Neural Text Sanitization with Explicit Measures of Privacy Risk (2022)

Abstract: We present a novel approach for text sanitization, which is the task of editing a document to mask all (direct and indirect) personal identifiers and thereby conceal the identity of the individuals(s) mentioned in the text. In contrast to previous work, the approach relies on explicit measures of privacy risk, making it possible to explicitly control the trade-off between privacy protection and data utility. The approach proceeds in three steps. A neural, privacy-enhanced entity recognizer is first employed to detect and classify potential personal identifiers. We then determine which entities, or combination of entities, are likely to pose a re-identification risk through a range of privacy risk assessment measures. We present three such measures of privacy risk, respectively based on (1) span probabilities derived from a BERT language model, (2) web search queries and (3) a classifier trained on labelled data. Finally, a linear optimization solver decides which entities to mask to minimize the semantic loss while simultaneously ensuring that the estimated privacy risk remains under a given threshold. We evaluate the approach both in the absence and presence of manually annotated data. Our results highlight the potential of the approach, as well as issues specific types of personal data can introduce to the process.

## introduction personal data, also known as personally identifiable information (pii), often abound in text documents, from emails to patient records, court judgments, interview transcripts or customer service chats. protecting the privacy of the individuals mentioned in those documents is an important task, particularly for sensitive texts which might disclose confidential information such as health status, religious beliefs, ethnicity or sex life. it is, however, possible to apply privacyenhancing techniques such as text sanitization to conceal the identity of those individuals from the texts, and thereby make it easier to share data to third parties, in particular for the purpose of scientific research or statistical analysis. the goal of text sanitization is to transform a document through edit operations such as hiding particular text spans or replacing them by more general values. although complete anonymization compliant with data privacy frameworks such as the general data protection regulation @xcite has been shown to be very difficult to achieve in practice @xcite ), text sanitization can substantially enhance the level of privacy protection while simultaneously retaining most of the semantic content expressed in the documents. existing work on text sanitization has primarily focused on masking predefined entity types through sequence labelling @xcite @xcite . these previous approaches, however, may not mask enough pii to prevent re-identification, as they are restricted to a fixed list of semantic categories to detect. these are often named entities such as persons, organizations, or locations. as a consequence, personal information that do not belong to those predefined categories (for instance, mentions of a person's appearance or occupation) will be ignored. paradoxically, they may also end up masking too much information, as they systematically mask all occurrences of a given entity type (for instance, all locations) regardless of the actual influence of a particular entity on the risk of re-identifying the individuals mentioned in the original document @xcite . in this paper we present a novel approach to text sanitization that seeks to address these limitations. the approach relies on a privacy-enhanced entity recognizer that goes beyond named entities and can detect demographic attributes and other types of personal information that frequently occur in text. the integration of empirical measures of privacy text with detected entities privacy-enhanced entity-recognizer step 1 privacy risk with web queries optimization algorithm step 3 bert-based privacy risk step 2 privacy risk estimator from labelled data text sanitized text (when available) figure 1 : general sketch of the approach. the text document is first given as input to the privacy-enhanced entity recognizer which detects personal information present in the text, along with their semantic type. then three privacy risk measures are used to determine which entities may constitute a privacy risk. finally, an optimization algorithm makes the optimal masking decisions for each document, resulting in a sanitized text. the resulting risk measures are fed to an optimization solver which determines the optimal set of entities to mask in each document. figure 1 provides a general outline of the procedure. the code along with the models used is publicly available. 1 the proposed approach can be applied without any labelled data, provided there already exists a generic named entity recognizer (ner) and a version of wikidata for the language employed in the documents. if text annotated with masking decisions is available, the approach can take advantage of them to further enhance the model's performance. the modularity of the approach also allows for the integration of additional methods to measure the privacy risk associated with the entities mentioned in the text. this paper makes the following contributions: the structure of the rest of the paper is the following. a background and review of related work are provided in section 2. section 3 details our approach, followed by an evaluation and discussion in section 4. we conclude in section 5. ## background privacy is a fundamental human right, and various legal frameworks for data protection foot_0 have been put in place in recent years to ensure that individuals remain in control of their personal data. those frameworks specify strict guidelines on how data that may contain personal information should be collected, stored and processed. personal identifiers can be divided in two broad categories @xcite : direct identifiers: information that can irrevocably and uniquely identify an individual (e.g. name, social security number, email address, bio-metric data, etc.) quasi identifiers: information