RedacBench: Can AI Erase Your Secrets?
Authors: Hyunjun Jeon
Kyuyoung Kim
Jinwoo Shin
Venue: ICLR 2026 Poster (2026)
Keywords: Redaction
Benchmark
Security
Language Model
Privacy
Sensitive Information
Data Sanitization
Primary area: datasets and benchmarks
TL;DR: We introduce RedacBench, a novel benchmark for the comprehensive evaluation of redaction capabilities, independent of specific data domains or redaction methods.

Abstract: Modern language models can readily extract sensitive information from unstructured text, making redaction—the selective removal of such information—critical for data security. However, existing benchmarks for redaction typically focus on predefined categories of data such as personally identifiable information (PII) or evaluate specific techniques like masking. To address this limitation, we introduce RedacBench, a comprehensive benchmark for evaluating policy-conditioned redaction across domains and strategies.
Constructed from 514 human-authored texts spanning individual, corporate, and government sources, paired with 187 security policies, RedacBench measures a model's ability to selectively remove policy-violating information while preserving the original semantics.
We quantify performance using 8,053 annotated propositions that capture all inferable information in each text. This enables assessment of both security—the removal of sensitive propositions—and utility—the preservation of non-sensitive propositions.
Experiments across multiple redaction strategies and state-of-the-art language models show that while more advanced models can improve security, preserving utility remains a challenge. To facilitate future research, we release RedacBench along with a web-based playground for dataset customization and evaluation. Available at https://hyunjunian.github.io/redaction-playground/.

Published as a conference paper at ICLR 2026
REDACBENCH: CAN AI ERASE YOUR SECRETS?
Hyunjun Jeon, Kyuyoung Kim, Jinwoo Shin Korea Advanced Institute of Science and Technology {hyun junian, kykim, jinwoos JarroossJkkae @kkist .r
ABSTRACT
Modern language models can readily extract sensitive information from unstruc- tured text, making redaction-the selective removal of such information-criticall for data security. However, existing benchmarks for redaction typically focus on predefined categories of data such as personally identifiable information (PII) evaluate specific techniques like masking. To address this limitation, we intro- duce RedacBench, comprehensive benchmark for evaluating policy-conditioned redaction across domains and strategies. Constructed from 514 human-authored texts spanning individual, corporate, and government sources, paired with 187 security policies, RedacBench measures model's s ability to selectively remove policy-violating information while preserving the original semanties. We quantify performance using 8,053 annotated propositions that capture all inferable informa- tion in each text. This enables assessment of both security the removal of sen- sitive propositions-and utility- preservation of non-sensitive propositions. Experiments across multiple redaction strategies and state-of-the-art language models show that while more advanced models improve security, preserving utility remains challenge. To facilitate future research, we release RedacBench along with web-based playground for dataset customization and evaluation
INTRODUCTION
Large language models (LLMs), trained on vast web-scale datasets, have demonstrated strong ca- pabilities in understanding and generating text, enabling applications in specialized domains such as finance, law, and healthcare (Brown et al., 2020); Touvron et al., [003). As these models are deployed automate tasks such as document summarization and information retrieval, they are increasingly exposed to sensitive personal and organizational data. This raises significant privacy concerns, as I.IMS may memorize and inadvertently disclose sensitive information from their train- ing corpora (Carlini et al. 2019 202T Biderman et al. 2023).
Beyond memorization, advances in LLM capabilities introduce additional data security risks. Pre- viously, extracting personal information often required access to specific databases specialized expertise. contrast, LLMs can infer and synthesize sensitive information from large volumes of unstructured text on the internet (Staab et al. 2024). Consequently, fragmented online content- such as posts, comments, and emails that was once difficult to aggregate and analyze can now be efficiently processed to reveal sensitive information.
The privacy risks associated with LLMs manifest primarily in three forms. The first is training data extraction, where model reproduces memorized PII in response to targeted queries (Nast et al. 2025). Recent studies have shown that such leakage can be induced through simple prompt manipulation malicious poisoning attacks (Panda al., 2024). The second form is inference-time data leakage, which occurs in interactive applications such as Al assistants or retrieval-augmenned generation (RAG) systems where sensitive user data is included within the prompt (Wu al.) 2024] Tang et al. 2024). In such scenarios, adversaries may employ prompt injection attacks to extract sensitive information from the context (Zhang et al. 2025), presenting a new dimension of security challenges. The third risk involves the inference of sensitive attributes from seemingly innocuous, publicly available text. Leveraging their strong contextual reasoning, LLMs can infer sensitive
Available http::://hyynnniii...iii.b.bbbbb

---

Published as a conference paper at ICLR 2026
personal information such individual's profession, health status, and personal relationships with high accuracy, even from texts lacking explicit identifiers (Staab et al. 2024).
In response these threats, several defense mechanisms have been proposed. including train- ing with differential privacy (Yu et al. 2022), privacy- prompting (Hong et al. 2024), and mitigating information leakage in in-context learning (Wu al. 2024). Among these, data sanitization- the detection and redaction of sensitive information from text-remaing
practical and widely adopted approach. It seeks remove not only explicit identifiers (e.g.. names or contact information) but also sensitive content such as personal health conditions or confidential business discussions that are embedded within context. However, many existing approaches rely on surface- level keyword or pattern matching. Consequently, they often fail to remove semantically sensitive information or may over-redact, leading to a poor trade-off between privacy and text utility (Kim) et al. 2025). These limitations have led to concerns that current techniques provide "false sense of privacy," highlighting the need for standardized and rigorous methodologies to evaluate the redaction
capabilities of LLMs (Xin et al. 2024 Mireshghallah al. 2024 Zhao & Zhang 2025).
In this paper, we address this critical gap by introducing RedacBench, a comprehensive bench- mark designed to evaluate LLM-based redaction of diverse forms of sensitive personal and orga- nizational information embedded in text. While existing benchmarks primarily focus on detecting unintended generation of sensitive content (Zhagg et al. 2025) on narrowly defined domains such as PII (Staab et al., 2025), RedacBench evaluates whether sensitive information remains inferable after redaction under policy-defined constraints. Our contributions threefold:
Benchmark: We introduce RedacBench, a benchmark for robust evaluation of redaction capabilities across domains and policy types. comprises 514 numan-authore texts along with 187 security policies to cover diverse redaction scenarios (Section 2
Baseline Evaluation and Analysis: Using RedacBench, we evaluate multiple redaction strategies across state-of-the-art language models. Our findings demonstrate that while advanced language models and strategies can improve security, these gains often come at the cost of a significant reduction in utility. We establish these as baseline performance for future research (Section 3
Interactive Playground: We release an interactive web-based playground that supports customizing RedacBench data (including security policies, source texts, and propositions) and experimenting with different redaction models and strategies, fostering further research in the community (Appendix A).
Our work aims to provide a standardized framework with a benchmark for evaluating the reliability of LLM- based redaction techniques. We believe RedacBench will serve crucial tool for fostering research in this area, offering important guidelines for safe and trustworthy deployment of LLMs in real-world applications.
2
BENCHMARK
2. TASK DEFINITION
We define the redaction task as selective removal of sensitive information from a source text in accordance with given security policy. This formulation is motivated by real-world settings in which the criteria for what constitutes sensitive information vary by context, making it impractical to explicitly enumerate all possible categories. Therefore, by including high-level 'security policy' as part of the input, our task definition faithfully reflects the variability and requirements of real operational environments. The system is thus designed to take both source text and security policy as input and produces a redacted text that complies with the policy (Figure
2.2 EVALUATION FRAMEWORK
To quantitatively evaluate the performance redaction system, we propose a proposition-base evaluation framework. The evaluation process, illustrated in Figure proceeds follows:
2

