Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Not every sensitive word in a private document needs the same treatment: selective anonymization can protect privacy without wrecking RAG retrieval and answers.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-13 17:47 UTC pith:U5D6HC2V

load-bearing objection Solid selective-anonymization pipeline for RAG KBs with real multi-model gains; privacy claim is empirical and rests on a small surrogate plus LLM-chosen thresholds. the 4 major comments →

arxiv 2603.26074 v3 pith:U5D6HC2V submitted 2026-03-27 cs.CR

Not All Entities are Created Equal: A Dynamic Anonymization Framework for Privacy-Preserving RAG

Xinyuan Zhu , Zekun Fei , Enye Wang , Ruiqi He , Jia Guo , Ruijie Wang , Zheli Liu , Qingkai Zeng This is my paper
classification cs.CR
keywords privacy-preserving RAGentity anonymizationmarginal privacy riskknowledge divergencetopical relevanceretrieval-augmented generationcontext-aware anonymization
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Private knowledge bases used by Retrieval-Augmented Generation (RAG) systems often contain names, ages, diagnoses, and other personal details. The usual fix is to blank or scramble every sensitive entity, which protects privacy but also destroys the cues that retrieval and answer generation need. This paper argues that privacy leakage is contextual, not a simple sum of isolated entities, so only a carefully chosen subset of entities must be generalized. TRIP-RAG scores each entity by how much it reduces document-level privacy risk when masked, how much it shifts the document's embedding, and how tightly it matches the document topic, then anonymizes only the high-priority ones. On healthcare dialogues and workplace email questions, the method keeps privacy leakage rates comparable to full anonymization while cutting far less retrieval performance and improving generation metrics by large margins over rewrite and noise baselines.

Core claim

Uniform anonymization of every detected sensitive entity is unnecessary for privacy-preserving RAG. By ranking entities with a three-factor score (marginal privacy risk after local masking, knowledge divergence in embedding space, and topical relevance) and generalizing only those above a data-driven threshold, TRIP-RAG can keep residual contextual reconstruction risk low while retaining most of the retrieval and generation utility of the original corpus.

What carries the argument

The entity priority score Ψ(e) = α S_priv(e) − β S_retr(e) − γ S_knw(e), where S_priv is the drop in a language-model privacy surrogate when the entity is masked, S_knw is the cosine shift of the document embedding, and S_retr is the negative L2 distance of the entity embedding to the document; entities with Ψ above a threshold τ are generalized.

Load-bearing premise

A privacy-scoring language model trained on only about two hundred GDPR-style annotations, plus a single-turn LLM dialogue that sets the anonymization threshold, correctly ranks which entities actually drive residual privacy risk for every document.

What would settle it

On held-out private RAG corpora, replace the surrogate-and-LLM ranking with full anonymization of every detected entity (or with random entity subsets of the same size) and check whether TRIP-RAG still matches full anonymization on extraction-attack leakage while keeping Recall@k drops under 35 percent and generation gains near the reported 56 percent; if the selective method loses either the privacy match or the utility edge, the central claim fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes TRIP-RAG, a context-aware entity anonymization framework for privacy-preserving RAG knowledge bases. Instead of uniformly masking all detected sensitive entities, it scores each entity by marginal privacy risk (via a language-model surrogate), knowledge divergence (embedding cosine shift after masking), and topical relevance (entity–document L2 proximity), then anonymizes entities whose priority score Ψ exceeds a dataset-adaptive threshold τ. The authors formalize utility-aware privacy protection as a constrained combinatorial optimization problem (Eq. 2), argue NP-hardness, and give a game-based semantic-security argument for the generalization map once entities are selected. Empirically, on ChatDoctor and EnronQA with multiple embedders, TRIP-RAG reports privacy extraction rates comparable to full anonymization/LPRAG while retaining substantially higher Recall@k (drops under ~35% vs. original) and generation quality (BLEU/ROUGE-L gains up to ~56% over baselines), with ablations and hyperparameter sweeps supporting the three-score design.

