De-Identification of Sensitive Personal Data in Datasets Derived from IIT - CDIP (2024)

Abstract: The IIT-CDIP document collection is the source of several widely used and publicly accessible document understanding datasets. In this paper, manual inspection of 5 datasets derived from IIT-CDIP uncovers the presence of thousands of instances of sensitive personal data, including US Social Security Numbers (SSNs), birth places and dates, and home addresses of individuals. The presence of such sensitive personal data in commonly-used and publicly available datasets is startling and has ethical and potentially legal implications; we believe such sensitive data ought to be removed from the internet. Thus, in this paper, we develop a modular data de-identification pipeline that replaces sensitive data with synthetic, but realistic, data. Via experiments, we demonstrate that this de-identification method preserves the utility of the de-identified documents so that they can continue be used in various document understanding applications. We will release redacted versions of these datasets publicly.

## introduction large volumes of data are becoming increasingly important for training machine learning models for document understanding tasks like classification, information extraction, and visual question answering. one such large volume is iit-cdip @xcite -containing over 7 million documents (∼40 million pages) -which has been used as a source for several smaller, widely-used document understanding datasets like rvl-cdip @xcite ; 400k samples) and docvqa @xcite ; 12,767 samples). in particular, these datasets have been used by the document understanding research community for benchmarking the performance of modern deep learning architectures, many of which make use of both image and text modalities (e.g., @xcite ; @xcite ; @xcite ). alarmingly, recent work by @xcite has reported large amounts of sensitive personally identifiable information (pii) in the rvl-cdip document classification dataset. such data would violate contemporary guidelines for responsible research in the nlp and machine learning communities, which have established that the presence of sensitive personal data is problematic and such data should be removed or minimized in datasets. for instance, the neurips code of ethics states that "datasets should minimize the exposure of any personally identifiable information," and similar guidelines can be found in the acl rolling review's responsible nlp research checklist. 1 such statements are seriously motivated: the presence of one's sensitive personal information -like their social security number, birth date, place of birth, etc. -in publicly accessible data heightens their risk to fraud and identity theft @xcite . indeed, many organizations now take extra precautions against storing pii like ssns. 2 additionally, it has been demonstrated that diffusion models and large language models (llms) can leak sensitive data @xcite @xcite @xcite , which is a serious concern if these types of models are to be trained on document understanding datasets like rvl-cdip. inspired by the recent work by @xcite -who estimated that roughly 7.7% of documents in rvl-cdip's resume category contain us social security numbers (ssns) -we inspect rvl-cdip and four other datasets derived from iit-cdip for the presence of sensitive pii. in this paper, we thoroughly investigate docvqa, funsd, tobacco3482, tobacco800, and rvl-cdip and determine the relative frequencies of various sensitive pii entities in each dataset. we find sensitive pii in all five of these datasets, including over 2,000 highly sensitive ssns; figure 1 displays several examples that contain highly sensitive ssns. seeking to re-align these datasets in the spirit of good data stewardship by minimizing the amount of sensitive personal information, we develop and analyze a data de-identification strategy that replaces original sensitive entities with synthetic, but realistic, replacement data (see figure 1 ). this strategy aims to preserve the utility, or semantics, of a document while also removing potential privacy-related harms. to help reduce further privacy risks, we release de-identified versions of the datasets. 3 2 motivation: presence of sensitive pii in datasets derived from iit-cdip in this section, we quantify the presence of sensitive personally identifiable information (pii) in 5 datasets derived from iit-cdip. we first introduce each of the 5 datasets. we next analyze the feasibility of using automated tools for detecting sensitive pii in documents. finding these tools to be lacking, we discuss manual annotation. finally, we quantify the presence of sensitive pii via manual annotation, motivating the need for the development of our document de-identification method, which we will discuss in section 3. 2 an example organizational policy from an american university: mcneese.edu/policy/social-security-number-policy/. ## de-identification of sensitive pii the presence of sensitive pii in all five iit-cdipderived datasets is alarming. for the sake of privacy, we will release redacted versions of these datasets along with the publication of this paper. in this section we discuss several ways of redacting sensitive information from document data, including one method that replaces the original sensitive data with synthetic data in order to preserve utility. ## experiments: impact of redactions having redacted sensitive pii from document images, we next determine whether such redactions impact downstream modeling performance. to help answer this question, we conduct several experiments to intrinsically and extrinsically compare the various redaction approaches with the original un-redacted documents. ## related work with the growing importance of data in training and evaluating machine learning models, recent work has started to examine datasets and corpora with the goal of evaluating data quality. this notion of quality encompasses notions of correctness (e.g., uncovering and quantifying label annotation errors @xcite @xcite @xcite ), and diversity and difficulty (e.g., measuring the similarity or overlap between test and train splits @xcite @xcite @xcite @xcite @xcite ), as well as whether datasets are free of potentially harmful contents like undesirable social biases (e.g., yang et al. (2020); hirota et al. (2022); sahoo et al. (2022); smith et al. (2023) ), harmful language or concepts (e.g., hate speech and sexually explicit content @xcite ), and sensitive personally identifiable data @xcite @xcite @xcite . in particular, @xcite uncovered the presence of pii in two massive web-scale corpora using automated methods, including presidio. recent work by @xcite observed the presence of sensitive pii in rvl-cdip, but did not investigate this in-depth or for other iit-cdip-derived corpora. our work is among the first to examine the presence of sensitive personal data in datasets derived from iit-cdip in depth. de-identification and pseudonymization have been investigated in computer vision in the context of de-identifying and pseudonymizing faces (e.g., gross et al. (2009); brkic et al. (2017); li and lin (2019); gafni et al. (2019); cai et al. (2024); yang et al. (2022) ) and other potentially sensitive image entities in images (e.g., orekondy et al. (2018) ). de-identification and pseudonymization also plays an important role in healthcare applications of natural language processing (e.g., friedrich et al. (2019); lothritz et al. (2023); vakili and dalianis (2022); sánchez et al. (2014); murugadoss et al. (2021) ), where healthcare records -often legally -must be anonymized before they can be used as data for training or evaluating models. despite deidentification and pseudonymization being active areas of research in computer vision and healthcare text processing applications, we found relatively little work on the topic in prior work on document image processing, with exceptions including work on applying black redactions over sensitive regions of documents @xcite . in particular, @xcite investigated the impact of applying black redaction boxes to documents from rvl-cdip, finding that this type of redaction strategy tends to negatively impact classifier performance. however, they did not investigate any other redaction or de-identification strategies. we therefore argue that sensitive data deidentification and pseudonymization should become active areas of future work for the document image processing research community; for instance, while we found simple data generation and augmentation strategies using augraphy and faker to be effective in imitating real data, perhaps more recent font style transfer methods (e.g., atarsaikhan et al. (2017); gomez et al. (2019); wu et al. (2019) ) could be investigated for this task in the future. ## conclusion in this paper, we uncover large amounts of sensitive personally identifiable information (pii) within five datasets derived from iit-cdip. we measure the coverage and performance of several off-the-shelf pii detection tools, finding that performance varies widely across tools at the task of detecting ssns, and that as a whole, coverage of the various pii types found in iit-cdip is limited. we analyze the impact of redactions on the data to various modeling tasks, and we will make redacted versions of these dataset publicly available.