{"id":"bbec91d3-ac6f-47b6-b3e5-d8c4580251d0","arxiv_id":"2412.12928","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"INTACT generates abstraction-sorted replacement candidates for sensitive spans and selects the most specific candidate that resists LLM-based inference attacks, achieving a strong privacy-utility trade-off on the Text Anonymization Benchmark.","lead":"This paper introduces INTACT, a method that uses a large language model to rewrite personal details in a text into broader, truthful terms, then only keeps the most specific rewrite that the same model cannot use to guess the original detail. The paper reports that this preserves more useful text than full suppression while raising re-identification risk by less than one percentage point.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The privacy oracle in Section 3.2 is the same 7B model that generates candidates, so the '<1 p.p. over suppression' claim has not been tested against an independent span-inference adversary; the only external metric, TRIR, is a different document-level threat model from the same group.","rationale":"The reader's weakest assumption correctly identifies the most load-bearing point: the privacy guarantee is established only against the model that also generates the candidates. The paper's own limitation statement in Section 6 reinforces this, noting the absence of ex ante guarantees and the need for ex post evaluation. The TRIR metric, while valuable, is a different threat model (document re-identification) and does not validate the span-level inference oracle. I considered whether the discrepancy between the abstract's '<1 p.p.' claim and Table 3 (where Mistral INTACT is 1.6 p.p. above suppression on the test subset) is more serious, but that difference may be attributable to the smaller test set and different background knowledge, and the central trade-off story remains intact. The proposed test directly probes the untested assumption: if an independent attacker guesses accepted replacements, the privacy-utility balance is not as claimed; if not, the concern is resolved. Hence the conditional verdict is appropriate and unchanged.","tokens_in":25830,"tokens_out":6184,"duration_ms":56784,"concrete_test":"Using the released code and the TAB test set, sanitize with INTACT (Mistral-7B) and then run an independent span-inference attack on every accepted replacement, using a larger or differently trained model (e.g., GPT-4o or Llama-3-70B-Instruct) with the same one-shot prompt but 20 guesses instead of 5, and the paper's matching function. If the independent attacker recovers the original span for more than 5% of accepted replacements, the selection oracle is not a sufficient proxy for a realistic adversary and the privacy claim needs re-qualification.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central privacy-utility trade-off rests entirely on the selection step in Section 3.2 (Eq. 2): a replacement is accepted only if Mistral-7B-Instruct, prompted one-shot with p=5 guesses, fails to guess the original span under a lenient lemma/n-gram matching function. This oracle is the same model that generated the candidates, so the method is only guaranteed to resist this specific attacker. The independent check in Section 5.6, TRIR, uses a fine-tuned distilbert in a document-level re-identification threat model; it does not test span-level inference, and the metric itself is authored by the same group. The paper explicitly concedes in Section 6 that INTACT offers no ex ante privacy guarantees. If a stronger adversary (larger LLM, fine-tuned model, or auxiliary knowledge) can guess accepted replacements, the claimed '<1 p.p. increase over suppression' and the resulting k-anonymity interpretation no longer hold. The utility evidence (TPS, NMI, manual truthfulness) is convincing, but the privacy claim is only as strong as the untested oracle.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes INTACT, a two-stage LLM-based text sanitization method. In the first stage, an instruction-tuned LLM (Mistral-7B-Instruct) generates a list of replacement candidates for each PII span, sorted from most specific to most generic. In the second stage, the same LLM is used as an inference attacker: for each candidate, it generates guesses for the original span given the sanitized document, and the most specific candidate that resists all guesses is selected. The paper also introduces TPS, a utility metric that combines information content and semantic similarity, and applies the TRIR privacy metric from previous work. Experiments on the Text Anonymization Benchmark report TPS=88.9, NMI=62.7, and TRIR=8.7 (versus 8.4 for suppression), with a manual evaluation finding 93.2% of INTACT replacements truthful.","tokens_in":26118,"tokens_out":5373,"duration_ms":50221,"significance":"If the claims hold, INTACT is a practical contribution: it requires no fine-tuning, works with open-weights LLMs, and produces truth-preserving generalizations that retain substantially more utility than suppression while maintaining a similar re-identification risk. The TPS metric is a useful addition to the text-sanitization evaluation toolbox, and the manual truthfulness evaluation gives credible evidence for the utility side. However, the central privacy-utility trade-off is only as strong as the adversary used at selection time, and the paper's privacy claims rely on a self-oracle and on a privacy metric without uncertainty quantification.","major_comments":[{"comment":"The privacy oracle in Eq. (2) is the same Mistral-7B-Instruct model that generates the candidates, so a replacement is accepted only if this specific model fails to guess the original span. The abstract and Section 6 claim a \"<1 p.p.