Re-identification of De-identified Documents with Autoregressive Infilling

TL;DR

This paper introduces a novel re-identification method that uses autoregressive infilling to recover masked personal information in de-identified documents, revealing potential privacy vulnerabilities.

Contribution

It presents a RAG-inspired approach combining retrieval and infilling models to reverse de-identification, demonstrating high re-identification success rates across various datasets.

Findings

Up to 80% of masked spans successfully recovered.

Re-identification accuracy improves with more background knowledge.

Effective across diverse document types like biographies, court rulings, and clinical notes.

Abstract

Documents revealing sensitive information about individuals must typically be de-identified. This de-identification is often done by masking all mentions of personally identifiable information (PII), thereby making it more difficult to uncover the identity of the person(s) in question. To investigate the robustness of de-identification methods, we present a novel, RAG-inspired approach that attempts the reverse process of re-identification based on a database of documents representing background knowledge. Given a text in which personal identifiers have been masked, the re-identification proceeds in two steps. A retriever first selects from the background knowledge passages deemed relevant for the re-identification. Those passages are then provided to an infilling model which seeks to infer the original content of each text span. This process is repeated until all masked spans are replaced. We evaluate the re-identification on three datasets (Wikipedia biographies, court rulings and clinical notes). Results show that (1) as many as 80% of de-identified text spans can be successfully recovered and (2) the re-identification accuracy increases along with the level of background knowledge.