Significance. If the privacy–utility frontier holds under stronger validation, the work is a useful corrective to one-size-fits-all entity anonymization in RAG: selective, context-dependent protection is practically important for healthcare and enterprise deployments where full redaction destroys retrieval. Strengths include multi-dataset/multi-embedding evaluation (Table 1), a privacy extraction comparison (Table 3), dimensional ablations (Fig. 3), hyperparameter sensitivity (Fig. 4), a concrete case study (Table 2), low feature-overlap analysis (Appendix B), and an explicit game-based indistinguishability argument for generalized entities (Appendix E). The problem formulation (Defs. 3.1–3.2) and the three-axis scoring idea are clear contributions even if the formal privacy guarantee remains partial.

major comments (4)
  1. [§3.1–3.2, Eq. (2), Table 3] §3.1–3.2 and Eq. (2): The central claim requires that the selected subset G_T drives residual contextual reconstruction risk R(T') ≤ ε for each document. The paper never measures or bounds R(T') document-wise; privacy is reported only as aggregate extraction-attack success (Table 3). Without a per-document check that the privacy constraint is met—or a clear operational definition of ε—the reported utility gains could partly reflect under-anonymization rather than a true frontier.
  2. [§4.1.2, Eq. (6), Appendix E] §4.1.2 and Appendix E: The game-based proof shows Adv_sem ≈ 0 for entities already mapped into the same generalization class. It does not establish that ranking by Ψ(e)=α S_priv − β S_retr − γ S_knw (Eq. 6) identifies a sufficient set to break contextual inference paths. The security argument therefore covers the replacement map, not the selection mechanism that is the paper’s main novelty. Either extend the analysis to selection correctness or clearly restate the claim as empirical privacy reduction under a specific attack.
  3. [§4.1.1, Appendix C–D, Fig. 4] §4.1.1, Appendix C, RQ3: Marginal privacy risk S_priv relies on a DeBERTa surrogate trained on ~200 GDPR-style annotations, with Spearman correlation reported on held-out snippets from the same pool (≈0.91). Threshold τ is then set from a single-turn LLM dialogue on a small sample set (Appendix D). Both steps are load-bearing for G_T. Please report (i) out-of-domain or cross-dataset transfer of f_priv, (ii) sensitivity of Table 1/3 to τ and to surrogate training size below 128, and (iii) inter-annotator agreement for the human labels used to calibrate f_priv.
  4. [§5.1–5.2, Tables 1 and 3] §5.1–5.2, Tables 1 and 3: All headline percentages (Recall@k drop <35%, generation gains up to 56%, leakage reductions of 26%/48%) are point estimates without error bars, confidence intervals, or significance tests across queries or seeds. Given that τ and (α,β,γ) are chosen on the same corpora, statistical uncertainty is needed to support “comparable privacy, substantially better utility” as a stable claim rather than a single-run observation.
minor comments (6)
  1. [Figure 1] Figure 1 contains typos (“knowleadge”, duplicated “Our Vanilla Design”) and is hard to parse; a cleaner pipeline diagram would help.
  2. [§4.1.1] Notation for the encoder is inconsistent: Φ, ℰ, and Embedding model appear for related maps in §4.1.1; unify symbols.
  3. [§5.1.2, §5.5] Default weights are stated as α=1, β=0.5, γ=0.4, then best γ/β=0.8 is adopted; briefly reconcile how the final defaults map to the sweep in Fig. 4.
  4. [§5.1.2, Appendix F] LPRAG privacy budget ε=5.0 is only in Appendix F; state it in the main experimental setup for reproducibility.
  5. [§7] Limitation §7 notes GLiNER misses some entities; quantify miss rate on a sample and discuss impact on privacy (missed entities remain exposed).
  6. [Throughout] Several small grammar/typo issues (e.g., “Utility-A ware”, “context-A ware” spacing; “knowleadge”) should be cleaned in revision.