\" increase in re-identification risk over suppression, but that claim is supported only by TRIR (Section 5.6), a document-level re-identification attack using fine-tuned distilbert, which is a different threat model and is also authored by the same group. The paper does not test accepted replacements against an independent span-inference adversary, such as a larger LLM, a fine-tuned model, or a model with additional background knowledge. Without such a test, the privacy guarantee is only established against the selecting model itself, and the claimed trade-off may not generalize to a stronger adversary.","section":"Section 3.2, Eq. (2)"},{"comment":"The description of the inference attack is ambiguous and potentially inconsistent. In Algorithm 1, D' is initialized with all spans replaced by their most specific candidate c_i,1, and it is updated only after c*_i is selected for each span. During the inner loop over j, the document passed to Eq. (2) therefore contains c_i,1 for the current span, not the candidate c_i,j being tested. If this is indeed the case, the attack is not actually evaluating whether c_i,j reveals the original span, and the selection procedure would not work as described. The prompt in Figure 3 should make explicit that the bracketed span in the attacked text is replaced by c_i,j; otherwise the method is not reproducible and the reported selection behavior is unexplained.","section":"Section 3.2 and Algorithm 1"},{"comment":"TRIR results are reported as point estimates without confidence intervals, significance tests, or multiple runs. The key comparison between INTACT (8.7) and suppression (8.4) is a difference of 0.3 percentage points, which is well within likely sampling noise for a corpus of 1,268 documents, and the background knowledge is a single random superset of TAB (2,536 documents). The claim of \"only a marginal (<1 p.p.) increase in re-identification risk\" should be supported by uncertainty quantification or by repeated draws of the background-knowledge subset; as presented, the evidence for this specific magnitude is weak.","section":"Section 5.6, Figure 7"}],"minor_comments":[{"comment":"Section 5.1 states that experiments are run on the full TAB corpus (1,268 documents), while Section 5.4 describes the test set as 127 documents with over 7,300 entity mentions; the paper should clarify which subset underlies the main results in Figures 4-7 and how the full-corpus claim is reconciled with the test-set description.","section":"Section 5.1 and Section 5.4"},{"comment":"The manual evaluation reports 93.2% truthfulness for INTACT, but the inter-rater reliability (Cohen's κ) was computed on 148 instances sampled across three methods, not on the full 600 instances; the text should state this distinction so that the κ values are not interpreted as applying to the full evaluation.","section":"Section 5.7, Table 2"},{"comment":"The choice of N=6 for the mask spacing in the TPS information-content computation is justified by runtime, but no sensitivity analysis is given; a small ablation over N would strengthen the metric's credibility.","section":"Section 4.1.1"},{"comment":"In the paragraph following Eq. (2), the boolean function appears as \"risky replace\" rather than a properly typeset identifier; this is a minor formatting issue but should be corrected for readability.","section":"Section 3.2"}],"recommendation":"major_revision","confidential_remarks":"The evaluation relies substantially on resources produced by the same research group: the TAB benchmark (Pilán et al., 2022), the TRIR metric (Manzanares-Salor et al., 2024), and the code provided with the paper. This is not by itself a reason to reject, but it strengthens the need for an independent span-inference adversary test as part of the revision. The editor should also be aware that the central privacy claim depends on a self-oracle, and that the reported TRIR differences are small without error bars."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should read this one. INTACT is a two-stage method: it prompts an instruction-tuned LLM to generate generalization candidates sorted from most to least specific, then runs LLM-based inference attacks on each candidate and picks the most specific one the LLM cannot guess back. The utility evidence is genuinely good: TPS 88.9, NMI 62.7 on TAB, and 93.2% of replacements rated truthful in a manual evaluation with reasonable inter-rater agreement. It beats Presidio and Dou et al. on the utility/truthfulness axes, and the code and data are public. The two-stage design with attack-based selection is new among LLM sanitizers, and the TPS metric is a useful, cheap proxy that correlates with downstream clustering performance (r=0.864). That part of the paper is solid.\n\nThe soft spot is exactly what the stress-test flags. The selection oracle in Eq. 2 is the same Mistral-7B model that generated the candidates, so a replacement is only guaranteed to resist that specific attacker. The TRIR check in Section 5.6 is an independent model (fine-tuned distilbert) but it is a document-level re-identification metric, not a span-level inference attack, and the metric itself comes from the same group. The 0.3 p.p. difference over suppression is on one configuration with no error bars or sensitivity analysis. The paper honestly concedes there are no ex ante privacy guarantees, and that is the right frame, but the headline claim that the approach adds less than 1 p.p. re-identification risk over suppression is only as strong as the untested oracle assumption. I would want to see an independent adversary (a larger LLM, a fine-tuned span-inference model, or the infilling attacker they cite) used at selection time, or at least a TRIR variant with a stronger attacker.