Technical Summary: AURA (Anonymization with Utility-Retention Adaptation)

Problem Statement

The rapid adoption of agentic Large Language Models (LLMs) equipped with web search capabilities has fundamentally altered the threat model for text anonymization. Unlike traditional threats focused on explicit identifiers (e.g., names, emails), modern agentic systems can infer identities by cross-referencing weak contextual cues—such as niche research topics, specific tool stacks, or unique project details—with public web evidence. This creates a structural tension: the same contextual details that carry high downstream analytic value for qualitative research are precisely the cues that enable re-identification.

Existing defenses are inadequate for this specific threat landscape. Heuristic Named Entity Recognition (NER) tools (e.g., Microsoft Presidio) fail to detect contextual quasi-identifiers. Formal privacy frameworks like Differential Privacy (DP) often degrade text coherence and analytic value through token-level perturbation. Prior LLM-based anonymization methods often treat privacy and utility as a single optimization problem or rely on non-agentic inference models, leaving the operating region between resistance to agentic web-search re-identification and utility retention underexplored.

Methodology: AURA Framework

The authors introduce AURA (Anonymization with Utility-Retention Adaptation), an LLM-powered mask-reconstruct framework designed to decouple privacy localization from utility-preserving reconstruction. The pipeline operates in three phases:

Phase 0: Initialization

AURA initializes a privacy scope and a utility profile for the specific transcript.

• Adaptive Privacy Scope: Using an LLM with web search, the system infers not only a base set of eight attributes (Age, Sex, Location, etc.) but also transcript-specific quasi-identifiers (e.g., specific research pipelines, tool stacks, institutional clues) that could support re-identification.
• Utility Profiling: The system extracts an "insight profile" summarizing research-valuable content across eight dimensions (Thematic Content, Experiential Narratives, Emotional Expressions, Reasoning, Behavioral Patterns, Relational Dynamics, Temporal Structure, and Domain Knowledge).

Phase 1: Masking Convergence

This phase localizes sensitive spans without rewriting the entire text immediately.

• The system iteratively rewrites the transcript to suppress inferred attributes, then diffs the rewritten text against the original.
• This process converges on a masked template ($\hat{T}$) containing placeholders (e.g., [MASK_i]) for sensitive spans and a mask map linking placeholders to original text.
• The goal is to identify exactly which spans are risky under the current privacy scope, creating a "privacy-risk map."

Phase 2: Reconstruct, Evaluate, and Select

Instead of a single rewrite, AURA generates and selects the optimal reconstruction.

• Reconstruction: An LLM generates $N$ candidate replacement dictionaries only for the masked spans, guided by the insight profile to preserve utility while avoiding re-identifiable details.
• Adversarial Evaluation: Each candidate is evaluated by two agents:
  1. Attacker: An attribute inference agent with web search checks for privacy leakage (severity score $S_n$) and counts dimensions that remain overly specific ($C_n$).
  2. Keeper: An agent scores the loss of research-valuable content across the eight utility dimensions ($L_n$).
• Selection: Candidates are filtered by a specificity cap ($C_n \leq C_{max}$). From the admissible set, the system selects the candidate minimizing privacy severity ($S_n$) and utility loss ($L_n$).

Key Contributions

1. Novel Threat Model Optimization: The authors claim to be the first to optimize and evaluate LLM text anonymization specifically in the operating region between resistance to real-world agentic web-search re-identification and the retention of downstream analytic utility.
2. Decoupled Framework: AURA separates where to intervene (masking) from how to rewrite (reconstruction), allowing for targeted protection of risky spans while preserving the integrity of the surrounding context.
3. Empirical Characterization: The study provides empirical evidence on how privacy and utility trade-offs shift across different anonymization settings, demonstrating that adaptive privacy scopes primarily influence re-identification resistance, while the reconstruction method preserves utility.

Experimental Results

The framework was evaluated on 27 real-user interview transcripts from the Anthropic Interviewer dataset, verified as vulnerable to agentic re-identification. The evaluation used three attacker models (GPT-5.1, GPT-5.4-mini, and Gemini-3-Flash) and compared AURA against NER-based redaction, one-shot LLM rewriting, iterative adversarial anonymization, and Differential Privacy (DP-MLM).

• Privacy Performance: AURA's adaptive privacy variants reduced agentic re-identification rates to 0–5 out of 27 transcripts across all attacker models. This is substantially lower than NER-based redaction (13–21/27) and prior LLM-based anonymizers (6–7/27).
• Utility Retention: AURA retained 74.9%–80.3% of unit-level utility-grid information (a combination of profile facts and codebook facts). This outperformed the Advanced Anonymizer baseline (72.1%) and significantly outperformed DP-MLM, which suffered from low utility (0–60%) even at higher privacy budgets.
• Local Deployment: Variants using open-weight on-device models (Qwen3.5-27B and Qwen3.5-35B-A3B) matched or exceeded the utility of API-powered baselines (78.7%–80.2% grid recovery) while maintaining comparable privacy, supporting fully local deployment.
• Pareto Frontier: AURA's adaptive variants consistently occupied the favorable region of the privacy-utility Pareto frontier, dominating non-DP baselines at comparable utility levels and offering higher utility than DP methods at comparable privacy levels.

Significance and Claims

The paper positions AURA as a practical framework for navigating the "middle ground" of text anonymization in the LLM era. The authors argue that:

• Contextual Nuance is Critical: Simply removing explicit identifiers is insufficient; the structural tension between privacy and utility requires a method that surgically transforms risky details while preserving the "thick description" necessary for qualitative analysis.
• Adaptive Scope is Superior: AURA demonstrates that dynamically expanding the privacy scope to include transcript-specific quasi-identifiers is more effective than fixed attribute lists.
• Decoupling Enables Optimization: By separating the identification of risky spans from the reconstruction process, AURA achieves a better privacy-utility trade-off than methods that attempt to rewrite the entire text in a single pass or rely on heavy perturbation.
• Feasibility of Local Deployment: The results suggest that high-quality, privacy-preserving anonymization can be achieved using open-weight models on local hardware, reducing reliance on proprietary API providers.

The authors conclude that AURA pushes the privacy-utility frontier for LLM-era text release, offering a viable path for responsible data sharing in the face of increasingly powerful agentic re-identification threats.