Circularity Check

0 steps flagged

No significant circularity: heuristic scoring + empirical metrics; security of generalization holds by construction of the mapping, not as a fitted or self-referential prediction.

full rationale

TRIP-RAG is an engineering pipeline that extracts entities, scores them with three context-aware quantities (marginal privacy risk via a DeBERTa surrogate, knowledge divergence, topical relevance), forms a linear priority Ψ(e), and thresholds at a data-driven τ to decide which entities to generalize. The headline privacy-utility numbers (Recall@k drop <35 %, generation quality up to +56 %, extraction-attack rates in Table 3) are obtained by running the full RAG pipeline on the anonymized corpora and measuring standard IR/NLG/attack metrics on held-out queries; they are not algebraic rearrangements of the fitted scores or of the 200-snippet calibration set. The sole theoretical claim (Sec. 4.2.1 + App. E) is that, once an entity has been replaced by its coarse class label, an attacker’s distinguishing advantage between any two pre-images is zero. That statement follows immediately from the definition of the non-injective generalization map Γ and is proved by a standard game hop that simply observes the output distribution is independent of the original entity; it is therefore true by construction for any such map and does not constitute a circular derivation of a non-trivial prediction. Hyper-parameters α/β/γ and the numerical thresholds τ are chosen on small samples (as is routine for systems papers) but are not subsequently re-presented as first-principles forecasts of the same quantities. No uniqueness theorem, ansatz, or load-bearing result is imported via self-citation. Consequently the paper contains no circular steps of the kinds enumerated by the analyzer.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 4 invented entities

The central claim rests on three hand-crafted scores, two dataset-specific thresholds, a small human-annotated privacy surrogate, and the modeling assumption that residual contextual risk can be driven below ε by masking only high-Ψ entities. These are free parameters and domain assumptions rather than derived quantities.

free parameters (3)
  • α, β, γ (priority-score weights)
    Set by hand to 1 / 0.5 / 0.4 after a grid search that maximises average BLEU; the ratio γ/β = 0.8 is chosen on the same data used for evaluation.
  • anonymization thresholds τ
    Empirically fixed at 0.0526 (ChatDoctor) and 0.2675 (EnronQA) from LLM-extracted critical subsets on a few samples; directly controls which entities enter 𝒢_T.
  • privacy-surrogate training size
    200 randomly sampled, human-annotated snippets used to train f_priv; Spearman correlation with humans is reported only for this size.
axioms (3)
  • domain assumption Privacy leakage of free-text is contextual and can be reduced below a threshold ε by generalising only a proper subset of extractable entities.
    Stated in Definitions 3.1–3.2 and used throughout the optimisation formulation; not proved for arbitrary attackers.
  • ad hoc to paper A language-model surrogate f_priv trained on ~200 GDPR-style annotations approximates true residual reconstruction risk.
    Section 4.1.1 and Appendix C; the entire marginal-privacy-risk axis rests on this surrogate.
  • domain assumption The generalisation map Γ has sufficiently large pre-images that an attacker’s distinguishing advantage is negligible.
    Appendix E game-based proof; required for the semantic-security claim.
invented entities (4)
  • Marginal Privacy Risk S_priv no independent evidence
    purpose: Quantifies the drop in document-level privacy score after masking a single entity.
    Defined by Eq. (3); no independent external validation beyond the authors’ own human correlation study.
  • Knowledge Divergence S_knw no independent evidence
    purpose: Measures cosine shift of the document embedding after entity masking.
    Eq. (4); introduced to penalise utility loss.
  • Topical Relevance S_retr no independent evidence
    purpose: Measures L2 distance of entity embedding to document embedding as a proxy for retrieval importance.
    Eq. (5); invented for the RAG-specific utility term.
  • Priority score Ψ and TRIP-RAG pipeline no independent evidence
    purpose: Combines the three scores and applies a thresholded greedy anonymisation.
    Eq. (6)–(7); the core algorithmic contribution of the paper.

pith-pipeline@v1.1.0-grok45 · 23001 in / 2845 out tokens · 38381 ms · 2026-07-13T17:47:29.420629+00:00 · methodology

