提出新框架,让本地模型更理性地匿名文本,避免隐私泄露与信息损失。
Look Twice before You Leap: A Rational Framework for Localized Adversarial Anonymization
- 用仲裁机制判断攻击者推理是否合理,防止无效修改
- 在多个数据集上实现更好隐私与可用性平衡
- 无需训练,适合资源有限的本地部署场景
当前基于大语言模型的文本匿名化框架通常依赖远程API服务,导致用户必须向不可信第三方披露原始数据,形成隐私悖论。此外,直接将现有方案迁移至本地小模型(LSMs)会引发严重可用性下降。本文认为,这一问题不仅源于小模型能力不足,更在于现有最先进方法采用贪婪对抗策略所固有的非理性。为此,提出完全本地化的训练无感框架RLAA,采用攻击者-仲裁者-匿名化器架构。将匿名化建模为边际隐私增益(MPG)与边际效用成本(MUC)的权衡,证明贪婪策略易陷入非理性状态。RLAA引入仲裁者作为理性守门人,验证攻击者推断,过滤虚假泄露。该机制实现理性早停,结构化防止可用性崩溃。在多个基准上的实验证明,相比强基线,RLAA在隐私-效用权衡上表现更优。
原文摘要 · Abstract (English)
Current LLM-based frameworks for text anonymization usually rely on remote API services from powerful LLMs, which creates an inherent privacy paradox: users must disclose the raw data to untrusted third parties for guaranteed privacy preservation. Moreover, directly migrating current solutions to local small-scale models (LSMs) offers a suboptimal solution with severe utility collapse. Our work argues that this failure stems not merely from the capability deficits of LSMs, but significantly from the inherent irrationality of the greedy adversarial strategies employed by current state-of-the-art (SOTA) methods. To address this drawback, we propose Rational Localized Adversarial Anonymization (RLAA), a fully localized and training-free framework featuring an Attacker-Arbitrator-Anonymizer architecture. We model the anonymization process as a trade-off between Marginal Privacy Gain (MPG) and Marginal Utility Cost (MUC), demonstrating that greedy strategies tend to drift into an irrational state. Instead, RLAA introduces an arbitrator that acts as a rationality gatekeeper, validating the attacker's inference to filter out ghost leaks. This mechanism promotes a rational early-stopping criterion, and structurally prevents utility collapse. Extensive experiments on different benchmarks demonstrate that RLAA achieves a superior privacy-utility trade-off compared to strong baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。