NAP 2: A Benchmark for Naturalness and Privacy-Preserving Text Rewriting by Learning from Human (2025)

Abstract: The widespread use of cloud-based Large Language Models (LLMs) has heightened concerns over user privacy, as sensitive information may be inadvertently exposed during interactions with these services. To protect privacy before sending sensitive data to those models, we suggest sanitizing sensitive text using two common strategies used by humans: i) deleting sensitive expressions, and ii) obscuring sensitive details by abstracting them. To explore the issues and develop a tool for text rewriting, we curate the first corpus, coined , through both crowdsourcing and the use of large language models (LLMs). Compared to the prior works based on differential privacy, which lead to a sharp drop in information utility and unnatural texts, the human-inspired approaches result in more natural rewrites and offer an improved balance between privacy protection and data utility, as demonstrated by our extensive experiments.

## introduction data sharing and information dissemination between ai models are pivotal in the ai era, particularly since the emergence of large language models (llms). the remarkable performance of llms benefits from a large amount of shared and publicly available data. however, it is still challenging to balance data privacy and information utility when training and utilizing such llms @xcite with a massive amount of data. users or applications often interact with commercial llms by directly inputting raw text. such interactions can inadvertently expose sensitive data, such as personally identifiable information (pii), to untrusted service providers or llms @xcite . redaction and anonymization techniques are widely applied to remove pii from texts, but suffer from three major drawbacks @xcite . 1 corresponding author. ## related work the field of controllable text style transfer focuses on modifying specific attributes in texts, such as formality @xcite and sentiment @xcite while preserving the core semantic content. the advancement of text rewriting tasks is heavily dependent on the availability of high-quality corpora to assess generation quality. @xcite collected a large-scale corpus gyafc for initiating the research of formality style transfer to rewrite formal language. as for our task sensitive to privacy, which demands sophisticated alignment in rewriting utterances, the construction of a specialized corpus for high-quality privacy-sensitive rewrites are crucial. there is a growing interest in protecting user privacy @xcite @xcite in nlp tasks. one way of protecting privacy is to implicitly remove the information in decision models, for example perturbing the representations via adversarial training @xcite @xcite or differential privacy @xcite . in text rewriting which is close to our rewriting approach, local differential privacy are recently adapted to protect the data by adding customized noise @xcite . such adaptations in rewriting system mitigate the privacy leakage risk of original input however result in complete semantic change of inputs as the noise is independently drawn from the data and task. we consider a more generalised rewriting setting where the naturalness and general meaning of sentence are preserved. another series of work suggested to generate new sentences with less sensitive information @xcite . recent work has explored prompting llms to rewrite sentences containing private information, aiming to obscure sensitive content @xcite @xcite . however, these approaches often rely on llms' internal knowledge and struggle to align with nuanced human privacy expectations @xcite . however in these works, the author does not control how private information to be rewritten in explicit way which may weaken the control for required privacy and human preference. even advanced techniques like selfdisclosure abstraction or adversarial anonymization face challenges in achieving robust, user-aligned privacy and often depend on powerful cloud-based models. in contrast, our work study private rewrite via more diversified free text and supports two rewriting strategies, offering a more flexible and general setting @xcite . ## conclusion we introduce naturalness to the tasks of privacypreserving text rewriting and collect a corpus nap 2 based on persona-chat. the fundamental concept involves training models to learn human strategies, namely deleting and obscuring, for inference-time privacy. the t5-base model trained on our corpus outperforms competitive zeroshot llms and dp methods by a wide margin. this work paves the way for future research on llmbased rewriting techniques with a new focus on preserving naturalness of rewriting.