TAB } \\
% \midrule
% \ENT{\textbf{CODE}} & \textit{n/a} & 0.98 & \textit{n/a} & 0.95 & \textit{ n/a} & 0.97 \\
% \ENT{\textbf{PERSON}} & 0.97 & 0.98 & 0.88 & 0.94 & 0.92 & 0.96 \\
% \ENT{\textbf{ORG}} & 0.86 & 0.75 & 0.79 & 0.81 & 0.82 & 0.78 \\
% \ENT{\textbf{LOC}} & 0.86 & 0.51 & 0.79 & 0.80 & 0.82 & 0.62 \\
% \ENT{\textbf{QUANTITY}} & 0.49 & 0.39 & 0.83 & 0.82 & 0.62 & 0.53 \\
% \ENT{\textbf{DATETIME}} & 0.84 & 0.92 & 0.96 & 0.99 & 0.90 & 0.95 \\
% \ENT{\textbf{DEM}} & 0.56 & 0.10 & 0.84 & 0.47 & 0.67 & 0.16 \\
% \ENT{\textbf{MISC}} & 0.52 & 0.03 & 0.61 & 0.23 & 0.56 & 0.06 \\
% \midrule
% \midrule
% \textbf{Micro-avg. w/ label match} & 0.72 & 0.57 & 0.81 & 0.84 & 0.76 & 0.68 \\
% \textbf{Micro-avg. w/o label match} & 0.83 & 0.63 & 0.92 & 0.93 & 0.87 & 0.75 \\
% \end{tabular}
% \end{table}
\begin{table}[t!]
\centering
\caption{\label{tbl:perf1} Token-level precision (\textit{P}), recall (\textit{R}) and $F_1$ score per semantic type on the test sets of the Wikipedia biographies and TAB corpus. We also report micro-averaged performance scores under two conditions: one where we require exact matches on the predicted label, and one where we only distinguish between PII-tokens and non-PII-tokens (thus conflating all PII types into one group).}
\begin{tabular}{lp{10mm}p{10mm}p{10mm}|p{10mm}p{10mm}p{10mm}}
\toprule
& \multicolumn{3}{c|}{\textbf{Wikipedia}} & \multicolumn{3}{c}{\textbf{TAB}} \\
& \textbf{ P } & \textbf{R} & \textbf{$F_1$} & \textbf{ P } & \textbf{R} & \textbf{$F_1$} \\
\midrule
\ENT{\textbf{CODE}} & \textit{n/a} & \textit{n/a} & \textit{ n/a} & 0.98 & 0.95 & 0.97 \\
\ENT{\textbf{PERSON}} & 0.97 & 0.88 & 0.92 & 0.98 & 0.94 & 0.96 \\
\ENT{\textbf{ORG}} & 0.86 & 0.79 & 0.82 & 0.75 & 0.81 & 0.78 \\
\ENT{\textbf{LOC}} & 0.86 & 0.79 & 0.82 & 0.51 & 0.80 & 0.62 \\
\ENT{\textbf{QUANTITY}} & 0.49 & 0.83 & 0.62 & 0.39 & 0.82 & 0.53 \\
\ENT{\textbf{DATETIME}} & 0.84 & 0.96 & 0.90 & 0.92 & 0.99 & 0.95 \\
\ENT{\textbf{DEM}} & 0.56 & 0.84 & 0.67 & 0.10 & 0.47 & 0.16 \\
\ENT{\textbf{MISC}} & 0.52 & 0.61 & 0.56 & 0.03 & 0.23 & 0.06 \\
\midrule
\midrule
\textbf{Micro-avg. w/ label match} & 0.72 & 0.81 & 0.76 & 0.57 & 0.84 & 0.68 \\
\textbf{Micro-avg. w/o label match} & 0.83 & 0.92 & 0.87 & 0.63 & 0.93 & 0.75 \\
\end{tabular}
\end{table}
We notice a clear difference between the performance with and without label match. This indicates a label disagreement between the model and the gold annotations, in particular for categories such as \ENT{ORG} and \ENT{LOC}. This does not, however, affect the detection of the text spans themselves. We also observe that the model performs better for the Wikipedia biographies than TAB corpus, indicating that the PII in Wikipedia are easier to detect than in TAB. %The low precision score for TAB split also reveal a relatively high number of false positives. %We also note a slightly bigger difference in scores for the annotated Wikipedia dataset split when we don't take labels into account during evaluation, than we do in the TAB split.
% SEMANTIC TYPE SPECIFIC
%Even though the overall evaluation scores are indicative of the model's performance, factoring the scores by each semantic type gives us even more information on the behavior of the model for different labels. Based on the results presented in Table \ref{tbl:perf1} we also conclude that the performance of the ER model, apart from dataset specific, is also semantic type dependent as well.
Breaking down the results based on semantic type, we observe that \ENT{CODE}, \ENT{PERSON}, \ENT{ORG}, and \ENT{DATETIME} seem to consistently exhibit strong results on the two datasets. This is likely due to those categories being easier to circumscribe and recognize from surface cues. In contrast, \ENT{DEM} and \ENT{MISC}, as well as \ENT{QUANTITY} are harder to detect, as those encompass a larger set of possible spans, include many which are not named entities.
%Regarding the \ENT{DEM} and \ENT{MISC} semantic types, we note that the performance for the annotated Wikipedia dataset is significantly higher than that for the latter. This is to be expected since Wikipedia and Wikidata are highly related to one another, meaning that the type of (personal) information found in Wikidata is more likely to be present in a Wikipedia article, than in an ECHR court case. Even though the annotation guidelines for the two datasets were very similar, the type of spans one can encounter in these two datasets are different.
In the annotated collection of Wikipedia biographies, \ENT{DEM} spans are maximum 9 tokens long, with an average of 1.3 tokens, while for \ENT{MISC} the maximum number of tokens is 42, with an average of 2.3 tokens. For TAB, the maximum number of tokens is much higher. For \ENT{DEM} it is 24, while for \ENT{MISC} it is 785 (a long transcript), with an average of 1.6 and 4 respectively. On the silver corpus, the label outputs from the model for \ENT{DEM} and \ENT{MISC} are at maximum 11 and 26 tokens respectively, while on average they are 1.1 tokens long, being much closer to Wikipedia standards than TAB ones.
% NOTE FROM ANTHI: The following Table (how the spans found in Wikidata are more similar to those found in Wikipedia than TAB) is also expressed in-text, so I commented this out, after Pierre's comments ------>
% Table \ref{tbl:examples_dem_misc} provides some examples of both semantic types for all three datasets.
% \begin{table}[t]
% \centering
% \caption{\label{tbl:examples_dem_misc} Examples of \ENT{DEM} and \ENT{MISC} spans found in the annotated Wikipedia biographies, the TAB corpus and the silver corpus used for training the ER model.}
% \begin{tabular}{*3l}
% \textbf{Dataset} & \textbf{Span} & \textbf{Type} \\
% \toprule
% Wikipedia & goalkeeper & \ENT{DEM} \\
% Wikipedia & luxury bus services & \ENT{MISC} \\
% \midrule
% TAB & chronic neurological pain & \ENT{DEM}\\
% TAB & a colourless gas, soluble in water, with a characteristic rotten-egg smell & \ENT{MISC}\\
% \midrule
% Silver corpus & assistant manager & \ENT{DEM}\\
% Silver corpus & statute of limitations & \ENT{MISC}\\
% \midrule
% \end{tabular}
% \end{table}
% \begin{table}[t]
% \centering
% \caption{\label{tbl:perf1} Token-level precision (\textit{P}), recall (\textit{R}) and $F_1$ \textit{(F1)} score calculated per semantic type for the test set of the TAB corpus, as well as the test set of the annotated Wikipedia dataset. We also report overall performance scores, with and without labels.}
% \begin{tabular}{lcc|cc|cc }
% \toprule
% & \multicolumn{2}{c|}{\textbf{P}} & \multicolumn{2}{c|}{\textbf{R}} & \multicolumn{2}{c}{\textbf{F1}} \\
% & \textbf{ Wiki } & \textbf{TAB} & \textbf{Wiki} & \textbf{TAB} & \textbf{Wiki} & \textbf{ TAB } \\
% \midrule
% \ENT{\textbf{CODE}} & \textit{n/a} & 0.983 & \textit{n/a} & 0.952 & \textit{ n/a} & 0.967 \\
% \ENT{\textbf{PERSON}} & 0.967 & 0.980 & 0.877 & 0.940 & 0.920 & 0.959 \\
% \ENT{\textbf{ORG}} & 0.856 & 0.747 & 0.791 & 0.811 & 0.822 & 0.777 \\
% \ENT{\textbf{LOC}} & 0.855 & 0.506 & 0.791 & 0.797 & 0.822 & 0.619 \\
% \ENT{\textbf{QUANTITY}} & 0.494 & 0.392 & 0.826 & 0.824 & 0.618 & 0.531 \\
% \ENT{\textbf{DATETIME}} & 0.840 & 0.916 & 0.963 & 0.992 & 0.897 & 0.952 \\
% \ENT{\textbf{DEM}} & 0.560 & 0.098 & 0.840 & 0.471 & 0.672 & 0.162 \\
% \ENT{\textbf{MISC}} & 0.524 & 0.034 & 0.609 & 0.229 & 0.563 & 0.059 \\
% \midrule
% \midrule
% \textbf{Micro-average w labels} & 0.723 & 0.570 & 0.807 & 0.844 & 0.763 & 0.680 \\
% \textbf{Micro-average w/o labels} & 0.827 & 0.627 & 0.924 & 0.934 & 0.873 & 0.750 \\
% \end{tabular}
% \end{table}
%It is clear that the spans present in the silver corpus are much more similar to those found in the annotated Wikipedia dataset. A model trained on such data is, thus, bound to perform better when similar spans are present in the text. In the following sections we analyze the performance of the model in greater detail, providing explanations and examples for this behavior.
\subsubsection*{Examples}
We provide below two examples of text spans from the two corpora, comparing PII spans annotated by a human annotator (\textit{black} line) with the ones detected the generic NER model (\textit{red} line) and the privacy-oriented entity recognizer (\textit{dark green} line).
\bigskip
\begin{example}
\uuuline{Percy Parke Lewis} \uuuline{(1885-1962)} was an \uuuline{American} \rAB{black}{darkgreen}{architect}.
\label{example_er}
\end{example}
\bigskip
In the above example, the privacy-oriented recognizer detected the demographic attribute \textit{architect}, in line with the human annotation, while it was ignored from the standard NER model.
\bigskip
\begin{example}
On \uuuline{1 December 2005} the applicant was arrested and remanded in custody. In \uuuline{2006} he was convicted of \rAB{red}{darkgreen}{three} counts of \rAB{darkgreen}{white}{battery} and \rAB{darkgreen}{white}{robbery} and received \rAB{darkgreen}{white}{prison} sentences ranging \uuuline{from two to four years}.
\label{tab_er}
\end{example}
\bigskip
We observe in the above example that the privacy-oriented entity recognizer also labeled \textit{battery} and \textit{robbery} as reasons of conviction (\ENT{MISC}) as well as \textit{prison} (\ENT{MISC}).
%Most of the noise located during manual inspection was due to errors or ambiguities in the original Wikidata pages. For example, we discovered person names instead of dates in dynasty eras related properties, as well as works of art or \ENT{MISC} related occupation words instead of occupation titles in \ENT{DEM} properties like \textit{occupation} (e.g. "goalkeeping" instead of "goalkeeper"). These types of errors are difficult to correct systematically and we, thus, expect thus this issue to potentially be present in the trained model's detection as well.
\subsection{Label Disagreement}
\label{ssec:ld}
As mentioned in Section \ref{sec:corpus}, Wikidata properties were used to annotate entity types in the text to train the entity-recognition model. Wikidata pages are either generated when a corresponding Wikipedia article is created or they are set up manually by human editors. Both of these make Wikidata pages prone to possible inaccuracies, something we encountered while performing an error analysis on the output of the model when applied to the datasets.
Two cases can be distinguished when there is disagreement between the expert annotations and the model outputs: either (1) both system and gold labels can be considered correct or (2) the system made an error, either as a false positive or false negative. We discuss below some of those disagreements.
The pair \ENT{LOC} and \ENT{ORG} are often confused with one another, which is an error commonly found in many NER systems as well. In Example \ref{gurajat} below, the underlined word was labeled as a \ENT{LOC} by the annotator but the predicted label was \ENT{ORG}.
\bigskip
\begin{example}
\textit{"... in the Government of \underline{Gujarat"}.}
\label{gurajat}
\end{example}
\bigskip
The \ENT{QUANTITY}-\ENT{MISC} and \ENT{MISC}-\ENT{DEM} label pairs are also often confused:
\bigskip
\begin{example}
\textit{"... and sentenced to \underline{life imprisonment}."}
\label{imprisonment}
\end{example}
\bigskip
\begin{example}
\textit{"Quinn \underline{co-founded} Crash Override."}
\label{override}
\end{example}
\bigskip
\begin{example}
\textit{"... was suffering from \underline{depression and memory loss} ..."}
\label{depression}
\end{example}
%\bigskip
%\begin{example}
% \textit{"... \underline{1st}, \underline{2nd}, \underline{3rd}, \underline{4th}, \underline{5th}, \underline{6th} and \underline{7th} parliaments ..."}
%\label{parliaments}
%\end{example}
\bigskip
In Example \ref{imprisonment}, the underlined span was labeled as \ENT{QUANTITY} by the annotator, potentially interpreting the span as a time duration. The entity recognizer, on the other hand, labeled the same span as \ENT{MISC} due to properties such as \textit{penalty} or \textit{cause of death} that were used to form the \ENT{MISC} gazetteer.
%In Example \ref{parliaments}, the gold label assigned by the annotators was \ENT{MISC} for the entire span, while the model predicted the individual spans as \ENT{QUANTITY}.
Similarly, in Examples \ref{override} and \ref{depression}, the human annotators decided to mark these spans as \ENT{DEM}, viewing job titles and diagnosis are demographic attributes. The entity recognizer detected both spans and labeled them as \ENT{MISC}, since, medical related properties or \textit{cause of death} and properties containing job related words that are not nouns were used for the \ENT{MISC} gazetteer.
% \bigskip
% \begin{example}
% \textit{"... lost his seat at the 2011 \underline{general election} ..."}
% \label{election}
% \end{example}
% \bigskip
% In Example \ref{election}, we see that the annotator labeled the span as a \ENT{MISC} span, but the ER detected it as a demographic attribute. The word "election" is part of spans in both in the \ENT{DEM} and the \ENT{MISC} gazetteers, due to Wikidata properties accepting similar values (e.g. \textit{"position held"} - \ENT{DEM} and \textit{"end cause"} - MISC). We see, thus, that in the large majority of the cases where these two labels were confused both could be considered acceptable.
%We also note instances where the predicted label was wrong when compared against the gold one. In Example \ref{competition} below, the span was detected by the entity recognizer as a \ENT{QUANTITY} while the gold label was \ENT{MISC}.
%\bigskip
%\begin{example}
% \textit{"... of the prestigious \underline{14th Annual USA Songwriting Competition}."}
%\label{competition}
%\end{example}
%\bigskip
%\bigskip
%\begin{example}
% \textit{"... the 18th \underline{Party Congress} in 2012 ..."}
%\label{congress_2012}
%\end{example}
%\bigskip
%In Example \ref{congress_2012}, \textit{"Party Congress"} was again wrongly detected as a \ENT{QUANTITY}, with the correct label being \ENT{ORG}.
%Detecting all possible PII is an most important first step in any text sanitization approach. It is, of course, also important to have a correct label assigned to the entity, but it is often the case that personal information cannot be easily grouped into pre-defined categories, or that they could belong to multiple ones depending on the interpretation of what that particular semantic type can entail. Allowing for some interchangeability does not hinder the subsequent privacy risk estimation.
Figure \ref{fig:label_graph} in Appendix \ref{label_confusion} shows a detailed breakdown of all pairs of label disagreements, common between the two datasets. The \ENT{MISC} semantic type is often found in many cases of label disagreements. In the following section we make an effort to analyze this semantic type in more detail.
\subsection{MISC Semantic Type}
%The performance of the model on the \ENT{MISC} semantic type was the lowest for all datasets consistently, as shown in Table \ref{tbl:perf1}. As discussed above, the \ENT{MISC} PII detected by the privacy-oriented ER does not clearly match that detected by the human annotators. Being, thus, able to break down this category and find subcategories that belong to it is an important step in recognizing and being able to better model the detection of such a category.
%Both annotation tasks followed similar guidelines where \ENT{MISC} was to be assigned to \textit{"any other type of information that describes an individual and that does not belong to the categories above"}. The two datasets, being from different domains show some similarities in what is considered a \ENT{MISC} span, but they also present many differences.
The \ENT{MISC} category was defined in Section \ref{sec:data} as a type of personal information that cannot be assigned to any of the other categories, namely \PERSON{}, \ORG{}, \LOC{}, \CODE{}, \DATETIME{}, \QUANTITY{} or \DEM{}. We conducted a qualitative analysis of this category in both the TAB corpus and the collection of Wikipedia biographies to better understand the coverage of this PII type.
We found that most \MISC{} spans could be mapped to the following 6 sub-categories:
\begin{itemize}
\item[] \ENT{EVENTS}: four-man, mixed doubles, Second World War
\item[] \ENT{QUOTES}: ``the need for further exploration of your insight into, and responsibility for, the index offence and the apparent lack of empathy towards the victim"
\item[] \ENT{HEALTH}: bullet entry hole on the face, multiple sclerosis, blood poisoning
\item[] \ENT{WORKS OF ART}: (\textit{only in Wikipedia}) Star Trek: The Original Series, The Book and the Brotherhood
\item[] \ENT{OFFENSES}: (\textit{only in TAB}) tax asset stripping, seriously injured, a charge of attempted murder
\item[] \ENT{LAWS}: (\textit{only in TAB}) sections 1 and 15 of the Theft Act 1968, Article 125 of the Criminal Code, 19 § 4
\end{itemize}
Some of those categories are quite general and can be found in a large number of text domains, such as \ENT{EVENTS} or \ENT{HEALTH}. Others are specific to a text domain, such as \ENT{OFFENSES}, which are most likely to be observed in court cases.
Finally, there were also examples of \ENT{MISC} that could not be grouped into the 6 categories above. These include, for example, various types of objects or occupation related words, or anything else that is difficult to assign to a specific group:
\begin{itemize}
\item[] \ENT{ITEM}: gold metal, weekly newspaper, car, motorcycle, police vehicle
\item[] \ENT{OCCUPATION RELATED}: science policy, basketball skills, captained, coached
\item[] \ENT{OTHER}: empowering the backward classes, responsibility for child poverty and childcare, premeditated murder [assassinat] and in the alternative with murder [meurtre]
\end{itemize}
%Figure \ref{fig:misc} shows a comprehensive break-down of the \ENT{MISC} semantic type. As one can see, we were able find common examples in both datasets that belong to three different categories, namely \ENT{EVENTS}, \ENT{QUOTES} and \ENT{HEALTH} related spans. We assume that these types of PII are dataset independent seeing how the TAB corpus is from the legal domain, while the annotated Wikipedia dataset is of a more generic nature, but examples of these can be found in both texts:
%To get a better understanding of this type, thus, we go through all \ENT{MISC} text spans as annotated by human annotators in the TAB corpus and the collection of Wikipedia articles, noting down different \ENT{MISC} spans and the context they appear in as we go. After we have gone through the spans multiple times we are able to group them into higher-level categories based on their meaning, finding thus similarities or differences between the datasets.
% For example, in both datasets we note mentions of \ENT{EVENTS} (e.g. World War II), \ENT{HEALTH} (e.g. multiple sclerosis, cancer) and \ENT{QUOTES}. At the same time we also observe examples that are unique to each dataset and/or hard to group into a more general category (e.g. span referring to \ENT{LAWS} or \ENT{OFFENSES} in the TAB corpus, \ENT{WORK OF ART} spans in the annotated Wikipedia dataset etc.)
%\begin{figure}[t]
%\centering
%\includegraphics[width = 0.95\textwidth]{figures/misc.pdf}
%\caption{\ENT{MISC} semantic type broken down in more refined categories. The left side shows the categories of PII that one can find in generic data while the right side presents categories that we found to be dataset specific. Finally, the \ENT{OTHER} category refers to instances of PII that cannot be concretely categorized due to the large number of possible instances.}
%\label{fig:misc}
%\end{figure}
%These could be found, for example, in the clinical domain as well. Patient records could be said to be more similar to Wikipedia summaries, where all the information in the text refers mainly to the individual to be protected. Health-related PII, quotes by the patient or the doctor as well as main events that might have caused injuries is information expected to be seen in such text. The same could be said for email data or customer service conversations.
%On the other hand there are types of \ENT{MISC} PII that are dependent on the content of the text, as is for example \ENT{WORKS OF ART}, \ENT{OFFENSES} or \ENT{LAWS}. The first one can be mainly found in Wikipedia summaries since they are about famous individuals that are often artists of some kind. The latter two are more frequent in legal documents due to the nature of the information they convey. For example:
The above analysis is constrained to the two datasets employed in this paper. A privacy-oriented entity recognizer may, of course, be enriched with other sub-categories. As pointed out by \citet{benchmark}, \ENT{MISC} was also the PII category human annotators found most difficult to agree on. Despite this difficulty, recognizing \ENT{MISC} spans remains an important part of text sanitization, as many of those text spans do provide detailed information about the individual in question.
%Note that we only inspect two datasets here. An ER model can, of course, be further enriched with clear, dataset-specific types of PII, from datasets from different domains (e.g. the clinical domain). \ENT{MISC} is a very difficult type of PII to clearly categorize, seeing how even the human annotators often had difficulty with detecting spans. The examples of the categories mentioned above show the wide range of possible information that can be identifying but not grouped into a semantic type.
%Being able to narrow down some groups, though, may be helpful in future annotation tasks by providing more information to the annotators as to what \ENT{MISC} might entail, or even aiding in having more fine-grained semantic types, with less spans ending up in the \ENT{MISC} category. This would result in better model performance as such a clear categorization can help in the automatic labelling of training examples for this semantic type.
\section{Privacy Risk Indicators}
\label{sec:indicators}
Many text sanitization approaches simply operate by masking all detected PII spans. This may, however, lead to overmasking, as the actual risk of re-identification may vary greatly from one span to another. In many documents, a substantial fraction of the detected text spans may be kept in clear text without notably increasing the re-identification risk. For instance, in the TAB corpus, only 4.4 \% of the entities were marked by the annotators as direct identifiers, and 64.4 \% as quasi-identifiers, thus leaving 31.2 \% of the entities in clear text. To assess which text spans should be masked, we need to design privacy risk indicators able to determine which text spans (or combination of text spans) actually constitute a re-identification risk.
We present 5 possible approaches for inferring the re-identification risk associated with text spans in a document. Those 5 indicators are respectively based on:
\begin{enumerate}
\item LLM probabilities,
\item Span classification,
\item Perturbations,
\item Sequence labelling,
\item Web search.
\end{enumerate}
The web search approach can be applied in a zero-short manner without any fine-tuning. The two methods respectively based on LLM probabilities and perturbations require a small number of labeled examples to adjust a classification threshold or fit a simple binary classification model. Finally, the span classification and sequence labelling approaches operate by fine-tuning an existing language model, and are thus the methods that are most dependent on getting a sufficient amount of labeled training data to reach peak performance. This training data will typically take the form of human decisions to mask or keep in clear text a given text span.
We present each method in turn and provide an evaluation and discussion of their relative benefits and limitations in Section \ref{sec:eval}.