that cannot directly single out an individual, but may do so indirectly when combined with other quasi identifiers (e.g. date of birth, occupation, city of residence, ethnicity etc.). for instance, the combination of gender, date of birth and postal code can single out between 63 and 87% of the u.s. population @xcite . both direct and quasi identifiers need to be masked (i.e. removed or generalized) to prevent identity disclosure. this necessarily leads to a a loss of information or data utility, and the objective of text sanitization is therefore to determine the set of masking operations that ensure the privacy risk remains below a given threshold, yet preserve as much data utility as possible. nlp approaches to text sanitization have mostly focused on medical data, using either rule-based methods @xcite or sequence labelling models trained on manually annotated data for pre-defined categories @xcite @xcite . text sanitization approaches have also been developed in the field of privacy-preserving data publishing (ppdp). those approaches seek to enforce a privacy model by searching for the optimal set of masking decisions to ensure that the requirements of the model are met. the k-anonymity privacy model @xcite has been adapted for text data in k-safety @xcite and k-confusability @xcite . like k-anonymity, these approaches require every entity to be indistinguishable from k-1 other entities. t-plausibility @xcite is a similar model which depends on pii being already detected to perform generalization so as to ensure that at least t documents can be derived through specialization of the generalized terms. finally c-sanitized @xcite is designed to mimic human annotators by taking into account semantic inferences in the text, in addition to disclosure risk. to this end, mutual information scores are calculated manually from co-occurrence counts in web data. those ppdp approaches, however, typically treat the text simply as a flat collection of terms, missing thus the importance of context for the entities and the linguistic inter-relationships between these terms. @xcite present the text anonymization benchmark (tab), a corpus of court judgements from the european court of human rights (echr), manually enriched with detailed annotations on the pii expressed in each document. the authors also propose a set of novel evaluation metrics for the task as well as baseline results using a neural sequence labelling model. @xcite describe a bootstrapping approach for text sanitization based on k-anonymity. their approach requires, however, an explicit specification of the background knowledge associated with each individual, which may be difficult to acquire. the masking operations employed in text sanitization are non-perturbative (i.e. limited to either hiding text spans or replacing them by more general values). this need to preserve the "truth value" of the original document is important for many types of data releases: a clinical report in which the description of symptoms and diagnosis has been randomly altered would be of little interest for e.g. medical researchers. this requirement distinguishes text sanitization from other privacyenhancing methods based on differential privacy @xcite , which transform existing texts through the addition of artificial noise. although those techniques are undeniably useful to create texts (or text representations) that can enforce specific privacy guarantees, they address a different task than the one discussed in this paper, as they effectively produce new, synthetic texts instead of masked versions of existing documents @xcite . ## approach in the following we introduce the three steps of our neural text sanitization model. ## evaluation we evaluate the proposed approach on the text anonymization benchmark (tab) @xcite which consists of 1268 echr court judgements manually annotated for text anonymization benchmarking. court judgements are freely available documents that are not subject to data protection regulations. the annotations in tab identify all possible pii in the texts, associated with both a semantic category (e.g., person name, code, demographic property, etc.) and a masking decision. the majority of entity types in the tab corpus belong to the datetime (34.6%), org (26.3%), and person (15.7%) semantic types, while 63.4% of all the annotations were masked as quasi identifiers and 4.4% as direct identifiers (mainly code and person semantic types), with the rest of the detected spans being left as is in the text @xcite . the test set, which we use for our evaluation purposes, consists of 127 documents which were annotated and quality checked by more than one annotators. we first analyse the performance of the privacyenhanced entity recognizer, and then evaluate the performance of the complete pipeline. ## conclusion this paper presented a novel approach to automated text sanitization. the approach relies on the detection of different types of pii as well as empirical measures of re-identification risk based on language models, web queries, and (when available) manually labelled data. such an approach makes it possible to derive explicit estimates of the privacy risk associated with a given masked document. those estimates can be employed to find the most appropriate trade-off between data utility and privacy protection, depending on the particular requirements of the application. the approach is evaluated on the newly released text anonymization benchmark @xcite . the evaluation results demonstrate the potential of the approach -both in the presence and absence of manually labelled data -, but also highlight the difficulty of the task. future work will focus on refining the privacyenhanced entity recognizer, to improve the detection of misc entities. we also aim to investigate more flexible masking strategies, such as the replacement of detected entities by more general text spans (such as @xcite being replaced by [city in france]), instead of merely hiding the entities from the text. finally, we wish to explore evaluation measures that do not rely on manually labelled data, as text sanitization is a task that may admit several, equally valid solutions @xcite .