Redacted Contextual Question Answering with Generative Large Language Models (2024)

Abstract: Many contexts, such as medicine, finance, and cybersecurity, require controlled release of private or internal information. Traditionally, manually redacting sensitive information for release is an arduous and costly process, and while generative Large Language Models (gLLM) show promise at document-based ques- tion answering and summarization, their ability to do so while redacting sensitive information has not been widely explored. To address this, we introduce a new task, called redacted contextual question answering (RC-QA). This explores a gLLM’s ability to collaborate with a trusted user in a question-answer task as a proxy for drafting a public release informed by the redaction of potentially sensitive information, presented here in the form of constraints on the answers. We introduce a sample question-answer dataset for this task using publicly available data with four sample constraints. We present evaluation results for five language models and two refined models. Our results show that most models—especially open-source models—struggle to accurately answer questions under these constraints. We hope that these preliminary results help catalyze further exploration into this topic, and to that end, we make our code and data avail- able at https://github.com/isi-vista/ redacted-contextual-question-answering.

## introduction generative large language models (gllms) have demonstrated the capability to answer questions to a high degree of accuracy when provided relevant context. many systems augment the generative capabilities of a gllm with retrieval-augmented generation (rag) to synthesize and respond to questions using a source document. however, in many applications, some aspects of the source document cannot (or should not) be shared with a * equal contribution. here, we focus on in-context constraints within a rag-like paradigm. in such a context, we aim for general purpose redaction capability without, e.g., per-constraint retraining or manual redaction of information on a per-document level. we call our task redacted contextual question answering (rc-qa). in rc-qa, the gllm must obey all applied constraints provided as free-form text (e.g., do not mention the name of a person, avoid mentioning injury or death) while simultaneously responding to a question with the relevant content from the posed context. we introduce a small sample dataset derived from movie and tv show synopses with three different constraints. we provide baseline performance for gpt-3.5-turbo, gpt-4-turbo (ope-nai et al., 2023), falcon-7b-instruct (henceforth falcon-7b) @xcite , gemma-7bit (henceforth gemma-7b) @xcite , and mistral-7b-instruct-v0.2 (henceforth mistral-7b) @xcite . in addition, we show instruction-tuned variants of falcon-7b and mistral-7b using half the sample data as training examples. our initial results indicate gpt-4-turbo performs the best at this task but comes with inherent data privacy risks. gemma-7b performs the best for a local model. these results show that current state-of-theart local models may not meet accuracy standards needed for automated document redaction, leaving room for improvement. ## related work bias, ethics, and safety represent related constrained generation problems. because such problems cover diverse topical constraints, prior work takes two broad approaches: (1) adjusting the training process, for example, fine-tuning to reduce bias and improve safety and ethics @xcite , or (2) supplying immediately relevant context to mitigate the bias: exemplars of desired behavior @xcite , constructed counterexamples to a relevant bias @xcite , or a relevant ethical principle @xcite . in contrast, we focus on a narrower problem where constraints can be usefully written and supplied directly, avoiding the need to supply directly relevant context to improve constraint compliance or to perform expensive retraining. an increasing number of papers have studied the problem of confidentiality or secret-keeping @xcite . such works often study the system's robustness to malicious inputs @xcite in addition to its incidental leakage of information during normal use @xcite . in this framing, one must create and maintain a complete listing of pieces of confidential information. we instead specify general constraints which obviate the need for such a list. ## redacted contextual question answering many contexts exist that require controlled release of private internal information as public messages, such as in medicine, finance, and security. relevant to the security field, severe common vulnerabilities and exposures (cves) need to be communicated about to the general public and other organizations before a patch is available, especially as a result of known active attacks which should be mitigated. in this case, a message has a clear objective: it must communicate the severity of the exploit while giving away as little information as possible about how to perform the attack. a successful rc-qa model would accelerate drafting such a disclosure by reducing the writing time of a security expert, leaving them to validate and refine a draft for compliance rather than needing to craft an entire statement by hand. ## baseline experiment to create a baseline of current gllm performance on rc-qa, we evaluated five recent models either via a published api or using an nvidia a6000 gpu for locally hosted models. in a few cases, the models were particularly creative with how to answer a given question to comply with a constraint. figure 2 shows gpt-3.5-turbo giving one such answer. in the horror film saw x, mateo's extraction of the key requires injuring himself; however, gpt-3.5-turbo finds a creative way of providing an answer that meets the constraint. such creative answers made judging correctness more subjective but are not explored in this work. to provide a basis for interpreting human agreement on the assessment judgements, we performed dual assessment on a sample of 20 questionconstraint pairs and found a 95% agreement rate on the binary decision.