%The task of text sanitization relies on privacy risk indicators that can determine whether a detected span that can identify an individual needs to be masked in the text document or not, depending on its level of informativeness. In this Section we formulate and describe a number of such privacy risk indicators, as also shown in Figure \ref{fig:overview}. More specifically, in Section \ref{ssec:tabular} and \ref{ssec:multimodal} we describe approaches that use language model probabilities from manually labeled data along with a masking decision made by a human annotator. In Section \ref{ssec:petrubation} we present another approach where we once again utilize language model probabilities in a substantially different way, by considering the combination of PII spans in the text in a perturbation type of setting. In Section \ref{ssec:supervised} we present an approach based on previous work by \citet{benchmark} where we use our fine-tuned model to label already detected spans by the entity recognizer as needing to be masked or not. Finally, in Section \ref{ssec:wqra}, we present an approach to risk estimation based on web query results for PII spans. Each privacy risk indicator is then evaluated in Section \ref{sec:eval} and further discussed in Section \ref{sec:discussion}.
\subsection{LLM Probabilities}
\label{ssec:tabular}
The probability of a span as predicted by a language model is inversely correlated with its informativeness: a text span that is harder to predict is more informative/surprising than one that the language model can easily infer from the context \citep{zarcone2016salience}.
The underlying intuition is that text spans that are highly informative/surprising are also associated with a high re-identification risk, as they often correspond to specific names, dates or codes that cannot be predicted from the context. %This approach builds upon earlier work outlined in \citep{papadopoulou-etal-2022-neural}.
%we made use of language model probabilities and an empirically chosen threshold to mask specific entities in a text. In this section and the next one (Sections \ref{ssec:tabular} and \ref{ssec:multimodal}), we utilize this notion of \textit{informativeness} of a span and instead of using the aggregated probability of a span, we use the information derived from the individual probabilities of the words and subwords that make up the span, in combination with extra information one might have for this span, and manually labeled data in the form of masking decisions made by human annotators.
Concretely, we calculate the probability of each detected PII span given the entire context of the text by masking all the (sub)words of the span, and returning a list with all log-probabilities (one per token) referring to the span as calculated by a large, bidirectional language model, in our case BERT (large, cased) \citep{devlin-etal-2019-bert}. Those probabilities are then aggregated and employed as features for a binary classifier that outputs the probability of the text span being masked by a human annotator.
% NOTE FROM ANTHI: It CAN be fitted on a small number of examples as further experimentation shows, but it is actually trained on the entire training dataset. -->
% This classifier is fitted on a small number of examples.
The list of log-probabilities for each span has a different length depending on the number of tokens comprised in the text span. We therefore aggregate this list by reducing it to 5 features, namely the \textit{minimum}, \textit{maximum}, \textit{median} and \textit{mean} log-probability as well as the \textit{sum} of log-probabilities in the list. In addition, we also include as feature an encoding of the PII type assigned to the span by the human annotators (see Table \ref{tbl:categories}).
%We combine this sequence of probabilities with other types of useful information, for example the semantic type of the string as well as the string itself and propose two different approaches to the task of calculating the privacy risk of a PII span using language model probabilities.
%Typical ML tasks often rely on extensive data pre-processing and analysis, hyperparameter tuning and model selection to achieve good results, something that is time-consuming to do. Automated-ML on the other hand (AutoML) is an approach that can handle a wide range of input types (images, text, sound, number etc.) while performing hyperparameter tuning and model selection in an automatic way to achieve optimal results. Typically this results in more convenient as well as better and faster model training.
%In this first approach we employ two types of input, categorical and numerical input, both of which are numerical in nature. The list of probabilities for each span is used to extract information like the minimum and maximum value, the average and median values, as well as the sum of the log probabilities. The masking decision made by the human annotators serves as the label. For this first approach we use the minimum amount of information (a PII span's semantic type and its probabilities) to check whether this is enough for a model to learn the difference between spans that should be masked or not, and achieve good performance.
%We here experiment, thus, with 6 types of input of numerical nature, 5 numerical ones and 1 categorical, more specifically:
% \begin{itemize}
% \item 1:1 mapping of semantic type to integers (values 0 to 8)
% \item Minimum value of probability list
% \item Maximum value of probability list
% \item Average value of probability list
% \item Median value of probability list
% \item Sum of probability list (which corresponds to the probability of the entire span)
%\label{it:input}
% \end{itemize}
%The list of probabilities for each span has a different length depending on the number of (sub)words that make up the span. By extracting these statistics from the list we make sure that each training example has the same size and same type of information. In addition to the sum of the log probabilities, we also include the minimum and maximum values, as well as the average and median value of the probability list. This is to include even more information and to account for cases such as larger spans, for example, where the minimum and maximum value indicate whether some parts of the string are more informative than others. The comparison of the minimum and maximum values can also indicate whether there are outliers in the list of probabilities (e.g. extremely easy or hard to predict (sub)words). All these in combination with the categorical mapping of the semantic type make up the input to the models. Table \ref{tab:tabular_features} shows an example of some training instances for four PII spans.
%\begin{table*}[t]
% \centering
% \caption{Selected examples of input used for training the tabular predictor. Each row represents one PII span. The final column is the label to be predicted.}
% \begin{tabular}{cccccc:c}
% \toprule
% \textbf{sem.type} & \textbf{p\textsuperscript{min}} &\textbf{p\textsuperscript{max}} & \textbf{p\textsuperscript{avg}} & \textbf{p\textsuperscript{mdn}} & \textbf{p\textsuperscript{sum}} & \textbf{label} \\
% \midrule
% 0 & -6.62 & -4.29 & -5.35 & -5.17 & -32.11 & \ENT{MASK} \\
% 6 & -2.90 & -2.90 & -2.90 & -2.90 & -2.90 & \ENT{NO\_MASK} \\
% 7 & -5.71 & -3.62 & -4.65 & -4.63 & -13.96 & \ENT{MASK} \\
% 2 & -6.51 & -3.71 & -5.11 & -5.10 & -20.44 & \ENT{NO\_MASK} \\
% \end{tabular}
% \label{tab:tabular_features}
% \end{table*}
For the classifier itself, we conduct experiments using a simple logistic regression model as well as a more advanced classification framework based on AutoML. AutoML \citep{he2021automl} provides a principled approach to hyper-parameter tuning and model selection, efficiently searching for the hyper-parameters and model combination that yield the best performance. We use the Autogluon toolkit \citep{autogluon} in our experiments, and more specifically AutoGluon's Tabular predictor \citep{autogluon}, which consists of an ordered sequence of base models. After each model is trained and hyper-parameter optimization is performed on each, a weighted ensemble model is trained using a stacking technique.
%Figure \ref{fig:tabular_predictor} shows the Tabular predictor architecture broken down into individual parts.
A list of all base models of the Tabular predictor is shown in Table \ref{tbl:tabular_models}, in Appendix \ref{model}.
We use the training splits of the Wikipedia biographies and the TAB corpus to fit the classifier. %Since we only use numerical input here, we also train and test a simple logistic regression model using the same input and compare its performance with the tabular predictor as a baseline.
%\begin{figure}[t]
%\centering
%\includegraphics[width = 0.95\textwidth]{figures/tabular.pdf}
%\caption{Overview of the Tabular Predictor architecture, used here with 6 input features (numerical) for binary classification. Adapted from \citet{autogluon}}
%\label{fig:tabular_predictor}
%\end{figure}
%This privacy risk indicator is evaluated first on manually detected PII in Table \ref{tbl:prob1} (Section \ref{ssec:manual}) and also on automatically detected PII by the entity-recognizer, shown in Table \ref{tbl:test_er} (Section \ref{ssec:automatic}), and discussed in Section \ref{sec:discussion}.
\subsection{Span Classification}
\label{ssec:multimodal}
The approach in the previous section has the benefit of being relatively general, as it only considers the aggregated LLM probabilities and predicted PII type. However, it does not take into account the text content of the span itself. We now present an indicator that includes this text information to predict whether a text span constitutes a high privacy risk, and should therefore be masked.
Concretely, we enrich the classifier from the previous section by adding to the features a vector representation of the text span derived from a large language model. The classifier thus relies on a combination of numerical features (the aggregated LLM probabilities discussed above, to which we add the number of words and subwords of the span), a categorical feature (an encoding of the PII type), and a vector representation of the text span. Crucially, the transformer-based language model that produces this vector representation is fine-tuned to this prediction task.
The resulting model architecture is illustrated in Figure \ref{fig:multimodal_predictor}. Concretely, the model training is done using AutoGluon's Multimodal predictor \citep{multimodal}, making it easier to incorporate a wide range of feature types, including textual content processed with a neural language model. We employ here the Electra Discriminator model due to its good encoding performance \citep{DBLP:conf/iclr/ClarkLLM20,multimodal}. The categorical and numerical features are processed by a standard MLP. After each model is trained separately, their output is pooled (concatenation) by a MLP model using a fuse-late strategy near the output layer. Table \ref{tab:multimodal_features} provides some examples of input.
\begin{figure}[t]
\centering
\includegraphics[width = 0.95\textwidth]{figures/multimodal.pdf}
\caption{Overview of the model architecture for span classification, including both numerical, text and categorical features. Adapted from \citet{multimodal}.}
\label{fig:multimodal_predictor}
\end{figure}
\begin{table*}[ht]
\caption{Selected examples of input features for the span classification model. The aggregated LLM probabilities are in logarithmic form. \textbf{nb}\textsuperscript{w} and \textbf{nb}\textsuperscript{sw} respectively correspond to the number of words and subwords (token) in the span.}
\begin{footnotesize}
\begin{tabular}{lllllllll|l}
\toprule
\textbf{span text}& \textbf{PII type} &
\textbf{p}\textsuperscript{min} &\textbf{p}\textsuperscript{max} & \textbf{p}\textsuperscript{avg} & \textbf{p}\textsuperscript{mdn} & \textbf{p}\textsuperscript{sum} & \textbf{nb}\textsuperscript{w} & \textbf{nb}\textsuperscript{sw} &\textbf{label} \\
\midrule
36244/06 & \CODE{} & -5.7 & -1.9 & -3.7 & -3.3 & -18.4 & 3 & 2 & \ENT{MASK} \\
Kingdom of Denmark & \ORG{} & -4.3 & -3.9 & -4.1 & -4.2 & -12.4 & 3 & 0 & \ENT{NO\_MASK} \\
winger & \MISC{} & -1.5 & -1.5 & -1.5 & -1.5 & -1.5 & 1 & 0 & \ENT{NO\_MASK} \\
Reniers & \PERSON{} &-8.6 & -4.2 & -6.4 & -6.4 & -12.8 & 1 & 1 & \ENT{MASK} \\
\end{tabular}
\end{footnotesize}
\label{tab:multimodal_features}
\end{table*}
%In this second approach, we enrich the previously mentioned types of input (Section \ref{ssec:tabular}), and use categorical, numerical and text input, to judge whether additional information and a different architecture results in better performance and a model that makes more appropriate masking decisions.
%Apart, thus, from using only numerical types of features, we also decide to use the actual PII span and any information that might entail. We use the original span as well as the number of (sub)words of the tokenized span, along with a masking decision made by the human annotator as the label. The input for this approach, thus, is:
% \begin{itemize}
% \item The same input discussed in \ref{it:input}, \textit{plus}
% \item Number of words, as computed by the output of the tokenizer
% \item Number of subwords, as computed by the output of the tokenizer
% \end{itemize}
% Table \ref{tab:multimodal_features} shows an example of the input. The length of the string as well as the number of words and subwords are highly correlated with the rest of the numerical input. For example, large numerical values and many tokens might either indicate a large span that is harder to predict or a span that contains a lot of subwords that are also hard to predict (e.g. foreign names). In contrast are smaller numerical values and a few tokens, which indicate smaller spans that are easier to predict.
% The word \textit{Reniers}, for example, in Table \ref{tab:multimodal_features} has a sum of log probabilities equal to -12.75, but we know it is split by the tokenizer into one word and one subword with different probabilities, as obvious by the minimum and maximum values. The word \textit{winger} on the other hand, consists of only 1 word when tokenized and has only one probability value which indicates that it perhaps a span that is easier to predict by the model.
For our experiments, we again fit the classifier using the training datasets of the annotated collection of Wikipedia biographies and the TAB corpus. % and evaluate it on the test datasets. %The results are shown in Table \ref{tbl:prob1} (Section \ref{ssec:manual}) for manually detected PII spans and Table \ref{tbl:test_er} (Section \ref{ssec:automatic}) for automatically detected PII spans by the entity recognizer. These are then discussed in Section \ref{sec:discussion}.
\subsection{Perturbations}
\label{ssec:petrubation}
The two previous risk indicators use features extracted from the text span to emulate masking decisions from human annotators. They are not, however, able to quantify how much information a PII span can contribute to the re-identification. They also consider each PII span in isolation, thereby ignoring the fact that quasi-identifiers constitute a privacy risk precisely because of their combination with one another. We now turn to a privacy risk indicator that seeks to address those two challenges.
%Another means of deciding which spans need to be masked in order to protect the identity of an individual, is judging how informative the spans of text are in relation to the rest of personal information in the text, and not in isolation. While the previous probability-based risk indicators consider the probability of a PII span in isolation, this approach defers from that substantially, since it takes into account combinations of PII spans. This is more in line with the nature of quasi identifiers for example which, on their own are usually not specific enough to re-identify an individual, but when combined can do so.
This approach is inspired by saliency methods \citep{li-etal-2016-visualizing,ding-etal-2019-saliency} used to explain and interpret the outputs of large language models. One such method is \textit{perturbation} when one changes the input to the model by either modification or removal, and observes how this change affects the downstream predictions \citep{Kindermans2019,li2017understanding, serrano-smith-2019-attention}. In our case, we \textit{perturb} the input by altering one or more PII spans and analyse the consequences of this change on the probability produced by the language model for another PII span in the text.
Consider the following text:
\bigskip
\begin{example}
``Michael Linder is an \underline{American} \dashuline{television producer} and broadcast journalist based in Los Angeles [...] In 1995-6 Linder created and produced ``Berserkistan" [..] From 2004 through 2009, Linder served as a radio journalist for KNX-AM. [...]"
\label{linder}
\end{example}
\bigskip
The target span \underline{American} has a log probability of -0.006 given the rest of the document. However, if the span ``\dashuline{television producer}'' ends up being masked, its log probability becomes -2.062, indicating that the latter is informative to the target.
To assess which spans to mask, we use a RoBERTa large model \citep{DBLP:journals/corr/abs-1907-11692} and all possible combinations of PII in the text in a perturbation-based setting. We begin by calculating the probability of a target span with the rest of the context available in the text. We then mask in turn every other PII span in the document and recompute the probability of the target span to determine how the absence of the PII span affects the probability of the target span.
To obtain sensible estimates, we must mask all spans that refer to the same entity while calculating the probabilities. In Example \ref{linder}, \textit{Michael Linder} and \textit{Linder} refer to the same entity. We use in our experiments the co-reference links already annotated in the TAB corpus and the collection of Wikipedia biographies.
%So during probability calculation we mask all these instances to assess how they affect the probability of the other spans in the text. To achieve that we use the co-reference links that are included in the annotated Wikipedia dataset and the TAB corpus, mentioned in Sections \ref{ssec:tab} and \ref{ssec:wiki}. One could, of course, also use automatically labeled data detected by a model like the entity recognizer in combination with a co-reference resolution approach to achieve this. An example of the input can be seen in Table \ref{tab:perturbation_example}.
%\begin{table*}[t]
% \centering
% \caption{Example input of selected combinations of PII. The \textit{target span} refers to the span whose probability we monitor at each combination, when removing the \textit{combination %span}.}
% \begin{small}
% \begin{tabular}{lllll}
% \toprule
% \textbf{target} & \textbf{combination} & \textbf{orig. target prob.} & \textbf{new target prob.} & \textbf{diff.} \\
% \midrule
% Michael Linder & American & -11.800 & -11.651 & -0.149 \\
% Michael Linder & KABC-AM & -11.800 & -12.090 & 0.289 \\
% American & [Michael Linder, Linder ...] & -0.0057 & -0.0084 & 0.0026 \\
% American & television producer & -0.0057 & -2.062 & 2.056 \\
% \end{tabular}
% \label{tab:perturbation_example}
% \end{small}
% \end{table*}
Based on the difference between the original and the new target probability, we select the PII spans that make the target span more difficult to predict. To determine a threshold for deciding which spans constitute an unacceptable risk, we devise an objective function based on the privacy-oriented precision and recall metrics outlined in Section \ref{sec:metrics}. More precisely, assuming that PII spans are masked when the difference between the original and new target probability is greater than a threshold $t$, we look for the optimal threshold value $t^*$ that maximises the sum of three scores, namely the precision $p^t$, recall on direct identifiers $r_{\textrm{direct}}^t$ and recall on quasi identifiers $r_{\textrm{quasi}}^t$:
\begin{equation}
t^* = \argmax_t \left(p^t + r_{\textrm{direct}}^t + r_{\textrm{quasi}}^t\right)
% NOTE FROM PIERRE: since the denominator is constant, we can actually ignore it for the optimization
% c = \frac{p^t + r_{quasi}^t + r_{direct}^t}{p^m + r_{quasi}^m + r_{direct}^m}
\label{cost_function}
\end{equation}
The three above scores $p^t$, $r_{\textrm{direct}}^t$ and $r_{\textrm{quasi}}^t$ are obtained using a threshold $t$ on the difference of probabilities to decide which spans to mask. Those scores are computed in our experiments using the training set of our corpora. The resulting thresholds are different for the Wikipedia biographies (approximately 3.5) and the TAB corpus (approximately 10). Figure \ref{fig:perturbation_graph} in Appendix \ref{per_graphs} shows the performance of this risk indicator at different thresholds for both datasets.
%based on the performance of masking specific spans at different thresholds. Using the training datasets of both the annotated Wikipedia dataset and TAB we set different thresholds from the minimum difference to the maximum and we calculate at each threshold the precision and recall score (split for direct and quasi identifiers separately as explained in Section \ref{sec:metrics}) with the cost function aiming to maximize all three scores at the same time. More specifically, the cost function, as shown in Equation \ref{cost_function}, is:
%where \textit{t} refers to the scores at a specific threshold, and \textit{m} is the maximum value of this score.
%Having established a threshold, we evaluate it on the development and test set of TAB and the annotated Wikipedia datasets respectively, shown in Table \ref{tbl:perturbation_results} for manually detected PII and Table \ref{tbl:er_perturbation_results} for PII spans detected by the entity recognizer. We then discuss these results in Section \ref{sec:discussion}.
\subsection{Sequence Labelling}
\label{ssec:supervised}
Yet another approach to indirectly assess the re-identification risk based on masking decisions from experts is to estimate a sequence labelling model. Compared to the previous methods, this method is the one that is most dependent on the availability of in-domain, labeled training data.
% This approach is also the one yielding the best performance on the privacy-oriented metrics of Section \ref{sec:metrics}.
For this approach, we fine-tune a encoder-type language model on a token classification objective, each token being assigned to either \ENT{MASK} or \ENT{NO\_MASK}. For the Wikipedia biographies, we rely on a RoBERTa model \citep{DBLP:journals/corr/abs-1907-11692}, while we switch to a Longformer model \citep{beltagy2020longformer} for TAB given the length of the court cases, as proposed in \citet{benchmark}. Due to discrepancies between the manually labeled spans or detected by the privacy-oriented entity recognizer, and the ones created by the fine-tuned model, we operate under two possible setups:
\begin{itemize}
\item Full match: We assume that a span constitutes a high re-identification risk if all of its tokens are marked as \ENT{MASK} by the fine-tuned Longformer/RoBERTa.
\item Partial match: We consider that the span has a high risk if at least one token is marked as \ENT{MASK} by the Longformer/RoBERTa model.
\end{itemize}
%For this privacy risk indicator we utilize our previous work on the TAB corpus \citep{benchmark} and more specifically, the supervised classifier that we trained using the training dataset of the corpus. This is a Longformer model \citep{beltagy2020longformer} trained to detect any spans that need to be masked so that the identity of the individual is protected, based on the masking decisions made by the annotators on the training dataset of the TAB corpus. Instead of combining detection and labelling, we use only the masking decisions of this model on PII detected by the entity recognizer model, as presented in Section \ref{sec:er}, instead.
% This can be useful specifically for data of a different domain, since the type of PII might differ from text to text but the masking decisions of a trained model can always be used as an indication of privacy risk.
%We combine, thus, the predictions of this model and the detected spans by the privacy-oriented entity recognizer so that a span is considered to pose a privacy risk if and only if:
%\begin{itemize}
% \item There is a strict or partial overlap between the span detected by the entity recognizer and the span detected by the supervised classifier model \textit{\textbf{and}}
% \item the span detected by the supervised classifier is classified as \ENT{MASK} (meaning a \ENT{DIRECT} or \ENT{QUASI} identifier)
%\end{itemize}
%We then test this approach by running the privacy-oriented entity recognizer on the test set of the annotated Wikipedia dataset and the test set of the TAB corpus and save the detected PII spans. Then we use the supervised classifier model to detect the entities that the model decided are risky and need to be masked. We evaluate the approach in two ways:
%\begin{enumerate}
% \item A \textit{strict offset match}, where we mask any PII span detected by the entity recognizer that was, in its entirety, also detected by the supervised classifier
% \item A \textit{partial offset match}, where we mask any PII span detected by the entity recognizer that has \textit{either} the same start offset \textit{or} the same end offset with the span detected by the supervised classifier
%\end{enumerate}
%The results of both of these evaluation settings are shown in Table \ref{tbl:supervised_results} of Section \ref{ssec:automatic} and further discussed in Section \ref{sec:discussion}.
\subsection{Web Search}
\label{ssec:wqra}
Web query results can also be used to approximate the re-identification risk. This approximation relies on the assumption that text spans with an inadmissible level of re-identification risk will have web results that mention the individual we are trying to protect. %More specifically, we check whether we can find mentions of the person to protect in web pages found by running a web query with %one or more
%PII spans from the document.
%This is necessary as it is not feasible to crawl all of the resulting web pages from querying a web search engine with a particular entity to see if the person is identified or not.
Building from earlier work in \citet{papadopoulou-etal-2022-neural}, we first query the person's name to obtain URLs related to that person. We then query the PII spans of the document. For each span, we then compare the resulting URLs with those from querying the search engine with the person's name. If the intersection of these two sets of URLs is not empty, the text span is considered to pose a high re-identification risk. %This results in a binary classification of entities as either posing a risk or not posing a risk.
More formally, whether a text span poses a risk of re-identification, $R_{web}$, is defined as:
\begin{equation}
R_{web}=\begin{cases}
0, &\text{ if } \{URLs_{e}\}\cap\{URLs_{i}\} = \emptyset \\
1, &\text{ otherwise }
\end{cases}
\label{eq:web_risk}
\end{equation}
where $\{URLs_{e}\}$ is the set of URLs resulting from querying the web search engine with the text span and $\{URLs_{i}\}$ is the set of URLs mentioning the person to protect.
We used the Google API to query for each target individual in a given document and the unique text spans that occur in a given document\footnote{Web searches are from the period spanning July 2023 to September 2023.}.
%to account for variations in the exact spans associated with a given entity from different entities and for entities that are labeled by one annotator and not another.
The Google API provides 10 results per page. We limit the experiment to the top 20 results (i.e. first two pages from the web search). To avoid a prohibitively high number of API calls, we also constrain the search to individual text spans, although the same approach can in principle be extended to combinations of PII spans.
%even using pairs of entities requires a prohibitively high number of searches, with respect to both time and cost.
We also used the total number of hits reported by the Google search API for each PII span query. The assumption here is that if a search yields a larger number of responses, there is a higher chance that one of those responses will contain information about the target individual. However, generic search queries are also likely to return many responses. %, so a balance needs to be struck.
Therefore we considered applying an upper and lower bound on the total number hits. These thresholds were set experimentally to maximize the token-level $F_1$ scores on the TAB development set. This resulted in a lower limit of 100 hits and no upper limit. This method is limited by the potential unreliable nature of the total responses reported by web search engines, as shown in \citet{sanchez2018survey}.
%This approach is evaluated both on manually labeled data in Table \ref{tbl:web_results}, Section \ref{ssec:manual} and automatically detected PII in Table \ref{tbl:web_results_er}, Section \ref{ssec:automatic}.