---

Published as a conference paper at ICLR 2026
Dataset
Evaluation
Original
Corresponding Policies
Redacted
Jim.
A. strategics must be cantidential...
[Redacted].
would appreciate your help in locating financing for the project described...
B. All governanee, future plans,
would appreciate your help in some things for the project described..
Corresponding Propositions
Status
project developing spartment complex
Removed Preserved X
Security
Philip Allen and buidderideeebper poesibly other investors are...
44.6%
3. The course described suttable for any business education school.
3. Preserved
Utilly 71.5%
Sensitive Information (Vidletes least policy) Non-Sensitive Information (Does not policy)
Figure I: Conceptual illustration of the RedacBench. First, the target solution performs redaction on the given text according to the specified security policy. Second, based on the redacted output, we examine which the predefined propositions have been removed. Third, using the sensitivity of the information and its removal status, quantify both security and utility.
Redaction: The system under evaluation receives a source text and associated security policy as input and produces redacted text.
2. Proposition-level Analysis: We define "proposition" as a minimal unit of information that can be inferred from the source text. According the given security policy, each proposition derived from the source text is classified as either "sensitive" or "non-sensitive." We then assess whether each proposition remains inferable after redaction, labeling it as either "preserved" "removed." From the analysis, construct confusion matrix to measure the system's performance. The components are defined as follows:
True Positive (TP); A non-sensitive proposition correctly preserved.
True Negative (TN): A sensitive proposition is correctly removed.
False Positive (FP): sensitive proposition is incorrectly preserved.
False Negative (FN): A non-sensitive proposition is incorrectly removed.
3. Performance Metric Calculation: Using these categories, we define two primary metrics
serve as our key performance indicators:
Security Score: Measures the proportion of sensitive information successfully TN
moved from the text, TN+FP.
Utility Score: Measures the proportion of non-sensitive information preserved in the TP
output, TF+FN.
The security and utility scores generally in trade-off relationship. Therefore, strong perfor- mance requires achieving high values on both metrics, balancing privacy protection and information preservation.
2.3 DATASET CONSTRUCTION
The dataset we construct consists of two primary components: a set of security policies and (2) collection of source texts paired with annotated propositions. Examples of policies and data samples provided in Table and Table 2 respectively.
The dataset is constructed through a four-stage procedure designed to ensure both relevance and quality:
1. Source Text Collection: We first collect diverse set of human--ritter texts originating from individual, corporate, and govermment sources. This step is crucial to ensure that our dataset covers wide range of topics and real-world scenarios.
3

---

Published as a conference paper at ICLR 2026
Table 1: Five example policies from the dataset, each defining a distinct sensitivity level.
Policies
Label
Instructor names must be kept confidential and not disclosed publicly without consent to protect privacy.
Instructor names
All sensitive financial information including internal financial data, investment details, negotiation terms, client financial information, and contractual financial terms- must be kept confidential and protected from unauthorized access or disclosure
Financial investment detail
times.
All strategic business, financial, operational, legal. and diplomatic in- formation must he classified as confidential and protected from unau- thorized access or disclosure. Access to such sensitive information is restricted to authorized personnel with legitimate business need, Shar- ing or communication of strategic information outside the organization or with unauthorized individuals strictly prohibited to prevent expo- sure and maintain corporate confidentiality.
Strategic business plan
All sensitive and classified information related to military, governmen- tal, strategic, financial, and diplomatic matters must be protected from unauthorized disclosure through strict access controls, secure handling procedures, and mandatory confidentiality prevent any exposure of such information.
Confidential military discussion
All sensitive information related internal strategies, governance, fu- ture plans, and market insights must strictly confidential and protected from unauthorized disclosure to safeguard company interests.
Management strategy revealed
Table 2: A sample of original text with propositions capturing its full meaning.
Original Text
Jim.
would appreciate your help in locating financing for the project I described to you last week. The project is a 134 unit apartment complex in San Marcos. There will be builder/developer plus myself and possibly couple of other investors involved. As I mentioned last week, I would like to find interim financing (land, construction, semi-perm) that does not require the investors personally guarantee. If there creative way to structure the deal, I would like to hear your suggestions. One idea that has been mentioned to obtain a 'Forward commitment' in order to reduce the equity required. would also appreciate hearing from you how deals of this nature are normally financed. Specifically, the transition from interim to permanent financing. could quick lesson in what numbers will be important to banks,
am faxing you project summary. And will have builder/developer email or fax financial statement to you.
Let me know what else you need. The land is scheduled to close mid January.
Phillip Allen
Propositions
Phillip Allen and builder/developer plus possibly other investors are involved in the project.
2. Phillip Allen is secking interim financing that does not require personal guarantees from investors.
3. A financing structure using a 'forward commitment' is being considered to reduce required equity.
4. The land purchase for the project is scheduled to close mid January.
5. The builder/developer's financial statement will be shared confidentially with financing contact. The project described is 134 unit apartment complex.
7. The project is located in San Marcos.
8. One idea mentioned is to obtain a 'forward commitment" to reduce the equity required.
9. Phillip Allen wants to know how deals of this nature normally financed.
10. Phillip Allen specifically wants to understand the transition from interim permanent financing.
4

---

Published as a conference paper at ICLR 2026
2. Proposition Extraction:
For each source text, extract comprehensive list of proposi- tions. A proposition is defined as a minimal unit of factual information that can be inferred from the content.
3. Policy Formulation:
We identify propositions that may be sensitive under specific con- textual or organizational settings. Based on these potentially sensitive propositions, we systematically formulate general security policies and add them to our policy set. Overlap- ping policies are consolidated to avoid redundancy. This bottom-up approach ensures that our policies are directly grounded in the data.
4. Violation Annotation: Each proposition extracted from Step is annotated with the spe- cific security policies from the set that it violates. Propositions that do not violate any policy are left unannotated.
To achieve both scalability in data generation and high-quality annotations, we employ a human- in-the-loop approach for Steps 2, and An LLM is first utilized to perform preliminary pass of proposition extraction, policy formulation, and violation annotation. Subsequently, the model- generated outputs are carefully reviewed and refined by two expert amnotators: one author with research expertise in Al privacy and security and one external professional with over five years of experience in academia and consulting. Both annotators were fully briefed on the data synthesis pipeline, and disagreements were resolved through discussion until consensus was reached to ensure the accuracy, consistency, and overall quality the final dataset.
For sufficient diversity in the subjects of sensitive information, the source data for this study are collected from individual, corporate, and govermment entities. The original source of each dataset is follows:
Original Texts.
Individual: 6,843 essays written by students enrolled in an open online course (Holmes
ct al. 2023).
Corporate: Approximately 500,000 emails exchanged by employees of the Enron Corpo- ration (Cohen 2004).
Government: 7,956 emails from former U.S. Secretary of State Hillary Clinton's
tenure (Kaggle 2016).
From this source data, texts containing sensitive information are manually selected to construct final benchmark dataset of 514 texts (36 from individuals, 342 from corporations, 136 from govern- ment sources). The selection prioritizes texts containing contextually sensitive content.
Propositions. Rather than mechanically segmenting the source text, the 8,053 propositions are constructed semantic units based the overall context. In partieular, approach involves including implicit information that can be derived through contextual inference, even when not ex- plicitly stated in the original text. For example, if the source text mentions that the speaker attended meeting at a specific company, this could be defined as the proposition, "The speaker is affiliated with that company." This approach ensures that the data is designed encompass not only the surface-leva semantics of the text but also its contextually inferable information.
To reflect the complexity and diversity of real-world scenarios, policies are designed to span various levels of abstraction, ranging from granular details to broad concepts, As illustrated in Table I the dataset includes both micro-level entries, such as 'Instructor names,' and macro-level directives like 'Strategic business plan.'
Policies.
3 EVALUATION
3.1 REDACTION METHODS
We evaluate three redaction methods using RedacBench and demonstrate the utility our proposed benchmark. The methods span a range of representative redaction strategies, including lexical mask- ing, model-based rewriting, and iterative redaction. This selection enables analysis of the security- utility trade-offs across different redaction paradigms.
5

