arXiv:2510.06383cs.CLcs.AI2025-10

用大模型重写文本片段,防止通过关键词匹配回原始数据

Protecting De-identified Documents from Search-based Linkage Attacks

  • 构建N-gram倒排索引,识别易被关联的短语组合
  • 通过大模型迭代重写低频短语,使搜索攻击失效
  • 在真实案件和维基人物数据上验证有效,适合隐私保护场景

去标识化模型虽能隐藏文档中提及个体的身份,却无法应对链接风险——即通过去标识文本反推其原始来源。一种简单攻击方式是提取去标识文本中的短语,在原始数据集中搜索是否存在匹配。本文提出一种对抗基于搜索的链接攻击的方法,分两步进行:首先构建文本集合中N-gram的倒排索引,高效识别出在少于k篇文档中出现过的单个或组合式N-gram;随后使用大模型对这些高风险短语进行迭代重写,直至无法通过搜索定位原始文档。在法院案例和维基人物两个数据集上的实验表明,该方法可有效阻止基于搜索的链接攻击,同时保持文本语义完整性。但研究也指出,更先进的语义导向攻击仍可能实现链接。

原文摘要 · Abstract (English)

While de-identification models can help conceal the identity of the individuals mentioned in a document, they fail to address linkage risks, defined as the potential to map the de-identified text back to its source. One straightforward way to perform such linkages is to extract phrases from the de-identified document and check their presence in the original dataset. This paper presents a method to counter search-based linkage attacks while preserving the semantic integrity of the text. The method proceeds in two steps. We first construct an inverted index of the N-grams occurring in the text collection, making it possible to efficiently determine which N-grams appear in fewer than $k$ documents, either alone or in combination with other N-grams. An LLM-based rewriter is then iteratively queried to reformulate those spans until linkage is no longer possible. Experimental results on two datasets (court cases and Wikipedia biographies) show that the rewriting method can effectively prevent search-based linkages while remaining faithful to the original content. However, we also highlight that linkages remain feasible with the help of more advanced, semantics-oriented approaches.

隐私保护去标识化大模型链接攻击

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。