[Paper Review] Generalised Differential Privacy for Text Document Processing

Natasha Fernandes, Mark Dras+1 more|arXiv (Cornell University)|Nov 26, 2018

Authorship Attribution and Profiling4 references4 citations

TL;DR

This paper proposes a generalised differential privacy mechanism for text document obfuscation that preserves semantic content while masking authorship. By applying Laplace noise to bag-of-words representations using Earth Mover’s distance as a similarity metric, it achieves provable privacy guarantees with strong utility for topic classification, validated on a fan fiction dataset.

ABSTRACT

We address the problem of how to "obfuscate" texts by removing stylistic clues which can identify authorship, whilst preserving (as much as possible) the content of the text. In this paper we combine ideas from "generalised differential privacy" and machine learning techniques for text processing to model privacy for text documents. We define a privacy mechanism that operates at the level of text documents represented as "bags-of-words" - these representations are typical in machine learning and contain sufficient information to carry out many kinds of classification tasks including topic identification and authorship attribution (of the original documents). We show that our mechanism satisfies privacy with respect to a metric for semantic similarity, thereby providing a balance between utility, defined by the semantic content of texts, with the obfuscation of stylistic clues. We demonstrate our implementation on a "fan fiction" dataset, confirming that it is indeed possible to disguise writing style effectively whilst preserving enough information and variation for accurate content classification tasks.

Motivation & Objective

• To address the challenge of author obfuscation in text documents while preserving content utility.
• To provide formal privacy guarantees against authorship inference using generalised differential privacy.
• To balance semantic utility (topic classification accuracy) with stylistic obfuscation (author anonymity).
• To extend $d_{\mathcal{X}}$-privacy to unstructured text data via the Earth Mover’s distance metric.
• To demonstrate feasibility and effectiveness of the mechanism on real-world text data, such as fan fiction.

Proposed method

• The method models documents as bag-of-words representations, retaining word frequencies but discarding word order.
• It applies a noise mechanism based on the Laplace probability density function to perturb word frequencies.
• The noise scale is calibrated using the Earth Mover’s distance (EMD) as a semantic similarity metric between documents.
• The mechanism ensures that documents with similar topics (under EMD) produce similar noisy outputs, regardless of authorship.
• Privacy is formalised via $E_{d_{\mathcal{X}}}$-privacy, a metric-based extension of differential privacy using EMD as the underlying distance.
• The approach is implemented on real-valued vector representations of bags-of-words and proven to satisfy privacy and utility properties.

Experimental results

Research questions

• RQ1 Can a privacy mechanism be designed that preserves topic classification utility while effectively obfuscating authorship in text documents?
• RQ2 How can generalised differential privacy be adapted to unstructured text data using semantic similarity metrics?
• RQ3 To what extent does the use of Earth Mover’s distance as a metric ensure both privacy and utility in text obfuscation?
• RQ4 Can the proposed mechanism provide formal, a priori privacy guarantees comparable to differential privacy in structured databases?
• RQ5 How does the trade-off between privacy (controlled by $\epsilon$) and utility (topic classification accuracy) manifest in practice?

Key findings

• The proposed mechanism successfully preserves topic classification accuracy even after obfuscation, demonstrating strong utility retention.
• Authorship attribution accuracy dropped significantly after applying the obfuscation mechanism, confirming effective style masking.
• The mechanism satisfies $E_{d_{\mathcal{X}}}$-privacy with respect to the Earth Mover’s distance, providing formal privacy guarantees.
• The use of Laplace noise scaled by the EMD metric ensures that similar-topic documents produce similar noisy outputs, regardless of original author.
• Experimental evaluation on a fan fiction dataset confirms that the method achieves a balance between privacy and utility, with measurable trade-offs controlled by the privacy parameter $\epsilon$.
• The results suggest that reconstructing readable text from obfuscated bag-of-words outputs is feasible, opening a path to human-readable private documents.