Venue: NAACL 2024

# Keep It Private: Unsupervised Privatization of Online Text

Calvin Bao, Marine Carpuat

{csbao, marine}@umd.edu

University of Maryland, College Park

###### Abstract

Authorship obfuscation techniques hold the promise of helping people protect their privacy in online communications by automatically rewriting text to hide the identity of the original author. However, obfuscation has been evaluated in narrow settings in the NLP literature and has primarily been addressed with superficial edit operations that can lead to unnatural outputs. In this work, we introduce an automatic text privatization framework that fine-tunes a large language model via reinforcement learning to produce rewrites that balance soundness, sense, and privacy. We evaluate it extensively on a large-scale test set of English Reddit posts by 68k authors composed of short-medium length texts. We study how the performance changes among evaluative conditions including authorial profile length and authorship detection strategy. Our method maintains high text quality according to both automated metrics and human evaluation, and successfully evades several automated authorship attacks.

+
Footnote †: Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 8678–8693

June 16-21, 2024 ©2024 Association for Computational Linguistics

## 1 Introduction

Maintaining privacy is crucial to allow everyone's participation in online communities. This is a key motivation for platforms such as Reddit that let users contribute pseudonymously. While anonymity is sometimes viewed as a cause of abuse, there is also clear evidence that de-anonymizing online communication can harm "queer people, sex workers, activists, researchers, journalists, and persons holding combinations of these identities" [1]. However simply using a pseudonym rather than one's legal name does not guarantee privacy, particularly for users from marginalized communities who might still perceive risks due to context collapse [5], and rely on "throwaway accounts" and other practices to negotiate identity boundaries [14]. Furthermore, even with anonymous accounts, text posts encode stylistic markers that can reveal the identity of the author. Stylometry studies [15] suggest that such clues can help identify authors across multiple genres, domains, and discourse types [1, 16, 17].

Automatic authorship obfuscation holds the promise of helping people protect their privacy in online communication by automatically rewriting text to convey the original content while hiding the identity of the original author. Since there is little, if any, supervised training data for this task, existing approaches primarily rely on rule-based systems inspired by stylometry insights [18], repurposing machine translation systems for paraphrasing [19, 17, 16], or unsupervised style transfer models trained with dedicated adversarial objectives [15, 2]. Other methods search for privatization-relevant sur

Figure 1: Authorship obfuscation as tested by attribution and verification attacks. A verification attack asks: Are the Original and Obfuscated texts written by the same author? An attribution attack asks: which author is the Obfuscated text written by among a set of candidate authors, represented by their author profiles?

face edits using genetic search algorithms Mahmood et al. (2019) or heuristic search Bevendorff et al. (2019).

Inspired by the "Keep it Simple" approach to unsupervised text simplification Laban et al. (2021), we introduce "Keep it Private", an unsupervised authorship obfuscation technique based on large language models, which uses reinforcement learning to guide them to generate text that hides author identity while producing sound outputs that preserve the meaning of the original. The impressive text generation abilities of language models suggest that they might help rewrite text in a way that is more natural and contextualized than stylometry-based edits. Large language models also offer an attractive general-purpose alternative to dedicated sequence-to-sequence models that rely on custom architectures, adversarial training, or parallel data such as Emmery et al. (2018).

To achieve privacy, an obfuscation model should be robust to any method that attempts to identify the author. Yet, prior work test on proxy tasks or against a single approach for authorship detection Shetty et al. (2017); Uchendu et al. (2023); Mahmood et al. (2019) in a small-scale authorship setting, with many writing samples per author. To simulate a setting for users participating in online forums, we focus our domain on a large REODIT dataset of 68k authors with short-medium length texts, and check to what degree authors remain private under our evaluation framework. We introduce a new evaluation framework for text obfuscation, where we privatize against several authorship attacks: automatic authorship verification and attribution, as delineated in Figure 2. We introduce a method to guide LLMs to rewrite text for privatization via reinforcement learning, and show that our approach fools attribution and verification models the most, while maintaining soundness of outputs. We make available our scripts on GitHub1.

Footnote 1: [https://github.com/csbao/kip-privatization](https://github.com/csbao/kip-privatization)

## 2 Background

Our authorship obfuscation and evaluation strategies are informed by prior work on authorship analysis, which has been driven by the PAN shared tasks2 spanning profiling, attribution, style change detection, diarization, and obfuscation. We first review different ways of framing the adversarial task of author identification, before reviewing obfuscation methods themselves.

Footnote 2: [https://pan.webis.de/shared-tasks.html#](https://pan.webis.de/shared-tasks.html#)

Authorship IdentificationIdentification can be framed either as **verification** - the task of determining whether two texts were written by the same author - or as **attribution** - the task of identifying the author of a text among a set of authors represented by their writing samples. For either task, one key dimension of variation lies in the nature of writing samples provided, ranging from a single **instance** to an entire author **profile** which groups many instances written by a single user Stamatatos (2009). In this work, we will evaluate our obfuscation techniques against a range of these types of adversaries.

The PAN 2022 shared task on Authorship Verification Stamatatos et al. (2022) demonstrated that verification remains difficult in settings with varied domains and text lengths: many submissions were outperformed by a naive baseline using cosine similarity of character \(n\)-gram representations of document pairs. We use this baseline as a verification adversary VERIF_CNG.

Learning neural embeddings that represent authorship has recently proven effective in large data identification scenarios: In Learning Universal Authorship Representations (LUAR), Rivera-Soto et al. (2021) introduce embeddings trained contrastively to assign higher similarity to pairs of profiles by the same author than to pairs by different authors. The similarity score can be used for verification or for attribution. In attribution settings, ranking a list of candidate authors by LUAR similarity between profiles outperform stylometry-inspired approaches. We will use both approaches as identification adversaries in our evaluation.

Authorship ObfuscationThe goal of obfuscation is to modify a document such that the obfuscated document cannot be traced to its original author. Many obfuscation techniques in the Author Masking series at PAN3 show that models trained for proxy rewriting tasks, such as round-trip translation Keswani et al. (2016); Altkrori et al. (2022) can work well for masking authorship style. Some obfuscation models Shetty et al. (2017); Mahmood et al. (2019); Bo et al. (2021) work in tandem with an adversary. Models designed explicitly to obfuscate stylometric features Karadzhov et al. (2017); 

Kacmarcik and Gamon, 2006) have been shown to fool identification models reliant on those features.

