Research map / Large language models / Instruction and fine-tuning
Self-Refining Language Model Anonymizers via Adversarial Distillation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Distills LLM adversarial anonymization (GPT-4o anonymizer/adversary/judge) into 8B small language models via SFT on anonymization, attribute-inference, and utility-critique tasks plus DPO, enabling local iterative self-refinement.
Problem
LLM-based text anonymization against attribute inference typically relies on proprietary models like GPT-4, which is costly and exposes sensitive text to external systems.
Approach
Collect adversarial anonymization trajectories (anonymizer, inference model, utility judge) from a frontier LLM, then train a small model to anonymize, infer attributes, and critique utility via multi-task SFT followed by DPO on privacy-utility preference pairs, so the model can self-refine at inference without external feedback.
Key results
- Llama3-8B trained with SEAL reaches privacy score 0.391 after one iteration (vs 0.424 for GPT-4o adversarial anonymization) and 0.263 after three iterations, with overall score 0.441 vs 0.253.
- On the hard set, SEAL surpasses all GPT-4o-based baselines after the second self-refinement iteration (overall 0.298 vs 0.272 after three iterations).
- Human study: GPT-4.1 utility judgments correlate 0.717 (readability) and 0.814 (semantic preservation) with human ratings.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| increase self-refinement from one to three steps | SEAL Llama3-8B · SynthPAI main | Privacy: 0.391 -> 0.263 | Helped |
| increase self-refinement from one to three steps | SEAL Llama3-8B · SynthPAI hard | Privacy: 0.609 -> 0.505 | Helped |
| use SEAL instead of the strongest adversarial baseline | Llama3-8B vs. adversarial anonymization · SynthPAI main | Privacy: 0.424 -> 0.391 | Helped |
| use SEAL instead of adversarial anonymization | Llama3-8B vs. adversarial anonymization · SynthPAI hard | Privacy: 0.571 -> 0.609; 0.579 -> 0.540; 0.568 -> 0.540 | Mixed |
| add critique tasks to anonymization-only SFT (ablation) | SEAL training · SynthPAI main | Privacy: 0.513 -> 0.498 | Helped |
| add DPO after SFT (ablation) | SEAL training · SynthPAI main | Privacy: 0.498 -> 0.493; 0.458 -> 0.379 | Helped |
| add adversarial feedback during anonymization (ablation) | SEAL training with SFT + DPO and A & C · SynthPAI main | Privacy: 0.493 -> 0.464 | Helped |
| use confidence-aware privacy scoring (ablation) | SEAL training with SFT + DPO, A & C, and adversarial feedback · SynthPAI main | Privacy: 0.464 -> 0.379 | Helped |
| add critique tasks to anonymization-only SFT (ablation) | SEAL training · SynthPAI hard | Privacy: 0.672 -> 0.679 | Hurt |
| add DPO after SFT (ablation) | SEAL training with A only · SynthPAI hard | Privacy: 0.672 -> 0.685 | Hurt |
| add adversarial feedback (ablation) | SEAL training with SFT + DPO, A & C · SynthPAI hard | Privacy: 0.682 -> 0.689 | Hurt |
| use confidence-aware privacy scoring (ablation) | SEAL training with SFT + DPO, A & C, and adversarial feedback · SynthPAI hard | Privacy: 0.689 -> 0.614 | Helped |
Surprising findings
- On the main set, SEAL with a single iteration already matches or exceeds GPT-4o adversarial anonymization on privacy, and the Qwen3 reasoning models did not show a clear advantage over Llama3 in this setting.
Limitations
- Harder, contextually embedded cases need more self-refinement iterations to reach strong privacy.
- Distillation trajectories are generated by GPT-4o, and utility evaluation relies on GPT-4.1 judgments with moderate human agreement on hallucination (0.775 accuracy).
- Self-refinement latency is higher with adversarial inference steps.
Experimental setup
Datasets: SynthPAI
Benchmarks: SynthPAI main eval (25 profiles) SEAL hard eval (500 synthetic texts)
Metrics: attribute inference accuracy (privacy) utility (readability, semantic similarity, hallucination) overall privacy-utility trade-off score
Baselines: Azure PII detection Dipper adversarial anonymization (GPT-4o) adversarial anonymization (GPT-4o mini) adversarial anonymization (Gemini 2.5 Flash)
Builds on: adversarial anonymization direct preference optimization
Closest papers by meaning
- Language Models are Advanced Anonymizers (ICLR 2025 · similarity 0.94)
- Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024 · similarity 0.90)
- Privacy Auditing of Large Language Models (ICLR 2025 · similarity 0.89)
- Forget to Flourish: Leveraging Machine-Unlearning on Pretrained Language Models for Privacy Leakage (AAAI 2025 · similarity 0.88)
- A Synthetic Dataset for Personal Attribute Inference (NeurIPS 2024 · similarity 0.88)
- PrE-Text: Training Language Models on Private Federated Data in the Age of LLMs (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.