Elamur Research⌕
☰
home / papers / 2026 / STAMP-R: Stylometric Text Anonymization with Memory-guided Policy Rewriting

STAMP-R: Stylometric Text Anonymization with Memory-guided Policy Rewriting

Paper · 2026 · Zhan Shi, Yefeng Yuan, Liang Cheng et al.

Summary

Removing names and other explicit identifiers does not prevent authorship attribution, because writing style alone can reveal who wrote a text. STAMP-R treats anonymization as a population-aware problem handled per instance. A rewrite counts as safe when it lands in a densely populated part of the style space, not merely when it drifts away from the source. The core component is the Style Manifold Memory (SMM), a prototype-based density model over style embeddings. It flags stylometric outliers, assigns each input a risk score, and supplies prototype targets that steer rewrites toward common styles. The risk score scales a composite reward that combines attacker entropy, geometric guidance, named-entity suppression and semantic fidelity. Training has two stages: a teacher LLM first produces a rewriting corpus, then a quantized Llama-3.2-3B-Instruct student is fine-tuned and further optimized with GRPO. On Yelp, Twitter and IMDb, STAMP-R reaches the lowest or near-lowest attacker macro-F1 and the best sentiment utility among generative methods. This makes inexpensive local anonymization feasible and especially protects highly distinctive writers.

Key points

  • Setup: The rewriter is Llama-3.2-3B-Instruct (4-bit, LoRA) trained with GRPO. SMM uses AnnaWegmann/Style-Embedding, while the attacker and utility classifiers are separate bert-base-cased models, which avoids metric coupling. Baselines are Presidio, StyleMix, DIPPER, DP-MLM and TAROT.
  • Main results: Attacker macro-F1 is 0.2917 on Yelp, 0.3107 on Twitter and 0.3519 on IMDb. On IMDb, TAROT-DPO is slightly better at 0.3474 but its utility drops to 0.5714. Sentiment macro-F1 reaches 0.8085 (Yelp), 0.8137 (Twitter) and 0.8192 (IMDb).
  • Ablation on Yelp: Privacy-F1 falls from 0.7450 to 0.2917 and utility rises from 0.7321 to 0.8085 as SFT, RL, SMM guidance and risk-adaptive weighting are added step by step.
  • Outliers: Outlier author F1 drops to 0.000, compared with 0.867 for DP-MLM. The correlation between SMM risk and re-identification falls from ρ = 0.69 to ρ = −0.06 after rewriting.
  • Efficiency and robustness: The model takes 2.23 s per sample, about twice as fast as DIPPER (4.50 s) and close to the GPT-4o API (2.07 s). It reaches 90% of the entropy reward in 122 steps versus 185 for the entropy-only baseline. Under stronger, adaptive attackers it still has the lowest F1, rising by only +0.076 compared with +0.101 for StyleMix.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🏢eBaySan Jose · United States2 works

Also on the byline: Santa Clara University.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

Cite

Cite as Zhan Shi, Yefeng Yuan, Liang Cheng and Yuhong Liu. 2026. STAMP-R: Stylometric Text Anonymization with Memory-guided Policy Rewriting. Proceedings of the Seventh Workshop on Privacy in Natural Language Processing.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.privatenlp-main.4

@inproceedings{shi2026stamp,
  title = {{STAMP-R: Stylometric Text Anonymization with Memory-guided Policy Rewriting}},
  author = {Zhan Shi, Yefeng Yuan, Liang Cheng and Yuhong Liu},
  booktitle = {Proceedings of the Seventh Workshop on Privacy in Natural Language Processing},
  year = {2026},
  doi = {10.18653/v1/2026.privatenlp-main.4},
  url = {https://doi.org/10.18653/v1/2026.privatenlp-main.4}
}

