Elamur Research⌕
☰
home / papers / 2025 / IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization

IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization

Paper · 2025 · Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka et al.

Summary

Large language models can infer personal details about an author, such as age, gender, income or location, from seemingly harmless text. Together, these details can help re-identify the author. Earlier defenses either edit individual words, which leaves stylistic and syntactic signals intact, or apply differential privacy, which damages utility. IncogniText takes a different approach. An LLM rewrites the text so that an attacker is steered toward a deliberately chosen wrong value of the attribute, rather than simply having cues removed. The method loops between two steps:

  1. A local adversary model guesses the attribute and explains its reasoning.
  2. An anonymizer rewrites the text using that reasoning and the target value.

The loop stops once the adversary is fooled. On synthetic conversations and real Reddit posts, IncogniText cuts attribute leakage by over 90% across eight attributes and beats several baselines. The authors also distill the method into LoRA weights for a small on-device model. This suggests privacy protection can run locally on consumer hardware with moderate utility cost.

Key points

  • Evaluation data:
    • 525 human-verified synthetic conversations from Staab et al. (2023), covering 8 attributes.
    • 196 relabeled Reddit samples from Dou et al. (2023), covering 5 attributes.
  • Baselines: Azure Language Service (ALS), DP-BART-PR+, Dou-SD and FgAA (Staab et al., 2024).
  • Ablation with Phi-3-small:
    • Conditioning on a target value is the decisive factor: leakage falls from 36.0% to 9.5%.
    • Adding the ground-truth value lowers leakage further, to roughly 7–8%.
    • Utility stays around 92%.
  • Early stopping: Stopping once the adversary fails improves both privacy and utility. Giving the adversary the ground truth hurts all metrics.
  • On-device distillation:
    • Setup: Qwen2-1.5B with LoRA, trained on 664 filtered extra synthetic examples.
    • Leakage: drops from 40.8% to 18.1%.
    • Utility: goes from 94.3% to 88.2%.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 6The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 worksSocial Sciences · 1,954 worksSociology and Political Science · 626 works

Cite

Cite as Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka, Ricardo Mendes, Xue Jiang and Xuebing Zhou. 2025. IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization. Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2025.ijcnlp-long.134

@inproceedings{frikha2025incognitext,
  title = {{IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization}},
  author = {Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka, Ricardo Mendes, Xue Jiang and Xuebing Zhou},
  booktitle = {Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics},
  year = {2025},
  doi = {10.18653/v1/2025.ijcnlp-long.134},
  url = {https://doi.org/10.18653/v1/2025.ijcnlp-long.134}
}

