Residual Attribute Leakage Is an Interface: Auditing Privacy Evaluation After Text De-identification

Summary

This paper examines privacy evaluation of de-identified text, where a language model adversary guesses a protected attribute. The authors propose a prior-normalised clipped leakage score and show that rankings of text editors depend on the evaluation interface, including the queried person, answer options, prior, adversary model and scoring rule. In a stress test, an opposite-sex-writing editor misleads the adversary about most people yet ranks first under this score, while a relabelling-invariant AUC reading ranks it sixth of eight.

Related items

• MediumCVE-2026-121938: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…Similar attack · NVD/CVE Database
• MediumHundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake FeaturesSimilar attack · Wired (Security)
• MediumNew VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial ValueSimilar attack · The Hacker News
• InfoAccessed, never disclosed: Silent access to protected health information by medical artificial intelligence agentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHow Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call TracesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)