\section{Analysis of Privacy Risk Indicators}
\label{sec:eval}
We now evaluate the privacy risk indicators detailed in the previous section, both in isolation (Section \ref{subsec:eval}) and in combination (Section \ref{ssec:combos}) and discuss the main findings.
\subsection{Evaluation Metrics}
\label{sec:metrics}
The evaluation of text sanitization must strike a balance between two competing considerations:
\begin{itemize}
\item \textit{Privacy risk}: text spans that have a high risk of leading, directly or indirectly, to the re-identification of the individual should be masked.
\item \textit{Data utility}: the sanitized text should preserve as much semantic content as possible.
\end{itemize}
The traditional approach to evaluating text sanitization is to rely on a manually labeled set of documents and use metrics such as precision, recall and $F_1$ score to measure the overlap between the human decisions and the system outputs. The recall is associated with the privacy risk, as a high recall indicates that most of the PII spans that should have been masked, are indeed masked. Similarly, the precision is correlated with the data utility, as a high precision expresses that the resulting sanitization did not mask unnecessary text spans.
%The ideal text sanitization system is one that manages to balance both precision and recall, by masking enough PII to protect the identity of the individual, but at the same time not too much, so that the data can be further used. Another aspect that needs to be taken into account, is the fact that the task can admit many different, but equally correct solutions.
As argued in \citet{benchmark}, the use of standard precision and recall measures has, however, a number of important shortcomings. They do not capture the fact that some identifiers have a more important influence on the privacy risk than others (for instance, omitting to mask a full person name is a more serious threat than omitting a vague quasi-identifier). They also ignore the fact that a personal identifier is only protected if all its occurrences are masked: if a person name is mentioned 4 times in a document, and 3 of those occurrences are masked, the re-identification risk remains unchanged, as the identifier remains available in clear text in one occurrence. Finally, text sanitization may admit several, equally correct solutions.
To provide a more fine-grained assessment of the text sanitization quality, \citet{benchmark} present a set of three privacy-oriented metrics, micro-averaged over multiple annotators:
\begin{description}
\item \textbf{Entity recall on direct identifiers} Micro-averaged, entity-level recall score calculated only for direct identifiers. If an entity is mentioned multiple times in the text, all mentions must to be masked for it to be considered correct.
\item \textbf{Entity recall on quasi identifiers} Micro-averaged, entity level recall score calculated only for quasi identifiers. In case of multiple mentions of the same entity, all mentions must again be masked.
\item \textbf{Weighted Precision} Micro-averaged, token-level precision where each token is weighted by its information content (measured using a language model such as BERT).
\end{description}
The evaluation results below are computed according to those three metrics.
\subsection{Experimental Results}
\label{subsec:eval}
We first evaluate the five privacy risk indicators using PII spans manually labeled by human annotators from both the TAB corpus and the Wikipedia biographies. The results are shown in Table \ref{tbl:manual}. The approaches based on LLM probabilities and span classification were trained on the corresponding training set (either Wikipedia or TAB), and the threshold of the perturbation-based method was similarly adjusted from the training set. The web search results rely on the two alternatives techniques presented in Section \ref{ssec:wqra}, respectively based on the intersection of URLs or the estimated number of hits. We also provide the results obtained with a simple baseline that masks all PII spans.
We then evaluate the risk indicators with the PII spans actually detected by the privacy-oriented entity recognizer described in Section \ref{sec:er}, thereby enabling us to assess the end-to-end performance of the proposed approaches. The results are shown in Table \ref{tbl:automatic}. Note that, in this setup, the majority rule baseline (which masks all PII spans) leads to recall scores lower than 1 due to detection errors arising from the privacy-oriented entity recognizer.
%All AutoGluon predictors are deterministic by default so we report the results of 1 training run for both the LLM-based approach (Section \ref{ssec:tabular}) and the span classification approach of Section \ref{ssec:multimodal}. Table \ref{tbl:prob1} presents the results of the LLM-based approach (tabular predictor) and the logistic regression baseline model, for both datasets, as well as the same evaluation metrics for the span classification approach (multimodal predictor).
\begin{table*}[t]
\begin{center}
\caption{\label{tbl:manual} Evaluation of the privacy risk indicators with manually labeled text spans. The results are obtained by comparing the text spans predicted as risky by each method against the masking decisions of human experts. We report \textit{token-level} and \textit{entity-level} scores. \textbf{P} denotes the token-level precision, $\mathbf{P_{w}}$ the token-level precision weighted by information content (see \citet{benchmark} for details), $\mathbf{R}_{\textrm{all}}$ the token-level recall of all personal identifiers, and $\mathbf{F_1}$ the token-level $F_1$ score on all identifiers. $\mathbf{R}_{\textrm{ent}}$ denotes the entity-level recall for all identifiers, while $\mathbf{R}_{\textrm{direct}}$ the entity-level recall of direct identifiers and $\mathbf{R}_{\textrm{quasi}}$ the entity-level recall of quasi-identifiers. The results for a given document are micro-averaged over all annotators.}
\vspace{3mm}
\begin{footnotesize}
\begin{tabular}{lrrrr:rrr}
\toprule
&\hspace{-2mm}\textbf{P} & $\mathbf{P_{w}}$ & $\mathbf{R}_{\textrm{all}}$ &\hspace{-2mm}$\mathbf{F_1}$ &\hspace{-3mm}$\mathbf{R}_{\textrm{ent}}$ &\hspace{-3mm}$\mathbf{R}_{\textrm{direct}}$ &\hspace{-3mm}$\mathbf{R}_{\textrm{quasi}}$ \\
\midrule
\multicolumn{8}{c}{\textbf{Wikipedia biographies (test set)}}\\
\midrule
Majority rule (mask everything) & 0.80 & 0.84 & \textbf{1.00} & 0.89 & \textbf{1.00} & \textbf{1.00} & \textbf{1.00} \\[1mm]\hdashline\\[-2mm]
LLM probabilities (logistic regression) & 0.87 & 0.89 & 0.92 & 0.89 & 0.85 & \textbf{1.00} & 0.84 \\
LLM probabilities (AutoML model) & 0.89 & 0.91 & 0.93 & \textbf{0.91} & 0.89 & \textbf{1.00} & 0.88 \\[1mm]\hdashline\\[-2mm]
Span classification (AutoML model) & 0.93 & 0.94 & 0.87 & 0.90 & 0.82 & 0.99 & 0.81 \\[1mm]\hdashline\\[-2mm]
Perturbations (threshold $\approx 3.5$) & 0.80 & 0.84 & \textbf{1.00} & 0.89 & \textbf{1.00} & 0.99 & \textbf{1.00} \\[1mm]\hdashline\\[-2mm]
Sequence labelling (RoBERTa, strict match) & 0.84 & 0.89 & 0.81 & 0.82 & 0.78 & 0.85 & 0.77\\
Sequence labelling (RoBERTa, partial match) & 0.83 & 0.86 & 0.97 & 0.89 & 0.97 & \textbf{1.00} & 0.96\\[1mm]\hdashline\\[-2mm]
Web search (URL $\cap$) & \textbf{0.98} & \textbf{0.99} & 0.22 & 0.36 & 0.08 & 0.52 & 0.03 \\
Web search (\# of hits) & 0.80 & 0.84 & 0.99 & 0.88 & 0.99 & 0.95 & 0.99 \\[1mm]
\midrule
\multicolumn{8}{c}{\textbf{Text Anonymization Benchmark (test set)}}\\
\midrule
Majority rule (mask everything) & 0.52 & 0.56 & 1.00 & 0.69 & \textbf{1.00} & \textbf{1.00} & \textbf{1.00} \\[1mm]\hdashline\\[-2mm]
LLM probabilities (logistic regression) & 0.53 & 0.57 & 0.96 & 0.68 & 0.93 & 0.91 & 0.93\\
LLM probabilities (AutoML model) & 0.61 & 0.64 & 0.93 & 0.73 & 0.93 & \textbf{1.00} & 0.92\\[1mm]\hdashline\\[-2mm]
Span classification (AutoML model) & 0.74 & 0.77 & 0.92 & 0.83 & 0.93 & \textbf{1.00} & 0.92 \\[1mm]\hdashline\\[-2mm]
Perturbations (threshold $\approx 10)$ & 0.52 & 0.56 & \textbf{1.00} & 0.69 & \textbf{1.00} & \textbf{1.00} & \textbf{1.00}\\[1mm]\hdashline\\[-2mm]
Sequence labelling (Longformer, strict match) & 0.90 & 0.91 & 0.87 & 0.88 & 0.88 & 0.96 & 0.87\\
Sequence labelling (Longformer, partial match) & 0.87 & 0.88 & 0.95 & \textbf{0.90} & 0.95 & \textbf{1.00} & 0.95 \\[1mm]\hdashline\\[-2mm]
Web search (URL $\cap$) & \textbf{0.95} & \textbf{0.96} & 0.13 & 0.22 & 0.04 & 0.41 & 0.01 \\
Web search (\# of hits) & 0.52 & 0.56 & 0.98 & 0.68 & 0.97 & 0.93 & 0.98\\
\end{tabular}
\end{footnotesize}
\end{center}
\bigskip
\end{table*}
% \begin{table*}[t]
% \begin{center}
% \caption{\label{tbl:prob1} Evaluation results for the LLM-based approach (tabular predictor) and a logistic regression model using 6 features, 5 from language model probabilities and the semantic type of the span, as well as the span classification one (multimodal predictor) using 9 features, 5 from language model probabilities, the text span and its semantic type, as well as the number of words and subwords based on the tokenized output of the span.}
% \begin{footnotesize}
% \begin{tabular}{*7c}
% \toprule
% & \textbf{P} & \textbf{P$_{w}$} & \textbf{ R$_{all}$} & \textbf{R$_{direct}$} & \textbf{R$_{quasi}$} & \textbf{F1} \\
% \midrule
% &&&\textbf{Wikipedia test}&&&\\
% \midrule
% \textbf{Logistic} & 0.871 & 0.894 & 0.918 & \textbf{1.000} & 0.835 & 0.894\\
% \textbf{LLM-based} & 0.886 & 0.909 &\textbf{0.928} & \textbf{1.000} & \textbf{0.876} & \textbf{0.906}\\
% \textbf{Span classification} & \textbf{0.931} & \textbf{0.944} & 0.870 & 0.992 & 0.807 & 0.899\\
% \midrule
% &&&\textbf{TAB test}&&&\\
% \midrule
% \textbf{Logistic} & 0.531 & 0.566 & \textbf{0.956} & 0.909 & \textbf{0.926} & 0.683\\
% \textbf{LLM-based} & 0.607 & 0.637 & 0.930 & 0.997 & 0.921 & 0.734 \\
% \textbf{Span classification} & \textbf{0.748} & \textbf{0.773} & 0.922 & \textbf{1.000} & 0.923 & \textbf{0.826} \\
% \end{tabular}
% \end{footnotesize}
% \end{center}
% \end{table*}
%In Table \ref{tbl:perturbation_results} we report the results of applying the selected threshold of the perturbation based risk indicator (Section \ref{ssec:petrubation}) to the test dataset of the annotated Wikipedia dataset and the TAB corpus.
% \begin{table*}[t]
% \begin{footnotesize}
% \begin{center}
% \caption{\label{tbl:perturbation_results} Evaluation results for the perturbation privacy risk indicator. The optimal threshold is calculated on the training dataset and then tested on the test dataset. Evaluation metrics for both datasets are shown here.}
% \begin{tabular}{*9c}
% \toprule
% & \textbf{Threshold} & \textbf{P} & \textbf{P$_{w}$} & \textbf{ R$_{all}$} & \textbf{R$_{direct}$} & \textbf{R$_{quasi}$} & \textbf{F1} \\
% \midrule
% &&& \textbf{Wikipedia} &&&& \\
% \midrule
% \textbf{\textcolor{gray}{Wiki train}} & \textcolor{gray}{$\approx$ 3.5} & \textcolor{gray}{0.760} & \textcolor{gray}{0.806} & \textcolor{gray}{0.997} & \textcolor{gray}{0.994} & \textcolor{gray}{0.997} & \textcolor{gray}{0.862}\\
% \textbf{Wiki test} & $\approx$ 3.5 & 0.796 & 0.841 & 0.999 & 0.992 & 0.999 & 0.886 \\
% % \textbf{Wiki test \& Opt.} & $\approx$ 3.5 & 0.893 & 0.291 & 0.931 & 0.431 & 0.130 & 0.439\\
% \midrule
% &&& \textbf{TAB} &&&& \\
% \midrule
% \textbf{\textcolor{gray}{TAB train}} & \textcolor{gray}{$\approx$ 10} & \textcolor{gray}{0.675} & \textcolor{gray}{0.716} & \textcolor{gray}{0.998} & \textcolor{gray}{0.999} & \textcolor{gray}{0.997} & \textcolor{gray}{0.805}\\
% \textbf{TAB test} & $\approx$ 10 & 0.521 & 0.562 & 0.999 & 0.999 & 0.999 & 0.685\\
% % \textbf{TAB test \& Opt.} & $\approx$ 10 & 0.402 & 0.414 & 0.247 & 0.153 & 0.127 & 0.306\\
% \end{tabular}
% \end{center}
% \end{footnotesize}
% \end{table*}
% We also pass the results to an optimization algorithm, as present in \citet{papadopoulou-etal-2022-neural}. More specifically, instead of masking the span that makes the target span more difficult to predict, we consider the \textit{combination of these entities} risky. The linear optimization algorithm aims to minimize the semantic loss in the resulting text under the constraint that for each risky combination of PII spans at least one entity needs to be masked.
%Results for the URL intersection method of the web query risk approximation as well as the results for the total hits method are in Table \ref{tbl:web_results}.
% \begin{table*}[tb]
% \centering
% \begin{footnotesize}
% \caption{\label{tbl:web_results} Evaluation results for the web search privacy risk indicator using url intersection and number of hits ($>100$).}
% \begin{tabular}{*7c}
% \toprule
% & \textbf{P} & \textbf{P$_{w}$} & \textbf{ R$_{all}$} & \textbf{R$_{direct}$} & \textbf{R$_{quasi}$} & \textbf{F1}\\
% \midrule
% % \textbf{TAB dev} & 0.788 & 0.789 & 0.142 & 0.518 & 0.033 & 0.240\\
% & & & \textbf{URL $\cap$} & & & \\
% \midrule
% \textbf{TAB test} & \textbf{0.950} & \textbf{0.956} & 0.127 & 0.413 & 0.008 & 0.224 \\
% \textbf{Wiki test} & \textbf{0.984} & \textbf{0.986} & 0.223 & 0.523 & 0.034 & 0.364 \\
% \midrule
% & & & \textbf{\# of hits} & & & \\
% \midrule
% \textbf{TAB test} & 0.522 & 0.562 & \textbf{0.982} & \textbf{0.929} & \textbf{0.978} & \textbf{0.682} \\
% \textbf{Wiki test} & 0.796 & 0.842 & \textbf{0.993} & \textbf{0.954} & \textbf{0.996} & \textbf{0.884}\\
% \end{tabular}
% \end{footnotesize}
% \end{table*}
% \begin{tabular}{*9c}
% \toprule
% & \multicolumn{8}{c}{\textbf{Recall$_{direct,entity\_type}$}} \\[0.5em]
% %\midrule
% & \DATETIME & \ORG & \PERSON & \LOC & \DEM & \MISC & \CODE & \QUANTITY\\
% \midrule
% \textbf{TAB dev} & 0.000& 0.000& 0.744& nan& nan& 0.800& 0.206& nan \\
% \textbf{TAB test} & 0.000& 0.000& 0.565& nan& nan& nan& 0.131& nan\\
% \end{tabular}
% \begin{table*}[t]
% \begin{footnotesize}
% \begin{center}
% \caption{\label{tbl:web_results_hits} Evaluation results for the web search privacy risk indicator using number of hits ($>100$).}
% \begin{tabular}{*{7}c}
% \toprule
% & \textbf{Precision} & \textbf{Precision$_{w}$} & \textbf{ Recall$_{all}$} & \textbf{Recall$_{direct}$} & \textbf{Recall$_{quasi}$} & \textbf{F1}\\
% \midrule
% % \textbf{TAB dev} & 0.539 & 0.577 & 0.967 & 0.900 & 0.961 & 0.692 \\
% \textbf{TAB test} & 0.522 & 0.562 & 0.982 & 0.929 & 0.978 & 0.682 \\
% \midrule
% \textbf{Wiki test} & 0.796 & 0.842 & 0.993 & 0.954 & 0.996 & 0.884
% \end{tabular}
% \end{center}
% \end{footnotesize}
% \end{table*}
%\subsection{Automatically Detected PII}
%\label{ssec:automatic}
\begin{table*}[t]
\begin{center}
\caption{\label{tbl:automatic} Evaluation of the privacy risk indicators with PII spans detected by the privacy-oriented entity recognizer of Section \ref{sec:er}, using the same metrics as in Table \ref{tbl:manual}.}
\begin{footnotesize}
\begin{tabular}{lrrrrrrr}
\toprule
& \textbf{P} &\hspace{-2mm}$\mathbf{P_{w}}$ & $\mathbf{R}_{\textrm{all}}$ & \hspace{-2mm}$\mathbf{F_1}$&\hspace{-3mm}$\mathbf{R}_{\textrm{ent}}$&\hspace{-3mm}$\mathbf{R}_{\textrm{direct}}$&\hspace{-3mm}$\mathbf{R}_{\textrm{quasi}}$\\
\midrule
\multicolumn{8}{c}{\textbf{Wikipedia biographies (test set)}}\\
\midrule
Majority rule (mask everything) & 0.66 & 0.75 & \textbf{0.93} & 0.77 & \textbf{0.91} & 0.88 & \textbf{0.91} \\[1mm]\hdashline\\[-2mm]
LLM probabilities (logistic regression) & 0.82 & 0.86 & 0.83 & 0.82 & 0.75 & 0.87 & 0.74 \\
LLM probabilities (AutoML model) & 0.83 & 0.87 & 0.84 & \textbf{0.84} & 0.78 & 0.87 & 0.78 \\[1mm]\hdashline\\[-2mm]
Span classification (AutoML model) & 0.87 & 0.90 & 0.78 & 0.83 & 0.72 & 0.85 & 0.71 \\[1mm]\hdashline\\[-2mm]
Perturbations (threshold $\approx 3.5$) & 0.66 & 0.75 & \textbf{0.93} & 0.77 & \textbf{0.91} & 0.87 & \textbf{0.91} \\[1mm]\hdashline\\[-2mm]
Sequence labelling (RoBERTa, strict match) & 0.80 & 0.87 & 0.70 & 0.75 & 0.65 & 0.81 & 0.63 \\
Sequence labelling (RoBERTa, partial match) & 0.76 & 0.82 & 0.91 & 0.83 & 0.88 & \textbf{0.88} & 0.88\\[1mm]\hdashline\\[-2mm]
Web search (URL $\cap$) & \textbf{1.00} & \textbf{1.00} & 0.11 & 0.20 & 0.02 & 0.20 & 0.00 \\
Web search (\# of hits) & 0.66 & 0.75 & 0.92 & 0.77 & 0.90 & 0.85 & \textbf{0.91} \\[1mm]
\midrule
\multicolumn{8}{c}{\textbf{Text Anonymization Benchmark (test set)}}\\
\midrule
Majority rule (mask everything) & 0.43 & 0.52 & \textbf{0.96} & 0.60 & 0.93 & \textbf{0.98} & \textbf{0.94} \\[1mm]\hdashline\\[-2mm]
LLM probabilities (logistic regression) & 0.44 & 0.53 & 0.91 & 0.60 & 0.85 & 0.93 & 0.85 \\
LLM probabilities (AutoML model) & 0.51 & 0.60 & 0.88 & 0.65 & 0.87 & \textbf{0.98} & 0.86 \\[1mm]\hdashline\\[-2mm]
Span classification (AutoML model) & 0.68 & 0.76 & 0.88 & 0.77 & 0.87 & \textbf{0.98} & 0.86 \\[1mm]\hdashline\\[-2mm]
Perturbations (threshold $\approx 10)$ & 0.43 & 0.52 & \textbf{0.96} & 0.60 & \textbf{0.94} & \textbf{0.98} & \textbf{0.94} \\[1mm]\hdashline\\[-2mm]
Sequence labelling (Longformer, strict match) & 0.87 & 0.88 & 0.83 & 0.85 & 0.83 & 0.95 & 0.82 \\
Sequence labelling (Longformer, partial match) & 0.82 & 0.84 & 0.91 & \textbf{0.86} & 0.90 & \textbf{0.98} & 0.90 \\[1mm]\hdashline\\[-2mm]
Web search (URL $\cap$) & \textbf{0.99} & \textbf{0.99} & 0.12 & 0.22 & 0.03 & 0.43 & 0.01 \\
Web search (\# of hits) & 0.43 & 0.51 & 0.94 & 0.59 & 0.91 & 0.90 & 0.92 \\
\end{tabular}
\end{footnotesize}
\end{center}
\bigskip
\end{table*}
% The models we have discussed so far, as mentioned before, are trained and evaluated on manually labeled data. We also evaluated their performance when the PII on the test set was detected by the privacy-oriented ER instead.
%The results shown in Table \ref{tbl:test_er} correspond to both the LLM-based and the span classification approaches of the language model probabilities-based risk indicator, when the predictors are trained on manually labeled data but tested on PII spans detected by the entity recognizer.
% \begin{table*}[t]
% \begin{center}
% \caption{\label{tbl:test_er} Evaluation results for both predictors trained on manually labeled data and tested on automatically detected PII}
% \begin{footnotesize}
% \begin{tabular}{*7c}
% \toprule
% & \textbf{P} & \textbf{P$_{w}$} & \textbf{ R$_{all}$} & \textbf{R$_{direct}$} & \textbf{R$_{quasi}$} & \textbf{F1} \\
% \midrule
% &&&\textbf{Wikipedia test}&&&\\
% \midrule
% \textbf{LLM-based} & 0.832 & 0.873 & \textbf{0.842} & \textbf{0.868} & \textbf{0.776} & \textbf{0.837}\\
% \textbf{Span classification} & \textbf{0.873} & \textbf{0.904} & 0.784 & 0.854 & 0.710 & 0.826\\
% \midrule
% &&&\textbf{TAB test}&&&\\
% \textbf{LLM-based} & 0.511 & 0.604 & 0.878 & 0.978 & 0.858 & 0.646\\
% \textbf{Span classification} & \textbf{0.683} & \textbf{0.756} & \textbf{0.880} & \textbf{0.981} &\textbf{0.863} & \textbf{0.769}\\
% \end{tabular}
% \end{footnotesize}
% \end{center}
% \end{table*}
%In Table \ref{tbl:er_perturbation_results}, after having determined the threshold on manually labeled data, we then repeat the procedure with PII detected by the privacy-oriented ER, reporting the results for the perturbation based risk indicator.
% \begin{table*}[t]
% \begin{footnotesize}
% \begin{center}
% \caption{\label{tbl:er_perturbation_results} Evaluation results for the perturbation privacy risk indicator with automatically detected PII spans and the already determined threshold on the test datasets.}
% \begin{tabular}{*9c}
% \toprule
% & \textbf{Threshold} & \textbf{P} & \textbf{P$_{w}$} & \textbf{ R$_{all}$} & \textbf{R$_{direct}$} & \textbf{R$_{quasi}$} & \textbf{F1} \\
% \midrule
% \textbf{ER Wiki test} & $\approx$ 3.5 & 0.661 & 0.747 & 0.929 & 0.869 & 0.912 & 0.773 \\
% % \textbf{ER Wiki test \& Opt.} & $\approx$ 3.5 & 0.811 & 0.860 & 0.251 & 0.277 & 0.140 & 0.384\\
% \midrule
% \textbf{ER TAB test} & $\approx$ 10 & 0.434 & 0.522 & 0.959 & 0.982 & 0.935 & 0.598\\
% % \textbf{ER TAB test \& Opt.} & $\approx$ 10 & 0.608 & 0.646 & 0.261 & 0.277 & 0.146 & 0.365\\
% \end{tabular}
% \end{center}
% \end{footnotesize}
% \end{table*}
%Table \ref{tbl:supervised_results} shows the results of this privacy risk indicator based on using the predictions of the supervised classifier model and PII detected by the entity recognizer, in two evaluation settings, a \textit{strict} and a \textit{partial} one, as presented at the end of Section \ref{ssec:supervised}.
