💬 NLP

Subject-level Inference for Realistic Text Anonymization Evaluation

This paper introduces SPIA, the first benchmark that evaluates text anonymization at the subject level rather than the span level, revealing that current methods often fail to prevent contextual inference of personal information even when most explicit PII spans are masked.

Original authors: Myeong Seok Oh, Dong-Yun Kim, Hanseok Oh, Chaean Kang, Joeun Kang, Xiaonan Wang, Hyunjung Park, Young Cheol Jung, Hansaem Kim

Published 2026-04-24

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Myeong Seok Oh, Dong-Yun Kim, Hanseok Oh, Chaean Kang, Joeun Kang, Xiaonan Wang, Hyunjung Park, Young Cheol Jung, Hansaem Kim

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a diary full of secrets. You decide to share it with the world, but before you do, you take a red marker and cross out every name, address, and phone number. You feel safe, right? You've hidden the "obvious" clues.

This paper argues that you are wrong.

The authors, a team of researchers from South Korea and Canada, have built a new way to test if text is truly anonymous. They call their new system SPIA (Subject-level PII Inference Assessment).

Here is the breakdown of why current methods fail and how SPIA fixes them, using some everyday analogies.

1. The Problem: The "Red Pen" Illusion

Currently, when companies check if a document is safe, they use a "Span-Based" method.

The Analogy: Imagine a game of "Where's Waldo?" where the goal is to find Waldo. The current method just checks: "Did you cross out the word 'Waldo'?" If the word is gone, they say, "Great! Waldo is hidden!"
The Reality: But what if the text says, "The man in the red and white striped shirt is walking to the beach"? Even if you crossed out "Waldo," anyone reading that sentence knows exactly who you are talking about.
The Paper's Finding: The researchers found that even when 90% of the obvious names and numbers were crossed out, 67% of the people could still be identified just by reading the context. The "red pen" method is a false sense of security.

2. The Second Problem: The "Main Character" Bias

Most current tests assume a document only has one important person (like the author of a blog post or the plaintiff in a lawsuit). They check if that one person is safe.

The Analogy: Imagine a group photo at a wedding. The security guard checks if the Groom's face is blurred. If the Groom is hidden, the guard says, "All clear!"
The Reality: But the Bride, the Best Man, and the Aunt are still standing there with their faces perfectly visible. The current methods ignore everyone else in the photo.
The Paper's Finding: When they focused only on the "Main Character," the other people in the text were left completely exposed. In legal documents, for example, protecting the person suing might leave the judge, the witnesses, and the defendant wide open.

3. The Solution: SPIA (The "Detective" Test)

The authors created SPIA, which changes the rules of the game.

The Shift: Instead of checking if specific words are crossed out, SPIA asks: "Can a detective figure out who every single person in this story is?"
The Method: They built a massive dataset of 675 documents (legal cases and social media posts) containing over 1,700 different people. They used powerful AI models to act as "adversaries" (hackers/detectives) to try and guess the identities of everyone mentioned, not just the main one.
The Metrics: They introduced two new scores:
1. Individual Protection Rate (IPR): How safe is each person individually?
2. Collective Protection Rate (CPR): How safe is the whole group?

4. What They Discovered

When they ran their new test on existing anonymization tools, the results were shocking:

The "High Masking" Trap: Some tools claimed to be 99% effective because they crossed out 99% of the names. But when SPIA tested them, the actual safety score dropped to 33%. The tools were great at hiding the "what" (the name) but terrible at hiding the "who" (the person behind the name).
The "Main Character" Flaw: Tools designed to protect the "Main Character" often made the other people in the text less safe. By focusing so hard on the main guy, the tools accidentally left clues about everyone else.
Context is King: In long legal documents, it's very hard to hide a person's identity because the story is so detailed. In short social media posts, it's easier, but only if you look at everyone mentioned, not just the poster.

The Bottom Line

The paper concludes that we need to stop playing "Where's Waldo?" (hiding words) and start playing "Who Am I?" (hiding identities).

If you want to share a story safely, you can't just cross out the names. You have to make sure that even if someone reads the whole story, they can't piece together the puzzle to figure out who the people are. SPIA is the new ruler that measures if you've actually done that job, ensuring that everyone in the story stays private, not just the star of the show.

1. Problem Statement

Current text anonymization evaluation methods suffer from two critical limitations that fail to reflect real-world privacy risks:

Span-based Metrics: Existing benchmarks rely on metrics like Token Recall and Entity Recall, which only measure whether explicit Personally Identifiable Information (PII) spans (e.g., names, dates) are masked. They fail to capture contextual inference risks, where an adversary can deduce sensitive attributes (e.g., occupation, location) from surrounding text even after explicit PII is removed.
Single-Subject Assumption: Most evaluation frameworks assume a single target subject (e.g., the document author or a specific patient). However, real-world documents (legal judgments, medical records, social media posts) often contain multiple individuals. Current methods often protect the primary target while leaving non-target subjects (e.g., witnesses, family members, colleagues) inadequately protected.