Recently, end-to-end neural approaches that view obfuscation as a style transfer task have been proposed. Bo et al. (2021) train a sequence-to-sequence model to generate text by masking the style from the input, without sacrificing aspects of fluency through its combination of a reconstruction loss and embedding reward at training time. Emmery et al. (2018) train a sequence-to-sequence model on parallel data and an autoencoder on non-parallel data consisting of different editions of the English Bible, presumably written by different authors. These models show promise, yet require training from scratch using complex custom procedures.

Our approach mainly targets the unsupervised authorship obfuscation task in an open-world setting with much larger number of authors with limited writing samples per author. We approach this by fine-tuning general-purpose language models to produce meaning-preserving rewrites with masked authorial style. This work crucially trains for authorship obfuscation guided by a neural-based adversarial authorship embeddings (Rivera-Soto et al., 2021), tested in a realistic online scenario.

Related TasksWe discuss several tasks related to general obfuscation. Style imitation focuses on mirroring a target author's linguistic style. With a similar evaluation setup, Patel et al. (2022) proposes a method rewriting REDDIT posts by prompting large language models (GPT-3 and BLOOM) to imitate the style of a target author (Rivera-Soto et al., 2021). However, we address the more general task of authorship obfuscation as opposed to impersonating a specific author.

Attribute obfuscation often pertains to altering text that is identifiable as a given attribute of the author, including gender and age. Xu et al. (2019) introduce an approach to text rewriting by using reinforcement learning on top of round-trip MT to encourage rewrites that hide demographic attributes of the author. Meanwhile Mireshgallah and Berg-Kirkpatrick (2021) propose a variational autoencoder technique that pools distinct styles associated with sensitive attributes to automatically rewrite text. Shetty et al. (2017) present an unsupervised approach that adversarially trains a neural network to transfer text to protect sensitive attributes. While effective, style rewrites guided by a small number of coarse attributes are not well-suited to obfuscating authorship in online communities, given the large number of users organized within communities that are likely to share many manipulated attributes.

## 3 Approach: The "Keep it Private" Model for Authorship Obfuscation

Our approach to text privatization relies on large language models to rewrite the input text, and uses reinforcement learning to directly optimize metrics that encourage obfuscating the identity of the original author, while preserving the meaning and acceptability of the original text. As a result, training is unsupervised and only requires examples of texts written by different authors, rather than supervised examples of obfuscation which are expensive to obtain at scale.

Our "Keep it Private" model (KiP) privatizes an input segment \(X=(x_{0},\ldots,x_{M})\) into an output \(Y=(y_{0},\ldots,y_{N})\) using a language model \(p(y|x;\theta)\). Inspired by Laban et al. (2021)'s approach to unsupervised text simplification, we adopt their variant of Self-Critical Sequence Training (\(k\)-SCST). Just like the popular REINFORCE algorithm (Williams, 1992), Self-Critical Sequence Training lets us optimize the gradient of the expected reward by sampling from the model during training, and treating those samples as ground-truth labels weighted by the reward. Unlike REINFORCE, \(k\)-SCST relies on its own inference outputs to normalize the rewards observed. We optimize the following loss \(\mathcal{L}\):

\[\mathcal{L}=\sum_{j=1}^{k}(\overline{R^{S}}-R^{S_{j}})\sum_{i=0}^{N}\log p(y_{ i}^{S_{j}}|y_{1}^{S_{j}}...y_{i-1}^{S_{j}},X) \tag{1}\]

For each input \(X\), we generate a set \(S\) of \(k\) output samples \(Y^{S_{j}}=(y_{0}^{S_{j}},\ldots,y_{N}^{S_{j}})\). The loss \(\mathcal{L}\) weighs the log-likelihood of each sample \(Y^{S_{j}}\) by the difference between \(\overline{R^{S}}\), the mean reward over the \(k\) samples and \(R^{S_{j}}\), the reward of the current sample. The mean reward thus serves as a baseline to compare the individual sample reward, and yields a better estimate of the reward distribution. Minimizing the loss thus increases the likelihood of sample \(S_{j}\) if it scores higher than the baseline mean reward.

Self-Critical Sequence Training was initially proposed for caption generation tasks (Rennie et al., 2017), and has also been used for other text generation tasks, including question generation (Zhang 

and Bansal, 2019) and summarization Wang et al. (2018); Celikyilmaz et al. (2018). Laban et al. (2021) showed the benefits of sampling \(k\) candidate rewrites instead of one for unsupervised text simplification, a rewriting task that shares with obfuscation the need to rewrite stylistic attributes of the input text while preserving its meaning.

Within this framework, we consider a range of language models \(P(Y|X;\theta)\) as base generators (subsection 3.1), and design a set of rewards for authorship obfuscation (subsection 3.2).

### Base Language Models

The loss (Equation 1) can be used to optimize any language model \(P(Y|X)\) that generates the output sequence \(Y\) autoregressively from left to right. We consider two different language models: 1. GPT**2-medium** (345M parameters) Radford et al. (2019), a decoder-only model, 2. BART**-large** (406M parameters) Lewis et al. (2019), an encoder-decoder model. We selected GPT2 as our decoder-only model to align with the Laban et al. (2021) setting, and we select the BART models to investigate the impact of encoder-decoder models.

We consider two variants that encourage meaning preservation by fine-tuning them for paraphrasing tasks, namely: 3. BART**-para** (406M parameters) and 4. DIPPER**-large** (770M parameters). BART**-para** is obtained by fine-tuning BART on meaning-preserving examples from 173.5k paraphrases coming from three datasets: QQP Iyer et al. (2017) (149k pairs), PAWS Zhang et al. (2019) (21.8k pairs), and MSR Dolan and Brockett (2005) (2.7k pairs). BART**-para** was fine-tuned in a supervised, sequence-to-sequence fashion by generating one side of the pairs conditioned on the other over 4 training epochs. DIPPER is obtained by fine-tuning the T5**-large**Raffel et al. (2020) model on 152k pairs of synthetically perturbed aligned translations of non-English novels from the PAR3 dataset Thai et al. (2022). The perturbations allow the introduction of control codes at inference time to control the edit type and the intensity of edits made.