% \begin{table*}[t]
% \begin{footnotesize}
% \begin{center}
% \caption{\label{tbl:supervised_results} Evaluation results for the supervised classifier privacy risk indicator considering both a strict and a partial overlap between spans}
% \begin{tabular}{*8c}
% \toprule
% & \textbf{P} & \textbf{P$_{w}$} & \textbf{ R$_{all}$} & \textbf{R$_{direct}$} & \textbf{R$_{quasi}$} & \textbf{F1} \\
% \midrule
% &&& \textbf{Wikipedia test} &&& \\
% \midrule
% \textbf{Wiki strict} & \textbf{0.798} & \textbf{0.865} & 0.378 & 0.185 & 0.318 & 0.513 \\
% \textbf{Wiki partial} & 0.612 & 0.683 & \textbf{0.850} & \textbf{0.838} & \textbf{0.828} & \textbf{0.715} \\
% \midrule
% &&& \textbf{TAB test} &&& \\
% \textbf{TAB strict} & \textbf{0.865} & \textbf{0.881} & 0.826 & 0.947 & 0.824 & 0.845\\
% \textbf{TAB partial} & 0.820 & 0.845 & \textbf{0.917} & \textbf{0.993} & \textbf{0.916} & \textbf{0.866} \\
% \end{tabular}
% \end{center}
% \end{footnotesize}
% \end{table*}
%Finally, Table \ref{tbl:web_results_er} shows results for the URL intersection method of the web query risk approximation as well as the results for the total hits method, for both datasets.
% \begin{table*}[tb]
% \centering
% \begin{footnotesize}
% \caption{\label{tbl:web_results_er} Evaluation results for the web search privacy risk indicator using url intersection and number of hits ($>100$) for automatically detected personal information.}
% \begin{tabular}{*7c}
% \toprule
% & \textbf{P} & \textbf{P$_{w}$} & \textbf{ R$_{all}$} & \textbf{R$_{direct}$} & \textbf{R$_{quasi}$} & \textbf{F1}\\
% \midrule
% % \textbf{TAB dev} & 0.788 & 0.789 & 0.142 & 0.518 & 0.033 & 0.240\\
% & & & \textbf{URL $\cap$} & & & \\
% \midrule
% \textbf{TAB test} & \textbf{0.986} & \textbf{0.986} & 0.124 & 0.427 & 0.005 & 0.220 \\
% \textbf{Wiki test} & \textbf{1.000} & \textbf{1.000} & 0.110 & 0.200 & 0.002 & 0.198 \\
% \midrule
% & & & \textbf{\# of hits} & & & \\
% \midrule
% \textbf{TAB test} & 0.430 & 0.514 & \textbf{0.942} & \textbf{0.904} & \textbf{0.915} & \textbf{0.590} \\
% \textbf{Wiki test} & 0.660 & 0.746 & \textbf{0.923} & \textbf{0.846} & \textbf{0.910} & \textbf{0.770} \\
% \end{tabular}
% \end{footnotesize}
% \end{table*}
\subsection{Discussion}
\label{sec:discussion}
We now discuss the experimental results of each privacy risk indicator one by one.
%In this section we discuss the results shown in Section \ref{sec:eval}, separately for each privacy risk indicator. We then discuss the performance of all the risk indicators when the PII is detected by the entity recognizer and how that affects the performance, in Section \ref{ssec:adpii}.
%We compare the performance of the privacy risk indicators and we also present and discuss results for a full text sanitization pipeline, both with manually and automatically detected spans and a combination of the privacy risk indicators we have presented so far in Section \ref{ssec:overall}. Finally, we discuss the concept of complete sanitization in relation to data utility in Section \ref{ssec:complete_sanitization}.
\subsubsection*{LLM probabilities}
\label{ssec:ppa}
%Regarding the LLM-based and span classification approaches, in Table \ref{tbl:prob1} we note that for each metric individually, different approaches yield the best results when we look at each score in isolation, with lower recall-related scores showing higher precision scores and vice versa.
% As mentioned in Section \ref{sec:metrics}, there needs to be a balance between data utility (precision) and privacy (recall). For this reason we highlight in bold the method that manages to have both a high precision \textit{and} a high recall score as the best performing one.
We can observe that the AutoML model, which consists of an ensemble of supervised classifiers such as decision trees with hyper-parameters optimized on the development set, outperforms a simpler logistic regression model. In other words, the task of predicting high-risk text spans given the aggregated probabilities obtained from a large language model seems to require a non-linear decision boundary.
%Having established that, we also note two major trends. When using only numerical input there is a difference in the performance of a simpler model like the logistic regression one, when compared to a more complex architecture like the Tabular predictor. For the Wikipedia dataset, the logistic regression model achieves a slightly higher precision score, but a lower recall score compared to the tabular predictor which shows a high performance for all scores. We also note that the weighted precision score is higher for the Tabular model, which means that it masks spans of a more general nature and thus, with a lower information content. This difference in performance between the logistic regression model and the Tabular predictor is also visible in the TAB corpus, with the latter performing better. We conclude, thus, that a more refined architecture with automatic hyperparameter tuning and model selection performs better than a simpler model, even with simple numerical input.
%, especially regarding precision. The scores for the TAB corpus show an overmasking trend where more information than necessary, based on the annotators' decisions, was masked. This also results in higher recall scores.
We also notice a substantial difference between the Wikipedia biographies and the TAB corpus. A closer look at the token log-probabilities factored by masking decision, as shown in Figure \ref{fig:wiki_tab_graph}, is particularly instructive.
%This helps us understand to what extend LM probabilities correspond to informativeness. For each PII span that was detected by the annotators, we extract the combination of the probability of the (sub)word and the masking decision and plot the results, shown in Figure \ref{fig:wiki_tab_graph}.
While the PII spans from the Wikipedia biographies show a clear difference between the log-probabilities of the masked and non-masked tokens, this is not the case for the TAB corpus\footnote{At least when aggregating over all PII types. If we do, however, factor those log-probabilities by PII type, we do notice a difference in log-probabilities for a number of PII types.}.
The classifier reaches its optimal performance relatively quickly, after observing about 1 \% of the total training set size in both corpora. Ablation experiments also show that the most important feature for the classifier is the PII type, as some types are masked by human annotators much more often than others.
%We observe that in the Wikipedia dataset, there is a clear distinction between (sub)word probabilities that are masked and those that are left as is in the text, both for the training and the test dataset. The plots also show a low number of outliers, especially for the test split of the dataset, which indicates spans that the annotator(s) decided to mask but were easy for the model to predict and vice versa. For TAB this distinction is not as clear, for any of the data splits, with many outliers present as well. This means that the spans the annotators decided to mask do not correlate well with how easy or difficult it is for the language model to predict them. Thus, a model trained on the Wikipedia dataset is expected to perform better than one trained on TAB since it is easier for the model to learn this distinction between spans.
% \begin{figure}[t]
% \centering
% \includegraphics[width = 0.95\textwidth]{figures/style_wiki.png}
% \caption{Word and subword probabilities in relation to the masking decision of the span of the annotated Wikipedia dataset.}
% \label{fig:wiki_graph}
% \end{figure}
% \begin{figure}[t]
% \centering
% \includegraphics[width = 0.95\textwidth]{figures/style_tab.png}
% \caption{Word and subword probabilities in relation to the masking decision of the span for the TAB corpus.}
% \label{fig:tab_graph}
% \end{figure}
\begin{figure}[t]
\centering
{\includegraphics[width=0.45\textwidth,trim={0 0 17cm 0},clip]{figures/style_wiki.png}}
\hfill
{\includegraphics[width=0.45\textwidth,trim={0 0 17cm 0},clip]{figures/style_tab.png}}
\caption{Token log-probabilities depending on the expert-annotated masking decision (\ENT{MASK} or \ENT{NO\_MASK}) of the corresponding span for Wikipedia and TAB.}
\label{fig:wiki_tab_graph}
\end{figure}
\subsubsection*{Span classification}
\label{ssec:scrm}
The span classification approach improves the classification performance compared to the classifier trained only on the aggregated probabilities from the LLM, in particular for the Text Anonymization Benchmark.
As training this classifier includes fine-tuning a large language model, it requires slighly more training data than the classifier based exclusively on LLM probabilities and PII types. We observe experimentally that the classifier performance stabilizes at around 10\% of training instances for both datasets. Based on ablation experiments, we also see that the outputs of the fine-tuned language model play a major role in the final prediction, along with the PII type.
%Regarding the results of the span classification approach in comparison to the LLM-based one, and the use of additional input, we again observe a boost in the precision score for all datasets, as shown in Table \ref{tbl:prob1}, and a slight drop in recall. This means that the combination of an architecture that can process multiple types of input, and the span and span information allows a model that avoids over-masking, maintaining the data utility of the resulting text.
% \paragraph{\textbf{Cross-domain evaluation}}
% It it also interesting to check whether this performance holds when testing a trained model on a different domain, as well as check how similar two datasets of two different domains are. For this reason, we train the Tabular and Multimodal predictors using the training dataset of the TAB and the annotated Wikipedia corpus respectively, and then test the model on the test dataset of each corpus. The results are presented in Table \ref{tbl:domain_prob}.
% % \begin{table*}[t]
% % \begin{footnotesize}
% % \begin{center}
% % \caption{\label{tbl:domain_prob} Evaluation results when testing each trained model of each predictor on data from another domain. We train the predictors using the training set of each dataset, and then test onthe test dataset.}
% % \begin{tabular}{*9c}
% % \toprule
% % \textbf{Train} & \textbf{Test} & \textbf{Precision} & \textbf{Precision$_{w}$} & \textbf{ Recall$_{all}$} & \textbf{Recall$_{direct}$} & \textbf{Recall$_{quasi}$} & \textbf{F1} \\
% % \midrule
% % &&& \textbf{Tabular Predictor} &&&& \\
% % \midrule
% % \textbf{Wiki} & \textbf{TAB} & 0.539 & 0.579 & 0.982 & 1.000 & 0.964 & 0.696\\
% % \textbf{TAB}& \textbf{Wiki} & 0.813 & 0.862 & 0.816 & 0.962 & 0.787 & 0.814 \\
% % \midrule
% % &&& \textbf{Multimodal Predictor} &&&& \\
% % \textbf{Wiki} & \textbf{TAB} & 0.546 & 0.586 & 0.983 & 1.000 & 0.969 & 0.702\\
% % \textbf{TAB}& \textbf{Wiki} & 0.831 & 0.874 & 0.898 & 0.962 & 0.864 & 0.863 \\
% % \end{tabular}
% % \end{center}
% % \end{footnotesize}
% % \end{table*}
% \begin{table*}[t]
% \begin{footnotesize}
% \begin{center}
% \caption{\label{tbl:domain_prob} Evaluation results when testing each trained model of each predictor on data from another domain. We train the predictors using the training set of each dataset, and then test on the test dataset of the other.}
% \begin{tabular}{*7c}
% \toprule
% & \textbf{Precision} & \textbf{Precision$_{w}$} & \textbf{ Recall$_{all}$} & \textbf{Recall$_{direct}$} & \textbf{Recall$_{quasi}$} & \textbf{F1} \\
% \midrule
% &&& \textbf{Wikipedia train - TAB test} &&& \\
% \midrule
% \textbf{Numerical} & 0.539 & 0.579 & 0.982 & 1.000 & 0.964 & 0.696\\
% \textbf{Num. \& text} & \textbf{0.546} & \textbf{0.586} &\textbf{ 0.983} & \textbf{1.000} & \textbf{0.969 }& \textbf{0.702}\\
% \midrule
% &&& \textbf{TAB train - Wikipedia test} &&& \\
% \midrule
% \textbf{Numerical} & 0.813 & 0.862 & 0.817 & 0.962 & 0.787 & 0.815 \\
% \textbf{Num. \& text} & \textbf{0.831} & \textbf{0.874} & \textbf{0.898} & \textbf{0.962} & \textbf{0.864} & \textbf{0.863} \\
% \end{tabular}
% \end{center}
% \end{footnotesize}
% \end{table*}
% We note that for both the numerical (tabular predictor) and the numerical \& text approach (multimodal predictor), when we train them on the Wikipedia dataset and test them on the TAB test dataset, it results in a low precision score, which in turn boosts the recall score. This means that more information than necessary is masked. On the other hand, when we train the predictors on the TAB training corpus and test them on the Wikipedia test dataset, we get more balanced results with a higher precision score, while also maintaining high recall scores. The scores are also higher than those obtained when training and testing using only the TAB corpus.
% We argue, thus, that the information found in the more generic Wikipedia dataset does not translate well to the legal domain to which TAB belongs. Apart from the difference in training size, with just 453 documents in the Wikipedia dataset in comparison to 1014 ones in the TAB corpus, Wikipedia summaries are smaller in size and contain a lot of information that is related to one individual. On the other hand court cases are typically longer documents, with additional information that is there for administrative purposes and is not highly related to the case or the individual. This results in different PII spans in length, frequency and type, as well as the number of masking decisions per text. In a shorter text with more person-specific information, one might need to mask more PII spans, when compared to a longer text.
%\subsubsection{\textbf{Training Size and Performance}}
%We also investigated how much training data the two previous classifiers need to reach a good performance, since manually labeled data are hard to come by and annotation efforts are costly and time consuming. To this end, we trained each predictor iteratively with a random sample of 1\% to 100\% of the training data and kept track of the F1 score.
%This translates to 8861 instances for TAB and 829 for Wikipedia\footnote{Note that here we mean PII spans, and not documents}. The training instances are PII spans in a text document, labeled with a semantic type, a masking decision, and a list of (sub)word probabilities of this span.
%Figure \ref{fig:training_size} in Appendix \ref{size} shows the performance of the Tabular and Multimodal Predictor for both datasets at different threshold in greater detail.
%We note that there is a difference between the number of instances needed for the two datasets. As we have shown in Figure \ref{fig:wiki_tab_graph} there is a clearer distinction between probabilities that are masked and those that are not for the annotated Wikipedia dataset, for both splits, compared to the TAB corpus, with less outliers as well. This means that a model trained to predict a \ENT{MASK} or \ENT{NO\_MASK} label on data from the annotated Wikipedia dataset will need fewer training examples to achieve good performance. We argue, thus, that instead of an extensive manually labeled dataset, one could annotate a small number of documents (depending on how many PII spans each document contains) to achieve a good classification performance.
%\paragraph{\textbf{Input Importance}}
%To understand whether specific inputs are more important than others to the performance of the model, we also train both the LLM probabilities and the span classification AutoML models with different combinations of input and check their performance.
%For the LLM-based approach (tabular predictor), and for both datasets we use the masking decision given by the annotators along with the following:
%\begin{itemize}
% \item only log probability related inputs (min, max, average, median, sum)
% \item only 1:1 mapping mapping of semantic type used (0-8)
%\end{itemize}
%For the span classification approach (multimodal predictor) and for both datasets, along with the label given by the annotators we use the following combinations of input:
%\begin{itemize}
% \item only log probability related input and text related input (span text, number of (sub)words)
% \item only 1:1 mapping mapping of semantic type and text related input (span text, number of (sub)words)
%\end{itemize}
%Table \ref{tbl:feature1} shows the results for each approach and dataset separately.
% \footnote{Note that for the Numerical \& Text approach we always use the actual string, and the number of tokens and subtokens it consists of in the combination, since this is the reason behind the approach and the use of the multimodal predictor.}.
% \begin{table*}[t]
% \begin{footnotesize}
% \begin{center}
% \caption{\label{tbl:feature1} Input importance for both the LLM-based and span classification approaches for the two datasets. We report the same metrics as in Table \ref{tbl:manual}.}
% \begin{tabular}{*8c}
% \toprule
% & \textbf{P} & $\mathbf{P_{w}}$ & $\mathbf{R}_{\textrm{all}}$ & $\mathbf{F_1}$& $\mathbf{R}_{\textrm{ent}}$& $\mathbf{R}_{\textrm{direct}}$ & $\mathbf{R}_{\textrm{quasi}}$ \\
% \midrule
% \multicolumn{8}{c}{\textbf{LLM-based}}\\
% \midrule
% \midrule
% \multicolumn{8}{c}{\textbf{Wikipedia biographies (test set)}}\\
% \midrule
% \textbf{semantic type} & 0.88 & 0.90 & 0.94 &\textbf{0.91} & \textbf{0.92} & \textbf{1.00} & \textbf{0.91} \\
% \textbf{log prob.} & 0.84 & 0.87 & \textbf{0.96} & 0.89 & \textbf{0.91} & 0.96 & 0.90\\
% \hdashline
% \textit{all input} & \textbf{0.89} & \textbf{0.91} & 0.93 & 0.91 & 0.89 & \textbf{1.00} & 0.88\\
% \hdashline
% \midrule
% \multicolumn{8}{c}{\textbf{Text Anonymization Benchmark (test set)}}\\
% \midrule
% \textbf{semantic type} & \textbf{0.63} & \textbf{0.66} & 0.90 & \textbf{0.74} & 0.94 & \textbf{1.00} & 0.94\\
% \textbf{log prob.} & 0.53 & 0.57 & \textbf{0.99} & 0.69 & \textbf{0.99} & \textbf{1.00} & \textbf{0.99}\\
% \hdashline
% \textit{all input}& 0.61 & 0.64 & 0.93 & 0.73 & 0.93 & \textbf{1.00} & 0.92\\
% \hdashline
% & & & & & & \\
% \midrule
% \midrule
% \multicolumn{8}{c}{\textbf{Span Classification}}\\
% \midrule
% \midrule
% \multicolumn{8}{c}{\textbf{Wikipedia biographies (test set)}}\\
% \midrule
% \textbf{text \& log prob.} & 0.92 & \textbf{0.94} & 0.86 & 0.90 & 0.85 & 0.98 & 0.83\\
% \textbf{text \& sem. type} & 0.92 & 0.93 & \textbf{0.91} & \textbf{0.91} & \textbf{0.87} & \textbf{1.00} & \textbf{0.86}\\
% \hdashline
% \textit{all input} & \textbf{0.93} & \textbf{0.94} & 0.87 & 0.90 & 0.82 & 0.99 & 0.81\\
% \hdashline
% \midrule
% \multicolumn{8}{c}{\textbf{Text Anonymization Benchmark (test set)}}\\
% \midrule
% \textbf{text \& log prob.} & \textbf{0.76} & \textbf{0.78} & 0.91 & \textbf{0.83} & 0.91 & 0.99 & 0.91\\
% \textbf{text \& sem. type} & 0.75 & \textbf{0.78} & 0.91 & 0.82 & 0.91 & \textbf{1.00} & 0.91\\
% \hdashline
% \textit{all input} & 0.74 & 0.77 & \textbf{0.92} & \textbf{0.83} & \textbf{0.93} & \textbf{1.00} & \textbf{0.92}\\
% \hdashline
% \end{tabular}
% \end{center}
% \end{footnotesize}
% \end{table*}
%We note that for the annotated Wikipedia dataset and the LLM-based approach, using only the semantic type as input to the tabular predictor yields better results for the recall of quasi identifiers, with slightly lower but comparable scores for the rest of the metrics, compared to the combination of all inputs. The use of log probability-based input on the other hand shows a lower precision and recall for direct identifiers score, but again, a higher recall for quasi identifiers score.
%As we have discussed already, in Figure \ref{fig:wiki_tab_graph} we see that there is a clearer distinction between probabilities and masking decisions. The results in Table \ref{tbl:feature1} suggest that there is also a relationship between the semantic type and the masking decision; meaning that specific semantic types tend to be masked more often, which leads to the good performance of the model, even when only using one of the inputs. The difference in performance when combining these, indicates a slight confusion of the model (lower recall for quasi identifiers) which we argue means that the combination of semantic type \textit{and} and log probability and its relation to a masking decision is not as clear as the individual inputs are. For the TAB dataset, we notice a lower precision score which is in line with the \textit{all input} results . When using only log probabilities, the precision score is very low which in turn boost the recall scores due to overmasking. The use of only the semantic type as input results in slightly higher precision and recall for quasi identifiers score. Figure \ref{fig:wiki_tab_graph} and these results show that there isn't a clear signal between either of the inputs and the masking decision made by the annotators.
%For the span classification approach, with a trained multimodal predictor, and the annotated Wikipedia dataset we notice the same trend as with the LLM-based approach. The combination of all input yields better precision scores, which in turn lowers the recall scores. If we only take the recall score into account, the combination of only text related information and the semantic type seems to achieve good results, with a comparable precision score to the use of all input, meaning that there is a good connection between the actual string, the number of (sub)words and the semantic type which the model picks up. For the TAB corpus on the other hand, we notice that all the combinations of inputs yield very comparable precision, and recall results compared to the use of all inputs, with the latter showing better recall scores. The precision scores are better for the combination of text and log probabilities. We argue that for this dataset the use of all inputs enables the model to make better masking decisions, compared to only some of the inputs.
\subsubsection*{Perturbations}
\label{ssec:threshold}
Despite its theoretical benefits (such as the possibility to directly assess the extent to which a PII span contributes to predicting a direct personal identifier), the perturbation-based method performs poorly, and does not seem to improve upon the majority rule baseline. Indeed, the perturbation mechanism, in combination with the cost function employed to fix the threshold on the log-probabilities, leads to masking the vast majority of text spans.
%For the perturbation-based risk indicator, in Table \ref{tbl:manual} we once again see a difference in performance between the annotated Wikipedia dataset and the TAB corpus. The threshold chosen on the training dataset of Wikipedia yields good results in the test dataset as well, with similar performance in all metrics. On the other hand we see a drop in performance for TAB, with a much lower precision score on the test set, indicating an overmasking trend.
% Finally, applying the optimization algorithm to the output, in both cases, results in much generally lower performance recall wise, but less semantic loss as indicated by the higher precision scores.
%This indicator is also based on language model probabilities and as discussed so far, we argue that such approaches will generally work better for datasets where he PII spans that are annotated as masked have a lower probability, whilst high probability spans are unmasked, meaning a clearer correlation between such probabilities and the annotated masking decisions. For example, as we have seen in Figure \ref{fig:wiki_tab_graph}, the annotated Wikipedia dataset is more in line with this risk indicator, since there is a more clear difference between probabilities (and thus (sub)words) that are masked and those that are not, compared to TAB. In this case, an optimal threshold, like the one we propose here, will yield better results. We note that the performance of this indicator shows the same performance as the majority vote baseline, where we mask all detected PII. It seems that our perturbation approach in combination with the cost function we decided to employ to find a threshold for each dataset, results in the same type of overmasking.
% Regarding the use of the optimizer, we see the same trend as before when for both manually labeled data and automatically detected ones, data utility is favored, seeing how the precision score is higher, but with a lower recall score, meaning a higher privacy risk.
% Anthi: I believe we could potentially do without this section so I removed it.
% \paragraph{\textbf{Semantic Pair Analysis}}
% Combinations of PII spans are the focus of this risk indicator, so breaking down the influence each semantic type has on the probability of the target span is an interesting direction to explore. For this reason we perform an analysis on the types of semantic type pairs that cause a difference in performance (positive or negative) across the two train datasets, shown in Figure \ref{fig:wiki_person} and \ref{fig:tab_person}. More specifically, we focus on the \ENT{PERSON} category as person names as one of the most identifying pieces of information for an individual, and we calculate which types of PII, when masked at the same time as a person name, affect the probability of the latter, by making the name either more difficult or easier to predict. For a more detailed breakdown of all semantic type combinations of PII see Appendix \ref{graphs}.
