Self-Refining Language Model Anonymizers via Adversarial Distillation

TL;DR

This paper presents SEAL, a distillation framework that trains small language models to perform effective text anonymization through adversarial interactions, enabling privacy protection without relying on proprietary models.

Contribution

Introduces SEAL, a novel adversarial distillation method for training small language models to anonymize text and evaluate outputs, reducing reliance on external proprietary models.

Findings

SLMs trained with SEAL achieve privacy-utility trade-offs comparable to GPT-4 anonymizer.

Self-refinement improves the anonymization capabilities of small language models.

SEAL enables efficient, effective anonymization without external model dependency.

Abstract

Large language models (LLMs) are increasingly used in sensitive domains, where their ability to infer personal data from seemingly benign text introduces emerging privacy risks. While recent LLM-based anonymization methods help mitigate such risks, they often rely on proprietary models (e.g., GPT-4), raising concerns about cost and the potential exposure of sensitive data to untrusted external systems. To address this, we introduce SElf-refining Anonymization with Language model (SEAL), a novel distillation framework for training small language models (SLMs) to perform effective anonymization without relying on external models at inference time. SEAL leverages adversarial interactions between an LLM anonymizer and an inference model to collect trajectories of anonymized texts and inferred attributes, which are then used to distill anonymization and critique capabilities into SLMs through supervised fine-tuning and preference learning. The resulting models learn both to anonymize text and to evaluate their outputs, enabling iterative improvement of anonymization quality via self-refinement. Experiments on SynthPAI, a dataset of synthetic personal profiles and text comments, demonstrate that SLMs trained with SEAL achieve substantial improvements in anonymization capabilities. Notably, 8B models attain a privacy-utility trade-off comparable to that of the GPT-4 anonymizer and, with self-refinement, even surpass it in terms of privacy protection. These results highlight the effectiveness of our adversarial distillation framework for training SLMs as efficient anonymizers.