Detecting Personal Identifiable Information in S wedish Learner Essays (2024)

Abstract: Linguistic data can — and often does — contain PII (Personal Identifiable Information). Both from a legal and ethical standpoint, the sharing of such data is not permissible. According to the GDPR, pseudonymization, i.e. the replacement of sensitive information with surrogates, is an acceptable strategy for privacy preservation. While research has been conducted on the detection and replacement of sensitive data in Swedish medical data using Large Language Models (LLMs), it is unclear whether these models handle PII in less structured and more thematically varied texts equally well. In this paper, we present and discuss the performance of an LLM-based PII-detection system for Swedish learner essays.

## introduction while there is a constant need for linguistic datafuelled recently by the advent of large language models (llms) which require copious amounts of training data -legal and ethical sharing and use thereof is problematic. the eu commission (2016) severely limits the use and sharing of data containing personal identifiable information (pii). however, the regulation also presents a possible solution: pseudonymizing the data, defined as: "[...] the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person" (art. 4 of eu @xcite . within the field of natural language processing (nlp), this definition becomes more narrow -and while various researchers formulate it slightly differently, we understand pseudonymization as "the process of replacing an individual's personal data with a pseudonym, which is not related to the original data," with the same end goal as outlined in the gdpr @xcite . naturally, conducting such a de-identification procedure manually is extremely time-consuming and costly, especially when the data in question is copious and very sensitive @xcite . it would therefore be beneficial to be able to automatize the process in a reliable and robust way. while there is existing research on automated deidentification systems, many of them are restricted to specific domains (especially healthcare), and not as much work has been conducted on less structured types of input, which we expect to be more problematic due to more varied types of personal information as well as a higher likelihood of various kinds of errors or non-standard forms (e.g. in terms of spelling, syntax, or semantics). we choose to work with l2 (second language) learner essays, as this kind of texts not only fulfills the requirement of larger structural and thematic variety but, as @xcite show, the essays are also likely to contain piis. since l2 corpora are relevant for various research applications, developing models that can handle pii detection and replacement in this kind of texts would be useful. what exactly constitutes sensitive information can differ across domains, documents, or even paragraphs, and is heavily context-dependent. we believe that algorithms could learn something akin to human intuition about what is personal and/or sensitive in the data. with this in mind, we experiment with an approach where none of the pii and sensitive categories are labeled for their classes (e.g. name, city, etc.), but are binary (personal/sensitive or not). this distinction is formalized as inside-outside-beginning (iob) classes, where non-sensitive tokens are labeled o (outside), while sensitive tokens or token spans are labeled with b (beginning) and, in the case of multi-token sensitive elements, i (inside) for every token after the first one. we replace manually assigned categories in our dataset of learner essays in swedish (swell-pilot, @xcite ) with b(i) and o, and fine-tune two large language models (llms, kb/bert-base-swedish-cased and bert-base-multilingual-cased) to distinguish between the two types of tokens @xcite . while we are aware that pseudonym generation is likely to rely on a predicted pii class, we decide to focus on the detection step, which can precede classification -presuming that such a step is necessary in a pseudonymization pipeline. our hypothesis is that the model will learn to distinguish between sensitive and non-sensitive information in a given context, and potentially even capture more types of personal information than we at the moment envisage, helping us identify new classes that can be added to the taxonomy or refine the existing ones. simultaneously, we hope to assess the usefulness of fine-tuned llms for pii detection, especially in more free-flowing and error-prone genres such as learner essays. ## prior research as previously mentioned, pseudonymization, as we understand it, entails the replacement of sensitive tokens or groups of tokens with new and somewhat unrelated -but still contextually appropriate -surrogates. the replacement of pii with a pseudonym presupposes a step at which the sensitive data is detected and possibly classified; recently @xcite conceptualized the pseudonymization pipeline as consisting of the two aforementioned steps. while @xcite consider the pseudonym generation step to be more of an open question than the detection of piis themselves, many previously presented detection systems do not account for, for example, misspellings or otherwise non-normative writing, which is essential when working with data like learner essays @xcite . although @xcite highlights the issues stemming from spelling variation, these issues seem to mostly pertain to specific genres, which so far have been underrepresented in pii detection research, as the bulk of the existing research is focused on medical data. as shown by @xcite , many of the well-performing systems for pii detection in medical data rely on neural or hybrid approaches. recently, @xcite have released a text anonymization benchmark corpus consisting of texts from the legal domain, and presented the results obtained by several models. while their custom metrics rely at least partly on there being more than one possible way to annotate a text, they do provide overall recall and precision as well, with the best model -a longformer model with a large window size -reaching 91.9% recall and 83.6% precision; however, an f1 score is not reported. @xcite , in turn, finetuned a swedish bert model for named entity recognition and classification (nerc) in swedish medical texts. the ner categories in the corpus utilized in their experiment are actually phi categories, which could be considered a type of pii, rendering this task sufficiently similar to warrant a comparison. they report precision and recall scores for various