### Rewards

We design rewards that encode the three main desiderata of the text obfuscation task. A good rewrite should _privatize_ the text so that the identity of the author cannot be correctly detected, while being _sound_ (i.e., well-formed) and preserving the _meaning_ of the input. We describe how these are encoded in the reward below.

PrivacyAmong the many ways to quantify the privacy of a given text with attribution and verification tasks, we prioritize signals that are relatively cheap to compute as training rewards. We rely on the LUAR embeddings Rivera-Soto et al. (2021) to compute cosine similarity \(S_{C}\) of output \(Y\) and input \(X\) in the authorship embedding space, and subtract it from 1 to get the distance metric:

\[LUAR_{self}=1-C_{S}(L_{X},L_{Y}). \tag{2}\]

Meaning PreservationWe compute the cosine similarity of SBERT embeddings Reimers and Gurevych (2019) between the inputs and generations, as seen in Equation 3.

\[SBERT_{self}=C_{S}(S_{X},S_{Y}) \tag{3}\]

To further improve saliency of the generations, we also retain the coverage model used in Laban et al. (2020, 2021) which is an informed gap-filling task on the original text, conditioned on the generation.

SoundnessWe use a grammatical acceptability model to assess whether an output is as sound as the input. Specifically, we use RoBeRTA-large finetuned on the CoLA dataset annotated with boolean grammatical acceptability labels Warstadt et al. (2019) to score both the input and output. The reward captures the agreement between these two soundness judgments:

\[CoLa_{self}=CoLa(X)==CoLa(Y) \tag{4}\]

To further improve soundness of the generations, we retain the fluency reward as described in Laban et al. (2021). This reward works to maintain soundness in the base generator by using the model's likelihood score and a discriminator model trained adversarially.

GuardrailsGuardrailsensurethatwekeepgenerationsalignedwithbasicrules,suchas brevity and repetition. Thesearebinary0-1 values--iftriggered, theywilleffectivelyzeroouttherewardscore, ensuringthatthemodeldoesnotlearnfrom"de-generations". Weusethebrevity guardrailfromLaban et al. (2021) to penalize generations thatfall outsideofthe0.8-1.4input-outputlengthratiorange.Therepetitionguardraildiscouragesrepetitionsbypenalizingoutputsthatcontainanyrepeated3-grams.

 

Overall Reward FunctionThe final reward \(R_{S}\) is the weighted logarithmic sum of the scalar components above, including the penalty guardrails:

\[R_{S}=\gamma_{1}\cdot\log(LUAR_{S})+\gamma_{2}\cdot\log(SBERT_{S})+\\ \gamma_{3}\cdot\log(Fluency_{S})+\gamma_{4}\cdot\log(CoLA)\\ +\sum_{i=1}^{g}log(1-G_{i_{S}}) \tag{5}\]

We use \(\gamma_{1}=3,\gamma_{2}=2,\gamma_{3}=1,\gamma_{4}=1\), based on a small grid search in early experiments.

## 4 Experimental Design

We describe our experimental design, including datasets, metrics, and models.

### Data

TrainingWe base our training data on a corpus of English Reddit comments Baumgartner et al. (2020). Our training split (REDII) is constrained to comments written by 30k authors, for a total of 7.12 million comments. Our data pipeline concatenates comments from one subreddit, written by the same author, into a pseudo-document until the pseudo-document reaches at least 250 words. We treat this as the author profile. For KiP models, we normalize by lowercasing, removing newline characters, duplicate spaces, and duplicate punctuation in order to encourage learning more substantial edits during the KiP process.

EvaluationWe conduct our primary evaluation over the REDDIT dataset. Our data pipeline extracts 1600 "needle" comments from 100 authors (16 comments per author). In the **attribution** setting, these comments are grouped and concatenated by author to create an author profile, and then our adversarial authorship attribution model LUAR uses that needle profile to query for the most similar candidate profiles in our "haystack" candidate set of more than 1 million comments written from a superset of 68k authors (16 comments per author, wherein overlapping authors have disjoint comments from the "needles"). In the **verification** setting, these comments are similarly grouped into the author profile, and then each profile is paired with a same-author profile constructed from a random sample of candidate texts, taken from the same author set. These pairs are provided to VERIF_CNG, the strong character-based verification baseline from the PAN 2022 verification task Stamatatos et al. (2022), in order to discriminate if they were written by the same author. VERIF_CNG was trained on an even mixture of profile lengths (comments=1,2,4,8,16) to be more robust to length size. Similar to the setup in Rivera-Soto et al. (2021) and Andrews and Bishop (2019), our evaluation dataset is author-disjoint from our training data - it contains comments by authors not present in the training data.

### Evaluation Metrics

We evaluate all outputs on the previously discussed aspects of privacy, meaning preservation, and soundness.

PrivacyWe evaluate privacy against a range of adversaries. We first report a LUAD distance, similar to the first privacy reward for our KiP model (Section 3.2), measuring distance between the LUAR embeddings of original inputs and privatized outputs. Second, we report the same retrieval metrics as in Rivera-Soto et al. (2021) based on the LUAR authorship attribution model: (1) recall-at-8 (R@8) which checks whether the correct author appears amongst the top 8 authors predicted by the model, and (2) mean reciprocal rank (MRR), the average inverse rank of the ordered retrievals. We compute MRR as: \(\frac{1}{n}\sum_{i}^{n}\frac{1}{RANK_{i}}\) over \(n\) query author profiles. An MRR value of 1 indicates perfect retrieval, with the correct author always ranked first. An MRR of 0 indicates complete failure, with the correct author never retrieved.

For our REDDIT sample, the haystack is large, consisting of comments from 68k authors. The LUAR attributor performs well at this scale (93% R@8, 83% MRR) for the unmodified "needles" collection, which leaves room for a range of impact that various obfuscation models can have on the retrieval metrics after privatization.

