To Redact, or not to Redact? A Local LLM Approach to Deliberative Process Privilege Classification

Technical Summary: To Redact, or not to Redact? A Local LLM Approach to Deliberative Process Privilege Classification

Problem Statement
Government transparency laws, such as the Freedom of Information Act (FOIA) in the US/UK and the Wet open overheid (Woo) in the Netherlands, grant citizens the right to access government documents. However, these documents often contain sensitive information (e.g., personal data, national security threats, or deliberative process privilege) that must be redacted before release. Currently, this redaction process relies on manual review, which is time-consuming, error-prone, and a primary driver of delays in government responses.

While prior research has explored automatic sensitivity classification using traditional machine learning models (Logistic Regression, SVM, BERT), these methods face significant limitations:

1. Generalization Issues: Models trained on specific datasets often fail to generalize to out-of-distribution data, such as documents from different record custodians or reviewers.
2. Lack of Explainability: Traditional classifiers often lack the ability to provide plausible explanations for their predictions, which is crucial for human reviewers.
3. Data Sovereignty: Processing sensitive, un-cleared government documents via third-party cloud APIs (required by many large commercial LLMs) is often legally or politically untenable for government agencies.

Methodology
The authors propose a sensitivity classification approach using Large Language Models (LLMs) that can be deployed locally on consumer-grade hardware to address data sovereignty concerns. The study focuses on FOIA Exemption 5 (Deliberative Process Privilege), which protects pre-decisional and deliberative records (e.g., internal recommendations, policy opinions) but excludes final opinions or established facts.

• Dataset: The study utilizes the sentence-level annotated corpus by Branting et al. [5], adapted from Baron et al. [2]. It consists of 4,502 sentences from Clinton White House documents (batches K1, K2, K3, R4), labeled as either "Always Deliberative" (AD) or "Non-AD."
• Models: Two models were compared to represent different deployment scenarios:
  1. Local Model: Qwen3.5-9B (open-weights), run on a single 24GB NVIDIA A10 GPU.
  2. Commercial Model: Gemini 2.5 Flash (closed-source), used via API as a proxy for cost-efficient, high-throughput production systems.
• Prompting Variants: Eight distinct prompting strategies were tested to optimize classification performance:
  1. Zero-Shot: Basic prompt without examples.
  2. Few-Shot: Providing 5 random examples of AD/Non-AD sentences.
  3. Error-Based Few-Shot: Providing examples specifically drawn from sentences the zero-shot model misclassified.
  4. Chain-of-Thought (CoT): Forcing the model to reason through three steps: (1) Is it pre-decisional? (2) Is it deliberative (opinion vs. fact)? (3) Conclusion.
  5. CoT + Error-Based Few-Shot: Combining reasoning with hard examples.
  6. Multi-Agent (Majority Vote): Three agents voting on the classification.
  7. CoT + Multi-Agent: Explicit Predictor-Critic-Judge roles.
  8. CoT + Error-Based Few-Shot + Multi-Agent: The full combination.
• Evaluation Metrics: Precision, Recall, F1, F2 (weighted towards recall), and Matthew's Correlation Coefficient (MCC). The authors emphasize Recall and F2 as the primary metrics, arguing that the cost of failing to redact sensitive information (false negative) is significantly higher than over-redacting (false positive).

Key Results

• Local Model Performance: The Qwen3.5-9B model performed poorly with a simple zero-shot baseline (Recall: 0.458). However, performance improved significantly with advanced prompting. The CoT + Error-Based Few-Shot variant achieved the best results for the local model, reaching a Recall of 0.800 and an F2 score of 0.731. This variant outperformed the BERT, SVM, and Logistic Regression baselines from prior work in terms of recall and F2.
• Commercial Model Performance: Gemini 2.5 Flash performed well out-of-the-box with a zero-shot baseline (Recall: 0.808). Interestingly, adding complex prompting techniques (few-shot, CoT, multi-agent) did not consistently improve its performance and sometimes degraded it, suggesting the commercial model already possesses strong parametric knowledge for this task.
• Comparison: The best-performing local variant (CoT + Error-Based Few-Shot) closely approached the performance of the best commercial variant across all metrics, demonstrating that a small, local model can rival a commercial API for this specific task.
• Hard Batch Analysis: On the most difficult batch (K2), the CoT + Error-Based Few-Shot variant nearly doubled the recall compared to the SVM baseline (0.754 vs. 0.42 for the local model; 0.827 vs. 0.42 for the commercial model) while maintaining stable precision.
• Multi-Agent Findings: Multi-agent setups generally resulted in lower recall for the local model. Analysis of agent disagreements revealed that the "Critic" and "Judge" agents were overly conservative, frequently changing correct "deliberative" predictions to "non-deliberative," thereby hurting recall.

Syntactical Analysis
The authors analyzed sentences where all variants agreed on the classification to identify linguistic markers of deliberativeness:

• Verbs: Deliberative sentences (easy-1) contained significantly more modal verbs (would, could, should) and opinion-expressing verbs (believe, propose, recommend, suggest) compared to non-deliberative sentences.
• Person: Deliberative sentences were more frequently phrased in the first-person (I, we, my).
• Combination: The most distinct characteristic of deliberative sentences was the co-occurrence of multiple indicators, specifically the combination of first-person words with verbs expressing opinion. Non-deliberative sentences rarely contained multiple unique indicators.

Significance and Claims
The paper claims that:

1. Local Deployment is Viable: It is possible to achieve high-performance sensitivity classification using small, open-weight models (Qwen3.5-9B) deployable on consumer-grade hardware, addressing the legal and political constraints of using cloud APIs for sensitive government data.
2. Prompting Strategy Matters: For local models, simple zero-shot prompting is insufficient. A combination of Chain-of-Thought reasoning and error-based few-shot examples is required to achieve performance comparable to commercial models and traditional baselines.
3. Recall is Paramount: In the context of FOIA redaction, optimizing for recall (catching all sensitive content) is more critical than precision, and the proposed method successfully prioritizes this metric.
4. Linguistic Indicators: The study validates that deliberative process privilege is strongly correlated with specific syntactical features (first-person + opinion verbs), which LLMs can effectively leverage when guided by appropriate prompting.

The authors maintain a modest stance, noting that the dataset is limited to specific custodians and that real-world redaction often requires broader document context, which was not fully utilized in this sentence-level task. However, the approach offers a training-free, explainable, and sovereign solution for automated sensitivity review.