The paper argues that high span-masking rates do not guarantee privacy, as large language models (LLMs) can infer hidden attributes through context, and focusing on a single subject creates protection inequalities.

2. Methodology: The SPIA Benchmark

The authors introduce SPIA (Subject-level PII Inference Assessment), the first benchmark designed to shift the unit of evaluation from text spans to individuals.

A. Dataset Construction

Scale: 675 documents comprising 1,712 unique subjects and 7,040 PII instances.
Domains:
- Legal (TAB): 144 European Court of Human Rights judgments (long-form, multi-party).
- Online (PANORAMA): 531 synthetic social media posts (short-form, diverse subjects).
PII Taxonomy: 15 categories divided into:
- CODE (5): Fixed formats (ID numbers, phone, email, passport, driver's license).
- NON-CODE (10): Free-text/categorical (Name, Age, Location, Occupation, Relationship, etc.).
Annotation Process: A two-stage framework using LLMs (validated against human annotators):
1. Subject Identification: Identifying all unique individuals in a document.
2. Subject-wise PII Inference: Inferring PII for each identified subject separately, rated by Hardness (cognitive effort to infer) and Certainty (confidence in the inference).

B. Evaluation Framework

SPIA introduces two novel metrics to measure protection at the subject level:

Collective Protection Rate (CPR): Measures the proportion of all PII instances across all subjects that remain protected. It weights subjects by their PII count.
$CPR = 1 - \frac{\sum A_i}{\sum O_i}$
(Where $A_i$ is inferred PII and $O_i$ is ground truth PII).
Individual Protection Rate (IPR): The average of per-subject protection rates, assigning equal weight to every subject regardless of how much PII they have. This highlights protection gaps for specific individuals.
$IPR = \frac{1}{N} \sum \left(1 - \frac{A_i}{O_i}\right)$

The evaluation pipeline involves:

Anonymization: Applying various methods to original text.
Adversarial Inference: Using an LLM (Claude-Sonnet-4.5) to identify subjects and infer PII from the anonymized text.
Alignment & Scoring: Matching ground-truth subjects to inferred subjects and scoring PII matches (Exact, Partial, Mismatch).

3. Key Contributions

SPIA Benchmark: The first multi-subject, multi-domain benchmark for subject-level privacy assessment, covering legal and online domains with 15 PII categories.
Subject-wise Evaluation Framework: A methodology that evaluates all identifiable individuals in a document, not just a single target, using novel metrics (IPR/CPR).
Empirical Evidence: Demonstrating that current state-of-the-art anonymization techniques fail significantly when evaluated under realistic, multi-subject, inference-based conditions.

4. Experimental Results

The authors evaluated 4 anonymization methods (Longformer, DeID-GPT, DP-Prompt, Adversarial Anonymization) across 6 LLM backbones.

Key Findings:

Span Masking $\neq$ Inference Protection:
- Even when span-based metrics showed >90% masking (e.g., Longformer achieved 99.7% Entity Recall), inference-based protection (CPR) dropped as low as 33%.
- Two-thirds of PII remained inferable from context despite explicit spans being removed.
Protection Inequality (Target vs. Non-Target):
- Methods focusing on a single target subject (e.g., Adversarial Anonymization) often leave non-target subjects substantially more exposed.
- In legal documents (TAB), the protection gap between the target and non-targets reached 11 percentage points.
- Conversely, subject-agnostic methods (like DeID-GPT) sometimes provided better collective protection than target-focused iterative methods.
Domain Variability:
- Legal Documents (TAB): Showed larger gaps between span masking and inference protection due to long contexts and rich demographic details.
- Online Texts (PANORAMA): Showed different patterns where anonymizing the author often inadvertently protected related subjects due to the interwoven nature of short posts.
Method Performance:
- Adversarial Anonymization (AA) provided the strongest inference protection (CPR ~0.87) but with utility trade-offs.
- DeID-GPT offered a strong balance of utility and protection.
- DP-Prompt (paraphrasing) failed to provide reliable inference protection.

5. Significance and Impact

Paradigm Shift: The paper argues that the field must move beyond "did we mask the name?" to "can an adversary still reconstruct the person's identity?"
Real-World Safety: It highlights that current anonymization tools are insufficient for GDPR/CCPA compliance in multi-party scenarios, as they leave secondary subjects vulnerable.
Future Directions: The authors call for domain-aware anonymization strategies and evaluation frameworks that explicitly account for all subjects in a document. SPIA serves as a foundation for developing techniques that ensure equitable privacy protection for every individual mentioned in a text.

The code, dataset, and evaluation scripts are publicly available to facilitate further research in this critical area of AI safety and privacy.