Along with the retrieval metrics, we include the adversarial verification metric: c@1 score Penas and Rodrigo (2011) of VERIF_CNG to evaluate how often the obfuscation flips a testbed of entirely same-author profile pairs to the different-author label, while calibrating for model uncertainty.

Meaning PreservationWe compute self-SBERT, which is the cosine similarity of SBERT embeddings Reimers and Gurevych (2019) from the input and the output in the test set to assess whether the privatized text preserves the meaning 

of the original. This is similar to how the respective reward is computed in section 3.2.

SoundnessFor soundness, we compute CoLA-out - the grammatical acceptability on the outputs. We also include LenRatio which computes the ratio of output to input character length as a soundness metric to spot-check that models are not producing unexpectedly short or long rewrites.

### Conditions

BaselinesWe consider a diverse set of baselines:

* the **Copy** baseline, which makes an exact copy of the input.
* a naive **normalizer**, which replaces newlines with spaces, removes duplicate spaces, and removes duplicate punctuation.
* **round-trip MT (RTMT)**, an approach that paraphrases the input by repurposing an off-the-shelf m2m50 multilingual machine translation tool Liu et al. (2020) to translate from English into German and back into English.
* **LUAR-rescored RTMT**, which samples 4 generations per input and selects the best generation according to LUAR.
* the **stylo** model, an obfuscation model that rewrites text to match pre-defined stylometric properties Karadzhov et al. (2017).
* prompting a **BLOOM-7b**Workshop (2023) model to rewrite text into a neutral style. We use the prompts in step 1 of the target author imitation recipe from Patel et al. (2022).

We include other baselines to understand the impact of KiP: BART-Para, as described in subsection 3.1, and DIPPER-large Krishna et al. (2023), which fine-tunes T5-large on the PAR3 dataset Thai et al. (2022), a collection of aligned literary translations.

Keep It Private ModelsOur models are built as described in section 3, resulting in four variants depending on the underlying base generator used: KiP-GPT2, KiP-BART, KiP-BART-Para, KiP-DIPPER. We used the same hyperparameters across base generators. We used Lamb optimizer You et al. (2020) to optimize the model with learning rate 0.0001 on the loss function defined in Equation 1. We use a training batch size of 4 inputs, sampling \(k\)=8 runs per input for 8-SCST. Every training run is done on a single RTXA6000 GPU.

## 5 Results

OverviewWe present the main evaluation results on the REODIT evaluation dataset in Table 2. We set the upper bound for our obfuscation methods by highlighting the performance of the **Copy** baseline, which represents the performance of adversarial authorship tools on the text as-is. The high attribution scores suggest that LUAD embeddings provide sound adversaries in these settings, and we compare that with our baselines and proposed KiP models. Finally, we discuss our human evaluation to further validate paraphrasing adherence of some of our obfuscation methods, and investigate how author profile length is a factor in the privacy evaluation.

### Baselines

Overall, our set of **baselines** show that the effectiveness of existing obfuscation methods varies widely. Many of the baselines preserve meaning well based on the high SBERT scores, however this is simply a consequence of limited or formulaic edits. The trivial edits of the Normalizer surprisingly degrade authorship attribution more than round-trip MT, with only a slight improvement when selecting the best-performing sample according to LUAR. The baseline that privatizes best is the Bloom-7b model, however, this comes at a heavy meaning cost. Qualitatively, this method also frequently produced repetitions, leading to outputs that are on average 20 times longer than inputs. On the other hand, the Stylo model also privatizes well, but it creates unsound outputs that appear unnatural to the human eye4, as we will see in the human evaluation (subsection 5.3). We also see strong performance from the paraphrasing baselines - DIPPER specifically shows strong privacy performance with higher meaning preservation depending on edit control code. The verification performance of all baselines except Bloom-7b, DIPPER 6OL, 6OO, and BART-Para remain close to that of the Copy control.

Footnote 4: Sample model outputs can be found in Table 1

### KiP models

The KiP models generally improve the privacy metrics over the baselines by performing edits that are more effective at fooling attribution and verification adversaries. As can be expected, this makes it harder to preserve meaning or soundness, although the SBERT sc 

above). KiP-GPT2 ranks well on privacy of attribution and meaning preservation metrics, but fails on soundness with outputs that are on average up to 4.78 times longer than inputs. Manual inspection shows that, despite the guardrails, KiP-GPT2 is prone to hallucinating long tangents that are fluent (as observed by high CoLA scores) but only topically connected to the original text, as illustrated in Table 1. This fools LUAD-based adversaries, but not VERIF_CNG. Using the BART language model as an underlying generator curbs this pathological behavior. The KiP-BART model improves privatization against both attribution and verification adversaries compared to KiP-GPT2, with more sound outputs.

Using a base generator fine-tuned for paraphrasing (KiP-BART-Para, KiP-DIPPER) results in more extensive edits that achieve improved privatization performance without hurting meaning preservation compared to the more conservative KiP-BART and even the aggressive baseline DIPPER model, however at a cost in acceptability. Overall, this shows that the KiP paraphrasing models address the actual task of text obfuscation compared to baselines and improves on privatization, including against adversaries that are independent from the privatization rewards it was trained on.

Finally, privatization models as a whole tend to be significantly more successful at fooling attribution than verification models, confirming the need to measure progress against a diverse range of adversaries. Though target use cases might differ, we argue that an effective privatization method should fool all or many detectors.

### Analysis

We include additional evaluation assessing how author profile length impacts the privacy evaluation. We also report a human evaluation to further validate the meaning preserving qualities of a subset of our systems.

\begin{table}
\begin{tabular}{l l} \hline \hline
* And theoretically -,it looks like halLF of the comments of someone Are true and 25\% are false. That’s a deceptive way to look at it. I could just as easily argue that half of her comments were false. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Sample outputs. Rephrasings are colored in orange, additions are colored in green, and reorderings are colored in pink. More outputs for a subset of these models can be found in Table 5 in Appendix E.
 

