TAROT : Task-Oriented Authorship Obfuscation Using Policy Optimization Methods (2025)

Abstract: Authorship obfuscation aims to disguise the identity of an author within a text by altering the writing style, vocabulary, syntax, and other linguistic features associated with the text author. This alteration needs to balance privacy and utility. While strong obfuscation techniques can effectively hide the author’s identity, they often degrade the quality and usefulness of the text for its intended purpose. Conversely, maintaining high utility tends to provide insufficient privacy, making it easier for an adversary to de-anonymize the author. Thus, achieving an optimal trade-off between these two conflicting objectives is crucial. In this paper, we propose **TAROT**: **T**ask-Oriented **A**utho**r**ship **O**bfuscation Using Policy Op**t**imization, a new unsupervised authorship obfuscation method whose goal is to optimize the privacy-utility trade-off by regenerating the entire text considering its downstream utility. Our approach leverages policy optimization as a fine-tuning paradigm over small language models in order to rewrite texts by preserving author identity and downstream task utility. We show that our approach largely reduces the accuracy of attackers while preserving utility. We make our code and models publicly available.

## introduction text is a primary medium for storing user data, training machine learning models, and interacting with large language models (llms) during inference. however, it also poses significant privacy risks, as sensitive or personal information contained within text can be exposed or misused. text anonymization is a vital technique to address these concerns by removing or obfuscating personal information. this process protects individual privacy while ensuring that machine learning models can still derive meaningful insights and patterns from anonymized data, preserving its utility. we generate obfuscation candidates and optimize the best policy using reinforcement learning and preference optimization. currently, most work done on text anonymization focuses on redacting sensitive entities in a given document @xcite . this is sufficient for texts where the only private aspects are named entities, such as medical reports, court cases, or biographies. but it is inadequate for removing the author's writing style, or the weak signals that can be used as hints for identification, which is, for example, the case for blog articles or emails. redacting entities in text while keeping stylometric features linked to a specific individual would eventually result in a leak of information. indeed, the writing style is a strong indicator of a person's identity @xcite . previous work on authorship attribution highlights the large amount of information that can be extracted from seemingly anonymized texts and the ease of identification of authors, especially for long documents @xcite . to solve this issue, authorship obfuscation (ao) aims to hide the author's identity by replacing some part of the text associated with authorship indicators. modifying the original text can impact its usability for specific tasks (i.e. utility), and therefore badly affects the downstream performances and text comprehension of machine learning models. the enforcement of privacy creates a trade-off between privacy and utility, where keeping the original text preserves the unchanged utility of the text, while not defending against attribution attacks. on the other hand, obfuscating the entire text guarantees privacy, but leads to unusable text in practice. previous approaches design their obfuscation by maximizing the preserved text content. they limit the modifications to small and targeted edits in order to preserve text meaning and keep textual content as close as possible to the original. while this strategy is necessary to maintain the exact content and ensure that we convey the exact same message (before publishing the text online for example), those approaches often lead to insufficient modification in the text, especially against realistic attack scenarios @xcite . to address these limitations, we reframe the ao problem into an adversarial problem between two adversaries (e.g. machine learning models): one attacker model whose goal is to reveal the identity of a given author from written texts, and one utility model that aims to perform a given task using authors' data. the goal is to provide a modified version of the original text such that the utility model can accurately perform its task while preventing the attacker from identifying the author, making the obfuscation task-oriented. this perspective is more angled towards data users who need to privately perform utility tasks on the data, where some degree of content alteration may be acceptable if it enhances privacy. the notion of task-oriented obfuscation/anonymization also takes its origin in the law. as stated by gdpr (european parliament and council of the european union, 2016), the collection and processing of personal information (including written texts) must be specified for a given usage. in order to learn this privacy-utility trade-off, we use the combination of supervised fine-tuning (sft) and policy optimization (po) to guide a generative model into generating privacy-and utility-preserving outputs. our model learns to rewrite the text while removing potential authorship signals, and preserving the text utility for a downstream task. this rewriting goal is further validated by the conclusion of @xcite which showed how difficult it is to comply with gdpr requirements concerning text anonymization without changing the entire text. we fine-tune a text simplification model for ao using a customized reward model. we design an unsupervised reward model for po using two pretrained sentence embedding models. the utility reward penalizes the fact that the general text embeddings @xcite of the anonymized sentence is too far removed from that of the original sentence. the author rewards does the opposite on the embedding built by the universal authorship representation model from @xcite . our final models are trained in an open-world setting where the number of authors is not defined, the same goes for the end utility for our model to work on a multi-task setting. we also provide experimentation on three different datasets, movie reviews, blog articles and scholar documents. we show that tarot can be used on multiple datasets targeting different tasks while protecting authorship. in summary, we list the main contributions as follows: ## related work authorship obfuscation obfuscation techniques can be