LLM Anonymization Against Agentic Re-Identification

• URL: http://arxiv.org/abs/2605.30848v2
• Date: Mon, 01 Jun 2026 17:13:40 GMT
• Title: LLM Anonymization Against Agentic Re-Identification
• Abstract summary: AURA (textbfAnonymization with textbfUtility-textbfRetention textbfAdaptation) is an LLM-powered textitmask-reconstruct framework that decouples privacy localization from utility-preserving reconstruction.<n>We evaluate AURA on real-user interview transcripts using re-identification attacks carried out by web-search agents, along with a utility evaluation based on interviewee-profile facts, codebook facts, and the joint contextual utility grid.
• Score: 7.3275169762993215
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Agentic LLMs with web search change the threat model for text anonymization: weak contextual cues can become cross-referenceable evidence for re-identification, yet those same details also carry downstream analytic value of the text. Existing defenses either remove explicit identifiers, perturb text for formal privacy, or test rewritten text against non-web inference models, leaving underexplored the operating region between resistance to agentic web-search re-identification and utility retention. We introduce AURA (\textbf{A}nonymization with \textbf{U}tility-\textbf{R}etention \textbf{A}daptation), an LLM-powered \textit{mask-reconstruct} framework that decouples privacy localization from utility-preserving reconstruction and selects candidates with adversarial privacy and utility-retention checks. We evaluate AURA on real-user interview transcripts using re-identification attacks carried out by web-search agents, along with a utility evaluation based on interviewee-profile facts, codebook facts, and the joint contextual utility grid. Our results show that AURA improves the privacy-utility frontier by using adaptive privacy scope to strengthen resistance to agentic re-identification and using a mask-reconstruct anonymization method to better preserve contextual utility under fixed privacy scope.

Related papers

• I Am No One: Style-Aware Paraphrasing for Text Anonymization [0.5874782446136914]
  Authorship attribution models can re-identify users from seemingly anonymized text by exploiting stable stylistic fingerprints.<n>We propose a style-aware, prompt-driven anonymization approach that uses pretrained large language models to construct compact stylistic profiles.<n>Our approach reduces authorship attribution F1 by 60-70% while maintaining content quality and readability.
  arXiv  Detail & Related papers  (2026-09-11T02:07:26Z)
• From Weak Cues to Real Identities: Evaluating Inference-Driven De-Anonymization in LLM Agents [15.933650066248648]
  LLM-based agents can autonomously reconstruct real-world identities from scattered, individually non-identifying cues.<n>We establish this threat as emphinference-driven linkage and systematically evaluate it across three settings.<n>In the Netflix Prize setting, an agent reconstructs 79.2% of identities, significantly outperforming a 56.0% classical baseline.
  arXiv  Detail & Related papers  (2026-03-19T00:59:26Z)
• Anonymous-by-Construction: An LLM-Driven Framework for Privacy-Preserving Text [0.42821598129654453]
  We develop an on-premise, LLM-driven substitution pipeline that anonymizes text.<n>We measure privacy, semantic utility, and trainability under privacy.<n>Our method attains state-of-the-art privacy, minimal topical drift, strong factual utility, and low trainability loss.
  arXiv  Detail & Related papers  (2026-03-17T23:46:15Z)
• Semantically-Aware LLM Agent to Enhance Privacy in Conversational AI Services [0.0]
  We present a semantically-aware privacy agent designed to safeguard sensitive PII data when using remote Large Language Models (LLMs)<n>Unlike prior work that often degrade response quality, our approach dynamically replaces sensitive PII entities in user prompts with semantically consistent pseudonyms.<n>Our results show that LOPSIDED reduces semantic utility errors by a factor of 5 compared to baseline techniques.
  arXiv  Detail & Related papers  (2025-10-30T21:34:23Z)
• Beyond Inference Intervention: Identity-Decoupled Diffusion for Face Anonymization [55.29071072675132]
  Face anonymization aims to conceal identity information while preserving non-identity attributes.<n>We propose textbfIDsuperscript2Face, a training-centric anonymization framework.<n>We show that IDtextsuperscript2Face outperforms existing methods in visual quality, identity suppression, and utility preservation.
  arXiv  Detail & Related papers  (2025-10-28T09:28:12Z)
• Zero-Shot Privacy-Aware Text Rewriting via Iterative Tree Search [60.197239728279534]
  Large language models (LLMs) in cloud-based services have raised significant privacy concerns.<n>Existing text anonymization and de-identification techniques, such as rule-based redaction and scrubbing, often struggle to balance privacy preservation with text naturalness and utility.<n>We propose a zero-shot, tree-search-based iterative sentence rewriting algorithm that systematically obfuscates or deletes private information while preserving coherence, relevance, and naturalness.
  arXiv  Detail & Related papers  (2025-09-25T07:23:52Z)
• VoxGuard: Evaluating User and Attribute Privacy in Speech via Membership Inference Attacks [51.68795949691009]
  We introduce VoxGuard, a framework grounded in differential privacy and membership inference.<n>For attributes, we show that simple transparent attacks recover gender and accent with near-perfect accuracy even after anonymization.<n>Our results demonstrate that EER substantially underestimates leakage, highlighting the need for low-FPR evaluation.
  arXiv  Detail & Related papers  (2025-09-22T20:57:48Z)
• The Double-edged Sword of LLM-based Data Reconstruction: Understanding and Mitigating Contextual Vulnerability in Word-level Differential Privacy Text Sanitization [53.51921540246166]
  We show that Language Large Models (LLMs) can exploit the contextual vulnerability of DP-sanitized texts.<n>Experiments uncover a double-edged sword effect of LLM reconstructions on privacy and utility.<n>We propose recommendations for using data reconstruction as a post-processing step.
  arXiv  Detail & Related papers  (2025-08-26T12:22:45Z)
• Tau-Eval: A Unified Evaluation Framework for Useful and Private Text Anonymization [7.9049991577473735]
  We present Tau-Eval, an open-source framework for benchmarking text anonymization methods.<n>A Python library, code, documentation and tutorials are publicly available.
  arXiv  Detail & Related papers  (2025-06-06T10:59:35Z)
• Robust Utility-Preserving Text Anonymization Based on Large Language Models [80.5266278002083]
  Anonymizing text that contains sensitive information is crucial for a wide range of applications.<n>Existing techniques face the emerging challenges of the re-identification ability of large language models.<n>We propose a framework composed of three key components: a privacy evaluator, a utility evaluator, and an optimization component.
  arXiv  Detail & Related papers  (2024-07-16T14:28:56Z)
• IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization [8.483679748399037]
  We propose IncogniText, a technique that anonymizes the text to mislead a potential adversary into predicting a wrong private attribute value.<n>Our empirical evaluation shows a reduction of private attribute leakage by more than 90% across 8 different private attributes.
  arXiv  Detail & Related papers  (2024-07-03T09:49:03Z)
• Unsupervised Text Deidentification [101.2219634341714]
  We propose an unsupervised deidentification method that masks words that leak personally-identifying information. Motivated by K-anonymity based privacy, we generate redactions that ensure a minimum reidentification rank.
  arXiv  Detail & Related papers  (2022-10-20T18:54:39Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.