---

Published as a conference paper at ICLR 2026
Masking: We include token-level masking, traditional method in which sensitive words or phrases are identified based on policy-conditioned keyword matching and removed from the text. This baseline reflects surface-level lexical removal without contextual reasoning, highlighting the limitations of simple masking.
Adversarial Redaction (AR): We evaluate a model-based strategy, adapting the adversar- ial anonymization method (Staab et al. 2025) to redaction task. The model is prompted with the source text and corresponding security policy and instructed to rewrite the text while removing policy-violating content. This method enables both syntactic and semantic redaction through language-model reasoning.
This strategy repeatedly applies the redaction model to its own output for multiple iterations. Each iteration aims to remove residual sensitive content, typically increasing security at the cost of utility. This approach allows analysis of how repeated redaction shifts the security-utilin balance.
Iterative Redaction:
We evaluate each method across diverse set of language models, varying in both size and archi- tecture. This allows us to analyze how model capacity influences redaction performance our benchmark.
3.2 EVALUATION MODEL
We employ the GPT-4. 1-mini model as an automated evaluator to determine whether propositions inferable from the original text remain inferable after redaction. Here, a "positive" prediction in- dicates that the evaluator judges proposition to be inferable from the given text. To ensure the reliability of our evaluator, we measure its false negative (FN) and false positive (FP) rates on the full set 8,053 annotated propositions.
False Negative Rate. To estimate the FN rate, we present the evaluator with original texts and their corresponding ground-truth propositions. The evaluator is tasked with assessing whether each proposition is supported by the text. A high FN rate poses risk of erroneously concluding that information has been successfully eliminated when it has actually been preserved. In our analysis, model incorrectly classified only 1.45% of true propositions as false, indicating strong recall of inferable information.
False Positive Rate. To estimate the FP rate, we evaluate the model on texts where the contextual evidence supporting specific propositions has been removed, rendering them non-inferable. false positive occurs when the evaluator incorrectly judges such propositions to remain inferable. The model produced 211 false positives, corresponding to a rate of 2.62%. As result, reported security scores may be slightly underestimated relative to true redaction performance.
Because the same evaluator is applied consistently across all methods and models, relative compar- isons remain meaningful despite minor absolute bias.
3.3 RESULTS
We evaluated the redaction performance of eleven popular language models of varying sizes and reasoning configurations (see Table In terms of the security metric (the removal rate of sensitive information), GPT-5-mini achieved the highest score. Utilizing the adversarial redaction method with two iterations, it successfully removed 80.9% of sensitive propositions. However, this level of security corresponded to significantly compromised utility, with only 37.6% of non-sensitive information preserved.
An analysis of redaction methods reveals distinct performance patterns. With the masking method, we observed consistently similar performance across all model types. This suggests that the masking approach may have reached performance ceiling for redaction when used with current language models.
In contrast, adversarial redaction exhibited clearer differences across models. Reasoning enhanced models removed sensitive information at consistently higher rates, suggesting that stronger baseline capabilities are associated with improved semantic redaction.

---

Published as a conference paper at ICLR 2026
Table 3: Redaction capability across models and methods. Boldface denotes the best perfor- mance in each column for each metric.
Masking Security
AR (iter 1)
AR (iter
Model
Utility
Security
Utility
Security
Utility
gpt-5
38.9
80.2
72.3
48.7
77.1
45.6
gpt-5-mini
41.8
75.8
63.4
57.2
80.9
37.6
gpt-5-nano
38.5
82.1
51.9
71.5
58.2
64.8
gpt-4.1
36.4
82.0
68.2
55.1
77.0
44.4
gpt-4.1-mini
37.2
80.8
53.7
68.3
60.2
62.9
gpt-4.1-nano
40.7
76.8
64.1
52.6
61.7
54.6
gemini-2.5-flash
43.9
76.4
56.2
69.4
61.7
60.1
fomini-2.5-flash-liii
35.9
85.1
52.2
70.6
60.2
62.1
c
44.6
78.3
59.5
68.6
68.5
55.8
qwen3-8b
37.1
79.3
46.5
75.2
57.4
64.2
qwen3-4b-2507
51.6
72.8
63.5
59.1
75.8
44.4
90
90
Model
Model
qut-t
gat-5
goi-S-mnni
gol-Sinano
gpt-4,1-mini
gri-11
goi-i I-rano
I-mitt
70
Utiliyy (95)
geminio Scfash
geminsd S-ttsb- be
owen
3-b-2-02-
40
50
70
Security 1963
Security
(a) All models
(b) GPT-5 vs. GPT-4.1-min
Figure 2: Utility-security trade-off graphs. (a) For all redaction model and method pairs, higher security comes the cost of lower utility. (b) Iterative adversarial redaction can achieve performance comparable to that more capable models.
Furthermore, found iterative redaction to generally improve the security score. A notable excep- tion was GPT-4.1-name which showed minimal performance gains under repeated iterations, sug- gesting that iterative refinement is ineffective when model's foundational capabilities Conversely, it was observed that method, achieved performance that slightly surpassed that of GPT-5-a larger, more capable, and more recent model with enhanced reasoning capabilities with two iterations of redaction (see Fig- ure This finding suggests that once model's 's performance exceeds a certain threshold, repeated iterations can partially compensate for differences in model scale and enable it to produce results comparable those more powerful model.
limited. after seven iterations of the adversarial redaction
Across all experiments, clear trade-off between security and utility was observed (see Figure 2 Among evaluated models, -ooune-- achieved one of the most favorable balances, consis- tently preserving higher degrees of utility at comparable security levels. However, absolute perfor- mance differences between models were modest. This highlights substantial room for improvement in redaction approaches capable of achieving high security while better preserving the utility of the original text.
Additionally, observed that open-source models can achieve highly competitive performance when combined with more advanced redaction strategies. For instance, the recently released Qwen3- 4B-2507 model attained results that fall between those of GPT-4.1 1 and GPT--411-m 1-mini, demonstrating

---

Published as a conference paper at ICLR 2026
that open-source models can significantly enhance redaction quality by leveraging state-of of- oute--of-hhearr t-thheerrt redaction techniques.
4 RELATED WORK
The field of text sanitization has evolved significantly, moving from targeted redaction of PII to addressing more nuanced, inference-based privacy threats. This has been driven by both regulatory requirements and the growing capabilities of LLMs.
Traditional Text Sanitization and PII Redaction. Early efforts in text sanitization primarily fo- cused on the detection and removal of explicit Pll-such as names, credit card numbers, and social security numbers- to comply with regulations including GDPR, HIPAA, and the CCPA. These ap- proaches relied heavily on rule-based methods such as named entity recognition (NER).
key limitation of these conventional methods, however, the assumption that sensitive infor- mation strictly corresponds to identifiable entities in the input text. As noted in recent literature, sensitive content in complex corporate and government documents often defined by high-level se- curity policies rather than fixed categories like names addresses. Consequently, while NER-based approaches are effective for structured data, they lack the scope to capture broader, policy-driven no- tions of sensitivity and may degrade text coherence when entity spans simply removed (Albanese) ct al. 2023).
Advancements in LLM-Based Redaction. The advent of LLMs offered a more flexible approach compared rigid entity masking. Models such BERT have been used for zero-shol redaction, using their contextual understanding to identify and substitute sensitive information without domain- specific training (Albanese al. (003). Recent frameworks. including the "Adaptive PII Mitigation Framework" by Asthana et al. (2025) and the PRvL framework by Garza et al. (025)) further refine this paradigm by aligning dynamic systems with diverse regulatory standards.
Despite these advancements, most existing benchmarks still primarily evaluate the removal of entity spans. In contrast, our proposition- based framework goes beyond simple entity removal to assess whether sensitive information remains inferable after redaction, supporting evaluation of removal, generalization, and contextual rewriting strategies.
Distinction from Model-Centric Privacy Frameworks. is important to distinguish text saniti- zation from broader model-centric privacy frameworks such as machine unlearning and differential privacy (DP). While approaches such as machine unlearning focus on preventing models from mem- orizing and leaking sensitive information from training data, work targets inference-time inputs and outputs. This distinction is particularly relevant for interactive systems such as Al assistants, where models routinely encounter new user-provided sensitive data not present during training.
Consequently, redaction serves as a complementary defense; even models equipped with perfect unlearning or DP protections require robust inference-time safeguards safely handle sensitive user inputs. Furthermore, unlike traditional metrics that focus on token-level removal, our proposition- based evaluation aligns with this inference-time objective by measuring the removal of sensitive information while preserving contextual meaning, providing finer-grain finer-grained view of privacy.
Inference-Based Privacy Threats. Recent work has highlighted a shift in focus from redacting explicit PII to mitigating the risk of contextually inferable sensitive information. [Stabb et al. (2024) show that sufficiently capable I.LMs can infer wide range of personal attributes age, and income-from -fre seemingly innocuous text, task that was previously difficult to automate. This reveals significant privacy risk, LLMs can draw sophisticated inferences from otherwise benign text. While benchmarks such as SynthPAI (Yukhymenko et al.) 2024) focus on personal attribute inference, RedacBench extends evaluation to complex, policy-define sensitivities in non- personal domains, thereby filling a gap that Pll-focused datasets do not address.
as location,
Other research has explored different aspects of text sanitization. Beltrame et al. 2024 introduced RedactBuster to highlight information leakage from redacted documents, underscoring the need for robust evaluation. Similarly, Gusain & Leith (025) proposed focusing the information revealed
8

