# Privacy Guarantees for De-identifying Text Transformations

arXiv: https://arxiv.org/abs/2008.03101 · HTML: https://mlsanity.com/paper/2008.03101/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Aug 2020.

## Built on by (most cited first, 8 of 8)

- [Selective Differential Privacy for Language Modeling](https://mlsanity.com/paper/2108.12944/) (2021)
- [Preventing Author Profiling through Zero-Shot Multilingual Back-Translation](https://mlsanity.com/paper/2109.09133/) (2021)
- [Interpretable bias mitigation for textual data: Reducing gender bias in patient notes while maintaining classification performance](https://mlsanity.com/paper/2103.05841/) (2021)
- [End-to-end speech recognition modeling from de-identified data](https://mlsanity.com/paper/2207.05469/) (2022)
- [Grandma Karl is 27 years old -- research agenda for pseudonymization of research data](https://mlsanity.com/paper/2308.16109/) (2023)
- [Towards Quantifying The Privacy Of Redacted Text](https://mlsanity.com/paper/2410.07772/) (2024)
- [Less Stress, More Privacy: Stress Detection on Anonymized Speech of Air Traffic Controllers](https://mlsanity.com/paper/2507.08882/) (2025)
- [PrivBench: A Holistic and Modular Benchmarking Platform for Evaluating Text-to-Text Privatization](https://mlsanity.com/paper/2608.29624/) (2026)

## Abstract (arXiv)

Machine Learning approaches to Natural Language Processing tasks benefit from a comprehensive collection of real-life user data. At the same time, there is a clear need for protecting the privacy of the users whose data is collected and processed. For text collections, such as, e.g., transcripts of voice interactions or patient records, replacing sensitive parts with benign alternatives can provide de-identification. However, how much privacy is actually guaranteed by such text transformations, and are the resulting texts still useful for machine learning? In this paper, we derive formal privacy guarantees for general text transformation-based de-identification methods on the basis of Differential Privacy. We also measure the effect that different ways of masking private information in dialog transcripts have on a subsequent machine learning task. To this end, we formulate different masking strategies and compare their privacy-utility trade-offs. In particular, we compare a simple redact approach with more sophisticated word-by-word replacement using deep learning models on multiple natural language understanding tasks like named entity recognition, intent detection, and dialog act classification. We find that only word-by-word replacement is robust against performance drops in various tasks.