References

27 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Aahill. What is azure ailanguage-azureaiservices, july 2023. find
  2. Marah Abdin, Sam Ade Jacobs, Ammar Ahmad Awan, Jyoti Aneja, Ahmed Awadallah, Hany Awadalla, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Harkirat Behl, et al. 2024. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219.
  3. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.
  4. Federico Albanese, Daniel Ciolek, and Nicolas D’Ippolito. 2023. Text sanitization beyond specific domains: Zero-shot redaction & substitution with large language models. arXiv preprint arXiv:2311.10785. — [arXiv:2311.10785](https://arxiv.org/abs/2311.10785) find
  5. Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, Binyuan Hui, Luo Ji, Mei Li, Junyang Lin, Runji Lin, Dayiheng Liu, Gao Liu, Chengqiang Lu, Keming Lu, Jianxin Ma, Rui Men, Xingzhang Ren, Xuancheng Ren, Chuanqi Tan, Sinan Tan, Jianhong Tu, P… — Qwen Technical Report
  6. Thomas Brewster. Chatgpt has been turned into a social media surveillance assistant, november 2023. find
  7. Yao Dou, Isadora Krsek, Tarek Naous, Anubha Kabra, Sauvik Das, Alan Ritter, and Wei Xu. 2023. Reducing privacy risks in online self-disclosures with language models. arXiv preprint arXiv:2311.09538. find
  8. Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3– 4):211–407. find
  9. Daniel Yacob Espinosa and Grigori Sidorov. 2023. Using bert to profiling cryptocurrency influencers. In CLEF (Working Notes), pages 2568–2573. find
  10. European Parliament and Council of the European Union. Regulation (EU) 2016/679 of the European Parliament and of the Council. find
  11. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations.
  12. Timour Igamberdiev and Ivan Habernal. 2023. Dp-bart for privatized text rewriting under local differential privacy. arXiv preprint arXiv:2302.07636. find
  13. Yansong Li, Zhixing Tan, and Yang Liu. 2023. Privacy-preserving prompt tuning for large language model services. arXiv preprint arXiv:2305.06212. — [arXiv:2305.06212](https://arxiv.org/abs/2305.06212) find
  14. Chin-Yew Lin. 2004. Rouge: A package for automatic evaluation of summaries. In Text summarization branches out, pages 74–81.
  15. Fenglin Liu, Hongjian Zhou, Yining Hua, Omid Rohanian, Lei Clifton, and David Clifton. 2024. Large language models in healthcare: A comprehensive benchmark. medRxiv, pages 2024–04. find
  16. Seth Neel and Peter Chang. 2023. Privacy issues in large language models: A survey. arXiv preprint arXiv:2312.06717.
  17. Shakked Noy and Whitney Zhang. 2023. Experimental evidence on the productivity effects of generative artificial intelligence. Science, 381(6654):187–192. find
  18. Reynier Ortega-Bueno, Berta Chulvi, Francisco Rangel, Paolo Rosso, and Elisabetta Fersini. 2021. Profiling irony and stereotype spreaders on twitter (irostereo). In CLEF 2022 Labs and Workshops, Notebook Papers. find
  19. Ildikó Pilán, Pierre Lison, Lilja Øvrelid, Anthi Papadopoulou, David Sánchez, and Montserrat Batet. 2022. The text anonymization benchmark (tab): A dedicated corpus and evaluation framework for text anonymization. Computational Linguistics, 48(4):1053–1101.
  20. Francisco Rangel, Gretel Liz de la Peña-Sarracén, María Alberta Chulvi-Ferriols, Elisabetta Fersini, and Paolo Rosso. 2021. Profiling hate speech spreaders on twitter task at pan 2021. In Proceedings of the Working Notes of CLEF 2021, Conference and Labs of the Evaluation Forum, Bucharest, Romania,… find
  21. Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. 2023. Beyond memorization: Violating privacy via inference with large language models. arXiv preprint arXiv:2310.07298. — [arXiv:2310.07298](https://arxiv.org/abs/2310.07298) find
  22. Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. 2024. Large language models are advanced anonymizers. arXiv preprint arXiv:2402.13846. — [arXiv:2402.13846](https://arxiv.org/abs/2402.13846) find
  23. Zhongxiang Sun. 2023. A short survey of viewing large language models in legal aspect. arXiv preprint arXiv:2303.09136. find
  24. Latanya Sweeney. 2000. Simple demographics often identify people uniquely. Health (San Francisco), 671(2000):1–34. find
  25. Michael Tschuggnall and Günther Specht. 2014. Enhancing authorship attribution by utilizing syntax tree profiles. In Proceedings of the 14th Conference of the European Chapter of the Association for Computational Linguistics, volume 2: Short Papers, pages 195–199. find
  26. Target Anon Adv ES Privacy (↓) BLEU ROUGE Utility ✗ Inf uncond ✓ 38.1 64.8 67.8 98.4 ✓ Inf uncond ✓ 14.5 74.6 75.2 92.1 14.7 75.7 77.4 93.0 ✓ GT uncond ✓ ✓ GT+Inf uncond ✓ 15.2 74.1 75.0 91.8 13.9 70.6 71.6 92.7 ✓ GT+Inf GT ✓ Benjamin Weggenmann, Valentin Rublack, Michael Andrejczuk, Justus Mattern,… — Finetuned Language Models Are Zero-Shot Learners
  27. Jiacen Xu, Jack W Stokes, Geoff McDonald, Xuesong Bai, David Marshall, Siyue Wang, Adith Swaminathan, and Zhou Li. 2024. Autoattacker: A large language model guided system to implement automatic cyber-attacks. arXiv preprint arXiv:2403.01038. — [arXiv:2403.01038](https://arxiv.org/abs/2403.01038) find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/frikha-2025-incognitext-privacy-enhancing-conditional-text/