---

Published as a conference paper at ICLR 2026
by the text as whole rather than specific keywords. Our work aligns with these findings but provides a concrete benchmark for evaluating such holistic privacy preservation via policy-driven redaction.
DISCUSSION AND CONCLUSION
This work introduces RedacBench, a comprehensive benchmark for evaluating LLM-based text redaction. By providing standardized framework quantitatively measure the trade-off between security and utility, it establishes foundation for researchers to objectively compare diverse tech- niques and guide future advancements. For industries such as finance and healthcare, RedacBench can serve as practical tool to validate the safety of AI systems, enabling the management of risks that extend beyond simple PII removal to the protection of contextually inferred information, Fur- thermore, our benchmark provides empirical basis for developing policies and standards for sponsible Al and data privacy. We hope that RedaeBench serves as a foundation for advancing research secure handling of sensitive information in LLM-based systems.
Limitations. While RedacBench was designed to closely reflect real-world redaction scenarios, its scope has inherent limitations. First, regarding privacy guarantees, RedacBench relies on empirical verification rather than formal methods such as differential privacy. While formal guarantees pro- vide statistical indistinguishabiiity, applying them to unstructured text often substantially degrades fluency and semantic coherence. In practical settings such as legal corporate communications where sensitive facts are semantically removed while preserving the narrative- is often more rele- vant. Therefore, adopt adversarial evaluation approach using strong LLMSs simulate realistic inference attacks. While this does not provide a mathematical guarantee, it establishes a practical lower bound on security; if a state-of-the-ar adversary fails to infer the redacted information, the risk of real-world leakage is substantially reduced.
Second, there risk of hallucination in the evaluation models. If evaluator LLM has been pre-trained on the original source documents in our dataset, it may recall the redacted information and incorrectly judge it as unredacted (Section 3.2 Fully mitigating this data contamination issue requires ensuring that evaluation models have not been exposed to the source texts. One possible solution to construct datasets exclusively from documents published after the knowledge cutoff of the evaluation models.
To facilitate community efforts in addressing these limitations, we provide an interactive playground alongside this study (see Appendix A for details). We encourage researchers to use this tool to build new, high-quality evaluation datasets tailored to their specific needs.
ETHICS STATEMENT
This work introduces benchmark for evaluating the redaction capabilities of LLMss. Given the sensitive nature of data sanitization and privacy, we carefully considered the ethical implications of our research.
First, regarding data provenance, all source texts used to construct RedacBench were obtained from publicly available datasets widely used in academic research: the Enron email corpus, Hillary Clin- ton's 's declassified emails, and publicly released student essays datasets. No private, proprietary, or newly scraped PII was collected or exposed during the creation of this benchmark. Human annota- tors involved in the data refinement process were fully briefed on the research objectives and data handling procedures.
Second, regarding potential misuse and limitations, we emphasize that RedacBench is an evaluation framework and does not provide a formal privacy guarantee, As demonstrated in our results, even state-of-the-ar LLMs struggle achieve perfect redaction while maintaining text utility. Therefore, we caution against deploying fully automated LLM- redaction systems in high-stakes real- world domains (e.g., healthcare, legal, financial sectors) without rigorous human oversight. Our benchmark intended to surface existing vulnerabilities and support the development of safer, more robust AI systems, rather than to provide false sense of security.

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
To ensure reproducibility, we make our datasets, evaluation framework, and implementation details publicly available.
Dataset: The complete RedacBench dataset- comprising 514 source texts, 187 security policies, and 8,053 annotated propositions-alony with the raw results of the main experi- ment, is released in the supplementary materials.
Interactive Environment: We provide web-based playground that allows researchers to inspect the data, create custom policies, and evaluate redaction outputs without needing to set up local environment (see Appendix (A).
Prompts and Hyperparameters: All prompts used for proposition extraction, policy for- mulation, truthfulness verification, and automated redaction (for both masking and adver- sarial approaches) are fully documented (see Appendix I..
ACKNOWLEDGEMENT
This work was supported by Institute for Information & communications Technology Planning & (yaluation((IIP)grant funded by the Korea governmen((MSTTT (RS-20091111111100005 Artificial Intel- ligence Graduate School Program(KAIST)
REFERENCES
Federico Albanese, Daniel Ciolek, and Nicolas D'Ippolito. Text sanitization beyond specific domains: Zero-shot redaction & substitution with large language models. arXiv preprint arXiv:2311.1078 2023.
Shubhi Asthana, Ruchi Mahindru, Bing Zhang. and Jorge Sanz. Adaptive PII mitigation framework for large language models. arXiv preprint arXiv:2501.12465. 2025.
Mirco Beltrame, Mauro Conti, Pierpaolo Guglielmin, Francesco Marchiori, and Gabriele Orazi. Redactbuster: Entity type recognition from redacted documents. In Computer Security ES- ORICS 2024, pp. 451-470. Springer Nature Switzerland, 2024.
Stella Biderman, Usvsn Prashanth, Lintang Sutawika, Hailey Schoelkopf, Quentin Anthony, Shivan- shu Purohit, and Edward Raff. Emergent and predictable memorization in large language models. Advances in Neural Information Processing Systems, 36:28072-28090, 2023.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 13:1877-1901,2000
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pp. 267-284, 2019.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21), pp- 2633-2650, 2021.
William Cohen. Enron email dataset, 2004. URL https: /t::://wwww.. cmu. www..eduueenro.. Accessed: 2025-09-22.
Leon Garza, Anantaa Kotal, Aritran Piplai, Lavanya Elluri, Prajit Kumar Das, and Aman Chadha. PRvL: Quantifying the capabilities and risks of large language models for PII redaction. arXiv preprint arXiv:2508.05545, 2025.
Vaibhav Gusain and Douglas Leith. Improving privacy benefits of redaction. arXiv preprint 00ft:2200117766 2025.
10