Human EvaluationBecause our goal is to prevent automatic authorship identification, we test the privacy-preserving aspects of system outputs according to an extensive automatic evaluation. To complement the automatic meaning preservation and soundness metrics described in subsection 4.2, we focus on validating generation quality of our proposed system in the human evaluation. We include 99 system outputs from REDDIT evaluation each from Stylo, RT MT, KiP-Bart-Para, KiP-DIPPER, totalling 396 outputs. Instead of asking annotators to separately assess meaning preservation and fluency, we adopt the three-point Likert scale as done by Hallinan et al. (2023); Iyyer et al. (2018) for **paraphrase validation**: (0 = no paraphrase, 1 = ungrammatical paraphrase, 2 = grammatical paraphrase). We recruited 36 Englishfluent participants using Prolific, and compensated them at rates complying with local wage standards. Results suggest that KiP-DIPPER outputs are meaningful and well-formed paraphrases of the original texts according to humans (Figure 3), despite being obfuscated with strong privacy-preserving edits.

Author Profile LengthFigure 2 shows the performance of our obfuscation model in the texting action and attribution scenarios over several # of REDDIT comments in author profiles. In the verification setting, we create a problem set containing on one side, the concatenations of the selected number of the obfuscations of the "needles" set, and on the other, unmodified versions of the "candidates" set written by the same authors as in the "needles"

\begin{table}
\begin{tabular}{l r r r r r r r} \hline \hline  & \multicolumn{5}{c}{**Privacy**} & \multicolumn{1}{r}{**Meaning**} & \multicolumn{1}{r}{**Soundness**} \\ \cline{2-7}  & \multicolumn{2}{c}{Attribution} & \multicolumn{2}{c}{Verification} & & & \\  & R@\(8\downarrow\) & MRR \(\downarrow\) & CNG c@\(1\downarrow\) & LUAR \(\uparrow\) & SBERT \(\uparrow\) & COLA \(\uparrow\) & LenRatio \\ \hline _Baselines_ Copy & 93.0 & 83.0 & 71.0 & 0 & **100.0** & **100.0** & 100.0 \\ Normalizer & 30.0 & 21.0 & 71.5 & 14.5 & 99.0 & 90.1 & 99.7 \\ Stylo & 8.0 & 6.0 & 67.3 & 35.6 & 90.0 & 49.0 & 113.3 \\ Round-trip MT & 56.0 & 43.0 & 71.8 & 17.7 & 89.0 & 85.5 & 100.4 \\ LUAR-scored RTMT & 51.0 & 38.0 & 73.5 & 23.0 & 84.4 & 86.4 & 101.07 \\ BLOOM–7b & **3.0** & **2.0** & **56.8** & **46.9** & 44.3 & 94.2 & 2613.8 \\ BART-Para & 18.0 & 15.0 & 62.4 & 33.8 & 82.3 & 73.4 & 118.3 \\ DIPPER 20L, 200 & 16.0 & 12.0 & 73.2 & 38.6 & 84.5 & 78.3 & 112.3 \\ DIPPER 60L, 600 & 10.0 & 6.0 & 62.6 & 38.8 & 83.4 & 77.1 & 128.1 \\ \hline _Keep It Private Models_ KiP-GTP2 & 9.0 & 6.0 & 72.8 & 39.7 & **78.6** & **76.7** & 478.2 \\ KiP-BART & 11.0 & 9.0 & 55.9 & 35.4 & 73.5 & 66.7 & 146.3 \\ KiP-BART-Para & 4.0 & 4.0 & 46.6 & 42.6 & 77.1 & 61.5 & 89.7 \\ KiP-DIPPER & **2.0** & **2.0** & **42.3** & **45.2** & 70.1 & 63.3 & 93.4 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Obfuscation performance over the REDDIT evaluation dataset. Keep It Private Models generally improve the privacy of generated text compared to baselines, but the improvement is more consistent against an attribution than a verification adversary. Privacy improvements come at the cost of a small degradation in meaning preservation and soundness.

Figure 2: Higher values on the Y-axis indicate better performance of the adversarial model, and thus, worse performance in the obfuscation. A subset of baselines (Stylo, RT MT, Copy) is compared against the KiP-Bart-Para model over the first five powers-of-2 progressions for author profile size: \(1\to 16\) comments.

 

set. VERIF_CNG was trained on an even mixture of lengths (comments={1,2,4,8,16}) in author profiles to provide a lens into various author profile sizes in the test set. In the attribution setting, we apply the same control on length per author profile, using the entire pool of unmodified "candidates" written by 68k authors. We limit our analysis here to the KiP-Bart-para model and three baselines.

Performance of the KiP-Bart-Para model worsens slowly in the attribution setting (0% R@8 at 1 comment \(\rightarrow\) 4% R@8 by 16 modified comments versus 2% R@8 at 1 comment \(\rightarrow\) 93% R@8 by 16 unmodified comments). We observe a similar trend for Copy in the verification setting: VERIF_CNG is not able to discriminate obfuscations from same-author pairs until a certain profile length, at which point the VERIF_CNG can correctly discern the pair as same-author. Though there is a gap in favor of the obfuscation at 2 and 4 comments, this gap is closed by the time the author profile grows to 8 comments. KiP-Bart-para is unable to fool VERIF_CNG at longer author profiles.

Reward AblationsAblation experiments confirm that the meaning preservation, soundness and privacy components of the reward are all necessary. We provide the detailed results in Appendix C.

Out of Domain EvaluationWe complement the REDDIT evaluation results by reporting additional results on the BLOG evaluation dataset in Appendix A Table 3. Here, we confirm that the KiP models improve performance against both privacy adversaries. However, we see a larger reduction in meaning preservation with the DIPPER model, compared to BART-Para.

## 6 Conclusion

We introduced a method for training obfuscation models that use reinforcement learning on top of pre-trained language models to obfuscate the authorship of the original text. This method relies on a diverse range of rewards, crucially including neural authorship representations to judge authorship signals. The resulting outputs are edited more substantially than with existing obfuscation baselines, thereby improving privacy, while preserving meaning and soundness better than other successful obfuscation strategies. We find that using paraphraser base models lead to better balancing of both privacy and meaning preservation in the resulting KiP models. Additionally, conducting an extensive evaluation with diverse adversaries and input lengths highlights some important performance differences -- namely, that it is difficult to fool verification systems with longer obfuscated author profiles, even if they fool attribution systems. This calls for more research into designing robust evaluation benchmarks for obfuscation systems, to assess and catch failure cases that can map to different real-world scenarios.