% \begin{figure}[t]
% \centering
% \includegraphics[width = 0.95\textwidth]{figures/wiki_person.png}
% \caption{Effect of various semantic types on the \ENT{PERSON} type on the annotated Wikipedia train dataset}
% \label{fig:wiki_person}
% \end{figure}
% \begin{figure}[t]
% \centering
% \includegraphics[width = 0.95\textwidth]{figures/tab_person.png}
% \caption{Effect of various semantic types on the \ENT{PERSON} type on the TAB train dataset}
% \label{fig:tab_person}
% \end{figure}
% We note some similarities between the two datasets. It seems that removing \ENT{DATETIME}, and \ENT{LOC} spans generally make the person names harder to predict. We assume this is because these two semantic types refer to dates of birth or death and places of origin for the individual. \ENT{ORG}, \ENT{MISC}, and \ENT{DEM} spans on the other hand, when removed, make it easier for a person's name to be guessed by the language model, since they are spans that are not always directly related to the individual. We also observe that removing other \ENT{PERSON} spans results in person names being harder to predict in the annotated Wikipedia datasets, with the opposite being true for the TAB corpus. Finally, in both datasets it seems that \ENT{QUANTITY} does not concretely affect the probability of a name.
\subsubsection*{Sequence labelling}
\label{ssec:sc}
Overall, this approach seems to provide the best balance between precision and recall scores, which is to be expected from a large language model fined-tuned on manually labeled data. In contrast to the span classification method, which only considers the tokens inside the PII span itself, the sequence labelling approach can take into account the surrounding context of each span.
One should note that the results in Tables \ref{tbl:manual} and \ref{tbl:automatic} are obtained with a default threshold of 0.5 on the masking probability. This threshold can, of course, be adjusted to increase the relative importance of recall scores, as is often done in text sanitization to increase the cost of false negatives.
The method based on partial matches, which considers a PII span as risky if at least one constituting token is marked as risky, provides the best results. We also observe that the results on the Wikipedia biographies are lower than those obtained for TAB. This is likely to be due to the smaller number of biographies available for training (453 short texts) compared to the 1014 documents in the training set of TAB.
%All direct identifiers are masked when we consider a partial match, along with the majority of quasi identifiers. At the same time the precision score is also high, which means that the resulting documents have high data utility, which is the desired outcome for text sanitization techniques.
%The same approach, though, does not result in the best performance across all risk indicators for the Wikipedia biographies. Despite all scores being relatively high, this approach is comparable to almost all other risk indicators. The amount of training data was low with only 453 documents which might have affected the performance of the model, since this dataset was mainly created for evaluation purpose \citep{bootstrapping}. All the hyperparameters (number of epochs, label weights etc.) were also chosen after the Longformer model trained on the TAB corpus. More hyperparameter tuning might have resulted in better performance. Nevertheless we also observe how for this dataset, the majority vote baseline of masking all detected spans seemingly also shows a good balance between precision and perfect recall, highlighting an over-masking trend which both affects the privacy risk indicator trained on this data, leading in overmasking, as well as favors risk indicators like the perturbation one which masks more PII spans than necessary.
%Regarding the difference in performance between a strict and partial overlap, not surprisingly we see a boost in performance in the latter. The sequence labelling models both detect and mask spans that need to be masked in a text to protect the identity of an individual. Even though they are trained on detected PII spans by annotators, their subsequent detection and masking will not exactly match that of the gold standard. A partial token match with the manually labeled spans will then favor the performance when such a risk indicator is applied.
\subsubsection*{Web Search}
\label{ssec:wq}
Table \ref{tbl:manual} shows a clear difference between using intersection of URLs and using the estimated number of hits, with the first showing a very low recall score while the latter shows a more balanced performance between precision and recall. The intersection of URLs, though, provides better explainability than the number of hits, as one can point the user to the actual URL(s) that contribute to the re-identification.
%Although using the total number of hits is somewhat more balanced, it fundamentally is much less discerning than using the intersection of URLs, so most spans are predicted as possessing a re-identification risk. Using the intersection of URLs has a much better performance when recalling direct identifiers than qausi identifiers, which could be useful, as any spans predicted to be a risk by this method is very likely to be a direct identifier and therefore possess an even higher risk.
While using the intersection of URLs is hampered by the limitation on the number of pages, the chances of a meaningful crossover between target and entities in a text diminishes the deeper into the tail of web results we delve. A possible solution is to try to analyze the text found in the URLs in order to evaluate whether the target individual is mentioned or not.
%We assume that the intersection of the urls between the name of the individual to be protected and the spans does not results in clear privacy risk estimation, potentially due to the limitation of number of pages we examined.
On the other hand, the number of hits up to a limit is a better approximation of risky entities, despite the unreliability of the number of hits as given by the API.
Note, though, the restrictions we have already mentioned in Section \ref{ssec:wqra} that are bound to affect the performance. Even though the web can be seen as a very useful and detailed approximation of potential background knowledge an attacker could have and use for re-identification purposes, the technical details of utilizing this make it hard to explain clearly the reason behind the performance.
%\subsubsection*{Automatically Detected PII}
%\label{ssec:adpii}
%For all privacy risk indicators and both datasets we note a similar trend of a performance drop for all evaluation metrics, precision and recall based ones, as shown in Table \ref{tbl:automatic}. This is to be expected since, as we have already shown and extensively discussed in Section \ref{ssec:er_results}, the spans that are detected by the entity recognizer do not exactly match those detected by the human annotators. Since the latter is what we evaluate against, it is clear that privacy risk indicators that utilize manually detected PII by human annotators will outperform the same metrics using PII detected by the privacy-oriented entity recognizer.
%We argue though, that this change in performance does not always translate to a higher privacy risk or a worse data utility. The subjective nature of the task of text sanitization also translates to the PII detection part of it. As we have already shown in the various examples so far, a partial overlap of PII offsets that are masked could be an equally valid solution, compared to what the annotator decided to detect and mask.
\subsubsection*{Summary}
\label{ssec:overall}
%Comparing all the risk indicators presented so far we observe that the performance is generally dependent on the following:
%\begin{itemize}
% \item risk indicator requiring manually labeled training data or not,
% \item Domain of the data in combination with human annotators' masking decisions,
% \item PII detection method.
%end{itemize}
As can be expected, privacy risk indicators trained on manually labelled data, in particular sequence labelling, provide the best performance when comparing the spans identified as high risk with expert annotations. Text data annotated with masking decisions is, however, scarce to non-existent for many text sanitization domains.
When it comes to data utility, we also observe that the precision score weighted by information content ($\mathbf{P}_w$) is higher than the regular precision score for all privacy risk indicators. As argued in \citet{benchmark}, this weighted score is more informative than the basic precision score as it takes into account the informativeness of each token. As a consequence, a higher weighted precision score means that overmasking tends to occur on less informative tokens.
%Not surprisingly, for example, the indicators that rely on manually labeled data are usually the best performing ones, especially when the PII is also detected manually since it matches the gold standard we evaluate against. More interestingly, the performance of these risk indicators seems to be tied also to the specific dataset and domain, with more interesting results for the TAB corpus than the Wikipedia biographies, which as we have discussed before, shows an overmasking trend that makes it difficult to judge the effectiveness of an approach.
%The TAB corpus consists of much longer texts, that contain information about individuals that are not well known the way individuals in Wikipedia are, and it also contains information that does not refer only to the individual (e.g. court information, dates etc.). The annotators, thus, would not need to mask as many entities. Contrary to that, a Wikipedia biography contains a lot of information in much shorter text, all of which refers to the person the article is about, information that is also well-known and specific. This might have led the annotators to mask more entities than necessary.
%################################################################################
% NOTE FROM ANTHI: I commented out this next part, since the combination of indicators are not that interesting to discuss, performance wise. I kept the part after this one about sanitization and data utility. If you think it is important we can un-comment it out.
% ==> comment from Pierre: I think it can still be useful, but we don't need to
% use a lot of spaces for it
%################################################################################
\subsection{Combination of Risk Indicators}
\label{ssec:combos}
Finally, we also evaluate the performance of the privacy risk indicators in combination. More specifically, we consider a manually detected PII span as high-risk if it has been marked as such by \textit{at least} one, two or three risk indicators.\footnote{For the web query risk indicator described in Section \ref{ssec:wqra}, we use the hit-based one since it shows more interesting results. For the sequence labelling model described in Section \ref{ssec:supervised}, we use the spans that were masked under the partial offset match.} The resulting performance is shown in Table \ref{tbl:combinations}.
\begin{table*}[t]
\begin{footnotesize}
\begin{center}
\caption{\label{tbl:combinations} Evaluation results (on manually labelled PII spans) for the combination of the privacy risk indicators where a PII span is masked if it is considered risky by at least one, two, or three of the five privacy risk indicators presented in the paper.}
\begin{tabular}{*8c}
\toprule
& \textbf{P} & \textbf{P$_{w}$} & \textbf{ R$_{all}$} & \textbf{F1} & \textbf{R$_{ent}$} & \textbf{R$_{direct}$} & \textbf{R$_{quasi}$}\\
\midrule
\multicolumn{8}{c}{\textbf{Wikipedia biographies (test set)}}\\
\midrule
\textit{$\geq$ 1} & 0.78 & 0.82 & \textbf{1.00} & 0.87 & \textbf{1.00} & \textbf{1.00} & \textbf{1.00}\\
\textit{$\geq$ 2} & 0.80 & 0.84 & \textbf{1.00} & 0.89 & \textbf{1.00} & \textbf{1.00} & \textbf{1.00}\\
\textit{$\geq$ 3} & \textbf{0.84} & \textbf{0.87} & 0.98 & \textbf{0.90} & 0.96 & \textbf{1.00} & 0.96\\
\midrule
\multicolumn{8}{c}{}\\
% &&& \textbf{Wikipedia:} \textit{ER PII} &&& \\
% \midrule
% \textit{$\geq$ 1} & & & & & & \\
% \textit{$\geq$ 2} & & & & & & \\
% \textit{$\geq$ 3} & & & & & & \\
% \midrule
\midrule
\multicolumn{8}{c}{\textbf{Text Anonymization Benchmark (test set)}}\\
\midrule
\textit{$\geq$ 1} & 0.52 & 0.56 & \textbf{1.00} & 0.68 & \textbf{1.00}& \textbf{1.00} & \textbf{1.00}\\
\textit{$\geq$ 2} & 0.52 & 0.56 & \textbf{1.00} & 0.69 & \textbf{1.00} & \textbf{1.00} & \textbf{1.00}\\
\textit{$\geq$ 3} & \textbf{0.61} & \textbf{0.64} & 0.98 & \textbf{0.75} & 0.99 & \textbf{1.00} & 0.99\\
% \midrule
% &&& \textbf{TAB:} \textit{ER PII} &&& \\
% \midrule
% \textit{$\geq$ 1} & & & & & & \\
% \textit{$\geq$ 2} & & & & & & \\
% \textit{$\geq$ 3} & & & & & & \\
\end{tabular}
\end{center}
\end{footnotesize}
\end{table*}
Although the combination of privacy risk indicators with $\geq 3$ positive signals leads to overmasking, it does detect all direct identifiers and virtually all quasi-identifiers while retaining a higher precision than the majority rule baseline. This high recall is important in text sanitization, as the cost of ignoring a high-risk PII span is much higher than the cost of a false positive. While overmasking does slightly reduce the data utility (by making the text less readable or stripped of some useful content), the presence of a false negative implies that it remains possible to re-identify the individual(s) in question, and that their privacy is therefore not fully ensured.
% It seems that different number of risk indicators yield similar results for both dataset. If we consider a span as needing to be masked if it is considered risky by at least 1 of our five privacy risk indicators, we notice that we achieve perfect recall both for direct and quasi identifiers, in the expense of precision. We have successfully protected the identity of the individual but at the same time the resulting text has lost much of its data utility. The same can be observed if we only mask spans that were deemed risky by 2 out of 5 indicators, where we note that we still get high recall scores, but with a slightly higher precision. Finally, masking spans that were masked by more than half of the risk indicators, results in a slight drop in the recall for quasi identifiers, but a higher precision score, meaning better data utility but a risk of re-identification through the combination of such identifiers that are left in the text. We also note that the precision score is generally higher for the Wikipedia dataset than the TAB corpus.
% % We also repeat the experiments with PII detected by the entity-recognizer. We observe a similar behavior in regards to precision and recall scores in relation to the number of risk indicators that are taken into account for the specific combination (i.e 1, 2 or 3), but with generally lower values than when the PII was manually detected due to the difference in PII compared to the gold standard when this information is automatically detected.More specifically, for the annotated Wikipedia dataset this translates to lower $F_1$ with 0.064, 0.113 and 0.077 points difference for $\geq$ 1, $\geq$ 2 and $\geq$ 3 respectively. The same goes for the TAB corpus, with 0.072, 0.087, and 0.089 points difference respectively.
% % Comparison of Table 17 to individual metrics
% For both datasets, comparing this performance to individual risk indicators we have discussed in previous sections, it seems that this combination of at least some of the five privacy risk indicators performs better recall wise, with a slightly lower precision score. We argue thus that the combination of more than one privacy risk indicators is able to mask more relevant PII information than individually in the two datasets, resulting in better performance, with a small data utility loss. Despite the good performance, we don't have information into specific approaches and how their combination affects this performance. For this reason we plot the performance (precision and recall split for direct and quasi identifiers) for all possible combinations of the five privacy risk indicators we have presented in this paper, shown in Figure \ref{fig:specific_performance}.
% Anthi: Commented out generally anything about agreement between risk indicators. Kept only the discussion of specific combinations and their performance.
% \begin{figure}[t]
% \centering
% {\includegraphics[width=0.49\textwidth]{figures/wiki_combos.png}}
% \hfill
% {\includegraphics[width=0.49\textwidth]{figures/tab_combos.png}}
% \caption{The number of PII spans that were masked by the agreement of different number of privacy risk indicators}
% \label{fig:combo_graph}
% \end{figure}
% To better understand this behavior, in Figure \ref{fig:combo_graph} we plot the agreement of different risk indicators, meaning the number of spans that were masked by different indicators, both for manually labeled PII spans and automatically detected ones. We observe that for the annotated Wikipedia dataset there were many PII spans that were masked by only one risk indicator, showing, thus, a disagreement between them. Spans that were detected by three out of the four indicators, both for manually and automatically detected spans come second in numbers. This insight combined with the performance shown in Table \ref{tbl:combinations} indicates that the agreement of spans that were masked by at least two or three privacy risk indicators correlates well with the decisions made by the human annotators, hence the higher performance scores, especially compared to the combination of all privacy risk indicators \textit{(=4)} which shows a much lower performance.
% For the TAB test dataset, on the other hand, we first note a clear difference between the agreement of the risk indicators and the method of detecting PII spans, which is larger compared to the annotated Wikipedia dataset, meaning that the source of PII affects the agreement between various risk indicators. As we see in Table \ref{tbl:combinations}, the performance for this dataset, especially regarding data utility is relatively low, which means that any sort of combination of risk indicators results in an overmasking of the text, compared to the annotators' decisions. We also note that compared to the annotated Wikipedia dataset, the agreement by all four risk indicators does not result in significantly lower performance. On the contrary, we see a drop in performance for quasi identifiers only, which in turn boosts the precision score. This means that for the TAB dataset there is generally a better correlation between the agreement of the privacy risk indicators and the decisions made by the annotators. We note though, that this performance might be affected by the supervised model described in Section \ref{ssec:supervised}, which is trained on the TAB corpus and will thus, perform better on similar data.
% We also perform an analysis of the agreement and disagreement between all combinations of privacy risk indicators, shown in Figure \ref{fig:fig_agreement} as well as a breakdown of the actual performance of each of these combinations by plotting the precision score along with the recall for direct and quasi identifiers in Figure \ref{fig:specific_performance}.
% \begin{figure*}[t!]
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/wiki_manual_agree.png}%
% \label{subfig:a}%
% }\hfill
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/wiki_er_agree.png}%
% \label{subfig:b}%
% }\\
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/tab_manual_agree.png}%
% \label{subfig:c}%
% }\hfill
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/tab_er_agree.png}%
% \label{subfig:d}%
% }
% \caption{Agreement and disagreement in number of spans for different combinations of privacy risk indicators. We report the results for both the annotated Wikipedia test dataset and the TAB test dataset and we also include both manually and automatically detected PII spans}
% \label{fig:fig_agreement}
% \end{figure*}
% \begin{figure*}[t!]
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/specific_wiki_combos_manual.png}%
% \label{subfig:a}%
% }\hfill
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/specific_wiki_combos_er.png}%
% \label{subfig:b}%
% }\\
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/specific_tab_combos_manual.png}%
% \label{subfig:c}%
% }\hfill
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/specific_tab_combos_er.png}%
% \label{subfig:d}%
% }
% \caption{Precision and recall scores, the latter split for direct and quasi identifiers, for all combination of privacy risk indicators. }
% \label{fig:specific_performance}
% \end{figure*}
% ANTHI: I took this part out, I think Table 9 suffices
% \begin{figure}[t]
% \centering
% {\includegraphics[width=0.49\textwidth]{figures/specific_wiki_combos_manual.png}}
% \hfill
% {\includegraphics[width=0.49\textwidth]{figures/specific_tab_combos_manual.png}}
% \caption{Token-level precision and entity-level recall score, the latter split for direct and quasi identifiers, for all combinations of privacy risk indicators. }
% \label{fig:specific_performance}
% \end{figure}
% \begin{figure*}[t!]
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/specific_wiki_combos_manual.png}%
% \label{subfig:a}%
% }\hfill
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/specific_wiki_combos_er.png}%
% \label{subfig:b}%
% }\\
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/specific_tab_combos_manual.png}%
% \label{subfig:c}%
% }\hfill
% \subfloat{%
% \includegraphics[width=.48\linewidth]{figures/specific_tab_combos_er.png}%
% \label{subfig:d}%
% }
% \caption{Precision and recall scores, the latter split for direct and quasi identifiers, for all combination of privacy risk indicators. }
% \label{fig:specific_performance}
% \end{figure*}
% For example, for the annotated Wikipedia dataset, we note a very high agreement between the spans masked by the perturbation based indicator \textit{and} the ones masked by the supervised classifier in Figure \ref{fig:fig_agreement}. At the same time, for this combination in Figure \ref{fig:specific_performance} we see a high precision score but at the same time a low recall score. This means that despite the two indicators masking similar spans, only a few of them were actually masked by the annotators. On the other hand, we see that even though the combination of the tabular predictor and the perturbation based indicator does not show a very high agreement, it shows nevertheless a performance that seems to balance both the precision and the recall scores. We conclude that most of the spans of the agreement were also masked by the human annotators we evaluate against, which leads to this good performance.
% For the TAB test dataset we observe a similar trend. There is a high agreement between the tabular predictor and the perturbation based indicator. However this results in a low precision score which in turn boosts the recall score. This high agreement between the indicators led, in this case, to overmasking and a low data utility. The best performing combination seems to be the numerical \& text (multimodal predictor) and the supervised classifier one, which do not show a high agreement score. Again, we argue that despite the number of agreed on spans, these spans were also masked by the annotators, hence the higher score.
%For the annotated Wikipedia dataset, we note that some combination favor data utility, while some show more balanced between utility and privacy risk. For example, the combination of the LLM-based approach and the span classification approach, as well as the span classification and sequence labelling combination, show high precision scores but very low recall for both types of identifiers. The resulting text has thus high data utility, but there is, at the same time, a high risk of re-identification. On the other hand, we observe that combinations like the LLM-based and the Perturbation one, shows a high recall for direct identifiers, meaning a lower re-identification risk, with high precision and recall for quasi identifiers too. For TAB, as shown in the same Figure, we note that the recall scores are generally higher than those shown in the Wikipedia dataset, with generally lower precision scores, an overmasking, thus, trend. The best performing combinations would be the combination of the LLM-based approach and span classification with relatively high precision but also high recall scores for both identifiers, as well as the span classification and perturbation approach combination.
% ANTHI: I took this part out, I think Table 9 suffices
% Comparing the different performance scores we note that the best performing combination of indicators for the annotated Wikipedia dataset is the perturbation based indicator and the tabular predictor. The same combination is the best performing one when the PII is detected by the entity recognizer. This means that the spans that were masked by \textit{both} these metrics were also masked by the annotators, leading to a high data utility and a high privacy risk. This is especially interesting since the perturbation based indicator does not rely on manually labeled data, and as discussed in Section \ref{sec:discussion} such an indicator performs well when applied to data whose language model probabilities show clear distinction for specific spans.
% For the TAB test dataset on the other hand, for manually detected PII, we observe that all combinations show a relatively good performance with some of them favoring data utility and others favoring privacy risk. Here, the combination of the span classification and perturbation based indicators would seem to strike the best balance between precision and recall scores, with a relatively low loss of data utility and a lower privacy risk as well. For automatically detected PII, the same combination shows a lower precision score, thus leading to overmasking, with the combination of the perturbation and the supervised classifier being the best performing one.
% ANTHI: I took this part out, I think Table 9 suffices
% Comparing the better performing combinations to the individual performance of the risk indicators of each combination, we notice that for the annotated Wikipedia dataset, the combination of the LLM-based and the perturbation based approaches shows the same precision and recall for quasi identifiers, but a lower recall score for recall for direct identifiers, when compared to the first element of the combination, and higher precision and lower recall for quasi identifiers when compared to the latter. For TAB, the LLM-based and span classification combination shows similar lower performance than the individual elements of the combination, while the span classification and perturbation combination shows almost identical performance when compared to the span classification results. We conclude thus, that a potential combination of risk indicators we have presented in this paper can favor some evaluation metrics over the others, but generally do not tend to outperform the individual indicators.
% For the TAB dataset, the combination of span classification approach with perturbation, leads to better performance than the latter, but almost identical performance to the first, with a very slight drop in performance for all metrics. For automatically detected PII, the score is comparable the performance of the supervised classifier, and again, better than the perturbation risk indicator. We conclude thus, that a combination of risk indicators we have presented in this paper can favor some evaluation metrics over the others, but generally do not outperform the individual indicators.
%\subsubsection*{Sanitization and Data Utility}
%\label{ssec:complete_sanitization}
%Throughout the evaluation of all the privacy risk indicators we present and discuss in this paper, we sometimes place emphasis on the balance between privacy risk and data utility. As we mentioned in Section \ref{sec:metrics} though, a perfect sanitization system is one that would achieve a score of 1.0 for the recall for direct identifiers, meaning that all mentions of the individuals we are trying to protect have been masked in the text by the privacy risk indicator. This results in a text that is much harder for an attacker to re-identify.
%Regarding perfect sanitization and individual risk indicators, this is only achieved when using manually labeled data for both datasets for only specific risk indicators, as for example the sequence labelling models or the perturbation-based risk indicator, shown in Table \ref{tbl:manual}.
% the annotated Wikipedia dataset by the following risk indicators, shown in Table \ref{tbl:manual}:
% \begin{itemize}
% \item LLM probability-based approach (\textit{LLM-probabilities (AutoML model)}
% \item Sequence labelling model trained on manually labeled data (\textit{Sequence labelling (RoBERTa, partial match)})
% \end{itemize}
% For the TAB dataset, the same goes for the following risk indicators, also shown in Table \ref{tbl:manual}:
% \begin{itemize}
% \item LLM probability-based approach (\textit{LLM-probabilities (AutoML model)}
% \item Span classification approach (\textit{Span classification (AutoML model)}
% \item Perturbation-based approach (\textit{Span classification (AutoML model)}
% \end{itemize}
%Some risk indicators that show high recall, typically show lower precision at the same time (e.g. the perturbation based one). This means that complete sanitization can be achieved, but often on the expense of data utility due to over-masking. On the other hand very high precision indicates a high privacy risk, as is the case with the URL intersection approach of the web search risk indicator, where the majority of direct and quasi identifiers were not masked.