0 comments
read the original abstract

Retrieval-Augmented Generation (RAG) enhances the utility of Large Language Models (LLMs) by retrieving external documents. Since the knowledge databases in RAG are predominantly utilized via cloud services, private data in sensitive domains such as finance and healthcare faces the risk of personal information leakage. Thus, effectively anonymizing knowledge bases is crucial for privacy preservation. Existing studies equate the privacy risk of text to the linear superposition of the privacy risks of individual, isolated sensitive entities. The "one-size-fits-all" full processing of all sensitive entities severely degrades utility of LLM. To address this issue, we introduce a dynamic anonymization framework named TRIP-RAG. Based on context-aware entity quantification, this framework evaluates entities from the perspectives of marginal privacy risk, knowledge divergence, and topical relevance. It identifies highly sensitive entities while trading off utility, providing a feasible approach for variable-intensity privacy protection scenarios. Our theoretical analysis and experiments indicate that TRIP-RAG can effectively reduce context inference risks. Extensive experimental results demonstrate that, while maintaining privacy protection comparable to full anonymization, TRIP-RAG's Recall@k decreases by less than 35% compared to the original data, and the generation quality improves by up to 56% over existing baselines.

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. FORT-Searcher: Synthesizing Shortcut-Resistant Search Tasks for Training Deep Search Agents

    cs.CL 2026-06 unverdicted novelty 7.0

    FORT synthesizes shortcut-resistant search tasks by controlling four identified shortcut risks across entity selection, graph construction, question formulation, and refinement, producing training data that yields age...

Reference graph

Works this paper leans on

46 extracted references · 10 linked inside Pith · cited by 1 Pith paper

  1. [1]

    Alan Akbik, Duncan Blythe, and Roland Vollgraf. 2018. Contextual string embed- dings for sequence labeling. In Proceedings of the 27th international conference on computational linguistics. 1638–1649

    2018

  2. [2]

    Harrison Chase. 2022. LangChain. https://github.com/hwchase17/langchain

    2022

  3. [3]

    Jiawei Chen, Hongyu Lin, Xianpei Han, and Le Sun. 2024. Benchmarking large language models in retrieval-augmented generation. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 17754–17762

    2024

  4. [4]

    Zhe Chen, Yusheng Liao, Shuyang Jiang, Pingjie Wang, Yiqiu Guo, Yanfeng Wang, and Yu Wang. 2025. Towards omni-rag: Comprehensive retrieval- augmented generation for large language models in medical applications. In Proceedings of the 63rd Annual Meeting of the Association for Computational Lin- guistics (Volume 1: Long Papers) . 15285–15309

    2025

  5. [5]

    Rangan Das, K Maheswari, Shaheen Siddiqui, Nikita Arora, Ankush Paul, Jeet Nanshi, Varun Udbalkar, Apoorva Sarvade, Harsha Chaturvedi, Tammy Shvarts- man, et al. 2024. Improved precision oncology question-answering using agentic LLM. Medrxiv (2024), 2024–09

    2024

  6. [6]

    Franck Dernoncourt, Ji Young Lee, Ozlem Uzuner, and Peter Szolovits. 2017. De- identification of patient notes with recurrent neural networks. Journal of the American Medical Informatics Association 24, 3 (2017), 596–606

    2017

  7. [7]

    Tobias Deußer, Lorenz Sparrenberg, Armin Berger, Max Hahnbück, Christian Bauckhage, and Rafet Sifa. 2025. A survey on current trends and recent advances in text anonymization. In 2025 IEEE 12th International Conference on Data Science and Advanced Analytics (DSAA). IEEE, 1–9

    2025

  8. [8]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers). 4171–4186

    2019

  9. [9]

    Colin Doyle and Aaron D Tucker. 2025. If you give an LLM a legal practice guide. In Proceedings of the 2025 Symposium on Computer Science and Law . 194–205

    2025

  10. [10]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Cali- brating noise to sensitivity in private data analysis. In Theory of cryptography conference. Springer, 265–284

    2006

  11. [11]

    Cynthia Dwork and Aaron Roth. 2014. The algorithmic foundations of differen- tial privacy. Foundations and trends® in theoretical computer science 9, 3-4 (2014), 211–487

    2014

  12. [12]

    Kenneth Enevoldsen, Isaac Chung, Imene Kerboua, M Kardos, A Mathur, D Stap, J Gala, W Siblini, D Krzemiński, GI Winata, et al. 2025. Mmteb: Massive multilin- gual text embedding benchmark (2025). arXiv preprint arXiv:2502.13595 (2025)

    arXiv 2025

  13. [13]

    European Union. 2016. General Data Protection Regulation (GDPR): Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data. Official Journal of the European Union L119 (may 2016), 1–88. https://eur-lex.eur...