models, with the best of them (kb-bert trained and tested on data from the same source) reaching a weighted precision score of 92.26% and a weighted recall score of 92.20% (with the weighted f1 of 92.23%). they also reach relatively good scores on m-bert (multilingual bert) with the same data setup -88.99% recall and 90.51% precision (and f1 of 89.74%). while @xcite argue that high recall is more desirable in pii detection systems than high precision, the latter is also important, as it means that the model is not over-detecting the sensitive data and flagging innocent passages. we believe that the alterations to the text should be kept to a necessary minimum as any changes made to the linguistic data may affect its future usability in various types of research (e.g. linguistics or machine learning). while our experiment is meant to test an approach similar to that of @xcite , it is worth keeping in mind that the data we use is less structured and may contain a bigger variety of personal information, as described in @xcite , which may lead to a worse performance by the system. ## materials and methods in this experiment, we utilize 445 learner essays from the swell-pilot corpus, representing a wide variety of learner levels, topics, and types of writing (e.g. descriptive or argumentative essays) @xcite . some of the essays contain piis, and some do not, predominantly due to the variation in types of writing and the prompts (e.g. a descriptive essay with the topic"about me" is much more likely to contain piis than an argumentative essay with the topic "stress in the modern society"). we use the unpseudonymized foot_0 versions of the texts. the essays have also been tokenized and reannotated with tags for pii categories using the svala tool according to the swell pseudonymization guidelines developed for the swell-gold corpus and the corresponding tagset @xcite @xcite . this annotation includes not only typically ner-like categories such as place names or surnames, but also e.g. names of professions or references to one's faith, with only the tokens deemed sensitive in a given context being annotated as such. in our experiments, we ignore the categories of sensitive information and only differentiate between sensitive and non-sensitive information. we transform the existing category annotation into an inside-outsidebeginning (iob) annotation to represent the difference between piis and non-pii tokens. due to bert-imposed input sequence limitations, we subdivide the essays into sections that are at most 100 tokens long, foot_1 resulting in a total of 651 such sections, out of which 165 contain at least one token of sensitive information. the data is then balanced so that the data splits (training, testing, development) contain equally many passages with piis as passages without piis, meaning that these splits are composed of 165 fragments with piis and 165 randomly chosen fragments without piis out of 486 such fragments. importantly, this does not mean that half of the tokens include sensitive information, and the actual distribution of sensitive and non-sensitive tokens can be seen in we have fine-tuned the models on 80% of our data (after balancing the set) twice, once with a standard crossentropyloss loss function, and once with a weighted version thereof, with the intent of accounting for the class imbalance in a task of this type 5 . we have also reduced the batch size to 8 since due to the length of the samples we did not have the computational resources to process that much data in one batch. aside from that, we have proceeded with the default settings for the script (notably, 3 epochs and adamw optimizer with a learning rate of 5e-05). the fine-tuning process also makes use of another 10% of our data for evaluation between the epochs (development set). the fine-tuned model has been tested on the held-out test set (another 10% of the data). the transformers evaluation code calculates average evaluation metrics but here we also additionally calculate per-class metrics. additionally, tokens misclassified by the models relative to the manually annotated gold standard have been extracted with their contexts and analyzed manually to see if any patterns of what the model struggled with could be identified. ## conclusions within this paper we have presented the results of an investigation into the performance of llms on pii detection in learner essays, framing it as a task similar to named entity recognition. we have shown that a finetuned kb/bert-base-swedish-cased model is capable of learning how to distinguish between sensitive and non-sensitive information in this kind of data, reaching up to 90.17% recall, suggesting that llms are able to approximate a human intuition when it comes to discerning what is sensitive in a given context, although they may struggle with overdetecting such data. we are also of the opinion that some of the model's disagreements with the original pii annotation could be informative when it comes to refining manual pii annotation, though perhaps not to the extent we would have wished for (the models did not discover any new kinds of pii). while the current performance of the models is behind the ones presented by @xcite (although they are relatively close in terms of recall) and the one discussed by @xcite (comparing our top two models, one is slightly ahead in precision, but much worse in recall, while the other one has a similar recall with much worse precision), they are promising for pii detection in unstructured and non-standard texts in swedish, and -with some improvements -a finetuned system like this could constitute a part of a pseudonymization pipeline. the current challenge is optimizing the model's hyperparameters so as to maximize the recall at the least possible cost to precision. in its current form, a weighted loss function does not seem to perform its function, but some method of accounting for class imbalance is necessary given the models' low performance on the i class. simultaneously, when discussing the performance of our models in relation to the ones reported by @xcite we consider it relevant to mention that the latter were trained and tested on various medical datasets. we consider the medical domain to be much more regular in terms of the kinds of pii it may include (corresponding, in large part, to what the authors of that paper described as named entities), as well as less likely to include errors of various kinds. therefore, pii detection in learner essays seems to us to be a more difficult task than pii detection in medical data.