% For the privacy risk indicators we mention here though, the data loss is not that high compared to the best performing indicators for the same metric, so we conclude that it is a reasonable trade-off to have.
\section{Conclusions and Future Work}
\label{sec:conclusion}
This paper presented a thorough empirical analysis of two key components of text sanitization methods, namely entity recognition and privacy risk indicators.
%presented a new evaluation for an already established privacy-oriented entity recognizer that is able to detected different semantic types of PII spans. We also presented a number of privacy risk indicators to judge whether a PII span or a combination of spans need to be masked or not in the text to protect the identity of the individual.
Our experimental results, based on two complementary corpora, indicate that the entity detection task is the most straightforward step to automate. We highlighted the need to go beyond the mere detection of named entities and identify other types of text spans that may provide identifying information. To this end, we showed how to extract large lists of person-related attributes extracted from a knowledge graph such as Wikidata, and thereby apply those lists, along with a standard NER model, to automatically annotate a silver corpus of PII spans. This silver corpus can, in turn, serve as training data to fine-tune a domain-specific, privacy-oriented entity recognizer.
%Creating an entity-recognizer from automatic annotations from a knowledge graph and a silver corpus . This can be adapted to any domain and any type of PII span, e.g. \ENT{MEDICAL}, \ENT{DRUG} or \ENT{INCIDENT} category for patient records, \ENT{BUSINESS} or \ENT{PRODUCT} for email conversations or customer service chats, etc.
Determining text spans associated with a high re-identification risk is the most challenging part of the task. A system that masks all detected spans leads to a low privacy risk, but also a comparatively low data utility.
%Finding the right balance between risk mitigation and data utility is far from trivial.
We presented five distinct indicators of privacy risk, respectively based on LLM probabilities, span classification, perturbations, sequence labelling and web search. Evaluation results comparing the outputs of those approaches with human annotations demonstrate the difficulty of the task. Sequence labelling leads to masking decisions that are most in line with expert annotations, but this approach hinges upon the availability of labelled training data, a requirement that is rarely satisfied in text sanitization tasks. The use of web search also constitutes a promising direction, but suffers from technical constraints arising from the reliance on search engine APIs.
%Our results show that the performance of an indicator is dependent on many factors, like the availability of manually labeled data and the way these were annotated, the domain of the data etc. This means that there is no one solution to fit all in estimating privacy risk, since different domains should be treated differently for optimal results. For example, a patient record where the majority of the information in the text is about the individual to be protected might benefit from a risk indicator that favors privacy risk, so as to minimize it. On the other hand, an email conversation that is of a more generic nature and less specific might be better suited to a risk indicator that favors data utility and is less prone to overmasking.
The present paper did not elaborate on how masking should be performed. A common option is to simply replace the selected spans by a black box or a generic string such as ``***''. However, to mitigate the loss of data utility , it is often preferable to replace those PII spans with other, less specific spans, such as editing ``Oslo'' into ``[city in Norway]'' or ``January 6, 2022'' into ``2022''. \citet{olstad-etal-2023-generation} explore an approach for selecting suitable replacements for different types of PII spans, which we evaluated against human decisions. Such an approach could be extended to different domains and different types of PII spans.
%The empirical evaluation of the data utility of sanitized texts (based on e.g.~their performance on various downstream tasks) is another question left for future work.
Evaluating text sanitization tasks is a challenging problem, notably due to the presence of multiple equally correct solutions for a given document \citep{lison-etal-2021-anonymisation}. In this work we evaluate against manually annotated documents, using several expert annotators for each document to ensure a reasonable set of possible solutions. Relying on manual annotations is, however, not always feasible, so alternative evaluation methods suitable for the task should also be explored. \textit{Re-identification} constitutes a promising approach \citep{scaiano2016unified,mozes2021no,10.1007/978-3-031-13945-1_12}, and operates by carrying out an attack aiming to determine whether an individual was part of the sanitized collection of documents, often having access to additional, external resources. Future work will look at the use of such re-identification attacks as an alternative measure of the text sanitization strength.
% \bmhead{Acknowledgments}
% We acknowledge support from the Research Council of Norway (CLEANUP project, grant nr. 308904).
\section*{Declarations}
\subsection*{Author Contribution}
A.P: conceptualization, implementation of privacy risk indicators (apart from web search), evaluation of privacy-aware entity recognition, evaluation of privacy risk indicators alone and in combination, creation of figures, creation of table, writing and editing of the final manuscript. P.L: supervision, writing and editing of the final manuscript. M.A: web search risk indicator, writing. L.Ø: supervision, writing. I.P: supervision, writing. All authors reviewed the manuscript prior to submission.
\subsection*{Funding}
The research leading to these results received funding from the Research Council of Norway (CLEANUP project) under Grant nr. 308904.
\subsection*{Conflict of Interest}
The authors have no conflict of interest to declare.
\subsection*{Data Availability Statement}
No datasets were generated during the current study.
\subsection*{Acknowledgment}
We acknowledge support from the Norwegian Research Council (CLEANUP project, grant nr.308904).
%%===========================================================================================%%
%% If you are submitting to one of the Nature Portfolio journals, using the eJP submission %%
%% system, please include the references within the manuscript file itself. You may do this %%
%% by copying the reference list from your .bbl file, paste it into the main manuscript .tex %%
%% file, and delete the associated \verb+\bibliography+ commands. %%
%%===========================================================================================%%
\newpage
% NOTE FROM ANTHI ---> \input is not allowed as per the instructions so I put the whole appendix here
% \input{appendix}
\appendix
\appendixpage
\section{Human properties from Wikidata}
\label{human_properties}
The two tables below show the selected Wikidata properties mentioned in Section \ref{sec:properties} that constitute the \ENT{DEM} and \ENT{MISC} gazetteers.
\subsection*{DEM-related properties}
\begin{longtblr}{|p{28mm}|p{28mm}|p{63mm}|} \hline
\textbf{Property} & \textbf{Example} & \textbf{Description} \\ \hline
\raggedright hairstyle / hairlength (P8839) & \raggedright afro & style of cutting, arranging, or combing the hair on the subject's scalp \\ \hline
\raggedright grants (P5460) & \raggedright Bachelor of Arts & confers degree, honor, award, prize, title, certificate or medal denoting achievement to a person or organization \\ \hline
\raggedright next lower rank (P3729) & \raggedright General & ``lower rank or level in a ranked hierarchy like sport league, military ranks. If there are several possible, list each one and qualify with ````criterion used"" (P1013), avoid using ranks and date qualifiers. For sports leagues/taxa, use specific properties instead." \\ \hline
\raggedright special rank (P5012) & \raggedright General of the Police of the Russian Federation & non-military rank given to a civil office holder in Russia \\ \hline
\raggedright political ideology (P1142) & \raggedright social liberalism & political ideology of an organization or person or of a work (such as a newspaper) \\ \hline
\raggedright office held by head of the organization (P2388) & \raggedright Chief Justice of the United States & position of the head of this item \\ \hline
\raggedright ethnic group (P172) & \raggedright Ashkenazi Jews & subject's ethnicity (consensus is that a VERY high standard of proof is needed for this field to be used. In general this means 1) the subject claims it themselves, or 2) it is widely agreed on by scholars, or 3) is fictional and portrayed as such) \\ \hline
\raggedright facial hair (P8852) & \raggedright chin curtain & style of cutting, arranging, or combing the hair on the subject's face (usually on the chin, cheeks, and upper lip region); beard \\ \hline
\raggedright language used (P2936) & \raggedright Catalan & language widely used (spoken or written) in this place or at this event \\ \hline
\raggedright writing language (P6886) & \raggedright French & language in which the writer has written their work \\ \hline
\raggedright religion (P8929) & \raggedright agnosticism & religious or world view affiliation of a person, organization or religious building \\ \hline
\raggedright sex or gender (P21) & \raggedright male organism & sex or gender identity of human or animal. For human: male, female, non-binary, intersex, transgender female, transgender male, agender. For animal: male organism, female organism. Groups of same gender use subclass of (P279) \\ \hline
\raggedright languages spoken, written or signed (P1412) & \raggedright Old Chinese & language(s) that a person or a people speaks, writes or signs, including the native language(s) \\ \hline
\raggedright noble title (P97) & \raggedright baron & titles held by the person \\ \hline
\raggedright position held (P39) & \raggedright President of the United States & subject currently or formerly holds the object position or public office \\ \hline
\raggedright Y-DNA Haplogroup (P4426) & \raggedright Haplogroup R1b & Y-DNA haplogroup of a person or organism \\ \hline
\raggedright original language of film or TV show (P364) & \raggedright italian & ``language in which a film or a performance work was originally created. Deprecated for written works and songs; use P407 (````language of work or name"") instead." \\ \hline
\raggedright canonization status (P411) & \raggedright saint & stage in the process of attaining sainthood per the subject's religious organization \\ \hline
\raggedright occupation (P106) & \raggedright writer & ``occupation of a person; see also ````field of work"" (Property:P101), ````position held"" (Property:P39)" \\ \hline
\raggedright eye color (P1340) & \raggedright blue-green & color of the irises of a person's eyes \\ \hline
\raggedright culture (P2596) & \raggedright Inca Empire & human culture or people (or several cultures) associated with this item \\ \hline
\raggedright practiced by (P3095) & \raggedright cheerleader & type of agents that study this subject or work in this profession \\ \hline
\raggedright official language (P37) & \raggedright English & language designated as official by this item \\ \hline
\raggedright dialect of (P4913) & \raggedright Northern Sami & ``language of which an item with this property is a dialect. Use in addition to ````subclass of"" (P279) if a languoid is also considered a dialect." \\ \hline
\raggedright political alignment (P1387) & \raggedright left-wing & political position within the left-right political spectrum \\ \hline
\raggedright educational stage (P7374) & \raggedright undergraduate education & ``educational stage of a specific school; qualifier of ````educated at"" (P69): the education stage of someone's attendance of school" \\ \hline
\raggedright substitute (P2098) & \raggedright Lieutenant Governor of the United States Virgin Islands & function that serves as deputy/replacement of this function/office (scope/conditions vary depending on office) \\ \hline
\raggedright professorship (P803) & \raggedright Lucasian Professor of Mathematics & professorship position held by this academic person \\ \hline
\raggedright official religion (P3075) & \raggedright Islam & official religion in this administrative entity \\ \hline
\raggedright office contested (P541) & \raggedright Chief Executive of Hong Kong & title of office which election will determine the next holder of \\ \hline
\raggedright sexual orientation (P91) & \raggedright homosexuality & the sexual orientation of the person -- use IF AND ONLY IF they have stated it themselves, unambiguously, or it has been widely agreed upon by historians after their death \\ \hline
\raggedright kinship to subject (P1039) & \raggedright daughter-in-law & ``qualifier of ````relative"" (P1038) to indicate less usual family relationships (ancestor, son-in-law, adoptions, etc). Indicate how the qualificator item is related to the main item." \\ \hline
\raggedright next higher rank (P3730) & \raggedright pope & ``higher rank or level in a ranked hierarchy like sport league, military ranks. If there are several possible, list each one and qualify with ````criterion used"" (P1013), avoid using ranks and date qualifiers. For sports leagues/taxa, use specific properties instead." \\ \hline
\raggedright academic degree (P512) & \raggedright Doctor of Philosophy & academic degree that the person holds \\ \hline
\raggedright religion or worldview (P140) & \raggedright Hinduism & religion of a person, organization or religious building, or associated with this subject \\ \hline
\raggedright office held by head of government (P1313) & \raggedright Prime Minister of the United Kingdom & political office that is fulfilled by the head of the government of this item \\ \hline
\raggedright native language (P103) & \raggedright Russian & language or languages a person has learned from early childhood \\ \hline
\raggedright members have occupation (P3989) & \raggedright lawyer & all members of this group share the occupation \\ \hline
\raggedright language of work or name (P407) & \raggedright Italian & ``language associated with this creative work (such as books, shows, songs, or websites) or a name (for persons use ````native language"" (P103) and ````languages spoken, written or signed"" (P1412))" \\ \hline
\raggedright office held by head of state (P1906) & \raggedright President of Israel & political office that is fulfilled by the head of state of this item \\ \hline
\raggedright military rank (P410) & \raggedright General & ``military rank achieved by a person (should usually have a ````start time"" qualifier), or military rank associated with a position" \\ \hline
\raggedright medical condition (P1050) & \raggedright spina bifida & any state relevant to the health of an organism, including diseases and positive conditions \\ \hline
\raggedright hair color (P1884) & \raggedright brown hair & person's hair color. Use P585 as qualifier if there's more than one value \\ \hline
\raggedright title of chess person (P2962) & \raggedright Grandmaster & title awarded by a chess federation to a person \\ \hline
\end{longtblr}
\subsection*{MISC-related properties}
\begin{longtblr}{|p{28mm}|p{28mm}|p{63mm}|} \hline
\textbf{Property} & \textbf{Example} & \textbf{Description} \\ \hline
\raggedright classification of race (P2502) & \raggedright 2015 Schaal Sels & race for which this classification applies \\ \hline
\raggedright contributing factor of (P1537) & \raggedright critical thinking & thing that is significantly influenced by this cause, but does not directly result from it. See 'Help:Modeling causes' for examples and discussion. \\ \hline
\raggedright length (P2043) & \raggedright 15 centimeters & measured dimension of an object \\ \hline
\raggedright conflict (P607) & \raggedright Battle of Dennewitz & battles, wars or other military engagements in which the person or item participated \\ \hline
\raggedright school of (P1780) & \raggedright Ain AlBaraha & for a creative work with author with a style influenced by the known author or circle, active in the same period, but a student or follower \\ \hline
\raggedright bowling style (P2545) & \raggedright Left-arm orthodox spin & type of bowling employed by a cricketer \\ \hline
\raggedright field of training (P8258) & \raggedright bookselling & profession, position or activity someone learnt during a training, traineeship or apprenticeship \\ \hline
\raggedright used by (P1535) & \raggedright television watcher & item or concept that makes use of the subject (use sub-properties when appropriate) \\ \hline
\raggedright studied by (P2579) & \raggedright egyptology & subject is studied by this science or domain \\ \hline
\raggedright hashtag (P2572) & \raggedright BlackLivesMatter & ``hashtag associated with this item. Format: do not include the ````\#"" symbol" \\ \hline
\raggedright worshipped by (P1049) & \raggedright Zoroastrianism & religion or group/civilization that worships a given deity \\ \hline
\raggedright motto (P1546) & \raggedright Florebo quocumque ferar & description of the motto of the subject \\ \hline
\raggedright statement is subject of (P805) & \raggedright death of Osama bin Laden & (qualifying) item that describes the relation identified in this statement \\ \hline
\raggedright GitHub topic (P9100) & \raggedright bitcoin & GitHub topic for a repository or subject \\ \hline
\raggedright original spelling (P1353) & \raggedright Aloe steffaniana & original spelling of a scientific name \\ \hline
\raggedright armament (P520) & \raggedright AIM\-120 AMRAAM & equippable weapon item for the subject \\ \hline
\raggedright architectural style (P149) & \raggedright French Gothic architecture & architectural style of a structure \\ \hline
\raggedright academic major (P812) & \raggedright political science & major someone studied at college/university \\ \hline
\raggedright in opposition to (P5004) & \raggedright Plan Juppé, 1995 & qualifier to indicate the purpose of a social action \\ \hline
\raggedright astronaut mission (P450) & \raggedright Soyuz TMA-8 & space mission that the subject is or has been a member of (do not include future missions) \\ \hline
\raggedright field of this occupation (P425) & \raggedright bodyboarding & activity corresponding to this occupation or profession (use only for occupations/professions - for people use Property:P101, for companies use P452) \\ \hline
\raggedright vessel (P1876) & \raggedright Soyuz-TMA & vessel involved in this mission, voyage or event \\ \hline
\raggedright test taken (P5021) & \raggedright SAT & subject took the test or exam, or was assessed per test or method \\ \hline
\raggedright trophy awarded (P4622) & \raggedright Oscar statuette & trophy awarded at the end of a selection process or of a competition, usually to winners or finishers under the form of a cup, a medal, a diploma \\ \hline
\raggedright sport number (P1618) & \raggedright 27 & number worn on a player's (competitor's) uniform, equipment, etc \\ \hline
\raggedright Twitter username (P2002) & \raggedright NASA & this item's username on Twitter; do not include the ??? symbol \\ \hline
\raggedright programming language (P277) & \raggedright C++ & the programming language(s) in which the software is developed \\ \hline
\raggedright advertises (P6291) & \raggedright Michelin & cause, organization or product targeted by the advertising campaign, character, jingle or slogan \\ \hline
\raggedright uses (P2283) & \raggedright paintbrush & item or concept used by the subject or in the operation (see also instrument [P1303] and armament [P520]) \\ \hline
\raggedright study or design for (P6606) & \raggedright Birds and Irises & finished work of art for which the subject is a preliminary study, design, or conceptual drawing \\ \hline
\raggedright manner of death (P1196) & \raggedright capital punishment & general circumstances of a person's death; e.g. natural causes, accident, suicide, homicide, etc. Use 'cause of death' (P509) for the specific physiological mechanism, e.g. heart attack, trauma, pneumonia... \\ \hline
\raggedright evaluation of (P5134) & \raggedright heart rate & the subject finding is an evaluation or interpretation of the object attribute or test \\ \hline
\raggedright Eight Banner register (P470) & \raggedright Manchu Bordered Yellow Banner & Manchu household register for people of the Qing Dynasty \\ \hline
\raggedright title of broader work (P6333) & \raggedright Revue des Deux Mondes & ``title of website, journal or other work in which an article (or other publication) is published in. Use ````published in"" (P1433) instead if possible." \\ \hline
\raggedright genre (P136) & \raggedright war film & creative work's genre or an artist's field of work (P101). Use main subject (P921) to relate creative works to their topic \\ \hline
\raggedright applies to jurisdiction (P1001) & \raggedright Eurozone & the item (institution, law, public office, public register...) or statement belongs to or has power over or applies to the value (a territorial jurisdiction: a country, state, municipality, ...) \\ \hline
\raggedright playing hand (P741) & \raggedright left-handedness & hand used to play a racket sport \\ \hline
\raggedright fictional analog of (P1074) & \raggedright spacecraft & used to link an entity or class of entities appearing in a creative work with the analogous entity or class of entities in the real world \\ \hline
\raggedright inscription (P1684) & \raggedright O U O S V A V V & inscriptions, markings and signatures on an object \\ \hline
\raggedright broader concept (P4900) & \raggedright hat & qualifier to indicate a broader concept that the present item is part of, as mapped by an external source. The statement being qualified should be an exact match. \\ \hline
\raggedright legal citation of this text (P1031) & \raggedright 384 U.S. 436 & legal citation of legislation or a court decision \\ \hline
\raggedright exhibition history (P608) & \raggedright Saint Anne, Leonardo da Vinci ultimate masterpiece & exhibitions where the item is or was displayed \\ \hline
\raggedright form of creative work (P7937) & \raggedright novel & structure of a creative work, type of music release \\ \hline
\raggedright has edition or translation (P747) & \raggedright Orgoglio e pregiudizio & link to an edition of this item \\ \hline
\raggedright nominated for (P1411) & \raggedright BRIT Awards & ``award nomination received by a person, organisation or creative work (inspired from ````award received"" (Property:P166))" \\ \hline
\raggedright voice type (P412) & \raggedright lyric spinto tenor & person's voice type. expected values: soprano, mezzo-soprano, contralto, countertenor, tenor, baritone, bass (and derivatives) \\ \hline
\raggedright platform (P400) & \raggedright Xbox 360 & platform for which a work was developed or released, or the specific platform version of a software product \\ \hline
\raggedright drug used for treatment (P2176) & \raggedright dabrafenib & drug, procedure, or therapy that can be used to treat a medical condition \\ \hline
\raggedright owner of (P1830) & \raggedright SPY Records & entities owned by the subject \\ \hline
\raggedright fabrication method (P2079) & \raggedright sericulture & method, process or technique used to grow, cook, weave, build, assemble, manufacture the item \\ \hline
\raggedright connects with (P2789) & \raggedright Rokin & item with which the item is physically connected \\ \hline
\raggedright totem (P2831) & \raggedright Siluriformes & in many indigenous cultures an individual or group has a particular totem (e.g. a type of animal) \\ \hline
\raggedright field of work (P101) & \raggedright linguistic purism & specialization of a person or organization; see P106 for the occupation \\ \hline
\raggedright definition domain (P1568) & \raggedright set of real numbers & ``set of ````input"" or argument values for which a mathematical function is defined" \\ \hline
\raggedright parliamentary term (P2937) & \raggedright 13th legislature of the Fifth French Republic & term of a parliament or any deliberative assembly \\ \hline
\raggedright exonerated of (P7781) & \raggedright murder & crime of which the subject was found not to be guilty after having previously been found guilty by a court for that crime \\ \hline
\raggedright carries scientific instrument (P1202) & \raggedright Astro & scientific instruments carried by a vessel, satellite, or device that are not required for propelling or navigating \\ \hline
\raggedright distribution format (P437) & \raggedright Blu-ray Disc & method (or type) of distribution for the subject \\ \hline
\raggedright use (P366) & \raggedright source of information & main use of the subject (includes current and former usage) \\ \hline
\raggedright end cause (P1534) & \raggedright resignation & qualifier to use together with the end date qualifier (P582) to specify the cause \\ \hline
\raggedright source of income (P2770) & \raggedright donation & source of income of an organization or person \\ \hline
\raggedright participant in (P1344) & \raggedright 1992 Winter Olympics & event in which a person or organization was/is a participant; inverse of P710 or P1923 \\ \hline
\raggedright depicted by (P1299) & \raggedright Traveler Over The Mist Sea & object depicting this subject (creative works, books of the bible) \\ \hline
\raggedright member of the crew of (P5096) & \raggedright Titanic & person who has been a member of a crew associated with the vessel or spacecraft. For spacecraft, inverse of crew member (P1029), backup or reserve team or crew (P3015) \\ \hline
\raggedright victory (P2522) & \raggedright 2015 Internationale Wielertrofee Jong Maar Moedig & competition or event won by the subject \\ \hline
\raggedright elected in (P2715) & \raggedright 1999 German presidential election & qualifier for statements in position held to link the election in which a person gained a position from, or reelection in which the position was confirmed \\ \hline
\raggedright has effect (P1542) & \raggedright mercury poisoning & effect of this item \\ \hline
\raggedright corrigendum / erratum (P2507) & \raggedright Evolution in Mendelian Populations & published notice that corrects or amends a previous publication \\ \hline
\raggedright electoral district (P768) & \raggedright Ohio's 8th congressional district & ``electoral district this person is representing, or of the office that is being contested. Use as qualifier for ````position held"" (P39) or ````office contested"" (P541) or ````candidacy in election"" (P3602)" \\ \hline
\raggedright mascot (P822) & \raggedright Scotty the Scottie Dog & mascot of an organization, e.g. a sports team or university \\ \hline