## 7 Acknowledgments

This research is supported in part by the Office of the Director of National Intelligence (ODNI), Intelligence Advanced Research Projects Activity (IARPA), via the HIATUS Program contract 2022-22072200006. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies, either expressed or implied, of ODNI, IARPA, or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for governmental purposes notwithstanding any copyright annotation therein.

### Limitations

Our primary evaluation is limited to two English datasets on short to medium-length texts. Because we only require data annotated by author ID, this method should be able to easily port to new datasets or new domains (for example, written fanfiction) in principle. However, this needs to be validated in a broader range of settings, especially because

Figure 3: Results from a crowdsourced paraphrase pair evaluation. Systems are ordered from strongest (left) to weakest (right) in automatic privacy performance. Meanwhile, KiP-DIPPER produces more grammatical paraphrases than the other models, validating KiP-DIPPER’s rewriting promise for achieving privacy and meaning preservation jointly.

 

many of the reward components use English models. Furthermore, we focused exclusively on _automatic_ authorship attribution and verification, and did not explore how people with varying expertise in authorship analysis might manually assess the resulting texts.

## Ethics Statement

Our work illustrates an improvement on automated obfuscation software, novelly applying a fine-tuning strategy for the task of general authorship obfuscation. The overarching goal for technologies that enable obfuscation on text data is to protect attribution of individuals or groups in cases where authorship metadata is scrubbed (e.g. using a pseudonym) Afsaneh (2021). At the same time, powerful obfuscation tools could be used to threaten, cyberbully, or otherwise endanger other individuals without accountability or fear of retribution.

Additionally, though this work does not explicitly target author style imitation, we acknowledge that obfuscation can cause existing identification tools to mis-attribute authorship to unsuspecting people. Because these identification tools have shown to be incredibly accurate for authorship retrieval, in scenarios where these users are unaware that texts have been modified, mis-attribution is a serious concern Altakrori et al. (2022).

The Reddit dataset used as training data in our work is licensed as CC-BY-4.0 protocol, which stipulates that publicly released data will be used exclusively for research purposes. All pre-trained models used in this work are publicly available on HuggingFace5, and we ensured that the research methodologies described in this work are aligned with licensing permissions. All methods and models described in this work are for research purposes, and are not intended for commercial use.

Footnote 5: [https://huggingface.co/](https://huggingface.co/)

We manually reviewed our evaluation data to ensure that PII or personal entity identifiers were masked. We did not scrub swear words. For the human evaluation, we manually reviewed outputs and removed any candidates with hate speech.

## References

* R. Afsaneh (2021)Why online anonymity matters. Note: Malik Altakrori, Thomas Scialom, Benjamin C. M. Fung, and Jackie Chi Kit Cheung External Links: Link Cited by: SS3.
* N. Andrews and M. Bishop (2019)Learning invariant representations of social media users. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), Hong Kong, China, pp. 1684-1695. External Links: ISBN 978-3- 

Findings of the Association for Computational Linguistics: EMNLP 2023, pp. 7546-7562. External Links: Link Cited by: SS1.
* D. I. Holmes (1998)The evolution of stylometry in humanities scholarship. Literary and Linguistic Computing13, pp. 111-117. External Links: Document Cited by: SS1.
* S. Iyer, N. Dandekar, and K. Csernai (2017)First quora dataset release: question pairs. Journal of Machine Learning Research. External Links: ISSN 1099-1219, Link Cited by: SS1.
* M. Iyyer, J. Wieting, K. Gimpel, and L. Zettlemoyer (2018)Adversarial example generation with syntactically controlled paraphrase networks. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers), New Orleans, Louisiana, pp. 1875-1885. External Links: ISBN 978-3-319-14503-4 Cited by: SS1.
* G. Kacmarcik and M. Gamon (2006)Obfuscating document stylometry to preserve author anonymity. In Proceedings of the COLING/ACL 2006 Main Conference Poster Sessions, Vol. 444-451, Sydney, Australia, pp. 444-451. External Links: ISBN 978-3-319-14503-4 Cited by: SS1.
* (best of the labs track at clef-2017). In Conference and Labs of the Evaluation Forum, Cited by: SS1.
* Y. Keswani, H. Trivedi, F. Mehta, and P. Majumder (2016)Author masking through translation. In Conference and Labs of the Evaluation Forum, Cited by: SS1.
* 16, 2023, External Links: Link Cited by: SS1.
* Philippe Laban, A. Hsi, J. Canny, and M. A. Hearst (2020)The summary loop: learning to write abstractive summaries without examples. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Online, pp. 5135-5150. External Links: Link Cited by: SS1.
* P. Laban, T. Schnabel, P. Bennett, and M. A. Hearst (2021)Keep it simple: unsupervised simplification of multi-paragraph text. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), Online, pp. 6365-6378. External Links: Link Cited by: SS1.
* A. Leavitt (2015)"This is a Throwaway Account": temporary technical identities and perceptions of anonymity in a Massive Online Community. In Proceedings of the 18th ACM Conference on Computer Supported Cooperative Work & Social Computing, CSCW '15, New York, NY, USA, pp. 317-327. External Links: ISBN 978-3-642-4651-3 Cited by: SS1.
* M. Lewis, Y. Liu, N. Goyal, M. Ghazvininejad, A. Mohamed, O. Levy, V. Stoyanov, and L. Zettlemoyer (2019)Bart: denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension. External Links: 1905.02770 Cited by: SS1.
* T. Litinova (2020)Stylometrics features under domain shift: do they really "context-independent"?. In Speech and Computer, Cham, pp. 279-290. External Links: ISBN 978-3-642-4651-3 Cited by: SS1.
* Y. Liu, J. Gu, N. Goyal, X. Li, S. Edunov, M. Ghazvininejad, M. Lewis, and L. Zettlemoyer (2020)Multilingual denoising pre-training for neural machine translation. Transactions of the Association for Computational Linguistics8, pp. 726-742. External Links: ISSN 1099-1219, Link Cited by: SS1.
* 71. External Links: ISSN 1099-1219, Link Cited by: SS1.
* I. Markov, N. Ljubesic, D. Fixer, and W. Daelemans (2021)Exploring stylometric and emotion-based features for multilingual cross-domain hate speech detection. In Proceedings of the Eleventh Workshop on Computational Approaches to Subjectivity, Sentiment and Social Media Analysis, Online, pp. 149-159. External Links: ISBN 978-3-642-4651-3 Cited by: SS1.
* F. Matreshghallah and T. Bergstrick (2021)Style pooling: automatic text style obfuscation for improved classification fairness. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, Online and Punta Cana, Dominican Republic, pp. 2009-2022. External Links: Link Cited by: SS1.
* A. Patel, N. Andrews, and C. Callison-Burch (2022)Low-resource authorship style transfer with in-context learning. ArXivabs/2212.08986. External Links: Link Cited by: SS1.
* A. Penas and A. Rodriguez (2011)A simple measure to assess non-response. In Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, Portland, Oregon, USA, pp. 1415-1424. External Links: ISBN 978-3-642-4651-3 Cited by: SS1.
* A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever (2019)Language models are unsupervised multitask learners. External Links: 1905.02770 Cited by: SS1.
* C. Raffed, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. J. Liu (2020)Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res.21, pp. 140:1-140:67. External Links: ISSN 1099-1219, Link Cited by: SS1.
* N. Reimers and I. Gurevych (2019)Sentence-BERT: sentence embeddings using Siamese BERT-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing 