---

Published as a conference paper at ICLR 2026
Langdon Holmes, Scott Crossley, Harshvardhan Sikka, and Wesley Morris. Piilo: open-source system for personally identifiable information labeling and obfuscation. Information and Learn ing Sciences, 124(9/10):266 284, 2023. URL https:/ /www kaggle com/ datasets
Sourleigh/ppe o-
Junyuan Hong. Jiachen Т. Wang, Chenhui Zhang, Zhangheng LI, Bo Li, and Zhangyang Wang. DP-OPT: Make large language model your privacy-preservve prompt engineer. In The Twelfth International Conference on Learning Representations, 2024.
Kaggle. Hillary Clinton'ss emails, 2016. URL https: www. hwtp://wwwwwkgggle....m com/ datasets/
kaggle saale/hhille hhwlllllllrrrrrr cl Wnliionnn emai 1s A version of the emails released by the U.S. De- partment of State, prepared for use on the Kaggle platform. Accessed: 2025-09-22.
Kyuyoung Kim, Hyunjun Jeon, and Jinwoo Shin. Self-refining language model anonymizers via adversarial distillation. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025.
Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. Can LLMs keep a secret? testing privacy implications of language models via contextual integrity theory. In The Twelfth International Conference on Learning Representations, 2024.
Milad Nasr, Javier Rando, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ippolito, Christopher A. Choquette- Choo, Florian Tramèr, and Katherine Lee. Scalable extraction of training data from aligned, production language models. In The Thirteenth Interna- tional Conference on Learning Representations, 2025.
Ashwinee Panda, Christopher A. Choquette-Chow Zhengming Zhang, Yaoqing Yang, and Prateek Mittal. Teach LLMs to phish: Stealing private information from language models. In The Twelfth International Conference Learning Representations, 2024.
Robin Staab, Mark Vero, Mislav Balunovic, and Martin Vechev. Beyond memorization: Violating privacy via inference with large language models. In The Twelfth International Conference on Learning Representations, 2024.
Robin Staab, Mark Vero, Mislav Balunovic, and Martin Vechev. Language models are advanced anonymizers. The Thirteenth International Conference on Learning Representations, 2025.
Xinyu Tang. Richard Shin, Huseyin A Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi. Janardhan Kulkarni. and Robert Sim. Privacy-preserving preserving in in-oontet learning with differentially private few-shot generation. The Twelfth International Conference on Learning Representations, 2024.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaci, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet. Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nic, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subramanian, Xiaoqing Ellen Tan, Binh Tang, Ross Tay Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, Iliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288. 2023.
Tong Wu, Ashwinee Panda, Jiachen T. Wang, and Prateek Mittal. srivacy-preeeving in-context learning for large language models. In The Twelfth International Conference on Learning Repre- sentations, 2024.
11

---

Published as a conference paper at ICLR 2026
Rui Xin, Niloofar Mireshghallah, Shuyue Stella Li, Michael Duan, Hyunwoo Kim, Yejin Choi, Yulia Tsvetkov, Sewoong Oh, and Pang Wei Koh. A false sense of privacy: Evaluating textual data sanitization beyond surface-level privacy leakage. In Neurips Safe Generative Al Workshop 2024, 2024.
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz. Sergey Yekhanin, and Huishuai Zhang. Differentially private fine-tuning of language models. In International Conference on Learning Representations, 2022.
Hanna Yukhymenko, Robin Staab, Mark Vero, and Martin Vechev. A synthetic dataset for personal attribute inference. arXiv preprint 2tti::2006.02.... 2024.
Qingjie Zhang, Han Qiu, Di Wang. Yiming Li, Tianwei Zhang, Wenyu Zhu, Haiqin Weng, Liu Yan, and Chao Zhang. A benchmark for semantic sensitive information in LLMs outputs. In The Thirteenth International Conference on Learning Representations, 2025.
Yunpeng Zhao and Jie Zhang. Does training with synthetic data truly protect privacy? In The Thirteenth International Conference on Learning Representations, 2025.
12

---

Published as a conference paper at ICLR 2026
A PLAYGROUND
We provide an interactive web-based playground for customizing and experimenting with the var- ious components of RedacBench, including source texts, security policies, and propositions. The playground is publicly accessible at:
Bttps://hyunjunile
This platform offers a range of functionalities to facilitate data creation and testing. The core features include, but are not limited to, the following:
1. Source Text and Proposition Generation: Authoring source text and automatically generating a set of propositions that encapsulate its semantic content.
2. Policy Management: Creating custom security policies and assigning them to individual propositions per-proposition basis.
3. Data Inspection: Viewing comprehensive list of created source texts and policies, along with their detailed information (e.g., word count, number of associated propositions).
4. Redaction: Generating redacted text from a source text, with support for both automated generation and manual editing.
5. Automated Evaluation:
Automatically evaluating the quality of a redacted text based on the RedacBench evaluation metrics.
6. Data Portability:
Importing and exporting the complete dataset in json format.
B INTERACTIVE REDACTION EXPERIMENT
While our original experiment used a static evaluation as a baseline, real-world redaction often occurs interactively. To address this, we conducted an additional experiment simulating context- evolving scenario:
1. Each text was split into & sequential chunks (41, (2,,2,,. ......,4... 4.), roughly corresponding to sentences short paragraphs.
2. The model acted multi-turn "redaction assistant." At n, it received chunk t, along with the conversation history and produced a redacted output ra-
3. Sequential outputs were concatenated (r1 + r2 2 e Tx) and evaluated with the standard proposition-basee RedacBench metrics.
This experiment highlights the challenge of missing "forward context" in dynamic scenarios. Using GPT-4.1-namo for adversarial redaction, we observed a security score of 55.2 and a utility score of 60.9, representing a notable drop security compared to the static baseline (a security score of 64.1 and utility score of 52.6), as the model fails to identify sensitive information that requires context found only later segments of the text.
C HALLUCINATION DETECTION
While our original utility score measures recall (i.c., how much the non-sensitive information from the original text remains), it does not penalize the introduction of new, false information. To bridge this gap, we applied a reverse-entailment check:
1. Proposition Extraction (Redacted Text): Instead of only looking at the original proposi- tions, we extract new set of propositions directly from the redacted text.
2. Verification: We verify whether each of these new propositions is entailed by (i.e., present in or inferable from) the original source text.
3. Hallucination Identification: Any proposition found in the redacted text that is not sup- ported by the original text is classified hallucination.
13

---

Published as a conference paper at ICLR 2026
Table 4: Complementary utility scores of redaction outputs produced by GPT-4.1 using three differ- ent redaction methods.
Redaction Method
RedacBench
Similarity
Readability
Faithfulness
Masking AR (iter 1) AR (iter 2)
82.0
77.5
89.1
99.8
55.1
80.2
94.8
99.2
44.4
72.8
93.2
99.4
This enables us to compute a hallucination rate, which complements the existing utility score by penalizing unsupported additions to the text (e.g., pseudonymizing "Patti" to "Alice"). This exten- sion provides a more complete evaluation by capturing both preservation (recall of true information) and faithfulness (avoidance of hallucinations).
We applied this analysis to the adversarial redaction method using GPT-4.1 and observed a hallu- cination rate of 3.36% (150 out of 4,460 instances). These results indicate that language models introduce unsupported information during redaction. Although the rate is relatively low, it still motivates future research on reducing such errors.
D COMPLEMENTARY UTILITY EVALUATION
While proposition-based utility metric effectively quantifies the preservation of atomic facts, may not fully capture broader semantic consistency. To provide more holistic evaluation of utility, we have expanded our analysis to include complementary measures of semantic consistency using an LLM-as-a-jii as-a-judge framework. Specifically, we now compare the original and redacted texts along three dimensions:
Semantic Similarity. Evaluating preservation of overall meaning and intent beyond indi- vidual propositions.
2. Readability. Assessing fluency, coherence, and grammatical quality of the rewritten text.
3. Faithfulness. Measuring the degree of hallucination introduced during redaction.
This LLM-as-a-judge framework follows recent practices and has been shown correlate well with human evaluations (Staab et al., 2025: Kim et al. (2025). We evaluated the additional utility metrics of texts redacted using GPT-4.1 through three distinct redaction methods (Table 4
The results revealed several noteworthy characteristics. Semantic similarity decreases more gradu- less strict evaluation. As anticipated,
ally than our benchmark's utility score. other words, readability suffered the most severe decline in the masking- based method. Finally, faithfulness scores approached the maximum possible value for all three redaction approaches, severely limiting the metric's s ability to differentiate between methods.
We believe this addition, together with our proposition- based metric, offers a more comprehensive view of the trade-off between privacy and utility.
E WEIGHTED POLICY EVALUATION
Macro-level violations (e-g., strategic business plans) can carry far greater consequences than micro- level ones (c.g., instructor names), and robust benchmark should reflect this. To address this, we performed an additional analysis using a risg-weighted metric as follows:
Risk Scoring. Each the 187 policies is assigned a severity score from 1 to 5, reflecting
the practical impact of violation. The distribution of severity score is 0, 3, 25, 71, 88 (0.0%, 1.6%, 13.4%, 38.0%, 47.1%).
2. Weighted Security Score. Model performance recaleulated so that redacting high- severity policies contributes more the final score than lower-severity ones.
14