\raggedright facet of (P1269) & \raggedright general relativity & topic of which this item is an aspect, item that offers a broader perspective on the same topic \\ \hline
\raggedright has cause (P828) & \raggedright mercury & underlying cause, thing that ultimately resulted in this effect \\ \hline
\raggedright direction (P560) & \raggedright north & qualifier to indicate the direction of the object relative to the subject item (for direction to the object, see P654) \\ \hline
\raggedright part of (P361) & \raggedright head & ``object of which the subject is a part (if this subject is already part of object A which is a part of object B, then please only make the subject part of object A). Inverse property of ````has part"" (P527, see also ````has parts of the class"" (P2670))." \\ \hline
\raggedright lifestyle (P1576) & \raggedright vegetarianism & typical way of life of an individual, group, or culture \\ \hline
\raggedright writing system (P282) & \raggedright English alphabet & alphabet, character set or other system of writing used by a language, supported by a typeface \\ \hline
\raggedright follows (P155) & \raggedright Star Wars: Episode IV A New Hope & ``immediately prior item in a series of which the subject is a part, preferably use as qualifier of P179 [if the subject has replaced the preceding item, e.g. political offices, use ````replaces"" (P1365)]" \\ \hline
\raggedright flag (P163) & \raggedright flag of Slovakia & subject's flag \\ \hline
\raggedright part of the series (P179) & \raggedright The Chronicles of Narnia & series which contains the subject \\ \hline
\raggedright means of locomotion (P3512) & \raggedright bipedalism & method that the subject uses to move from one place to another \\ \hline
\raggedright color (P462) & \raggedright black & color of subject \\ \hline
\raggedright constellation (P59) & \raggedright Andromeda & the area of the celestial sphere of which the subject is a part (from a scientific standpoint, not an astrological one) \\ \hline
\raggedright medical examinations (P923) & \raggedright medical radiography & examinations that might be used to diagnose and/or prognose the medical condition \\ \hline
\raggedright partially coincident with (P1382) & \raggedright Interstate 76 & object that is partially part of, but not fully part of (P361), the subject \\ \hline
\raggedright catchphrase (P6251) & \raggedright Did I do that? & commonly used phrase by which someone or something may be recognized \\ \hline
\raggedright stock exchange (P414) & \raggedright New York Stock Exchange & exchange on which this company is traded \\ \hline
\raggedright motto text (P1451) & \raggedright Un Dieu, un roy, une foy, une loy (French) & short motivation sentence associated to item \\ \hline
\raggedright level of description (P6224) & \raggedright record group & position of the unit of description in the hierarchy of the fonds \\ \hline
\raggedright instrumentation (P870) & \raggedright piano & combination of musical instruments employed in a composition or accompanying a (folk) dance \\ \hline
\raggedright footedness (P8006) & \raggedright left-footedness & dominant foot or preferred stance of this person \\ \hline
\raggedright subclass of (P279) & \raggedright fruit & next higher class or type; all instances of these items are instances of those items; this item is a class (subset) of that item. Not to be confused with P31 (instance of) \\ \hline
\raggedright domain of saint or deity (P2925) & \raggedright sea & domain(s) which this saint or deity controls or protects \\ \hline
\raggedright charted in (P2291) & \raggedright Billboard 200 & chart where the element reached a position \\ \hline
\raggedright radio format (P415) & \raggedright rhythmic contemporary & describes the overall content broadcast on a radio station \\ \hline
\raggedright category contains (P4224) & \raggedright architectural structure & category contains elements that are instances of this item \\ \hline
\raggedright theme music (P942) & \raggedright St. Anger & the theme music/song used by the item \\ \hline
\raggedright sport (P641) & \raggedright trail running & sport that the subject participates or participated in or is associated with \\ \hline
\raggedright mount (P3091) & \raggedright Rocinante & creature ridden by the subject, for instance a horse \\ \hline
\raggedright notable work (P800) & \raggedright Hamlet & notable scientific, artistic or literary work, or other work of significance among subject's works \\ \hline
\raggedright movement (P135) & \raggedright Frankfurt School & literary, artistic, scientific or philosophical movement or scene associated with this person or work \\ \hline
\raggedright has pattern (P5422) & \raggedright stripe & pattern, design, or motif intrinsic to, incorporated into, or applied to the surface of the subject \\ \hline
\raggedright history of topic (P2184) & \raggedright history of Germany & ``item about the historical development of an subject's topic, sample: ````history of Argentina"" for ````Argentina"". To list key events of the topic, use ````significant event"" (P793)" \\ \hline
\raggedright position played on team / speciality (P413) & \raggedright centre & position or specialism of a player on a team \\ \hline
\raggedright basic form of government (P122) & \raggedright unitary state & subject's government \\ \hline
\raggedright call sign (P2317) & \raggedright Freedom 7 & short form identifier for a radio operator or broadcaster and (as flag signal) previous for watercrafts \\ \hline
\raggedright statistical unit (P2353) & \raggedright country & member of a dataset \\ \hline
\raggedright cabinet (P5054) & \raggedright Florida Cabinet & ``qualifier for ````position held"" (P39) to indicate the cabinet to which belongs a minister" \\ \hline
\raggedright main subject (P921) & \raggedright Rocco Granata & primary topic of a work (see also P180: depicts) \\ \hline
\raggedright Artsy gene (P2411) & \raggedright cubism & generalization of artwork type, technique, material, genre, movement, etc. from artsy.net \\ \hline
\raggedright template has topic (P1423) & \raggedright Syngnathiformes & topic related to template \\ \hline
\raggedright candidacy in election (P3602) & \raggedright 2012 Finnish municipal elections & election where the subject is a candidate \\ \hline
\raggedright does not have part (P3113) & \raggedright control tower & expected part that the item does not have (for qualities, use P6477) \\ \hline
\raggedright commemorates (P547) & \raggedright Johann Sebastian Bach & what the place, monument, memorial, or holiday, commemorates \\ \hline
\raggedright alternate names (P4970) & \raggedright hankies & qualifier for alternative name(s) given for a subject in a database entry \\ \hline
\raggedright iconographic symbol (P4185) & \raggedright Keys of Heaven & identifying element typically depicted as accompanying or worn by this religious figure, hero, fictional or historical character \\ \hline
\raggedright cuisine (P2012) & \raggedright Indian cuisine & type of food served by a restaurant or restaurant chain or national food culture \\ \hline
\raggedright possible medical findings (P5131) & \raggedright mid-systolic click & possible medical findings of a medical condition \\ \hline
\raggedright parent taxon (P171) & \raggedright Sus scrofa & closest parent taxon of the taxon in question \\ \hline
\raggedright presented in (P5072) & \raggedright TED2010 & event at which a talk, film, paper, or poster was presented \\ \hline
\raggedright title (P1476) & \raggedright Nature & published name of a work, such as a newspaper article, a literary work, piece of music, a website, or a performance work \\ \hline
\raggedright affiliation string (P6424) & \raggedright Southampton University & qualifier to provide the published string form of affiliation attached to an author \\ \hline
\raggedright quotation or excerpt (P7081) & \raggedright who would these fardels bear[...] & quotation or excerpt from this work. No quotation marks needed \\ \hline
\raggedright subject has role (P2868) & \raggedright antineoplastic & ``role/generic identity of the item (````subject""), also in the context of a statement. For the role of the value of the statement (````object""), use P3831 (````object has role""). For acting roles, use P453 (````character role""). For persons, use P39." \\ \hline
\raggedright item operated (P121) & \raggedright transport infrastructure & equipment, installation or service operated by the subject \\ \hline
\raggedright sports competition competed at (P5249) & \raggedright 2012 UEFA Champions League & edition of sports competitions at which the club or team that played a season competed at. Use this to link items for team seasons to items for specific seasons of competitions.Sample: 2012 ??? 13 FC Barcelona season ??? 13 UEFA Champions League \\ \hline
\raggedright literal translation (P2441) & \raggedright first son (English) & direct or word-for-word translation of a name or phrase (qualifier for name, title, inscription, and quotation properties) \\ \hline
\raggedright from narrative universe (P1080) & \raggedright Tolkien's legendarium & subject's fictional entity is in the object narrative. See also P1441 (present in work) and P1445 (fictional universe described in) \\ \hline
\raggedright seal description (P418) & \raggedright Great Seal of the United States & links to the item for the subject's seal \\ \hline
\raggedright anthem (P85) & \raggedright State Anthem of the Soviet Union & subject's official anthem \\ \hline
\raggedright taxon name (P225) & \raggedright Panthera leo & correct scientific name of a taxon (according to the reference given) \\ \hline
\raggedright wears (P3828) & \raggedright engagement announcement dress of Catherine Middleton & clothing or accessory worn on subject's body \\ \hline
\raggedright studies (P2578) & \raggedright Ancient Egypt & the object that an academic field studies; distinct from field of work (P101), which is used for human, organization, etc. \\ \hline
\raggedright business model (P7936) & \raggedright free-to-play & business model a business enterprise or creative work operates under \\ \hline
\raggedright social classification (P3716) & \raggedright commoner & social class as recognized in traditional or state law \\ \hline
\raggedright record held (P1000) & \raggedright men's pole vault world record & notable record achieved by a person or entity, include qualifiers for dates held \\ \hline
\raggedright named after (P138) & \raggedright Camembert & ``entity or event that inspired the subject's name, or namesake (in at least one language). Qualifier ````applies to name"" (P5168) can be used to indicate which one" \\ \hline
\raggedright general classification of race participants (P2321) & \raggedright Nacer Bouhanni & classification of race participants \\ \hline
\raggedright tracklist (P658) & \raggedright Wanna Be Startin' Somethin' & audio tracks contained in this release \\ \hline
\raggedright nickname (P1449) & \raggedright The Golden State & informal name (for a pseudonym use P742) \\ \hline
\raggedright shooting handedness (P423) & \raggedright left-handed shot & whether the hockey player passes or shoots left- or right-handed \\ \hline
\raggedright significant event (P793) & \raggedright Battle of Dennewitz & significant or notable events associated with the subject \\ \hline
\raggedright followed by (P156) & \raggedright April & ``immediately following item in a series of which the subject is a part, preferably use as qualifier of P179 [if the subject has been replaced, e.g. political offices, use ````replaced by"" (P1366)]" \\ \hline
\raggedright manner of inhumane treatment (P7160) & \raggedright sleep deprivation & manner of torture and other cruel, inhumane or degrading treatment or punishments as covered by the UN Convention experienced by the subject \\ \hline
\raggedright possessed by spirit (P4292) & \raggedright Pazuzu & item which is spiritually possessing this item \\ \hline
\raggedright fandom (P8693) & \raggedright A.I Troops & fan group name of a celebrity, musical group, or an artist \\ \hline
\raggedright input method (P479) & \raggedright computer keyboard & input method or device used to interact with a software product \\ \hline
\raggedright damaged (P3081) & \raggedright Upper Basilica of San Francesco d'Assisi & physical items damaged by this event \\ \hline
\raggedright plea (P1437) & \raggedright guilt & whether a person pleaded guilty, not guilty, etc. \\ \hline
\raggedright derivative work (P4969) & \raggedright MX Linux & new work of art (film, book, software, etc.) derived from major part of this work \\ \hline
\raggedright dataset distribution (P2702) & \raggedright Art \& Architecture Thesaurus LOD Dataset & particular manner of distribution of a data set (database or file) that is publicly available \\ \hline
\raggedright real estate developer (P6237) & \raggedright Strabag Real Estate & person or organization responsible for building this item \\ \hline
\raggedright product or material produced (P1056) & \raggedright uranium & material or product produced by a government agency, business, industry, facility, or process \\ \hline
\raggedright contributed to creative work (P3919) & \raggedright Dictionary of National Biography & ``person is cited as contributing to some creative or published work or series (qualify with ````subject has role"", P2868)" \\ \hline
\raggedright military casualty classification (P1347) & \raggedright killed in action & allowed values: killed in action (Q210392), missing in action (Q2344557), died of wounds (Q16861372), prisoner of war (Q179637), killed in flight accident (Q16861407), others used in military casualty classification \\ \hline
\raggedright separated from (P807) & \raggedright Presbyterian Church in the United States & subject was founded or started by separating from identified object \\ \hline
\raggedright results (P2501) & \raggedright general classification of the 2015 Coupe Sels & results of a competition such as sports or elections \\ \hline
\raggedright ritual object (P8706) & \raggedright corpse powder & ceremonial or ritual objects associated with, and used as part of, rites and rituals practiced in everyday life and in rarer cultic and communal rites \\ \hline
\raggedright edition or translation of (P629) & \raggedright Pride and Prejudice & is an edition or translation of this entity \\ \hline
\raggedright Catholic rite (P3501) & \raggedright Roman Rite & Christian liturgical rite associated with this item \\ \hline
\raggedright academic minor (P811) & \raggedright political science & minor someone studied at college/university \\ \hline
\raggedright intangible cultural heritage status (P3259) & \raggedright inventory of intangible cultural heritage in France & status of an item that is designated as intangible heritage \\ \hline
\raggedright opposite of (P461) & \raggedright peace & item that is the opposite of this item \\ \hline
\raggedright reward (P4444) & \raggedright travel insurance & reward, bonus, or prize received as part of a membership or loyalty program \\ \hline
\raggedright award received (P166) & \raggedright Theodor Haecker Price & award or recognition received by a person, organisation or creative work \\ \hline
\raggedright legal form (P1454) & \raggedright GmbH \& Co. KG & legal form of an entity \\ \hline
\raggedright Bharati Braille (P9021) & \raggedright braille script & transcription of Indic scripts in a national standard Braille script \\ \hline
\raggedright vehicle normally used (P3438) & \raggedright popemobile & vehicle the subject normally uses \\ \hline
\raggedright coat of arms (P237) & \raggedright Coat of arms of Liechtenstein & subject's coat of arms \\ \hline
\raggedright convicted of (P1399) & \raggedright murder & crime a person was convicted of \\ \hline
\raggedright made from material (P186) & \raggedright chocolate liquor & material the subject or the object is made of or derived from \\ \hline
\raggedright competition class (P2094) & \raggedright Group R & official classification by a regulating body under which the subject (events, teams, participants, or equipment) qualifies for inclusion \\ \hline
\raggedright shape (P1419) & \raggedright pyramid & shape of an object \\ \hline
\raggedright academic thesis (P1026) & \raggedright Pan, Sinking: for Steelpan and Nine Instruments & thesis or dissertation written for a degree \\ \hline
\raggedright audio system (P7501) & \raggedright bell & audio system hardware used in the item \\ \hline
\raggedright first appearance (P4584) & \raggedright A Study in Scarlet & work in which a fictional/mythical character or entity first appeared \\ \hline
\raggedright last words (P3909) & \raggedright I want nothing but death. & last words attributed to a person before their death \\ \hline
\raggedright strand orientation (P2548) & \raggedright software & orientation of gene on double stranded DNA molecule \\ \hline
\raggedright female form of label (P2521) & \raggedright autora & female form of name or title \\ \hline
\raggedright penalty (P1596) & \raggedright capital punishment & penalty imposed by an authority \\ \hline
\raggedright handedness (P552) & \raggedright right-handedness & handedness of the person \\ \hline
\raggedright Google Play developer slug (P8939) & \raggedright Facebook & human-readable identifier for a developer on the Google Play Store \\ \hline
\raggedright instrument (P1303) & \raggedright drum & musical instrument that a person plays or teaches or used in a music occupation \\ \hline
\raggedright index case of (P1677) & \raggedright Ebola virus disease in the United States & primary case, patient zero: initial patient in the population of an epidemiological investigation \\ \hline
\raggedright reward program (P4446) & \raggedright Chase Ultimate Rewards & reward program associated with the item \\ \hline
\raggedright charge (P1595) & \raggedright seditious libel & offence with which someone is charged, at a trial \\ \hline
\raggedright had as last meal (P3902) & \raggedright ice cream & components of the last meal had by a person before death \\ \hline
\raggedright relevant qualification (P4968) & \raggedright Project Management Professional & practitioners of this industry get this degree, licence or certification after specialist education, apprenticeship, or professional review. This includes qualifications that one needs to obtain in order to join the industry or qualifications that one obtains after a certain level of experience in the industry in order to progress further in their career. \\ \hline
\raggedright for work (P1686) & \raggedright Little Life & qualifier of award received (P166) to specify the work that an award was given to the creator for \\ \hline
\raggedright interested in (P2650) & \raggedright The Holocaust & item of special or vested interest to this person or organisation \\ \hline
\raggedright health specialty (P1995) & \raggedright ophthalmology & main specialty that diagnoses, prevent human illness, injury and other physical and mental impairments \\ \hline
\raggedright appears in the form of (P4675) & \raggedright bull & this fictional or mythical entity takes the form of that entity \\ \hline
\raggedright vessel class (P289) & \raggedright Concordia-class cruise ship & series of vessels built to the same design of which this vessel is a member \\ \hline
\raggedright medical condition treated (P2175) & \raggedright non-small-cell lung carcinoma & disease that this pharmaceutical drug, procedure, or therapy is used to treat \\ \hline
\raggedright sports discipline competed in (P2416) & \raggedright marathon & discipline an athlete competed in within a sport \\ \hline
\raggedright madhhab (P9929) & \raggedright Shafi`i & Islamic school of thought within Fiqh \\ \hline
\raggedright cause of death (P509) & \raggedright nitric acid poisoning & underlying or immediate cause of death. Underlying cause (e.g. car accident, stomach cancer) preferred. Use 'manner of death' (P1196) for broadest category, e.g. natural causes, accident, homicide, suicide \\
\end{longtblr}
\section{Training parameters of entity recognizer}
\label{parameters}
Table \ref{tbl:Params} details the parameters employed to train the privacy-oriented entity recognition model from Section \ref{sec:er}.
\begin{table}[h]
\caption{\label{tbl:Params} Training Parameters for the RoBERTa model}
\begin{tabular}{p{5cm}p{4cm}}
\toprule %\vspace{-1mm}
Optimizer & AdamW \\
Learning rate & 2e-5\\
Loss function & CrossEntropy \\
Inference layer & Linear \\
Epochs & 3 \\
Full fine-tuning & yes \\
GPU & yes \\
Early stopping & yes
\end{tabular}
\end{table}
\vspace{-5mm}
\section{Label Agreement}
\label{label_confusion}
Frequently confused label pairs (see Section \ref{ssec:ld}) are shown in Figure \ref{fig:label_graph}.
\begin{figure}[h]
\centering
\includegraphics[width = 0.95\textwidth]{figures/label_confusion.png}
\caption{Most common label confusion pairs common in the test sets of the annotated Wikipedia biographies and the TAB corpus. The first element of the pair corresponds to the gold standard label and the second to the output from the entity recognizer.}
\label{fig:label_graph}
\end{figure}
\section{LLM probabilities: base models}
\label{model}
Table \ref{tbl:tabular_models} describes the (ordered) based models the Autogluon tabular predictor employs for the LLM-probability based approach of Section \ref{ssec:tabular}
\begin{table}[h]
\centering
\caption{\label{tbl:tabular_models} Base models of the Tabular predictor in the order they are trained when using the AutoGluon library. This order based on training time and reliability to ensure efficient training time \citep{autogluon}.}
\begin{tabular}{lp{8cm}}
\toprule %\vspace{-1mm}
\textbf{Model name} & \textbf{Description}\\
\midrule
\textit{KNeighborsUnif} & k-nearest neighbors classifier with uniform weighting\\
\textit{KNeighborsDist}& k-nearest neighbors classifier with distance weighting (the inverse of their distance)\\
\textit{LightGBMXT}& LightGMB model that enables extra trees\\
\textit{LightGBM}& default light gradient-boosting machine implementation\\
\textit{RandomForestGini}& random forest classifier with Gini impurity loss function\\
\textit{RandomForestEntr}& random forest classifier with entropy loss function\\
\textit{CatBoost}& algorithm that performs gradient boosting on decision trees\\
\textit{ExtraTreesGini}& extra-trees classifier with Gini impurity loss function\\
\textit{ExtraTreesEntr}& extra-trees classifier with entropy loss function\\
\textit{NeuralNetFastAI}& fast AI neural network for classification of tabular data\\
\textit{XGBoost}& an optimized distributed gradient boosting decision tree model \\
\textit{LightGBMLarge}& LightGMB model that enables larger models\\
\textit{NeuralNetTorch}& PyTorch neural network for classification of tabular data\\
\textit{WeightedEnsemble\_L2}& meta-model that implements Ensemble Selection of the above models\\
%\bottomrule
\end{tabular}
\end{table}
\section{Training size and performance}
\label{size}
Figure \ref{fig:training_size} shows the $F_1$ score of both the Tabular and the Multimodal Autogluon predictors (LLM probabilities Section \ref{ssec:scrm} and span classification Section \ref{ssec:ppa} respectively) at different training sizes for both datasets. We use a random sample of 1\% to 100\% for each training dataset split.
\begin{figure}[h]
\centering
{\includegraphics[width=0.49\textwidth]{figures/tabular_size.png}}
\hfill
{\includegraphics[width=0.49\textwidth]{figures/multimodal_size.png}}
\caption{Performance of the tabular and multimodal predictors when different training sizes are used during training. We report the F1 score for the annotated Wikipedia test dataset and the TAB test dataset as well.}
\label{fig:training_size}
\end{figure}
\section{Perturbation thresholds}
\label{per_graphs}
Figure \ref{fig:perturbation_graph} shows the performance of different perturbation thresholds for both datasets for the training dataset split, with the black line indicating the threshold used in Section \ref{ssec:petrubation} for evaluation.
\begin{figure}[h]
\centering
{\includegraphics[width=0.49\textwidth]{figures/wiki_train_threshold_graph.png}}
\hfill
{\includegraphics[width=0.49\textwidth]{figures/tab_threshold.png}}
\caption{Precision and recall score for direct and quasi identifiers at different thresholds of probability difference for the Wikipedia and TAB train datasets. The black line indicates the threshold where the cost function is maximized. This is approximately 3.5 for Wikipedia and 10 for TAB)}
\label{fig:perturbation_graph}
\end{figure}
% NOTE FROM ANTHI: I modified all arXiv pre-prints to have the same formatting so none looks incomplete due to template
% ---->
\clearpage
\bibliography{sn-bibliography}% common bib file
%% if required, the content of .bbl file can be included here once bbl is generated
%%\input sn-article.bbl
\end{document}
\begin{thebibliography}{}
\providecommand{\doi}[1]{\url{https://doi.org/#1}}
\bibcommenthead
\bibitem[\protect\citeauthoryear{Anandan, Clifton, Jiang, Murugesan,
Pastrana-Camacho, and Si}{Anandan et~al.}{2012}]{anandan}
Anandan, B., C.~Clifton, W.~Jiang, M.~Murugesan, P.~Pastrana-Camacho, and
L.~Si. 2012, December.
\newblock T-plausibility: Generalizing words to desensitize text.
\newblock {\em Transactions on Data Privacy\/}~{\em 5\/}(3): 505–534 .
\bibitem[\protect\citeauthoryear{Beltagy, Peters, and Cohan}{Beltagy
et~al.}{2020}]{beltagy2020longformer}
Beltagy, I., M.E. Peters, and A.~Cohan. 2020.
\newblock Longformer: The long-document transformer.
\newblock {\em arXiv preprint arXiv:2004.05150\/} .
\bibitem[\protect\citeauthoryear{Chakaravarthy, Gupta, Roy, and
Mohania}{Chakaravarthy et~al.}{2008}]{chakaravarthy2008efficient}
Chakaravarthy, V.T., H.~Gupta, P.~Roy, and M.K. Mohania 2008.
\newblock Efficient techniques for document sanitization.
\newblock In {\em Proceedings of the 17th ACM conference on Information and
knowledge management}, pp.\ 843--852. ACM.
\bibitem[\protect\citeauthoryear{Chevrier, Foufi, Gaudet-Blavignac, Robert, and
Lovis}{Chevrier et~al.}{2019}]{article}
Chevrier, R., V.~Foufi, C.~Gaudet-Blavignac, A.~Robert, and C.~Lovis. 2019, 05.
\newblock Use and understanding of anonymization and de-identification in the
biomedical literature: Scoping review.
\newblock {\em Journal of Medical Internet Research\/}~21.
\newblock \doi{10.2196/13484} .
\bibitem[\protect\citeauthoryear{Chiu and Nichols}{Chiu and
Nichols}{2016}]{Chi:Nic:16}
Chiu, J.P. and E.~Nichols. 2016.
\newblock Named entity recognition with bidirectional {LSTM}-{CNN}s.
\newblock {\em Transactions of the Association for Computational
Linguistics\/}~4: 357--370.
\newblock \doi{10.1162/tacl_a_00104} .
\bibitem[\protect\citeauthoryear{Clark, Luong, Le, and Manning}{Clark
et~al.}{2020}]{DBLP:conf/iclr/ClarkLLM20}
Clark, K., M.~Luong, Q.V. Le, and C.D. Manning 2020.
