[论文解读] Adaptive Text Anonymization: Learning Privacy-Utility Trade-offs via Prompt Optimization

Gabriel Loiseau, Damien Sileo+3 more|arXiv (Cornell University)|Feb 24, 2026

Privacy-Preserving Technologies in Data被引用 0

一句话总结

论文提出自适应文本去识别化，通过进化式提示优化自动学习领域和任务特定的隐私–效用权衡，使开源模型在多样基准上达到或超过闭源模型的水平。

ABSTRACT

Anonymizing textual documents is a highly context-sensitive problem: the appropriate balance between privacy protection and utility preservation varies with the data domain, privacy objectives, and downstream application. However, existing anonymization methods rely on static, manually designed strategies that lack the flexibility to adjust to diverse requirements and often fail to generalize across domains. We introduce adaptive text anonymization, a new task formulation in which anonymization strategies are automatically adapted to specific privacy-utility requirements. We propose a framework for task-specific prompt optimization that automatically constructs anonymization instructions for language models, enabling adaptation to different privacy goals, domains, and downstream usage patterns. To evaluate our approach, we present a benchmark spanning five datasets with diverse domains, privacy constraints, and utility objectives. Across all evaluated settings, our framework consistently achieves a better privacy-utility trade-off than existing baselines, while remaining computationally efficient and effective on open-source language models, with performance comparable to larger closed-source models. Additionally, we show that our method can discover novel anonymization strategies that explore different points along the privacy-utility trade-off frontier.

研究动机与目标

• 通过实现自适应、任务条件化的隐私–效用权衡，解决文本去识别化的上下文敏感性。
• 通过自动提示进化，消除对人工提示工程和固定权衡的依赖。
• 使本地可部署的开源模型实现去识别化，性能与基于 API 的解决方案竞争力相当。

提出的方法

• 将去识别化形式化为通过提示进行的自适应、任务条件化改写。
• 引入一个两阶段的基于 GEPA 的进化提示优化流水线，包含热启动阶段和细化阶段。
• 在隐私与效用上进行帕累托基的选择，以维持多样的工作点。
• 实现丰富的反馈和自适应验证采样，以提高搜索效率和引导。
• 在中等规模的开源大模型上运行，拥有本地可部署的去识别代理和提议代理。
• 将每个权衡点表示为自然语言指令，而非固定的模型检查点。

Figure 1: Overview of our approach. We perform reflective prompt optimization using the GEPA algorithm Agrawal et al. ( 2025 ) . Our method adapts a base seed prompt into an optimized prompt defining the privacy and utility task requirements. The optimization operates in a strict fixed budget enviro

实验结果

研究问题

• RQ1 自适应提示优化是否能够在跨域场景中发现多组帕累托最优的文本去识别化隐私–效用权衡？
• RQ2 在隐私与效用方面，开放源代码模型基于任务特定提示的去识别化与闭源或传统方法相比如何？
• RQ3 该框架是否能够有效将去识别化策略推广至多样化的领域和威胁模型？

主要发现

Model/Method	DB-Bio Privacy	DB-Bio Utility	SynthPAI Privacy	SynthPAI Utility	TAB Privacy	TAB Utility	PUPA Privacy	PUPA Utility	MedQA Privacy	MedQA Utility
OpenPII	57.6/98.1	9.02/97.3	87.1/32.2	75.4/70.3	3.80/59.5	-	-	-	-	-
RUPTA (GPT-5)	74.0/98.3	- / -	- / -	- / -	- / -	- / -	- / -	- / -	- / -	- / -
AF (GPT-5)	78.0/92.1	64.0/57.6	59.9/42.5	94.2/46.0	24.4/45.8	-	-	-	-	-
Prompt (GPT-5)	63.6/100	18.3/88.1	99.3/48.6	99.1/72.7	10.7/45.5	-	-	-	-	-
(Optimized)	65.5/100	22.5/94.4	92.3/56.2	98.0/79.3	24.6/45.9	-	-	-	-	-

• 优化后的提示在开源模型和任务中始终提升隐私分数，同时保持或提升效用。
• 框架在单次优化运行中发现多组帕累托最优的去识别化策略，覆盖高隐私到高效用的工作点。
• 优化后的 Qwen3-30B-A3B 在若干任务上与基于 GPT-5 的方法具有竞争力，缩小了与闭源模型的差距。
• 权衡因模型和任务而异，在 TAB、SynthPAI 和 MedQA 数据集上呈现出不同的前沿。
• 该方法使开源模型在多个基准上达到或超过部分基于 API 的基线的性能。

Figure 4: A comparison of learning behavior of our modified GEPA implementation against each separated component and a state-of-the-art prompt optimizer reference (MIPROv2). Results are measures with Gemma-3-27b-it on SynthPAI (top) and Mistral-Small-3.2-24B on TAB (bottom).