\n\nMinor issues: the matching function is lenient (lemma overlap, 4-grams), which may undercount successful guesses; several free parameters (number of candidates, guesses, temperature, mask spacing) are chosen without sensitivity analysis; and the evaluation is single-domain, single-language, legal English. The computational cost of inference attacks is also considerable, but that is practical rather than fatal.\n\nNet: the central utility claim holds up, and the privacy claim is clearly scoped but needs an independent adversarial check before I would rely on it. This paper deserves a serious referee. I would send it out with a request for that robustness experiment and error bars on TRIR.","headline":"A practical, novel two-stage LLM sanitizer with convincing utility and truthfulness results, but the privacy claim rests on a single threat model and a selection oracle that is the same model that generates the candidates.","tokens_in":26665,"tokens_out":2605,"would_cite":true,"duration_ms":26431,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that replacing sensitive text spans with the most specific generalization an LLM adversary cannot guess back achieves near-suppression privacy with substantially higher utility, and supports this with results on a…","keywords":["text sanitization","data privacy","inference attacks","truth-preserving replacements","large language models","generalization","Text Anonymization Benchmark","privacy-utility trade-off"],"falsifier":"Run an independent re-identification attack, such as a fine-tuned classifier or a retrieval-augmented infiller with a different architecture and more training data, against INTACT's sanitized documents and compare its success rate with the suppression baseline. If the independent attacker recovers original spans from accepted replacements at a rate more than about one percentage point above the suppression baseline, the paper's central privacy-utility claim would not hold.","tokens_in":25646,"feed_emoji":"🕵️","tokens_out":6552,"duration_ms":58646,"temperature":0.7,"pith_summary":"Text sanitization usually removes sensitive spans entirely or swaps in generic labels, which shreds the document's meaning. This paper argues for a middle path: replace each sensitive span with a broader but still true term, a generalization, chosen so that a large language model asked to guess the original span from the surrounding text cannot recover it. The proposed two-stage method, INTACT, first asks an instruction-tuned LLM to generate and rank replacement candidates from most to least specific, then runs one-shot inference attacks to test each candidate and picks the most specific one that resists those attacks. On a benchmark of court-case documents, the authors report that this approach preserves far more of the original content than suppression while increasing re-identification risk by less than one percentage point, and that 93% of its replacements are rated truthful by human evaluators. The paper also introduces a no-annotation utility metric, Text Preserved Similarity, that weights each span's semantic similarity by its information content.","feed_headline":"Truthful edits hide personal data with <1% extra re-ID risk","feed_subtitle":"A two-stage LLM sanitizer picks the most specific replacement that an inference attack cannot trace back to the original span.","key_machinery":"The load-bearing mechanism is the pairing of abstraction-sorted candidate generation with an inference-attack selection oracle. The same instruction-tuned LLM both proposes generalizations and plays adversary: given the candidate replacement plus the full edited document, it must produce five guesses for the original span, and the matching function decides whether any guess counts as a hit. Utility is measured by Text Preserved Similarity, which weights cosine similarity between original and replacement embeddings by the span's information content computed with a masked language model.","core_discovery":"The central claim is that privacy-preserving text sanitization can be reduced to a search over abstraction levels: for each detected personally identifiable information (PII) span, the safest useful edit is the most specific hypernym-like generalization from which an inference attacker cannot reconstruct the original. The method implements this by generating a candidate list sorted from most to least specific, then iterating through the list with an LLM-based inference attack that produces five guesses for the original span and a matching function based on lemma overlap and n-gram overlap for named entities. A candidate is rejected if any guess matches; if all candidates fail, the span falls back to its entity-type label. The authors report on the Text Anonymization Benchmark that this selection yields a Text Preserved Similarity of 88.9% versus 78.1% for suppression, the highest clustering-based utility (Normalized Mutual Information of 62.7) among compared methods, and a Text Re-identification Risk of 8.7% versus 8.4% for suppression. A manual evaluation finds 93.2% of INTACT replacements truthful, against 19.7% for the synthetic-replacement baseline.","pith_inferences":["The privacy guarantee is adversary-relative by construction: as language models become stronger attackers, replacements accepted today may become guessable, so the method should be re-run with the strongest available attacker before release.","The selection oracle could be turned into an iterative loop, feeding accepted replacements back into the attacker to catch document-level correlations across multiple spans rather than judging each