\newblock {ELECTRA:} pre-training text encoders as discriminators rather than
generators.
\newblock In {\em 8th International Conference on Learning Representations,
{ICLR} 2020, Addis Ababa, Ethiopia, April 26-30, 2020}. OpenReview.net.
\bibitem[\protect\citeauthoryear{Cumby and Ghani}{Cumby and
Ghani}{2011}]{Cumby2011AML}
Cumby, C. and R.~Ghani. 2011, August.
\newblock A machine learning based system for semi-automatically redacting
documents.
\newblock {\em Proceedings of the {AAAI} Conference on Artificial
Intelligence\/}~{\em 25\/}(2): 1628--1635.
\newblock \doi{10.1609/aaai.v25i2.18851} .
\bibitem[\protect\citeauthoryear{Dernoncourt, Lee, Uzuner, and
Szolovits}{Dernoncourt et~al.}{2017}]{dernoncourt2017identification}
Dernoncourt, F., J.Y. Lee, O.~Uzuner, and P.~Szolovits. 2017.
\newblock De-identification of patient notes with recurrent neural networks.
\newblock {\em Journal of the American Medical Informatics Association\/}~{\em
24\/}(3): 596--606 .
\bibitem[\protect\citeauthoryear{Devlin, Chang, Lee, and Toutanova}{Devlin
et~al.}{2019}]{devlin-etal-2019-bert}
Devlin, J., M.W. Chang, K.~Lee, and K.~Toutanova 2019, June.
\newblock {BERT}: Pre-training of deep bidirectional transformers for language
understanding.
\newblock In {\em Proceedings of the 2019 Conference of the North {A}merican
Chapter of the Association for Computational Linguistics: Human Language
Technologies, Volume 1 (Long and Short Papers)}, Minneapolis, Minnesota, pp.\
4171--4186. Association for Computational Linguistics.
\bibitem[\protect\citeauthoryear{Ding, Xu, and Koehn}{Ding
et~al.}{2019}]{ding-etal-2019-saliency}
Ding, S., H.~Xu, and P.~Koehn 2019, August.
\newblock Saliency-driven word alignment interpretation for neural machine
translation.
\newblock In {\em Proceedings of the Fourth Conference on Machine Translation
(Volume 1: Research Papers)}, Florence, Italy, pp.\ 1--12. Association for
Computational Linguistics.
\bibitem[\protect\citeauthoryear{Dwork, McSherry, Nissim, and Smith}{Dwork
et~al.}{2006}]{dwork}
Dwork, C., F.~McSherry, K.~Nissim, and A.~Smith 2006.
\newblock Calibrating noise to sensitivity in private data analysis.
\newblock In S.~Halevi and T.~Rabin (Eds.), {\em Theory of Cryptography},
Berlin, Heidelberg, pp.\ 265--284. Springer Berlin Heidelberg.
\bibitem[\protect\citeauthoryear{Elliot, Mackey, O'Hara, and Tudor}{Elliot
et~al.}{2016}]{soton399692}
Elliot, M., E.~Mackey, K.~O'Hara, and C.~Tudor. 2016.
\newblock {\em The anonymisation decision-making framework}.
\newblock UKAN Manchester.
\bibitem[\protect\citeauthoryear{Erickson, Mueller, Shirkov, Zhang, Larroy, Li,
and Smola}{Erickson et~al.}{2020}]{autogluon}
Erickson, N., J.~Mueller, A.~Shirkov, H.~Zhang, P.~Larroy, M.~Li, and A.~Smola.
2020.
\newblock Autogluon-tabular: Robust and accurate automl for structured data.
\newblock {\em arXiv preprint arXiv:2003.06505\/} .
\bibitem[\protect\citeauthoryear{Fernandes, Dras, and McIver}{Fernandes
et~al.}{2019}]{DBLP:conf/post/FernandesDM19}
Fernandes, N., M.~Dras, and A.~McIver 2019.
\newblock Generalised differential privacy for text document processing.
\newblock In F.~Nielson and D.~Sands (Eds.), {\em Principles of Security and
Trust - 8th International Conference, {POST} 2019, Held as Part of the
European Joint Conferences on Theory and Practice of Software, {ETAPS} 2019,
Prague, Czech Republic, April 6-11, 2019, Proceedings}, Volume 11426 of {\em
Lecture Notes in Computer Science}, pp.\ 123--148. Springer.
\bibitem[\protect\citeauthoryear{Feyisetan, Diethe, and Drake}{Feyisetan
et~al.}{2019}]{feyisetan2019leveraging}
Feyisetan, O., T.~Diethe, and T.~Drake 2019.
\newblock Leveraging hierarchical representations for preserving privacy and
utility in text.
\newblock In {\em 2019 IEEE International Conference on Data Mining (ICDM)},
pp.\ 210--219. IEEE.
\bibitem[\protect\citeauthoryear{Goldsteen, Ezov, Shmelkin, Moffie, and
Farkash}{Goldsteen et~al.}{2021}]{goldsteen2021data}
Goldsteen, A., G.~Ezov, R.~Shmelkin, M.~Moffie, and A.~Farkash. 2021,
September.
\newblock Data minimization for {GDPR} compliance in machine learning models.
\newblock {\em {AI} and Ethics\/}~{\em 2\/}(3): 477--491.
\newblock \doi{10.1007/s43681-021-00095-8} .
\bibitem[\protect\citeauthoryear{Golle}{Golle}{2006}]{golle2006}
Golle, P. 2006.
\newblock {Revisiting the uniqueness of simple demographics in the US
population}.
\newblock In {\em {Proceedings of the 5th ACM workshop on Privacy in electronic
society}}, pp.\ 77--80. ACM.
\bibitem[\protect\citeauthoryear{He, Zhao, and Chu}{He
et~al.}{2021}]{he2021automl}
He, X., K.~Zhao, and X.~Chu. 2021, January.
\newblock {AutoML}: A survey of the state-of-the-art.
\newblock {\em Knowledge-Based Systems\/}~212: 106622.
\newblock \doi{10.1016/j.knosys.2020.106622} .
\bibitem[\protect\citeauthoryear{HIPAA}{HIPAA}{2004}]{HIPAA}
HIPAA. 2004.
\newblock {\em The {H}ealth {I}nsurance {P}ortability and {A}ccountability
{A}ct}.
\newblock U.S. Dept. of Labor, Employee Benefits Security Administration.
\bibitem[\protect\citeauthoryear{Igamberdiev and Habernal}{Igamberdiev and
Habernal}{2023}]{igamberdiev2023dpbart}
Igamberdiev, T. and I.~Habernal 2023.
\newblock Dp-bart for privatized text rewriting under local differential
privacy.
\newblock In {\em Findings of the Association for Computational Linguistics:
ACL 2023}, Toronto, Canada, pp.\ (to appear). Association for Computational
Linguistics.
\bibitem[\protect\citeauthoryear{Johnson, Bulgarelli, and Pollard}{Johnson
et~al.}{2020}]{johnson2020deidentification}
Johnson, A.E., L.~Bulgarelli, and T.J. Pollard 2020.
\newblock Deidentification of free-text medical records using pre-trained
bidirectional transformers.
\newblock In {\em Proceedings of the ACM Conference on Health, Inference, and
Learning}, pp.\ 214--221.
\bibitem[\protect\citeauthoryear{Juez-Hernandez, Quijano-Sánchez, Liberatore,
and Gómez}{Juez-Hernandez et~al.}{2023}]{JUEZHERNANDEZ2023110540}
Juez-Hernandez, R., L.~Quijano-Sánchez, F.~Liberatore, and J.~Gómez. 2023.
\newblock Agora: An intelligent system for the anonymization, information
extraction and automatic mapping of sensitive documents.
\newblock {\em Applied Soft Computing\/}~145: 110540.
\newblock \doi{https://doi.org/10.1016/j.asoc.2023.110540} .
\bibitem[\protect\citeauthoryear{Kindermans, Hooker, Adebayo, Alber,
Sch{\"u}tt, D{\"a}hne, Erhan, and Kim}{Kindermans
et~al.}{2019}]{Kindermans2019}
Kindermans, P.J., S.~Hooker, J.~Adebayo, M.~Alber, K.T. Sch{\"u}tt,
S.~D{\"a}hne, D.~Erhan, and B.~Kim 2019.
\newblock {\em The (Un)reliability of Saliency Methods}, pp.\ 267--280.
\newblock Cham: Springer International Publishing.
\bibitem[\protect\citeauthoryear{Krishna, Gupta, and Dupuy}{Krishna
et~al.}{2021}]{krishna2021adept}
Krishna, S., R.~Gupta, and C.~Dupuy 2021, April.
\newblock {AD}e{PT}: Auto-encoder based differentially private text
transformation.
\newblock In {\em Proceedings of the 16th Conference of the European Chapter of
the Association for Computational Linguistics: Main Volume}, Online, pp.\
2435--2439. Association for Computational Linguistics.
\bibitem[\protect\citeauthoryear{Lample, Ballesteros, Subramanian, Kawakami,
and Dyer}{Lample et~al.}{2016}]{Lam:Bal:Sub:16}
Lample, G., M.~Ballesteros, S.~Subramanian, K.~Kawakami, and C.~Dyer 2016.
\newblock Neural architectures for named entity recognition.
\newblock In {\em Proceedings of the 2016 Conference of the {N}orth {A}merican
{C}hapter of the {A}ssociation for {C}omputational {L}inguistics: {H}uman
{L}anguage {T}echnologies}, San Diego, California, pp.\ 260--270.
\bibitem[\protect\citeauthoryear{Lebret, Grangier, and Auli}{Lebret
et~al.}{2016}]{lebret2016neural}
Lebret, R., D.~Grangier, and M.~Auli 2016, November.
\newblock Neural text generation from structured data with application to the
biography domain.
\newblock In {\em Proceedings of the 2016 Conference on Empirical Methods in
Natural Language Processing}, Austin, Texas, pp.\ 1203--1213. Association
for Computational Linguistics.
\bibitem[\protect\citeauthoryear{Li, Chen, Hovy, and Jurafsky}{Li
et~al.}{2016}]{li-etal-2016-visualizing}
Li, J., X.~Chen, E.~Hovy, and D.~Jurafsky 2016, June.
\newblock Visualizing and understanding neural models in {NLP}.
\newblock In {\em Proceedings of the 2016 Conference of the North {A}merican
Chapter of the Association for Computational Linguistics: Human Language
Technologies}, San Diego, California, pp.\ 681--691. Association for
Computational Linguistics.
\bibitem[\protect\citeauthoryear{Li, Monroe, and Jurafsky}{Li
et~al.}{2017}]{li2017understanding}
Li, J., W.~Monroe, and D.~Jurafsky. 2017.
\newblock Understanding neural networks through representation erasure.
\newblock {\em arXiv preprint arXiv:1612.08220\/} .
\bibitem[\protect\citeauthoryear{Lison, Pil{\'a}n, Sánchez, Batet, and
{\O}vrelid}{Lison et~al.}{2021}]{lison-etal-2021-anonymisation}
Lison, P., I.~Pil{\'a}n, D.~Sánchez, M.~Batet, and L.~{\O}vrelid 2021, August.
\newblock Anonymisation models for text data: State of the art, challenges and
future directions.
\newblock In {\em Proceedings of the 59th Annual Meeting of the Association for
Computational Linguistics and the 11th International Joint Conference on
Natural Language Processing (Volume 1: Long Papers)}, Online, pp.\
4188--4203. Association for Computational Linguistics.
\bibitem[\protect\citeauthoryear{Liu, Ott, Goyal, Du, Joshi, Chen, Levy, Lewis,
Zettlemoyer, and Stoyanov}{Liu
et~al.}{2019}]{DBLP:journals/corr/abs-1907-11692}
Liu, Y., M.~Ott, N.~Goyal, J.~Du, M.~Joshi, D.~Chen, O.~Levy, M.~Lewis,
L.~Zettlemoyer, and V.~Stoyanov. 2019.
\newblock Roberta: {A} robustly optimized {BERT} pretraining approach.
\newblock {\em CoRR\/}~abs/1907.11692.
\newblock {\href{https://arxiv.org/abs/1907.11692}{{1907.11692}}} .
\bibitem[\protect\citeauthoryear{Liu, Tang, Wang, and Chen}{Liu
et~al.}{2017}]{liu2017identification}
Liu, Z., B.~Tang, X.~Wang, and Q.~Chen. 2017.
\newblock De-identification of clinical notes via recurrent neural network and
conditional random field.
\newblock {\em Journal of Biomedical Informatics\/}~75: S34--S42 .
\bibitem[\protect\citeauthoryear{Liu, Yu, Zhang, Wu, Cao, Dai, Zhao, Liu, Shen,
Li, et~al.}{Liu et~al.}{2023}]{liu2023deid}
Liu, Z., X.~Yu, L.~Zhang, Z.~Wu, C.~Cao, H.~Dai, L.~Zhao, W.~Liu, D.~Shen,
Q.~Li, et~al. 2023.
\newblock {DeID-GPT}: Zero-shot medical text de-identification by {GPT}-4.
\newblock {\em arXiv preprint arXiv:2303.11032\/} .
\bibitem[\protect\citeauthoryear{Manzanares-Salor, S\'{a}nchez, and
Lison}{Manzanares-Salor et~al.}{2022}]{10.1007/978-3-031-13945-1_12}
Manzanares-Salor, B., D.~S\'{a}nchez, and P.~Lison 2022.
\newblock Automatic evaluation of disclosure risks of text anonymization
methods.
\newblock In {\em Privacy in Statistical Databases: International Conference,
PSD 2022, Paris, France, September 21–23, 2022, Proceedings}, Berlin,
Heidelberg, pp.\ 157–171. Springer-Verlag.
\bibitem[\protect\citeauthoryear{Mozes and Kleinberg}{Mozes and
Kleinberg}{2021}]{mozes2021no}
Mozes, M. and B.~Kleinberg. 2021.
\newblock No intruder, no validity: Evaluation criteria for privacy-preserving
text anonymization.
\newblock {\em arXiv preprint arXiv:2103.09263\/} .
\bibitem[\protect\citeauthoryear{Neamatullah, Douglass, Li-wei, Reisner,
Villarroel, Long, Szolovits, Moody, Mark, and Clifford}{Neamatullah
et~al.}{2008}]{neamatullah2008automated}
Neamatullah, I., M.M. Douglass, H.L. Li-wei, A.~Reisner, M.~Villarroel, W.J.
Long, P.~Szolovits, G.B. Moody, R.G. Mark, and G.D. Clifford. 2008.
\newblock Automated de-identification of free-text medical records.
\newblock {\em BMC Medical Informatics and Decision Making\/}~{\em 8\/}(1): 32
.
\bibitem[\protect\citeauthoryear{Olstad, Papadopoulou, and Lison}{Olstad
et~al.}{2023}]{olstad-etal-2023-generation}
Olstad, A.W., A.~Papadopoulou, and P.~Lison 2023, May.
\newblock Generation of replacement options in text sanitization.
\newblock In {\em Proceedings of the 24th Nordic Conference on Computational
Linguistics (NoDaLiDa)}, T{\'o}rshavn, Faroe Islands, pp.\ 292--300.
University of Tartu Library.
\bibitem[\protect\citeauthoryear{Papadopoulou, Lison, {\O}vrelid, and
Pil{\'a}n}{Papadopoulou et~al.}{2022}]{bootstrapping}
Papadopoulou, A., P.~Lison, L.~{\O}vrelid, and I.~Pil{\'a}n 2022, June.
\newblock Bootstrapping text anonymization models with distant supervision.
\newblock In {\em Proceedings of the Thirteenth Language Resources and
Evaluation Conference}, Marseille, France, pp.\ 4477--4487. European
Language Resources Association.
\bibitem[\protect\citeauthoryear{Papadopoulou, Yu, Lison, and
{\O}vrelid}{Papadopoulou et~al.}{2022}]{papadopoulou-etal-2022-neural}
Papadopoulou, A., Y.~Yu, P.~Lison, and L.~{\O}vrelid 2022, November.
\newblock Neural text sanitization with explicit measures of privacy risk.
\newblock In {\em Proceedings of the 2nd Conference of the Asia-Pacific Chapter
of the Association for Computational Linguistics and the 12th International
Joint Conference on Natural Language Processing (Volume 1: Long Papers)},
Online only, pp.\ 217--229. Association for Computational Linguistics.
\bibitem[\protect\citeauthoryear{Pilán, Lison, Øvrelid, Papadopoulou,
Sánchez, and Batet}{Pilán et~al.}{2022}]{benchmark}
Pilán, I., P.~Lison, L.~Øvrelid, A.~Papadopoulou, D.~Sánchez, and M.~Batet.
2022, 12.
\newblock {The Text Anonymization Benchmark (TAB): A Dedicated Corpus and
Evaluation Framework for Text Anonymization}.
\newblock {\em Computational Linguistics\/}~{\em 48\/}(4): 1053--1101.
\newblock
{\href{https://arxiv.org/abs/https://direct.mit.edu/coli/article-pdf/48/4/1053/2062009/coli\_a\_00458.pdf}{{https://direct.mit.edu/coli/article-pdf/48/4/1053/2062009/coli\_a\_00458.pdf}}}
.
\bibitem[\protect\citeauthoryear{Ribeiro, Rolla, and Santos}{Ribeiro
et~al.}{2023}]{ribeiro-etal-2023-incognitus}
Ribeiro, B., V.~Rolla, and R.~Santos 2023, May.
\newblock {INCOGNITUS}: A toolbox for automated clinical notes anonymization.
\newblock In {\em Proceedings of the 17th Conference of the European Chapter of
the Association for Computational Linguistics: System Demonstrations},
Dubrovnik, Croatia, pp.\ 187--194. Association for Computational
Linguistics.
\bibitem[\protect\citeauthoryear{Samarati and Sweeney}{Samarati and
Sweeney}{1998}]{Samarati98}
Samarati, P. and L.~Sweeney 1998.
\newblock Protecting privacy when disclosing information: k-anonymity and its
enforcement through generalization and suppression.
\newblock Technical report, SRI International.
\bibitem[\protect\citeauthoryear{Sasada, Kawai, Taenaka, Fall, and
Kadobayashi}{Sasada et~al.}{2021}]{9415242}
Sasada, T., M.~Kawai, Y.~Taenaka, D.~Fall, and Y.~Kadobayashi 2021.
\newblock Differentially-private text generation via text preprocessing to
reduce utility loss.
\newblock In {\em 2021 International Conference on Artificial Intelligence in
Information and Communication (ICAIIC)}, pp.\ 042--047.
\bibitem[\protect\citeauthoryear{Scaiano, Middleton, Arbuckle, Kolhatkar,
Peyton, Dowling, Gipson, and El~Emam}{Scaiano
et~al.}{2016}]{scaiano2016unified}
Scaiano, M., G.~Middleton, L.~Arbuckle, V.~Kolhatkar, L.~Peyton, M.~Dowling,
D.S. Gipson, and K.~El~Emam. 2016.
\newblock A unified framework for evaluating the risk of re-identification of
text de-identification tools.
\newblock {\em Journal of biomedical informatics\/}~63: 174--183 .
\bibitem[\protect\citeauthoryear{Serrano and Smith}{Serrano and
Smith}{2019}]{serrano-smith-2019-attention}
Serrano, S. and N.A. Smith 2019, July.
\newblock Is attention interpretable?
\newblock In {\em Proceedings of the 57th Annual Meeting of the Association for
Computational Linguistics}, Florence, Italy, pp.\ 2931--2951. Association
for Computational Linguistics.
\bibitem[\protect\citeauthoryear{Shi, Mueller, Erickson, Li, and Smola}{Shi
et~al.}{2021}]{multimodal}
Shi, X., J.~Mueller, N.~Erickson, M.~Li, and A.~Smola 2021.
\newblock Multimodal automl on structured tables with text fields.
\newblock In {\em 8th ICML Workshop on Automated Machine Learning (AutoML)}.
\bibitem[\protect\citeauthoryear{Sweeney}{Sweeney}{1996}]{sweeney1996replacing}
Sweeney, L. 1996.
\newblock Replacing personally-identifying information in medical records, the
scrub system.
\newblock In {\em Proceedings of the AMIA annual fall symposium}, pp.\
333--337. American Medical Informatics Association.
\bibitem[\protect\citeauthoryear{Sánchez and Batet}{Sánchez and
Batet}{2016}]{Sanchez2016}
Sánchez, D. and M.~Batet. 2016.
\newblock C-sanitized: A privacy model for document redaction and sanitization.
\newblock {\em Journal of the Association for Information Science and
Technology\/}~{\em 67\/}(1): 148--163 .
\bibitem[\protect\citeauthoryear{Sánchez, Mart{\'\i}nez-Sanahuja, and
Batet}{Sánchez et~al.}{2018}]{sanchez2018survey}
Sánchez, D., L.~Mart{\'\i}nez-Sanahuja, and M.~Batet. 2018.
\newblock Survey and evaluation of web search engine hit counts as research
tools in computational linguistics.
\newblock {\em Information Systems\/}~73: 50--60 .
\bibitem[\protect\citeauthoryear{Tjong Kim~Sang and De~Meulder}{Tjong Kim~Sang
and De~Meulder}{2003}]{tjong-kim-sang-de-meulder-2003-introduction}
Tjong Kim~Sang, E.F. and F.~De~Meulder 2003.
\newblock Introduction to the {C}o{NLL}-2003 shared task: Language-independent
named entity recognition.
\newblock In {\em Proceedings of the Seventh Conference on Natural Language
Learning at {HLT}-{NAACL} 2003}, pp.\ 142--147.
\bibitem[\protect\citeauthoryear{Weitzenboeck, Lison, Cyndecka, and
Langford}{Weitzenboeck et~al.}{2022}]{weitzenboeck2022gdpr}
Weitzenboeck, E.M., P.~Lison, M.~Cyndecka, and M.~Langford. 2022, March.
\newblock The {GDPR} and unstructured data: is anonymization possible?
\newblock {\em International Data Privacy Law\/}~{\em 12\/}(3): 184--206.
\newblock \doi{10.1093/idpl/ipac008} .
\bibitem[\protect\citeauthoryear{Yang and Garibaldi}{Yang and
Garibaldi}{2015}]{YANG2015S30}
Yang, H. and J.M. Garibaldi. 2015.
\newblock Automatic detection of protected health information from clinic
narratives.
\newblock {\em Journal of Biomedical Informatics\/}~58: 30 -- 38.
\newblock \doi{https://doi.org/10.1016/j.jbi.2015.06.015} .
\bibitem[\protect\citeauthoryear{Yermilov, Raheja, and Chernodub}{Yermilov
et~al.}{2023}]{yermilov-etal-2023-privacy}
Yermilov, O., V.~Raheja, and A.~Chernodub 2023, July.
\newblock Privacy- and utility-preserving {NLP} with anonymized data: A case
study of pseudonymization.
\newblock In {\em Proceedings of the 3rd Workshop on Trustworthy Natural
Language Processing (TrustNLP 2023)}, Toronto, Canada, pp.\ 232--241.
Association for Computational Linguistics.
\bibitem[\protect\citeauthoryear{Yogarajan, Mayo, and Pfahringer}{Yogarajan
et~al.}{2018}]{Yog:May:Pfa:2018}
Yogarajan, V., M.~Mayo, and B.~Pfahringer. 2018.
\newblock A survey of automatic de-identification of longitudinal clinical
narratives.
\newblock {\em arXiv preprint arXiv:1810.06765\/} .
\bibitem[\protect\citeauthoryear{Zarcone, Van~Schijndel, Vogels, and
Demberg}{Zarcone et~al.}{2016}]{zarcone2016salience}
Zarcone, A., M.~Van~Schijndel, J.~Vogels, and V.~Demberg. 2016.
\newblock Salience and attention in surprisal-based accounts of language
processing.
\newblock {\em Frontiers in psychology\/}~7: 844 .
\end{thebibliography}