New Benchmark Reveals Text Anonymization Fails to Truly Protect Personal Data

A new research effort exposes fundamental weaknesses in how we evaluate text anonymization, showing that masking personally identifiable information (PII) on the surface often leaves sensitive data vulnerable to inference by determined adversaries.

The Problem with Current Approaches#

Existing anonymization evaluation relies on span-based metrics—measures that focus on whether specific text fragments containing PII have been hidden. This approach overlooks a critical real-world threat: an adversary doesn't need the exact data point to be visible; they can often reconstruct it from context clues scattered throughout a document. Additionally, current benchmarks typically treat documents as containing a single person's information, which fails to reflect how real-world data often involves multiple subjects whose information can leak through interconnected details.

SPIA: A New Evaluation Framework#

Researchers introduced SPIA (Subject-level PII Inference Assessment), the first benchmark designed to shift evaluation focus from individual text spans to the protection of complete individuals. The benchmark comprises 675 documents sourced from legal and online domains and introduces novel metrics that measure protection at the subject level rather than the span level.

Sobering Findings#

The results are troubling. Experiments demonstrate that even when more than 90% of PII spans are successfully masked, the protection level at the subject level plummets to as low as 33%—meaning roughly two-thirds of an individual's recoverable personal information remains exposed. The research also uncovered an asymmetry problem: when anonymization targets a specific subject, that person receives stronger protection while other individuals in the same document remain substantially more vulnerable.

Why This Matters#

These findings underscore that truly safe text anonymization requires rethinking how we measure success. Span-level metrics paint an overly optimistic picture of anonymization effectiveness, while real-world security demands that we protect individuals as coherent entities, accounting for how fragments of information across a document can be pieced together to reveal identity and sensitive details.