---

Published as a conference paper at ICLR 2026
Table 5: Comparison of security scores between the weighted policy and the unweighted policy.
Masking unweight
AR (iter 1)
AR (iter 2)
Model
weight
unweight
weight
unweight
weight
gpt-5
38.9
38.3
72.3
71.7
77.1
76.6
gpt-5-mini
41.8
41.3
63.4
62.8
80.9
80.5
gpt-5-nano
38.5
37.5
51.9
50.9
58.2
57.4
gpt-4.1
36.4
35.7
68.2
67.6
77.0
76.5
gpt-4.1-mini
37.2
36.3
53.7
52.8
60.2
59.4
gpt-4.1-nano
40.7
39.9
64.1
63.5
61.7
60.9
gemini-2.5-ffa
43.9
43.2
56.2
55.4
61.7
60.9
2ommni--25-fllss-liie
35.9
34.9
52.2
51.3
60.2
59,4
claude-sonnet-4
44.6
43,6
59.5
58.6
68.5
67.8
qwen3-8b
37.1
36.1
46.5
45.8
57.4
56.9
qwcn3-4b-2507
51.6
50.7
63.5
62.7
75.8
75.4
Table 6: Ceiling performance of RedacBench.
Version
Security
Utility
Optimal-1
62.8
85.2
Optimal-2
69.8
66.0
Optimal-3
72.6
57.5
After applying the policy-specific weights, the overall security scores decreased (Table This sug- gests that high-severity security policies include requirements that are inherently more difficult to satisfy. This perspective suggests valuable avenue for future work: dynamically adjusting redac- tion strategies based on policy severity maximize safety while preserving utility.
F CEILING PERFORMANCE ANALYSIS
Understanding what constitutes optimal redaction is essential for interpreting progress on RedacBench. To establish clear standard, we manually redacted the dataset ourselves, optimizing for both security (maximum removal of sensitive propositions) and utility (maximum preservation of non-sensitive content).
Our findings show that manual redaction performs substantially better than all evaluated redaction methods (Figure 3.. Table (6. This large gap shows that the benchmark is far from saturated and that significant headroom remains for improving automated redaction systems.
G EVALUATION MODEL ABLATION
To validate the reliability of GPT-4.1-min as our evaluator, we conducted an ablation study com- paring it with GPT-5, GPT-4.1-nane Gemini-2.5-Flash, and S.auude-oonne-4.5. We repeated the experiments under identical -aannngg- only the evaluation model sundelusinng redacted outputs produced by GPT-4.1 to ensure fair comparison with our original results.
Model Scale on Evaluation. We observed notable relationship between model capability and evaluation strictness. Larger models (e.g., GPT-5, (oouee-Sonne-4.5) tended to apply stricter cri- teria when determining whether specific information could be inferred from the text. As result, they often determined that the sensitive propositions were not contained in the text. This resulted in inflated security scores and deflated utility scores (Figure Bp. Table 7). GPT-4.1-mi provided a more balanced trade-off, while maintaining sufficient reasoning capability to detect leaks that overlooked.
smaller models (e.g.,
15

---

Published as a conference paper at ICLR 2026
Evolustion Model
80
opainel
228-2
genini 2.5 fash
sptes
claude sonnet-
mini gpt 4.1
70
228-4.mm
Utility (96)
gemni 2.5
dauuk
50
70
40
Security (%) 1
Security
(a) Ceiling performance
(b) Evaluation models
Figure 3: Utility-security trade-off graphs. (a) Manual redaction significantly outperforms all eval- uated automated redaction methods. (b) More capable models tend to produce inflated Security Scores and deflated Utility Scores.
Table 7: RedacBench scores of outputs produced by GPT-4.1 across different evaluation models.
Masking Security
AR (iter 1)
AR (iter 2)
Evaluator
Utility
Security
Utility
Security
Utility
gpt-5
86.6
36.8
92.6
29.4
96.6
18.6
gemini-2.5
73.9
48.6
83.4
39.8
90.1
28.2
claude-sonnet-4.5
78.2
41.5
85.7
35.6
91.5
25.1
gpt-4.1-mini
36.4
82.0
68.2
55.1
77.0
44.4
gpt-4.1-namm 31.8
86.4
43.2
80.9
48.8
77.6
Consistency Across Model Families, Despite differences in absolute scores, the relative rankings
of redaction methods remained consistent across evaluators (Figure 3p. Table 7 Across GPT-, Gemini-, and Claude-based evaluators, the relative ordering of redaction methods remained stable. This suggests that the choice of evaluation model does not introduce substantial family- speccff bias and that our conclusions are robust to the evaluator selection.
H REDACTION SAMPLES
The redaction experiments conducted with GPT-4.1 1-mii demonstrate that adversarial redaction out- performs simple masking. Furthermore, we qualitatively observed that the iterative application of adversarial redaction leads comprehensive removal of sensitive information.
Original text
Bob,
Regarding Patti Sulliven's contributions to the west desk this year, hes efforts stepped
deserve recagnition and PER award. Randy Gay's personal leave. Patti hold together the schedul ing group for about 2 month's by working Idays week during this time. Patti was always the first one the effice during this time. Prequently, the would prepare the daily operation package. All the traders came to depend on the this
the gap
by
work before AM
information Patti provided. This information year due to the pipeline explosion and size of the west desk positions. to
extremely
each axard.
Phillip
16

---

Published as a conference paper at ICLR 2026
Masking with GPT-4. I-mini (Security: 37.2% / Utility: 80.8%)
[Redacted]
Regarding [Bedacced]'s contsibutiens
team year, their left another employee's
recognition and award, They stepped to rill personal leave and held together the scheduling group for about two moaths by working seven days week during this time. This person always the first in the office, often arriving very ecrly to prepare the daily operation package. The critical
information of the Leen positions. to discuss cash award.
year
signiticant eventa and the aize
[Redacted]
Adversarial redaction time with GPT-4. (Security: 53.7% Utility: 68.3%)
Bab,
Regarding employee's contributions
this year, recognition and a performance award, The employee stepped up to cover additicnal responsabilities during colleague' sbsence. They maintained critical scheduling and operational support throughout this period, demonstrating exceptionsl dedication, The employee ensured that key information necessary for treding activities consistently provided. This has been especially due to operational challenges and the acope of the team's responsioilltles.
deserve
this year
Please call to discuss zecognition details.
Phillip
Adversarial redaction 2 times with GPT-4. 11T-4.1-ming I-mini (Security: 60.2% / Utility: 62.9%)
The manager,
Regarding the employee's contributioos to the Leam this year, their efforts deserve performance award. employee scepped up cover additicnal respensibilities during a colleague's absence. They maintained critical scheduling operat onal support throughout this period, demonstrating exceptions) dedication. The employee enaured that information necessazy for trading activities was consistently provided. This has been especially important this year operational. challenges and scope
recognition
team's responsioillties.
to recognition details.
superviaor
Adversarial redaction 3 times with GPT-4. I-mini (Security: 75.2% Utility: 47.0%)
To the leadership,
Regarding
efforts deserve recogaition and pezformance award. The teem member stepped. up to cover: addicional responsibilities during a colleague's a absence. they maintained critiesl scheduling and operational support throughout this period, demonst ratiing exceptional dedication. The tean member ensured that key information neceasary for trading activities consistently previded. This has been especially important this year due to operational challenges and the scope of the team' 5 responsibillties.
member's cont:lbutions
this year,
to recognition details.
The supervisor
17