span independently.","Text Preserved Similarity's term-level cosine similarity will miss context-dependent meaning changes, and a sentence- or passage-level similarity variant is the natural next test.","Because the same model family generates candidates and performs the attack, an independent attacker with a different architecture and more training data would provide the cleanest check on whether the reported sub-one-percentage-point risk gap actually holds."],"forward_implications":["Sanitized documents can retain enough meaning for downstream analyses such as document clustering to mirror results on the originals, unlike redacted text.","Re-identification risk stays within about one percentage point of full suppression, so organizations can release richer versions of sensitive documents under a similar threat model.","The method needs no fine-tuning and no cloud transfer of the sensitive text, because a compact open-weights model can perform both generation and attack locally.","Because replacements are generalizations rather than fabrications, downstream readers are less likely to be misled by false facts such as wrong nationalities or dates.","The selection rule can be tuned by strengthening the attack (more guesses or a stronger model), which shifts the privacy-utility trade-off in a controlled way."],"supporting_citations":[{"why":"Supplies the Text Anonymization Benchmark corpus and annotation guidelines used for all experiments.","marker":"[46]"},{"why":"The prior truthful-abstraction method that serves as the main comparison baseline for replacement quality and privacy.","marker":"[18]"},{"why":"The synthetic-replacement baseline that the paper compares against to show the value of truth-preserving generalizations.","marker":"[39]"},{"why":"Introduces the Text Re-identification Risk metric used to measure residual privacy risk.","marker":"[38]"},{"why":"Provides evidence that autoregressive infilling models can re-identify de-identified documents, motivating the use of LLMs as adversaries.","marker":"[12]"},{"why":"Frames the text anonymization task and the detection assumptions that the method takes as given.","marker":"[36]"}],"fun_headline_variants":["LLM-driven sanitization finds safest detail level for PII spans","Inference attacks guide text editing to balance privacy and utility","Truthful replacements via abstraction ranking and attack simulation","Sanitize with LLM: 88.9% utility, 8.7% re-ID risk","PII safe edits: pick most specific hypernym attackers can't crack"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"A replacement is considered safe only when one particular 7-billion-parameter instruction-tuned LLM fails to guess the original span, so the method's privacy guarantee is only as strong as that model's attacking ability; the paper does not test a stronger independent adversary during selection.","fun_headline_variants_meta":{"raw":{"variants":["LLM-driven sanitization finds safest detail level for PII spans","Inference attacks guide text editing to balance privacy and utility","Truthful replacements via abstraction ranking and attack simulation","Sanitize with LLM: 88.9% utility, 8.7% re-ID risk","PII safe edits: pick most specific hypernym attackers can't crack"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000263,"raw_usage":{"total_tokens":1655,"prompt_tokens":1054,"completion_tokens":601,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":670,"completion_tokens_details":{"reasoning_tokens":506}},"tokens_in":670,"tokens_out":601,"duration_ms":5792,"temperature":1.0,"reasoning_tokens":506,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T13:34:42.536735+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an independent re-identification attack, such as a fine-tuned classifier or a retrieval-augmented infiller with a different architecture and more training data, against INTACT's sanitized documents and compare its success rate with the suppression baseline. If the independent attacker recovers original spans from accepted replacements at a rate more than about one percentage point above the suppression baseline, the paper's central privacy-utility claim would not hold.","supporting_citations":[{"cited_title":"The text anonymization benchmark (tab): A dedicated cor- pus and evaluation framework for text anonymization","cited_arxiv_id":null,"evidence_quote":"Supplies the Text Anonymization Benchmark corpus and annotation guidelines used for all experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The prior truthful-abstraction method that serves as the main comparison baseline for replacement quality and privacy."},{"cited_title":"Automated anonymization of text documents, in: IEEE Congress on Evolutionary Computation, IEEE, Vancouver, BC, Canada","cited_arxiv_id":null,"evidence_quote":"The synthetic-replacement baseline that the paper compares against to show the value of truth-preserving generalizations."},{"cited_title":"Evaluating the dis- closure risk of anonymized documents via a machine learning-based re- identification attack","cited_arxiv_id":null,"evidence_quote":"Introduces the Text Re-identification Risk metric used to measure residual privacy risk."},{"cited_title":"Re-identification of De-identified Documents with Autoregressive Infilling, in: The 63rd Annual Meeting of the Association for Computational Linguistics, p","cited_arxiv_id":null,"evidence_quote":"Provides evidence that autoregressive infilling models can re-identify de-identified documents, motivating the use of LLMs as adversaries."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Frames the text anonymization task and the detection assumptions that the method takes as given."}],"review_version":1}