and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_, pages 3982-3992, Hong Kong, China. Association for Computational Linguistics.
* Rennie et al. (2017) Steven J. Rennie, Etienne Marcheret, Youssef Mroueh, Jerret Ross, and Vaibhava Goel. 2017. Self-critical sequence training for image captioning. In _2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26, 2017_, pages 1179-1195. IEEE Computer Society.
* Rivera-Soto et al. (2021) Rafael A. Rivera-Soto, Olivia Elizabeth Miano, Juanita Ordonez, Barry Y. Chen, Aleem Khan, Marcus Bishop, and Nicholas Andrews. 2021. Learning universal authorship representations. In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_, pages 913-919, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
* Schler et al. (2006) Jonathan Schler, Moshe Koppel, Shlomo Argamon, and James W Pennebaker. 2006. Effects of age and gender on blogging. In _AAAI spring symposium: Computational approaches to analyzing weblogs_, volume 6, pages 199-205.
* Shetty et al. (2017) Rakshith Shetty, Bernt Schiele, and Mario Fritz. 2017. A4nt: Author attribute anonymity by adversarial training of neural machine translation. In _USENIX Security Symposium_.
* Stamatatos (2009) Efstathios Stamatatos. 2009. A survey of modern authorship attribution methods. _J. Am. Soc. Inf. Sci. Technol._, 60(3):538-556.
* Stamatatos et al. (2022) Efstathios Stamatatos, Mike Kestemont, Krzysztof Kredens, Piotr Pezik, Annina Heini, Janek Bevendorff, Benno Stein, and Martin Potthast. 2022. Overview of the Authorship Verification Task at PAN 2022. In _CLEF 2022 Labs and Workshops, Notebook Papers_. CEUR-WS.org.
* Thai et al. (2022) Katherine Thai, Marzena Karpinska, Kalpesh Krishna, Bill Ray, Moira Inghilleri, John Wieting, and Mohit Iyyer. 2022. Exploring document-level literary machine translation with parallel paragraphs from world literature. In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_, pages 9882-9902, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
* Triggs et al. (2021) Anthony Henry Triggs, Kristian Moller, and Christina Neumayer. 2021. Context collapse and anonymity among queer Reddit users. _New Media & Society_, 23(1):5-21.
* Uchendu et al. (2023) Adaku Uchendu, Thai Le, and Dongwon Lee. 2023. Attribution and obfuscation of neural text authorship: A data mining perspective. _SIGKDD Explor._, 25(1):1-18.
* Wang et al. (2018) Li Wang, Junlin Yao, Yunze Tao, Li Zhong, Wei Liu, and Qiang Du. 2018. A reinforced topic-aware convolutional sequence-to-sequence model for abstractive text summarization. In _Proceedings of the 27th International Joint Conference on Artificial Intelligence_, IJCAI'18, page 4453-4460. AAAI Press.
* Warstadt et al. (2019) Alex Warstadt, Amanpreet Singh, and Samuel R. Bowman. 2019. Neural network acceptability judgments. _Transactions of the Association for Computational Linguistics_, 7:625-641.
* Williams (1992) Ronald J. Williams. 1992. Simple statistical gradient-following algorithms for connectionist reinforcement learning. _Mach. Learn._, 8(3-4):229-256.
* Workshop (2023) BigScience Workshop. 2023. Bloom: A 176b-parameter open-access multilingual language model.
* Xu et al. (2019) Qiongkai Xu, Lizhen Qu, Chenchen Xu, and Ran Cui. 2019. Privacy-aware text rewriting. In _Proceedings of the 12th International Conference on Natural Language Generation_, pages 247-257, Tokyo, Japan. Association for Computational Linguistics.
* You et al. (2020) Yang You, Jing Li, Sashank J. Reddi, Jonathan Hkeu, Sanjiv Kumar, Srinadh Bojanapalli, Xiaodan Song, James Demmel, Kurt Keuzer, and Cho-Juji Hsieh. 2020. Large batch optimization for deep learning: Training BERT in 76 minutes. In _8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020_. OpenReview.net.
* Zhang and Bansal (2019) Shiyue Zhang and Mohit Bansal. 2019. Addressing semantic drift in question generation for semi-supervised question answering. In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_, pages 2495-2509, Hong Kong, China. Association for Computational Linguistics.
* Zhang et al. (2019) Yuan Zhang, Jason Baldridge, and Luheng He. 2019. PAWS: Paraphrase adversaries from word scrambling. In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_, pages 1298-1308, Minneapolis, Minnesota. Association for Computational Linguistics.

## Appendix A BLOG Evaluation Results

We start with 400 "needle" BLOG(Schler et al., 2006) snippets from 200 authors (2 comments per author). In our evaluation set, there are 211 words per BLOG snippet with 2 snippets per author, versus 37 words per REDMIT comment with 16 comments per author. The attribution evaluation for this data is as described in the REODIT setting. We include the BLOG dataset in our evaluation to show that the proposed models operate well out-of-domain, and on slightly longer text lengths. Results are reported in Table 3.

