Data Anonymization for Privacy-Preserving Large Language Model Fine-Tuning on Call Transcripts (2024)

Abstract: Large language models in public-facing industrial applications must accurately process data for the domain in which they are deployed, but they must not leak sensitive or confidential information when used. We present a process for anonymizing training data, a framework for quantitatively and qualitatively assessing the effectiveness of this process, and an assessment of the effectiveness of models fine-tuned on anonymized data in comparison with commercially available LLM APIs.

## data the data set to be anonymized consists of transcripts generated by an internal proprietary asr system. raw transcripts are passed through an inverse text normalization module to generate final formatted transcripts. the transcripts in the data set include phone and video conference conversations between at least one and usually two or more speakers in business contexts, such as voicemails (single speaker), call center conversations (typically two speakers) and internal company meetings (two or more). transcripts generated from an asr system are imperfect due to characteristics common to businesses, such as noisy environments, fast or quiet speakers, and poor-quality microphones. recognition errors propagate to the final transcription, which can create difficulties in applying and evaluating the anonymization process. ## anonymization process mindful of the ongoing discussion over the appropriate terminology for such processes (garfinkey, 2015), we use the term "anonymization" herein because the intended outcome of our method is that no individual can be identified from the resulting text. additionally, specifying anonymization distinguishes our method from pseudonymization, which appears superficially similar in that it includes replacing pi with tokens, e.g. @xcite . the difference is that pseudonymization maintains a consistent mapping of the replacement token across conversations, potentially permitting later reidentification, whereas our process reuses these de-identified tokens across conversations, functionally eliminating the possibility of using them for re-identification purposes. ## privacy-preserving llm training given a successfully anonymized data set, it can be used in combination with training prompts to fine-tune an llm. as the training prompts contain no pi either, the combined fine-tuning data set contains no pi. if the model remains suitably performant, this demonstrates the ability to benefit from highly relevant domain-specific (i.e. real-world) training data while substantially reducing or even eliminating the risk of leakage or extraction. ## conclusion in this paper, we presented a method for improving data anonymization on transcripts of business conversations using a publicly available service. we proposed a framework for quantitative and qualitative criteria for anonymization (residual risk scoring plus red team review), and showed that an llm fine-tuned with data anonymized by the proposed workflow on relevant tasks has superior performance compared to commercially available llms. this shows llms are still able to understand and leverage contextual information without access to those key entities. in practice, we found that having some key entities like user or company names is helpful for some downstream tasks. in future work we will assess the performance of llms