    2016

  14. [14]

    Oluwaseyi Feyisetan, Borja Balle, Thomas Drake, and Tom Diethe. 2020. Privacy- and utility-preserving textual analysis via calibrated multivariate perturbations. In Proceedings of the 13th international conference on web search and data mining . 178–186

    2020

  15. [15]

    Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yixin Dai, Jiawei Sun, Haofen Wang, Haofen Wang, et al. 2023. Retrieval-augmented generation for large language models: A survey. arXiv preprint arXiv:2312.10997 2, 1 (2023), 32

    Pith/arXiv arXiv 2023

  16. [16]

    Gabriele Gianini and Ernesto Damiani. 2008. A game-theoretical approach to data-privacy protection from context-based inference attacks: A location- privacy protection case study. In Workshop on Secure Data Management . Springer, 133–150

    2008

  17. [17]

    Sagar Goyal, Eti Rastogi, Sree Prasanna Rajagopal, Dong Yuan, Fen Zhao, Jai Chintagunta, Gautam Naik, and Jeff Ward. 2024. Healai: A healthcare llm for effective medical documentation. In Proceedings of the 17th ACM International Conference on Web Search and Data Mining . 1167–1168

    2024

  18. [18]

    Longzhu He, Peng Tang, Yuanhe Zhang, Pengpeng Zhou, and Sen Su. 2025. Mit- igating privacy risks in Retrieval-Augmented Generation via locally private en- tity perturbation. Information Processing & Management 62, 4 (2025), 104150

    2025

  19. [19]

    Pengcheng He, Jianfeng Gao, and Weizhu Chen. 2021. Debertav3: Improving deberta using electra-style pre-training with gradient-disentangled embedding sharing. arXiv preprint arXiv:2111.09543 (2021)

    Pith/arXiv arXiv 2021

  20. [20]

    Ruiqi He, Zekun Fei, Jiaqi Li, Xinyuan Zhu, Biao Yi, Siyi Lv, Weijie Liu, and Zheli Liu. 2025. Transform Before You Query: A Privacy-Preserving Approach for Vec- tor Retrieval with Embedding Space Alignment. arXiv preprint arXiv:2507.18518 (2025)

    Pith/arXiv arXiv 2025

  21. [21]

    Timour Igamberdiev and Ivan Habernal. 2023. DP-BART for privatized text rewriting under local differential privacy. In Findings of the Association for Com- putational Linguistics: ACL 2023 . 13914–13934

    2023

  22. [22]

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchen- bauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614 (Sept. 2023)

    Pith/arXiv arXiv 2023

  23. [23]

    Song Jin, Shuqi Li, Shukun Zhang, and Rui Yan. 2026. Finrpt: Dataset, evaluation system and llm-based multi-agent framework for equity research report gener- ation. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 40. 507–515

    2026

  24. [24]

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rock- täschel, et al. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems 33 (2020), 9459–9474

    2020

  25. [25]

    Ninghui Li, Tiancheng Li, and Suresh Venkatasubramanian. 2006. t-closeness: Privacy beyond k-anonymity and l-diversity. In 2007 IEEE 23rd international con- ference on data engineering . IEEE, 106–115

    2006

  26. [26]

    Yunxiang Li, Zihan Li, Kai Zhang, Ruilong Dan, Steve Jiang, and You Zhang

  27. [27]

    Cureus 15, 6 (2023)

    Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (llama) using medical domain knowledge. Cureus 15, 6 (2023)

    2023

  28. [28]

    Chin-Yew Lin. 2004. Rouge: A package for automatic evaluation of summaries. In Text summarization branches out. 74–81

    2004

  29. [29]

