Conformal Privacy Auditing: Calibrated Re-identification Attacks with Statistical Guarantees
Conformal Privacy Auditing certifies per-document re-identification risk against LLM attackers with statistical coverage guarantees.
Conformal Privacy Auditing is a distribution-free method that certifies re-identification risk for each released text document against adversaries that combine large language models with auxiliary knowledge. For a user-chosen confidence level, it returns a conformal ambiguity set guaranteed, under exchangeability, to contain the true identity, and it treats set size as a leakage proxy. It supports both logit-access and sampling-only attackers, so open-weight models and proprietary APIs can be audited in one framework. Across release benchmarks, certified identifiability changed sharply with auxiliary knowledge, LLM augmentation, and the release mechanism.
- CPA issues a per-document conformal set guaranteed to contain the true identity at a chosen confidence.
- Set size is used as an interpretable leakage proxy.
- The method covers logit-access and sampling-only attackers, including proprietary APIs.
- Audits show identifiability shifts with auxiliary knowledge, LLM use, and release mechanisms.
Full article181 words · extracted from arxiv.org · click to collapse
Empirical identity leakage from released text is increasingly driven by attackers that combine large language models (LLMs) with auxiliary knowledge to link documents to individuals. Existing audits typically report success rates for specific attack pipelines but lack finite-sample statistical guarantees, while training-time protections such as differential privacy are difficult to translate into release-time decisions for individual natural-language documents. We introduce Conformal Privacy Auditing(CPA), a distribution-free calibration framework that provides a statistical certificate of re-identification risk for each released document against LLM-empowered adversaries. CPA outputs a conformal ambiguity set of candidate identities that is guaranteed to contain the true identity with user-chosen confidence under exchangeability, together with an interpretable leakage proxy derived from set size. CPA supports both logit-access and sampling-only attackers, enabling audits of open-source models and proprietary API models in a unified framework. Across multiple release benchmarks and attacker configurations, CPA achieves calibrated coverage and reveals sharp shifts in certified identifiability as auxiliary knowledge, LLM augmentation, and release mechanisms vary, providing a statistically grounded basis for reporting and comparing release-time linkage risk across attacker configurations, datasets, and release mechanisms alike.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21340