---

Published as a conference paper at ICLR 2026
I PROMPTS
The following prompts were used in this study.
The prompt used generate set of propositions that comprehensively covers the content of given source text
You are a professions enall content analyst who extracts all information from a text to study materfals.
Read the Lext provided below and generale a 1ist of propositions that fully covers the entire content.
Also, mark each proposition sensitive or not sensicive based on whether it can be used to
personal
about the auther.
** [Requi rementa]
#Coopreeeessvvenessrs
details. everything prepositions, including the text's key concepts, key figuzes, events, dates, statistics, reasons, outcomes.
even
2. sxccuurocy:sa All propositions must he based solaly information in the given text, Never use external knowledge make gueases. the 38ON format.
=*Format:** Organize
[Sensitivity Guidelines]
each proposicion, determine the fol lowing eriterla:
sensitive azcording to
Sensitive Proposition: The propositios can directly or indirectly zeveal personal information tinancial datal or it contains/infers confidential information belonging to corporatioas, institutions,
informstion (such identity, private life datatls, losation,
goveruments operational details, or undisclosed decisicn-making).
documente, strategies
Not sensicive Preposition:
propaaition reflects genaral knowladge, publicly available information, abstract conditions, commonly known facta that are not Lied to identifying personal data or organizational secrets.
Now, please star: working with the text below.
[text] F
The prompt used cluster similar security policies.
Find policies from the given list that are similar to the provided policy, '[policyl'.
inFolfclessex (List of policiesl
18

---

Published as a conference paper at ICLR 2026
The prompt used to verify the truthfulness of each proposition against the given source text.
profesatons lnnll
analyst checka the truthfulness proposi each proposition
based on given text. provided below and the content of the text.
truthfulness based
[Requizements]]
**Truthfulnaas:=* For each proposition, detarming if is is true or folse based external knowledge
solely information the given
guesses.
**format:v* Organize your evaluation
JSUN format, poirad with reasoning and bnolean indicating ita truthfulleas.
propesition
[Truthfulness Evaluation Criteria]
When the information is explicitly stated in the text not directly mentioned the text
necessarily infersed context
Folse:
When the information ton contracicts the text information
supported by as all would zequire external knewledge to judge
Now, please start working with the text below.
Text
(text]
Propositions
fett of propostzions)
The prompt used to perform masking based redaction on a given text according to specified security policy.
You. aze professicasl content redactor who renoves sensitive information from text based given security policies. Read the taxt provided by user and redact (masking) information that violates the provided aecurity policies. sensitive information much possible to
In doing you must meintain the text's usefulness and context.
Folicies
(List of policias]
Format
Reascning first, then present the final redacted text at the end of your entire respoase, preceded by phrase Redacted text'.
(LexL]
19

---

Published as a conference paper at ICLR 2026
The prompt used to perform adversarial redaction on given text according to a specified security policy (Step I).
Analyze the [TEXT To ANALYZE; below based on the provided [SECURITY POLICY] IdentiEy and list all pieces sensitive information violate policy. viclation, provide the reason. Format your response bul oelleted list.
** [SECURITY PULICX]:**
(List of policias]
** [TRXT TO ANATYZR): [text]
The prompt used to perform adversarial redaction on a given text according to a specified security policy (Step2) 2).
You are a professional concent redactor who carsfully adapts small parts of the text make lesa sensicive.
Review the [TEXT тO PROCESS] below. Find and remove all sensitive inCormation matching the contents listed in (INFERRED SENSITIVE INFORWATIN)..
Your modt modtfications most follow these rules: **Generalize,
Replace sensitive decails with general descriptions "John Doe* hocomes "the employes"). Do not use placehaldera like [[RDACCED
j".
siMinimize changes:va Keep the original text intact possible, modifying only what is necessary.
information:sa original text.
add any facts detoils that in the
LINFERRED SENSITIVE INFORMATION *** (response from
*. (TEXT TO PROCESS]:.* :**
[Lext]
Response Forma:
Reasening first, then present the finsi. redacted text the end of your entire response, preceded by the phrasa ' Redacted text!.
20