    Ashwin Machanavajjhala, Daniel Kifer, Johannes Gehrke, and Muthuramakrish- nan Venkitasubramaniam. 2007. l-diversity: Privacy beyond k-anonymity. Acm transactions on knowledge discovery from data (tkdd) 1, 1 (2007), 3–es

    2007

  30. [30]

    Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. 2013. Efficient esti- mation of word representations in vector space. arXiv preprint arXiv:1301.3781 (2013)

    Pith/arXiv arXiv 2013

  31. [31]

    Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2002. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics . 311–318

    2002

  32. [32]

    Yuefeng Peng, Junda Wang, Hong Yu, and Amir Houmansadr. 2024. Data ex- traction attacks in retrieval-augmented generation via backdoors. arXiv preprint Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Zhu et al. arXiv:2411.01705 (2024)

    Pith/arXiv arXiv 2024

  33. [33]

    Richard Plant, Dimitra Gkatzia, and Valerio Giuffrida. 2021. CAPE: Context- aware private embeddings for private language learning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing . 7970– 7978

    2021

  34. [34]

    Zhenting Qi, Hanlin Zhang, Eric Xing, Sham Kakade, and Himabindu Lakkaraju

  35. [35]

    arXiv preprint arXiv:2402.17840 (2024)

    Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems. arXiv preprint arXiv:2402.17840 (2024)

    Pith/arXiv arXiv 2024

  36. [36]

    Michael J Ryan, Danmei Xu, Chris Nivera, and Daniel Campos. 2025. En- ronqa: Towards personalized rag over private documents. arXiv preprint arXiv:2505.00263 (2025)

    Pith/arXiv arXiv 2025

  37. [37]

    Shamane Siriwardhana, Rivindu Weerasekera, Elliott Wen, Tharindu Kalu- arachchi, Rajib Rana, and Suranga Nanayakkara. 2023. Improving the domain adaptation of retrieval augmented generation (RAG) models for open domain question answering. Transactions of the Association for Computational Linguis- tics 11 (2023), 1–17

    2023

  38. [38]

    Amber Stubbs and Özlem Uzuner. 2015. Annotating longitudinal clinical narra- tives for de-identification: The 2014 i2b2/UTHealth corpus.Journal of biomedical informatics 58 (2015), S20–S29

    2015

  39. [39]

    Latanya Sweeney. 2002. k-anonymity: A model for protecting privacy. Interna- tional journal of uncertainty, fuzziness and knowledge-based systems 10, 05 (2002), 557–570

    2002

  40. [40]

    Xinyu Tang, Richard Shin, Huseyin A Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim

  41. [41]

    arXiv preprint arXiv:2309.11765 (2023)

    Privacy-preserving in-context learning with differentially private few- shot generation. arXiv preprint arXiv:2309.11765 (2023)

    Pith/arXiv arXiv 2023

  42. [42]

    Nandan Thakur, Nils Reimers, Andreas Rücklé, Abhishek Srivastava, and Iryna Gurevych. 2021. Beir: A heterogenous benchmark for zero-shot evaluation of information retrieval models. arXiv preprint arXiv:2104.08663 (2021)

    Pith/arXiv arXiv 2021

  43. [43]

    Kushal Tirumala, Daniel Simig, Armen Aghajanyan, and Ari Morcos. 2023. D4: Improving llm pretraining via document de-duplication and diversification. Ad- vances in Neural Information Processing Systems 36 (2023), 53983–53995

    2023

  44. [44]

    Urchade Zaratiana, Nadi Tomeh, Pierre Holat, and Thierry Charnois. 2024. GLiNER: Generalist model for named entity recognition using bidirectional transformer. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 5364–5376

    2024

  45. [45]

    Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, et al. 2024. The good and the bad: Exploring privacy issues in retrieval-augmented generation (rag). In Findings of the Association for Computational Linguistics: ACL 2024 . 4505–4524

    2024

  46. [46]

    Shenglai Zeng, Jiankun Zhang, Pengfei He, Jie Ren, Tianqi Zheng, Hanqing Lu, Han Xu, Hui Liu, Yue Xing, and Jiliang Tang. 2025. Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data. InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 24538– 24569

    2025