References

26 references, 5 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Kalpesh Krishna, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. Dipper: Paraphrasing for differential privacy. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (ACL). find
  2. Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318. find
  3. Jenny Chim, Julia Ive, and Maria Liakata. 2025. Evaluating synthetic data generation from user generated text. Computational Linguistics, 51(1):191–233. find
  4. Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2024. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. In Advances in Neural Information Processing Systems (NeurIPS), volume 36.
  5. Chun Jie Chong, Chenxi Hou, Zhihao Yao, and Seyed Mohammadjavad Seyed Talebi. 2025. Casper: Prompt sanitization for protecting user privacy in web-based large language models. In 2025 IEEE 12th International Conference on Cyber Security and Cloud Computing (CSCloud), pages 122–133. IEEE. find
  6. Gabriel Loiseau, Damien Sileo, Damien Riquet, Maxime Meyer, and Marc Tommasi. 2025. Tarot: Task-oriented authorship obfuscation using policy optimization methods. In Proceedings of the Sixth Workshop on Privacy in Natural Language Processing, pages 14–31. find
  7. Tobias Deußer, Lorenz Sparrenberg, Armin Berger, Max Hahnbück, Christian Bauckhage, and Rafet Sifa. 2025. A survey on current trends and recent advances in text anonymization. In 2025 IEEE 12th International Conference on Data Science and Advanced Analytics (DSAA), pages 1–9. IEEE. find
  8. Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. 2023. Analyzing leakage of personally identifiable information in language models. In 2023 IEEE Symposium on Security and Privacy (SP), pages 346–363. IEEE.
  9. Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography Conference (TCC). find
  10. Stephen Meisenbacher, Maulik Chevli, Juraj Vladika, and Florian Matthes. 2024. Dp-mlm: Differentially private text rewriting using masked language models. Preprint, arXiv:2407.00637. find
  11. Jillian Fisher, Skyler Hallinan, Ximing Lu, Mitchell L Gordon, Zaid Harchaoui, and Yejin Choi. 2024. StyleRemix: Interpretable authorship obfuscation via distillation and perturbation of style elements. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages…
  12. Microsoft. 2019. Presidio: Data protection and de-identification sdk. find
  13. Michele Miranda, Elena Sofia Ruzzetti, Andrea Santilli, Fabio Massimo Zanzotto, Sébastien Bratières, and Emanuele Rodolà. 2024. Preserving privacy in large language models: A survey on current threats and solutions. arXiv preprint arXiv:2408.05212. — [arXiv:2408.05212](https://arxiv.org/abs/2408.05212) find
  14. James Flemings, Meisam Razaviyayn, and Murali Annavaram. 2024. Differentially private next-token prediction of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Pape… find
  15. Bo Peng, Xinyi Ling, Ziru Chen, Huan Sun, and Xia Ning. 2024. ecellm: Generalizing large language models for e-commerce from large-scale, high-quality instruction data. arXiv preprint arXiv:2402.08831. — [arXiv:2402.08831](https://arxiv.org/abs/2402.08831) find
  16. Nudrat Habib, Tosin Adewumi, Marcus Liwicki, and Elisa Barney. 2025. Trends and challenges in authorship analysis: A review of ml, dl, and llm approaches. arXiv preprint arXiv:2505.15422. — [arXiv:2505.15422](https://arxiv.org/abs/2505.15422) find
  17. Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Y Wu, and 1 others. 2024. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300.
  18. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, and 1 others. 2022. Lora: Low-rank adaptation of large language models. ICLR, 1(2):3.
  19. Zhan Shi, Yefeng Yuan, Liang Cheng, and Yuhong Liu. 2025. Reinforcement learning-guided large language model fine-tuning for privacy-preserving text rewriting. In Proceedings of the Tenth ACM/IEEE Symposium on Edge Computing, pages 1–7. find
  20. Baixiang Huang, Canyu Chen, and Kai Shu. 2025. Authorship attribution in the era of llms: Problems, methodologies, and challenges. ACM SIGKDD Explorations Newsletter, 26(2):21–43. find
  21. Latanya Sweeney. 2002. k-anonymity: A model for protecting privacy. International journal of uncertainty, fuzziness and knowledge-based systems, 10(05):557– 570. find
  22. Kyuyoung Kim, Hyunjun Jeon, and Jinwoo Shin. 2025. Self-refining language model anonymizers via adversarial distillation. arXiv preprint arXiv:2506.01420. find
  23. Rui Xin, Niloofar Mireshghallah, Shuyue Stella Li, Michael Duan, Hyunwoo Kim, Yejin Choi, Yulia Tsvetkov, Sewoong Oh, and Pang Wei Koh. 2025. A false sense of privacy: Evaluating textual data sanitization beyond surface-level privacy leakage. arXiv preprint arXiv:2504.21035. — [arXiv:2504.21035](https://arxiv.org/abs/2504.21035) find
  24. Eric Xing, Saranya Venkatraman, Thai Le, and Dongwon Lee. 2024. Alison: Fast and effective stylometric authorship obfuscation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 19315–19322. find
  25. Tianyu Yang, Xiaodan Zhu, and Iryna Gurevych. 2025. Robust utility-preserving text anonymization based on large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 28922– 28941. find
  26. Hanna Yukhymenko, Robin Staab, Mark Vero, and Martin Vechev. 2024. A synthetic dataset for personal attribute inference. Advances in Neural Information Processing Systems, 37:120735–120779. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/shi-2026-stamp-r-stylometric-text-anonymization/