K eep it P rivate: Unsupervised Privatization of Online Text (2024)

Abstract: Authorship obfuscation techniques hold the promise of helping people protect their privacy in online communications by automatically rewriting text to hide the identity of the original author. However, obfuscation has been evaluated in narrow settings in the NLP literature and has primarily been addressed with superficial edit operations that can lead to unnatural outputs. In this work, we introduce an automatic text privatization framework that fine-tunes a large language model via reinforcement learning to produce rewrites that balance soundness, sense, and privacy. We evaluate it extensively on a large-scale test set of English Reddit posts by 68k authors composed of short-medium length texts. We study how the performance changes among evaluative conditions including authorial profile length and authorship detection strategy. Our method maintains high text quality according to both automated metrics and human evaluation, and successfully evades several automated authorship attacks.

## introduction maintaining privacy is crucial to allow everyone's participation in online communities. this is a key motivation for platforms such as reddit that let users contribute pseudonymously. while anonymity is sometimes viewed as a cause of abuse, there is also clear evidence that de-anonymizing online comunication can harm "queer people, sex workers, activists, researchers, journalists, and persons holding combinations of these identities" @xcite . however simply using a pseudonym rather than one's legal name does not guarantee privacy, particularly for users from marginalized communities who might still perceive risks due to context collapse @xcite , and rely on "throwaway accounts" and other practices to negotiate identity boundaries @xcite . furthermore, even with anonymous accounts, text posts encode stylistic markers that can reveal the identity of the author. stylometry studies @xcite suggest that such clues can help identify authors across multiple genres, domains, and discourse types @xcite @xcite . automatic authorship obfuscation holds the promise of helping people protect their privacy in online communication by automatically rewriting text to convey the original content while hiding the identity of the original author. since there is little, if any, supervised training data for this task, existing approaches primarily rely on rule-based systems inspired by stylometry insights @xcite , repurposing machine translation systems for paraphrasing @xcite @xcite , or unsupervised style transfer models trained with dedicated adversarial objectives @xcite . other methods search for privatization-relevant sur-face edits using genetic search algorithms @xcite or heuristic search @xcite . inspired by the "keep it simple" approach to unsupervised text simplification @xcite , we introduce "keep it private", an unsupervised authorship obfuscation technique based on large language models, which uses reinforcement learning to guide them to generate text that hides author identity while producing sound outputs that preserve the meaning of the original. the impressive text generation abilities of language models suggest that they might help rewrite text in a way that is more natural and contextualized than stylometrybased edits. large language models also offer an attractive general-purpose alternative to dedicated sequence-to-sequence models that rely on custom architectures, adversarial training, or parallel data such as @xcite . to achieve privacy, an obfuscation model should be robust to any method that attempts to identify the author. yet, prior work test on proxy tasks or against a single approach for authorship detection @xcite @xcite in a small-scale authorship setting, with many writing samples per author. to simulate a setting for users participating in online forums, we focus our domain on a large reddit dataset of 68k authors with short-medium length texts, and check to what degree authors remain private under our evaluation framework. we introduce a new evaluation framework for text obfuscation, where we privatize against several authorship attacks: automatic authorship verification and attribution, as delineated in figure 2 . we introduce a method to guide llms to rewrite text for privatization via reinforcement learning, and show that our approach fools attribution and verification models the most, while maintaining soundness of outputs. we make available our scripts on github 1 . ## background our authorship obfuscation and evaluation strategies are informed by prior work on authorship analysis, which has been driven by the pan shared tasks 2 spanning profiling, attribution, style change detection, diarization, and obfuscation. we first review different ways of framing the adversarial 1 https://github.com/csbao/kip-privatization 2 https://pan.webis.de/shared-tasks.html task of author identification, before reviewing obfuscation methods themselves. ## approach: the "keep it private" model for authorship obfuscation our approach to text privatization relies on large language models to rewrite the input text, and uses reinforcement learning to directly optimize metrics that encourage obfuscating the identity of the original author, while preserving the meaning and acceptability of the original text. as a result, training is unsupervised and only requires examples of texts written by different authors, rather than supervised examples of obfuscation which are expensive to obtain at scale. our "keep it private" model (kip) privatizes an input segment @xmath0, . . . , x m ) into an output @xmath1, . . . , y n ) using a language model p(y|x; θ). inspired by @xcite 's approach to unsupervised text simplification, we adopt their variant of self-critical sequence training (k-scst). just like the popular reinforce algorithm @xcite , self-critical sequence training lets us optimize the gradient of the expected reward by sampling from the model during training, and treating those samples as groundtruth labels weighted by the reward. unlike re-inforce, k-scst relies on its own inference outputs to normalize the rewards observed. we optimize the following loss l: self-critical sequence training was initially proposed for caption generation tasks @xcite , and has also been used for other text generation tasks, including question generation @xcite and summarization @xcite . @xcite showed the benefits of sampling k candidate rewrites instead of one for unsupervised text simplification, a rewriting task that shares with obfuscation the need to rewrite stylistic attributes of the input text while preserving its meaning. within this framework, we consider a range of language models p (y |x; θ) as base generators (subsection 3.1), and design a set of rewards for authorship obfuscation (subsection 3.2). ## experimental design we describe our experimental design, including datasets, metrics, and models. ## results overview we present the main evaluation results on the reddit evaluation dataset in ## conclusion we introduced a method for training obfuscation models that use reinforcement learning on top of pre-trained language models to obfuscate the authorship of the original text. this method relies on a diverse range of rewards, crucially including neural authorship representations to judge authorship signals. the resulting outputs are edited more substantially than with existing obfuscation baselines, thereby improving privacy, while preserving meaning and soundness better than other successful obfuscation strategies. we find that using paraphraser base models lead to better balancing of both privacy and meaning preservation in the resulting kip models. additionally, conducting an extensive evaluation with diverse adversaries and input lengths highlights some important performance differences -namely, that it is difficult to fool verification systems with longer obfuscated author profiles, even if they fool attribution systems. this calls for more research into designing robust evaluation benchmarks for obfuscation systems, to assess and catch failure cases that can map to different real-world scenarios.