ER - AE : Differentially Private Text Generation for Authorship Anonymization (2021)

Abstract: Most of privacy protection studies for textual data focus on removing explicit sensitive identifiers. However, personal writing style, as a strong indicator of the authorship, is often neglected. Recent studies, such as SynTF, have shown promising results on privacy-preserving text mining. However, their anonymization algorithm can only output numeric term vectors which are difficult for the recipients to interpret. We propose a novel text generation model with a two-set exponential mechanism for authorship anonymization. By augmenting the semantic information through a REINFORCE training reward function, the model can generate differentially private text that has a close semantic and similar grammatical structure to the original text while removing personal traits of the writing style. It does not assume any conditioned labels or paralleled text data for training. We evaluate the performance of the proposed model on the real-life peer reviews dataset and the Yelp review dataset. The result suggests that our model outperforms the state-of-the-art on semantic preservation, authorship obfuscation, and stylometric transformation.

## introduction privacy has become a vital issue in online data gathering and public data release. various machine learning models and privacy preservation algorithms have been studied for relational data @xcite , network graph data @xcite , and transactional data @xcite . some of them have been successfully adopted in real-life applications such as telemetry collection @xcite . however, the studies on privacy protection for textual data are still preliminary. most related works only focus on replacing the sensitive key phrases in the text @xcite without considering the author's writing style, which is indeed a strong indicator of a person's identity. even though some textual data, such as double-blind academic reviews, is released anonymously, the adversaries may recover the author's identity using the personal traits in writing. stylometric techniques @xcite can identify an author of the text from 10,000 candidates. they are effective across online posts, articles, emails, and reviews @xcite . nevertheless, traditional text sanitization methods @xcite focus on anonymizing the contents, such as patient information, instead of the writing style, so they are ineffective against writing style analysis. the original author can be easily re-identified even if protected by these traditional approaches @xcite @xcite . only a few recent studies focus on authorship anonymization, aiming to hide the personal traits of writing style in the given textual data. anonymouth @xcite is a semiautomatic framework that offers suggestions to users to change their writing style. yet, this framework is not practical since it requires two datasets as a reference to compare the change in writing style. also, the user has to make all the final modification decisions. syntf @xcite represents a line of research that protects the privacy of the numeric vector representation of textual data. it adopts the exponential mechanism for a privacy guarantee, but the output is only an opaque term frequency vector, not an interpretable text in natural language. furthermore, its token substitution approach does not consider the grammatical correctness and semantic. style transfer is another line of research that tries to generate text with controllable attributes @xcite @xcite . representative models @xcite can control the sentiment and tense of the generated text. however, they do not modify the personal traits in writing. their applications on sentiment and word-reordering correspond to the content of the text more than the writing style. we argue that their definition of styles, such as sentiment or tense, is different from the personal linguistic writing characteristics that raise privacy concern. a4nt @xcite is a generative neural network that sanitizes the writing style of the input text. however, it requires text samples to be labeled with known author identities. it is not applicable to many textual data publishing scenarios. additionally, according to the samples provided in the paper, it has difficulties keeping the same semantic meaning between the original and the generated text. without using any privacy model, a4nt does not provide any privacy guarantee. to address the aforementioned issues, we propose an embedding reward auto-encoder (er-ae) to generate differentially private text. relying on differential privacy, it protects the author's identity through text indistinguishability without assuming any specific labels, any parallel data or any assumption on the attacker. it guards the privacy of the data against the worst information disclosure scenario. er-ae receives the original text as input and generates a new text using the two-set exponential mechanism. we propose a reinforce @xcite embedding reward function to augment the semantic information during the text generation process. the model can keep the generated text a close semantic and sentiment similarity to the original while providing a guarantee that one can hardly recover the original author's identity. unlike the aforementioned authorship anonymization