regrouped into two categories, depending on their implementation. generic methods, on one hand, are methods that were not explicitly designed for ao, but show interesting performance. these methods include machine translation @xcite , paraphrasing @xcite , or synonym replacements @xcite . more recently, advanced techniques were built explicitly for ao, often relying on a trained attacker performing authorship attribution attacks on the obfuscated text. then, they perform accurate adversarial text edits from the attacker knowledge on authors in order to obtain a privatized output. mutant-x @xcite , is a genetic algorithm that utilizes glove @xcite word embeddings selected from an svm or random forest attacker to replace words in a document with similar ones. jamdec @xcite is an unsupervised approach for obfuscating the writing style of text while preserving semantics. it uses embedding-based and likelihood-based methods, rather than attackerbased methods, to extract keywords, then generates multiple text variations using constrained diverse beam search on gpt2-xl (1.61b parameters). finally, the candidates are filtered using natural language inference (nli) and corpus of linguistic acceptability (cola) metrics to ensure coherence, content preservation, and grammatical correctness. recently, alison @xcite employs a lightweight multilayer perceptron classifier using part-of-speech sequences to guide obfuscation, and leverages a bert pre-trained language model to generate replacement sequences. by ranking and replacing important part-of-speech n-grams, alison obfuscates text uniformly, reducing classifier confidence. related studies share a common approach to evaluating privacy: they measure it through the performance of authorship attribution classifiers against obfuscated texts. @xcite push forward this evaluation framework by introducing adversarial attackers that can resist obfuscation techniques. for measuring utility, the standard is to treat ao as a reference-less natural language generation problem, and to rely on standard metrics used for similar tasks such as machine translation and summarization @xcite . reinforcement learning in nlp, reinforcement learning (rl) is often used to capture small signals over word or sentence embedding. for example, @xcite proposes a text representation anonymization approach that employs deep reinforcement learning to detect and modify text embeddings to maintain a good privacy-utility trade-off. with the development of reinforcement learning from human feedback (rlhf) as a llm fine-tuning paradigm, rl techniques have been leveraged to improve language models with scalar metrics by optimizing rewards from (human) feedback. it has emerged as a prominent tool for tackling undesirable behaviors such as toxicity, social biases, and offensive language @xcite . this is accomplished by implementing po algorithms to optimize a language model (lm) by associating a reward with each generation, derived from a trained reward model. very recently, @xcite introduced an authorship style transfer method using po. they optimize style transfer generation using style similarity reward models. authorship style transfer is similar to ao in the way those task's goal is to change within a text the author writing style. however, style transfer assumes a distinct target style to achieve, whereas ao assumes a lack of distinct style. @xcite also showed the ineffectiveness of style transfer for ao. to the best of our knowledge, our work is the first one applying po algorithms on ao. private synthetic text generation our work lies at the frontier between private text editing and synthetic text generation. creating private synthetic data often relies on established frameworks such as differential privacy @xcite . in contrast to these approaches, we focus on the implementation of a single text-to-text transformation specifically designed for authorship obfuscation, rather than on the generation of new textual data derived from potentially multiple sources @xcite . differential privacy traditionally targets noise addition in documents to produce useful and private text representations @xcite . applying differential privacy to document rewriting primarily serves to mitigate membership inference attacks, addressing a distinct threat model compared to the authorship attribution attacks targeted by our approach. while these techniques exhibit emergent capabilities for masking authorship signals @xcite @xcite , they typically do so at a substantial cost to text utility, both at the task-level and the syntactic-level @xcite . this approach introduces unnecessary noise to semantic content not relevant to authorship identification, often degrading the overall coherence and readability of the text. in contrast, our obfuscation methodology implements targeted modifications to stylometric features while maintaining the overall integrity of the source text. ## experimental setup in this section, we describe the datasets involved for training and evaluation of our resulting models, and present our custom reward targeting the open-world authorship verification and multi-task text embeddings to learn this ao task. we then evaluate the resulting obfuscation against text edition and rewriting baselines. ## conclusion we introduced a novel authorship obfuscation framework that focuses on optimizing the privacyutility trade-off for a specific downstream data usage. we fine-tuned a text simplification model using two policy optimization algorithms to obfuscate the authorship of a given text, while preserving utility for multiple tasks. our end-models are tuned using two sentence embedding rewards, one for content preservation and one for privacy, resulting in an unsupervised approach made for the open-world authorship setting. the results obtained help to improve the privacy from state-of-the-art ao methods, while preserving task utility. our findings suggest that editing approaches are not suitable for privacy, especially against realistic attack settings. additionally, we show that generated texts can be used to retrain utility classifiers and increase their performances, while limiting the accuracy of more advanced attackers. ultimately, the performance of obfuscation methods largely varies depending on the downstream task choice, as does the resulting privacy-utility trade-off, highlighting the importance of selecting an appropriate model based on the specific requirements of the intended application. this calls for more research to design robust evaluation benchmarks for obfuscation systems, to assess and catch failure cases that can map to different real-world scenarios.