For our BLOG sample, the haystack is smaller than that of the REDDT sample. We observe that the LUAR attributor performs well out-of-domain at 51% R@8, 41% MRR, also leaving room to assess impact of the included obfuscation methods.

 



## Appendix B Human Evaluation Setup

As it is difficult for humans to identify authorship signals in natural language texts, we focused our human evaluation on assessing **paraphrase validity** to ensure quality of system generations.

Figure 4 shows the annotation instructions, and Figure 5 and Figure 6 show sample annotation screens. We recruited in total 27 participants. Each participant was paid complying with local wage standards. Each input-output pairing was annotated 3 times, and we took the majority vote as the score for the pairing.

## Appendix C Reward Component Ablation

Reward ComponentsTo better understand trade-offs across evaluation dimensions, we measure the impact of reward components on the results (Table 4). We confirm that the meaning preservation, soundness and privacy components of the reward are all necessary. As expected, when we remove the LUAR-based reward leads to better privacy evaluation at the expense of SBERT and for BART-para, CoLA, and vice versa (rows 3 and 7 compared to rows 1 and 5), which leads to better SBERT scores at the expense of LUAR. caption

## Appendix D Bloom Prompts

As with all language models used in this work, we pulled language models from model repositories on the Hugging Face6 platform. For our prompting experiments, we used BLOOM-7b 7. We followed the procedures listed out in Patel et al. (2022) to prompt BLOOM into rewriting the given REDDIT comments in a neutral style. We set default decoding parameters temperature\(=0.7,top_{p}=1.0\), and prompt with:

Footnote 6: [https://huggingface.co/](https://huggingface.co/)

Passage: {Input Reddit comment}

Paraphrase the passage in a simple neural style.

Rewrite:

and allow BLOOM to generate until the <eos> token. We treat the model generation as the obfuscated text. We did not do any decoding parameter experiments.

## Appendix E Sample of obfuscation outputs

More sample outputs can be found in Table 5.



The goal of this study is to assess whether a text is a **valid paraphrase** of the other.

In this task, you will be provided with two texts: **Text A (the first text)** and **Text B (the second text)**. Some texts will be paragraphs, while some will be sentences or shorter phrases. Text B is a paraphrase of Text A if the meaning is preserved, despite different phrasing.

You will be selecting between 3 options:

**0 -** the two texts are NOT paraphrases -- they have significant meaning differences.

**1 -** the second text is an ungrammatical paraphrase of the first text.

**2 -** the second text is a grammatical paraphrase of the first text.

_Note:_ If text B retains the same meaning as text A and there are only minor grammatical mistakes in text B that might follow from text A's grammaticality, then please select "2". Otherwise, please use your best judgment.

Devices you can use to take this study:

Figure 4: Instructions given to study participants. 27 English-fluent participants were recruited via Prolific.

Figure 5: A sample multiple-choice question given to annotators.

 



\begin{table}
\begin{tabular}{l|c c c} \hline _Model_ & LUAR & SBERT & CoLa \\ \hline \hline Remove guardrails & 0.632 & 0.378 & 0.383 \\ Remove fluency & 0.246 & 0.818 & 0.608 \\ Remove meaning & 0.265 & 0.677 & 0.756 \\ Remove privacy & 0.384 & 0.812 & 0.591 \\ KiP-BART-para & 0.426 & 0.771 & 0.615 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Impact of removing various components on LUAR distance, SBERT similarity and CoLA, an acceptability judgment.





\begin{table}
\begin{tabular}{l l} \hline
**Model** & **Output** \\ \hline Copy & 1. It’s all that sustains her at this point. 2. It’s more of a reflection of the low enthusiasm of her supporters. People simply aren’t excited about ¡PERSON¿. Obviously it doesn’t mean much in the real world you can’t be so literal 3. He’s the nimblest of all navigators 4. For ios 100% no, the permission settings is still saying that it tracks your movement only when the app is open. \\ RT MT & 1. It is all that it supports at this time 2. It is more a reflection of the low enthusiasm of their supporters. People are simply not enthusiastic about ¡PERSON¿. Obviously it doesn’t mean much in the real world you can’t be so literal 3. He is the cleverest of all navigators 4. For ios 100% No, the permission settings still say that it only tracks your movements when the app is open. \\ RT MT & 3. He is the cleverest of all navigators 4. For ios 100% No, the permission settings still say that it only tracks your movements when the app is open. \\ \hline Stylo & 1. It ’s all that lengthen or extend in duration or space her at this point 2. It ’s more in a reflection in the low enthusiasm in her supporters, people simply are n’t excited about ¡ Person ¿; and obviously it does n’t mean much in the true international you ca not be so literal 3. ”He ’s the nimblest in all the member of an acirrew who is responsible for the aircraft ’s course 4. For ios One hundred percent no, the permission settings is still saying that it tracks your movement only when the app is open. \\ KiP-BART & 1. it’s all that sustains her at this point 2. it’s more of a reflection of the low enthusiasm of her supporters. people simply aren’t excited about ¡PERSON¿. obviously it doesn’t mean much in the real world you can’t be so literal 3. he’s the nimblest of all navigators 4. for ios 100% no, the permission settings is still saying that it tracks your movement only when the app is open. \\ \hline  & 1. At this point, it’s all that sustains her. 2. It’s more of a manifestation of low expectations from her supporters. people simply aren’t excited about about ‘PERSON’. it doesn’t mean much in the world, can be literal 3. He is the nimblest of all navigation leaders. 4. For ios 100% no. the permission settings says it only tracks Movement when The app Open \\ \hline \hline  & 1. All that she has to support her at this point is this 2. This simply shows the low enthusiasm of her supporters. Obviously, you can’t be so literal in the real world. They are simply not excited about her. 3. He is the nimblest of all navigators 4. No, Ios is still saying it only tracks your movements when the app is open. 8693 \\ \end{tabular}
\end{table}
Table 5: More privatized Reddit comments from a subset of the explored obfuscation methods.