works, er-ae produces human-friendly text in natural language. our key contributions are summarized as follows: ## preliminaries and problem definition adjacency is a key notion in differential privacy. one of the commonly used adjacency definitions is that two datasets d 1 and d 2 are adjacent if d 2 can be obtained by modifying one record in d 1 @xcite . differential privacy @xcite is a framework that provides a rigorous privacy guarantee on a dataset. it demands inherent randomness of a sanitization algorithm or generation function: definition 1. differential privacy. two datasets are considered as adjacent if there is only one single element is different. let privacy @xmath0, a randomized algorithm a : d n -→ z, and the image of a: im(a). the algorithm a is said to preservedifferential privacy if for any two adjacent datasets d 1 , d 2 ∈ d n , and for any possible set of output @xmath1: it guarantees that the result from a given algorithm a is not sensitive to a change of any individual record in d. denotes the privacy budget, the allowed degree of sensitivity. a large implies a higher risk to privacy. however, is a relative value that implies different degrees of risk given different problems @xcite . some studies @xcite use a large , while the others @xcite use a smaller value. adversary scenario. generally in an authorship identification problem, one assumes that the attacker holds an anonymous text authored by one of the suspects from the dataset. the attacker aims to infer the true author of the anonymous text based on a set of reference texts from each suspect. however, this scenario assumes certain information on the applicable dataset, such as author labels and the number of reference text samples. therefore, following @xcite , we define that any two pieces of text as adjacent datasets. adjacency. any two pieces of text can be considered adjacent in the strictest scenario that datasets d 1 and d 2 both have only one record, and d 2 can be obtained by editing one record in d 1 following definition 1. with differential privacy, we can have text indistinguishability: one cannot distinguish the identity of any text to another. in our case, the identity of a text corresponds to the author who wrote the text. along with this, the attacker would fail in the original authorship identification scenario since the anonymous text is indistinguishable from the rest of the dataset. our definition follows weggenmann and kerschbaum (2018)'s idea, leading to the strictest and most conservative definition of adjacency. definition 2. differentially private text generation. let d denote a dataset that contains a set of texts where @xmath2. |x|, the length of the text, is bound by l. given d with a privacy budget , for each x the model generates another text xdp that satisfies l-differential privacy. following the above definitions, any two datasets that contain only one record are probabilistically indistinguishable w.r.t. a privacy budget . it directly protects the identity of an individual record, disregarding whether some of the records belong to the same author or not. it assumes that every record is authored by a different author, which is the strictest situation. technically, the proposed text generation approach protects the writing style by reorganizing the text, replacing tokens with different spelling, removing the lexical, syntactical and idiosyncratic features of the given text. the above definition is based on syntf (2018), but our target is readable text rather than numeric vectors, which is more challenging. ## er-ae for differentially private text generation figure 1 depicts the overall architecture of our proposed er-ae model, which consists of an encoder and a generator. the encoder receives a sequence of tokens as input and generates a latent vector to represent the semantic features. the generator, which is incorporated with the two-set exponential mechanism, can produce differentially private text according to the latent vector. er-ae is trained input text encoder latent vector generator differentially -private text two-set exponential mechanism 0.1 0.6 0.05 0.1 0.01 0.6 0.7 0.0 0.2 embedding reward reconstruction loss random k top k + data release training ... ... ... by combining a reconstruction loss function and a novel embedding loss function. ## experiment all the experiments are carried out on a windows server equipped with two xeon e5-2697 cpus (36 cores), 384 gb of ram, and four nvidia titan xp gpu cards. we evaluate er-ae on two different datasets with respect to its effectiveness for privacy protection and utility preservation. this method generates a new text by replacing each token in the text by randomly picking substitution from the vocabulary. ## conclusion in this paper, we propose a novel model, er-ae, to protect an individual's privacy for text data release. we are among the first to fuse the differential privacy mechanisms into the sequence generation process. we demonstrate the effectiveness of our model on the yelp review dataset and two peer reviews datasets. however, we also find that er-ae performs not very well on long texts due to the privacy budget accounting issue. our future research will focus on improving long texts generation with better budget allocation scheme.