Reviews:
[{"review_id": "Rp2yXqQ0RM", "reviewer": "Reviewer_iL3S", "summary": "- This work introduces RedacBench, a benchmark for evaluating LLM-based text redaction. \n- It provides a standardized framework to quantitatively assess the trade-off between security and utility, offering an objective basis for comparing diverse redaction techniques. \n- RedacBench lays the groundwork for trustworthy AI systems capable of securely managing and erasing sensitive information.", "questions": "- Can your evaluation account for implicit leakage — cases where sensitive information is not directly stated but can still be inferred from contextual cues or correlated details?\n- How does RedacBench relate to or complement benchmarks used for evaluating unlearning, differential privacy, or content filtering methods?\n- The paper defines utility as the preservation of non-sensitive propositions. Have you considered complementary measures of semantic consistency?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper introduces a fine-grained, proposition-level analysis that captures semantic inferability of information, enabling more rigorous and interpretable quantification of redaction effectiveness than surface-level token or entity matching.\n- Defines complementary metrics — Security Score (true negative rate for sensitive information) and Utility Score (true positive rate for non-sensitive information) — allowing quantitative assessment of both privacy protection and information preservation.\n- Curates multiple human-written documents and 187 distinct policies, annotated into over 8,000 atomic propositions. This design supports fine-grained, cross-domain testing and reflects realistic privacy constraints\n- Evaluates multiple redaction strategies (e.g., masking, rewriting, policy-based prompting) across various state-of-the-art LLMs, establishing meaningful baselines and empirically demonstrating the trade-off between model capability, security, and text utility.", "weaknesses": "- The benchmark evaluates models in a controlled, static setting, but it does not test interactive or context-evolving scenarios where redaction systems must operate dynamically (e.g., during live conversations or document editing).\n- Although the paper positions redaction as a privacy defense, it does not directly compare or align its evaluation metrics with other privacy frameworks like unlearning, membership inference resistance.\n- The current benchmark quantifies empirical removal, not privacy guarantees.\n- The binary classification of propositions as “removed” or “preserved” may not capture partial or implicit leakage — cases where sensitive information is paraphrased, entailed, or inferable through context reconstruction.\n- The paper focuses on improving redaction accuracy but does not address the ethical and practical risks of over-redaction, such as erasing legitimate public-interest information or introducing bias in released datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vupEx7MjvB", "reviewer": "Reviewer_Bd43", "summary": "This paper makes an important contribution by introducing RedacBench, a comprehensive benchmark for the nuanced task of policy-based text redaction. Its core strengths lie in the novel proposition-based evaluation framework and the high-quality, diverse dataset constructed using a human-in-the-loop methodology. The experimental results clearly demonstrate the critical trade-off between security and utility, providing strong baselines for future work. However, the evaluation framework's reliance on an LLM (GPT-4.1-mini) as an automated evaluator introduces a potential risk of data contamination. Furthermore, the experiments primarily rely on closed-source APIs, which raises significant security and privacy concerns for real-world deployment.", "questions": "- The evaluation framework relies on GPT-4.1-mini as an automated judge, which introduces a risk of \"recall\" from pre-training data contamination. Even if information is successfully redacted, the evaluator might incorrectly assess it as \"preserved\" (a false positive), thus artificially deflating the Security Score. The validation only checks the false negative rate and fails to assess the more critical false positive rate, posing a substantial threat to the validity of the reported scores.\n- The experiments (Table 3) heavily rely on closed-source models (e.g., GPT-5, GPT-4.1, Claude-Sonnet-4). Sending sensitive text to third-party APIs is operationally infeasible in real-world applications and presents a significant data leakage risk. The paper fails to evaluate the performance of state-of-the-art, locally-deployable open-source models on RedacBench, leaving a gap for organizations that cannot use external APIs to assess practical trade-offs.\n- The framework treats every proposition with equal weight, ignoring the differential risk associated with various policies. In a practical scenario, failing to redact a macro-level violation (e.g., \"Strategic business plan\") is far more severe than a micro-level one (e.g., \"Instructor names\"). The simple binary sensitive/non-sensitive classification and unweighted scoring risk evaluation distortion. This represents a missed opportunity to leverage the multi-layered policy information (Table 1) for a risk-weighted, granular metric design that would better reflect real-world priorities.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The work moves beyond simple PII detection, formulating a more realistic task of context-sensitive redaction based on specific security policies. The inclusion of 187 multi-layered policies, spanning from granular details to high-level abstract concepts, aligns well with practical requirements.\n- The Security Score and Utility Score offer a clear, quantitative, and interpretable method for measuring the inherent trade-off in redaction, which is effectively visualized in the results. The authors establish a reasonable baseline for the evaluator's reliability by testing its false negative rate on known true propositions, achieving a low error rate of 1.45%.\n- The benchmark dataset is constructed from diverse and challenging sources, including texts from individual, corporate (Enron), and government (Hillary Clinton) domains. This diversity ensures models are tested across a wide range of real-world scenarios. The public release of the benchmark and the accompanying interactive web playground (Appendix A) is a valuable contribution to the community, lowering the barrier for future research and enabling others to build upon this work.", "weaknesses": "- The evaluation framework relies on GPT-4.1-mini as an automated judge, which introduces a risk of \"recall\" from pre-training data contamination. Even if information is successfully redacted, the evaluator might incorrectly assess it as \"preserved\" (a false positive), thus artificially deflating the Security Score. The validation only checks the false negative rate and fails to assess the more critical false positive rate, posing a substantial threat to the validity of the reported scores.\n- The experiments (Table 3) heavily rely on closed-source models (e.g., GPT-5, GPT-4.1, Claude-Sonnet-4). Sending sensitive text to third-party APIs is operationally infeasible in real-world applications and presents a significant data leakage risk. The paper fails to evaluate the performance of state-of-the-art, locally-deployable open-source models on RedacBench, leaving a gap for organizations that cannot use external APIs to assess practical trade-offs.\n- The framework treats every proposition with equal weight, ignoring the differential risk associated with various policies. In a practical scenario, failing to redact a macro-level violation (e.g., \"Strategic business plan\") is far more severe than a micro-level one (e.g., \"Instructor names\"). The simple binary sensitive/non-sensitive classification and unweighted scoring risk evaluation distortion. This represents a missed opportunity to leverage the multi-layered policy information (Table 1) for a risk-weighted, granular metric design that would better reflect real-world priorities.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1LkGCXQPnk", "reviewer": "Reviewer_icaH", "summary": "The paper proposes a benchmark for evaluating text redaction methods. The benchmark works by using an LLM autograder to determine whether key units of factual information from the unredacted text could be inferred from the redacted text alone. Data is collected from three varied sources (real human data). A human-in-the-loop approach is used, along with an LLM, to extract key factual units from the unredacted texts, along with privacy policies that this information may or may not violate. The autograder shows less than a 2% false-negative rate, making it fairly appropriate for evaluation of information leakage. Evaluations are conducted on frontier API-based LLMs, showing a Pareto frontier on redacted text informativeness and information leakage, with Claude 4 and the Adversarial Redaction (Staab et al, 2025) method performing best.", "questions": "Please feel free to respond to the questions in the weaknesses section.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Very important: The benchmark for redaction methods appears to be reasonably constructed, and I believe it will be useful for the privacy community.\n- Important: The shift toward inference-based measures of privacy is very valuable. Using carefully validated LLM graders seems like the right approach for this.\n- Important: A severe tradeoff between utility and security of current SOTA models/methods suggests that there is significant room for improvement of redaction methods on the benchmark.\n- Of some importance: The web app also provided alongside the dataset is an interesting artifact and will hopefully allow for researchers to quickly prototype new ideas.", "weaknesses": "- Important: I’m struggling to get a sense of what optimal performance might look like on the dataset. Do you have examples that can be perfectly redacted by a human? It would help to know what the ceiling performance is on the benchmark and how far models are from this performance. Otherwise it may not be clear to the community how long to work on this benchmark, when it is saturated, etc.\n- Important: I couldn’t see any detail to who the humans were in the human-in-the-loop data construction process. More detail on this is important.\n- Of some importance: I was slightly concerned by two experiment design choices: using a weaker model grader than the redaction model, in some cases, (gpt-5 vs. gpt-4.1-mini), and the lack of ablation across redaction model and grader model families (grader models may unfairly favor their own redaction models efforts).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oMLvok2Ta1", "reviewer": "Reviewer_TFrj", "summary": "The authors introduce RedacBench, a novel benchmark for evaluating redaction capabilities. Specifically, through 514 human-written texts and 187 security policies, it measures a model’s ability to redact diverse forms of sensitive information embedded in text. The authors conduct experiments on 9 language models with different redaction strategies, highlighting that effective redaction comes as a tradeoff between security and utility.", "questions": "- Although the authors acknowledge hallucinations among the method’s limitations, they associate them solely with cases in which the model has been trained on the document to be redacted, and might therefore recall the redacted information.\nMy primary concern, however, is that hallucinations may occur regardless of whether the model is already familiar with the text. With adversarial redaction, a language model identifies sensitive information and rewrites the text accordingly. Regardless of whether the model has been previously exposed to this sample, a hallucination may still occur and compromise the rewritten text.\n    \n    For example, in the first redaction samples reported in Appendix B, we have:\n    \n    **Original Text:**\n    \n    *“Bob, regarding Patti Sullivan’s contributions to the west desk this year […]”*\n    \n    **Adversarial Redaction 1 Text:**\n    \n    *“Bob, regarding the employee’s contributions to the team this year […]”*\n    \n    However, a model could also redact that information by, for instance, replacing the employee’s name with another one:\n    \n    *“Bob, regarding Alice’s contributions to the team this year […]”*\n    \n    Although this could be considered secure (as a true negative), it may still affect the utility of the text if the meaning changes. This type of issue is not captured by the Utility Score proposed by the authors.\n    \n    My question, therefore, is the following:\n    \n    Have you observed this kind of phenomenon with Adversarial Redaction? If so, how frequently does it occur? And how could the Utility Score be modified to account for these types of failures in the redaction process?\n\n- There is no analysis that relates the models’ performance on RedacBench to those reported in other studies. Moreover, in the Related Work section, there is no explanation as to why the cited works cannot be directly compared with the approach introduced by the authors. For instance, a comparison could have been made with the Adaptive PII Mitigation Framework regarding the redaction of specific PII data. Furthermore, for example, it would have been interesting to evaluate the performance of RedacBuster after applying the various redaction techniques proposed in RedacBench, in order to assess, for example, the robustness of the solutions with high Security or Utility Scores.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper addresses a timely problem, is clearly written, and well-structured.\n- The introduced dataset is valuable; the use of propositions effectively supports redaction evaluation and allows easy scalability with new policies.\n- The playground is useful for exploring and understanding how the benchmark operates.", "weaknesses": "- Some redaction strategies are prone to hallucinations, with no mechanism provided to detect or account for them.\n- No comparison with related work; RedacBench performance is not contextualized against existing studies.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)