Generation of Replacement Options in Text Sanitization (2023)

Abstract: The purpose of text sanitization is to edit text documents to mask text spans that may directly or indirectly reveal personal information. An important problem in text sanitization is to find less specific, yet still informative replacements for each text span to mask. We present an approach to generate possible replacements using a combination of heuristic rules and an ontology derived from Wikidata. Those replacement options are hierarchically structured and cover various types of personal identifiers. Using this approach, we extend a recently released text sanitization dataset with manually selected replacements. The outcome of this data collection shows that the approach is able to suggest appropriate replacement options for most text spans.

## introduction most texts contain personally identifiable information (pii), which is information that can be used to directly or indirectly identify an individual. this raises privacy problems, as privacy frameworks such as gdpr @xcite enshrine the right of each individual to control the availability and sharing of their personal information. although full, gdpr-compliant anonymization is difficult to achieve @xcite , it is often desirable to apply text sanitization techniques to mask (i.e. remove or replace) pii from a given text and thereby conceal the identity of the persons referred to in the document. those pii can either correspond to direct identifiers (e.g. names, addresses, telephone numbers or social security identifiers) or take the form of so-called quasiidentifiers which are information that do not identify a person when seen in isolation, but may do so when combined together @xcite . ex-amples of quasi-identifiers are postal codes, gender, age, employer or profession. most text sanitization approaches operate by ( 1 ) detecting text spans that convey pii and (2) replacing them with a default string such as '***' or a black box @xcite . however, this considerably reduces the utility of the sanitized document. an alternative is to replace the detected text spans with more general values that are less risky from a privacy perspective, but remain more informative than a default string. for instance, drammen may be replaced by [city in norway], telenor by [telecommunications company] and february 5, 2023 by @xcite . the paper makes two contributions: the paper focuses on the specific problem of generating replacement choices for text spans expressing pii. the problem of how those text spans should be detected and classified lies therefore outside the scope of this paper. this span detection can be implemented using various types of sequence labelling models, as detailed in @xcite al. (2017); lison et al. (2021); pilán et al. (2022) the rest of the paper is constructed as follows. section 2 describes previous work in this task, while section 3 presents the replacement approach. in section 4 we present the dataset and evaluate its quality. we conclude in section 5. ## related work how to replace text spans expressing pii has been investigated in both natural language processing (nlp) and in privacy-preserving data publishing (ppdp). most nlp approaches @xcite @xcite simply replace the detected text spans by a default string or a black box. some alternatives include replacing text spans by pseudonyms @xcite or synthetic surrogates @xcite . in the medical domain, identified names in patient records can be replaced with random names from a list @xcite . one can also rely on lexical substitution, in which target words are replaced with similar lexical entities, e.g. a synonym or hypernym @xcite . this substitution can be implemented using various neural language models @xcite . within the field of ppdp, the c-sanitize approach @xcite frames the replacement of quasi-identifiers through an automatic sanitization process that mimics manual sanitization. it replaces identifiers with suitable generalizations, selected from a knowledge base, and an a parameter that can be adjusted to trade between privacy protection and data utility. t-plausibility @xcite generalizes identifiers so that at least t documents are derived through specialization of the generalized terms. ## generation of potential replacements we follow the categorization of text spans expressing pii detailed in @xcite : person names of people. ## dataset the dataset used for the data collection consists of 553 wikipedia articles already annotated for text sanitization by @xcite . wikipedia articles are suitable for this task as they are both dense in pii and publicly available. for each article, human annotators labelled the text spans that needed to be masked to protect the identity of the mentioned individual, while also retaining as much of the utility of the resulting text as possible. each text span is also assigned to one of the 8 categories enumerated in section 3. ## conclusion we presented an approach to generate replacements for detected pii based on heuristic rules and an ontology derived from wikidata properties. the approach is employed to enrich an existing text sanitization dataset with suitable replacements for each text span. those replacements were manually selected by annotators among a set of alternatives generated by the above approach. the collected data highlights the benefits of this replacement strategy, with 64% of the text spans being mapped to a generalization other than the default '***'. however, the moderate inter-annotatoragreement also illustrates the difficulty of the task, which may admit multiple solutions. future work will focus on enriching the ontology, resolving entity linking ambiguities and using the dataset to train a neural model to select appropriate generalizations for pii spans. figure 2: step 2 note that there is no one correct solution, as long as the identity of the individual is not disclosed and the replacement choices result in an (as much as possible) informative text. nb!you have to choose a replacement option. the original string is provided (first option in the drop-down list that cannot be chosen) in order to help choose the most appropriate one. the submit and go to next button can only be clicked if replacements for all the spans have been selected. read the text with the selected replacements one last time (step 3). make sure that you have chosen replacements for all text spans. click on submit and go to next to continue with the rest of the texts for this task. a short message will appear on your screen when your assigned number of texts have been annotated.