Anonymisation Models for Text Data: State of the art, Challenges and Future Directions (2021)

Abstract: This position paper investigates the problem of automated text anonymisation, which is a prerequisite for secure sharing of documents containing sensitive information about individuals. We summarise the key concepts behind text anonymisation and provide a review of current approaches. Anonymisation methods have so far been developed in two fields with little mutual interaction, namely natural language processing and privacy-preserving data publishing. Based on a case study, we outline the benefits and limitations of these approaches and discuss a number of open challenges, such as (1) how to account for multiple types of semantic inferences, (2) how to strike a balance between disclosure risk and data utility and (3) how to evaluate the quality of the resulting anonymisation. We lay out a case for moving beyond sequence labelling models and incorporate explicit measures of disclosure risk into the text anonymisation process.

## introduction privacy is a fundamental human right (art. 12 of the universal declaration of human rights) and a critical component of any free society, among others to protect citizens against social control, stigmatisation, and threats to political expression. privacy is also protected by multiple national and international legal frameworks, such as the general data protection regulation (gdpr) introduced in europe in 2018. this right to privacy imposes constraints on the usage and distribution of data including personal information, such as emails, court cases or patient records. in particular, personal data cannot be distributed to third parties (or even used for secondary purposes) without legal ground, such as the explicit and informed consent of the individuals to whom the data refers. as informed consent is often difficult to obtain in practice, an alternative is to rely on anonymisa-tion techniques that render personal data no longer personal. access to anonymised data is a prerequisite for research advances in many scientific fields, notably in medicine and the social sciences. by facilitating open data initiatives, anonymised data can also help empower citizens and support democratic participation. for structured databases, anonymisation can be enforced through well-established privacy models such as k-anonymity @xcite or differential privacy @xcite . these privacy models and their implementations are, however, difficult to apply to unstructured data such as texts. in fact, text anonymisation has been traditionally enforced manually, a process that is costly, timeconsuming and prone to errors @xcite . these limitations led to the development of various computational frameworks designed to extend automated or semi-automated anonymisation to the text domain @xcite @xcite . in this paper, we review the core concepts underlying text anonymisation, and survey the approaches put forward to solve this task. these can be divided into two independent research directions. on the one hand, nlp approaches rely on sequence labelling to detect and remove predefined categories of entities that are considered sensitive or of personal nature (such as names, phone numbers or medical conditions). on the other hand, privacy-preserving data publishing (ppdp) approaches take the notion of disclosure risk as starting point and anonymise text by enforcing a privacy model. anonymisation consists of a sequence of transformations (such as removal or generalisation) on the document to ensure the requirements derived from the privacy model are fulfilled. this position paper makes the case that none of these approaches provide a fully satisfactory account of the text anonymisation problem. we illustrate their merits and shortcomings on a case study and discuss three open challenges: we argue in this paper that nlp and ppdp approaches should be viewed as complementary (one focusing on linguistic patterns, the other on disclosure risk) and that future anonymisation approaches for text should seek to reconcile these two views. in particular, we contend that text anonymisation models should combine a data-driven editor model (which selects masking operations on the document) with an adversary seeking to infer confidential attributes from edited documents. ## what is anonymisation? the most common definition of privacy amounts to self-determination, which is the ability of individuals, groups or organisations to seclude information about themselves selectively @xcite . information related to an identified or identifiable person is known as personal data, or more precisely personally identifiable information (pii). datasets with pii cannot be released without control as this would impair the privacy of the data subjects. ## ppdp approaches privacy-preserving data publishing (ppdp) develops computational techniques for releasing data without violating privacy @xcite . the ppdp approach to anonymisation is privacyfirst: a privacy model specifying an ex ante privacy condition is enforced through one or several data masking methods, such as noise addition or generalisation of values @xcite . the first widely-accepted privacy model is k-anonymity @xcite : a dataset satisfies kanonymity if each combination of values of quasiidentifier attributes is shared by at least k records. with @xmath0, no unequivocal re-identifications are possible, thereby preventing identity disclosure. most of the attention of the ppdp community has been on structured databases. privacy models such as k-anonymity assume that datasets consist of records, each one detailing the attributes of a single individual, and that attributes have been classified beforehand into identifiers, quasi-identifiers and confidential attributes. moreover, most masking methods employed to enforce privacy models have been designed with numerical data in mind, and barely (and poorly) manage categorical or nominal attributes @xcite . ## case study to investigate the performance of nlp and ppdp methods, we carried out a case study where 5 annotators annotated 8 english wikipedia page extracts. the extracts were all biographies from the "20th century scientists" category, with a length between 300 and 500 characters. wikipedia articles are generic enough not to require expert domain knowledge and are commonly adopted for the evaluation of ppdp approaches @xcite . their informativeness and density make them particularly challenging to anonymise. the annotation task foot_1 consisted of tagging text spans that could re-identify a person either directly or in combination with publicly available knowledge. the annotators were instructed to prevent identity disclosure but otherwise seek to preserve as much semantic content as possible. the five annotators were researchers without previous experience in text anonymisation. the guidelines were left intentionally general to examine how annotators interpret and carry out the complex task of anonymisation -and not only de-identificationwhere multiple correct solutions are possible. the task is challenging since these biographies relate to publicly known scientists for which extensive background material can be found online. inter-rater agreement between the five annotators for the binary masking decisions was low: 0.68 average observed agreement and krippendorff's α = 0.36. this low agreement illustrates that, contrary to traditional sequence labelling, several solutions may exist for a given anonymisation problem. direct identifiers were generally agreed on, while quasi-identifiers such as professions and roles (e.g. founder) triggered mixed decisions. to shed further light on the anonymisation problem, we go on to compare the performance of existing tools with the manual annotations: ## challenges and future directions the case study illustrates a number of issues facing current methods for text anonymisation. we discuss below three overarching challenges: the need to protect against several types of semantic inferences, the formalisation of possible masking operations to apply on documents, and, last but not least, the design of evaluation metrics to empirically assess the anonymisation performance. ## conclusion this position paper discussed a number of unresolved challenges in text anonymisation. text anonymisation is defined as the removal or masking of any information that, directly or indirectly, may lead to an individual being identified (given some assumptions about the available background knowledge). as illustrated in our case study, text anonymisation is a difficult task (also for human annotators), which goes beyond the mere detection of predefined categories of entities and may allow for several solutions. how to properly anonymise text data is a problem of great practical importance. in particular, access to high-quality data is a key ingredient for most scientific research, and the lack of good anonymisation methods for text documents (allowing data to be shared without compromising privacy) is a limiting factor in fields such as medicine, social sciences, psychology and law. we surveyed two families of approaches with complementary strengths and weaknesses: nlp models are well-suited to capture textual patterns but lack any consideration of disclosure risk, while ppdp approaches provide principled accounts of privacy requirements, but view documents as bagof-terms void of linguistic structure. as outlined in the last section, a promising approach is to couple a neural editor model (applying transformations to the text) with an adversary model (capturing possible semantic inferences to uncover confidential entities). these two models can be optimised jointly using adversarial training, taking into account the necessary balance between disclosure risk and utility preservation. finally, we lay out a case for designing evaluation metrics that go beyond traditional ir-based measures, and account in particular for the fact that some identifiers and quasi-identifiers are more important than others in terms of their influence on the disclosure risk.