Auditing reveals residual attribute leakage in text de-identification evaluations
Original title: Residual Attribute Leakage Is an Interface: Auditing Privacy Evaluation After Text De-identification
The paper audits privacy evaluations of de-identified text and finds that most verdict changes are gains or losses of separability when varying evaluation interfaces.
A privacy evaluation of de-identified text asks a language model to guess a person's protected attribute. We introduce a prior-normalised clipped leakage score of its gain on the true value. We vary the evaluation interface on fixed releases of three corpora. In a stress test an editor that writes the opposite-sex form at the same spans a redaction editor would redact misleads the adversary about most people yet ranks first among editors scored on the same MedQA entries under this score.
- Most verdict changes in interface variations are gains or losses of separability
- Only the adversary reverses comparisons in 5 of 124 changes
- SACC traceable editor allows ablation of editing principles
From the original article
1 min read at arxiv.orgA privacy evaluation of de-identified text asks a language model (the adversary) to guess a person's protected attribute. We introduce a prior-normalised clipped leakage score of its confidence gain on the true value and audit the conclusions drawn from it.
By Tuan Thanh Duong · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.