---
title: "IncogniText — paper by Frikha et al. (2025) — summary and ideas"
description: "Large language models can infer personal details about an author, such as age, gender, income or… 27 references, cited by 8 papers here."
authors: ["Ahmed Frikha", "Nassim Walha", "Krishna Kanth Nakka", "Ricardo Mendes", "Xue Jiang", "Xuebing Zhou"]
year: 2025
venue: "Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics"
source: "https://aclanthology.org/2025.ijcnlp-long.134/"
doi: "10.18653/v1/2025.ijcnlp-long.134"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/frikha-2025-incognitext-privacy-enhancing-conditional-text/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/frikha-2025-incognitext-privacy-enhancing-conditional-text/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2025](https://md.research.elamur.ai/free/en/papers/2025/page/9/) / IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization

# IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization

**Authors:** [Ahmed Frikha](https://md.research.elamur.ai/free/en/authors/ahmed-frikha/), Nassim Walha, [Krishna Kanth Nakka](https://md.research.elamur.ai/free/en/authors/krishna-kanth-nakka/), Ricardo Mendes, [Xue Jiang](https://md.research.elamur.ai/free/en/authors/xue-jiang/) and [Xuebing Zhou](https://md.research.elamur.ai/free/en/authors/xuebing-zhou/) · **Year:** 2025 · **Venue:** [Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics](https://md.research.elamur.ai/free/en/venues/ijcnlp/) ([IJCNLP 2025](https://md.research.elamur.ai/free/en/venues/ijcnlp/2025/)) · **Publisher:** [The Asian Federation of Natural Language Processing and The Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/the-asian-federation-of-natural-language-processing-and-the-association-for/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2025.ijcnlp-long.134/) · [PDF](https://aclanthology.org/2025.ijcnlp-long.134.pdf) · [DOI 10.18653/v1/2025.ijcnlp-long.134](https://doi.org/10.18653/v1/2025.ijcnlp-long.134) · [OpenAlex](https://openalex.org/W7138024259)

**Citations:** 2 citations (OpenAlex, 2026-10-14) · [8](https://md.research.elamur.ai/free/en/papers/frikha-2025-incognitext-privacy-enhancing-conditional-text/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Large language models can infer personal details about an author, such as age, gender, income or location, from seemingly harmless text. Together, these details can help re-identify the author. Earlier defenses either edit individual words, which leaves stylistic and syntactic signals intact, or apply differential privacy, which damages utility. IncogniText takes a different approach. An LLM rewrites the text so that an attacker is steered toward a deliberately chosen *wrong* value of the attribute, rather than simply having cues removed. The method loops between two steps:
1. A local adversary model guesses the attribute and explains its reasoning.
2. An anonymizer rewrites the text using that reasoning and the target value.

The loop stops once the adversary is fooled. On synthetic conversations and real Reddit posts, IncogniText cuts attribute leakage by over 90% across eight attributes and beats several baselines. The authors also distill the method into LoRA weights for a small on-device model. This suggests privacy protection can run locally on consumer hardware with moderate utility cost.

## Key points
- **Evaluation data:**
  - 525 human-verified synthetic conversations from Staab et al. (2023), covering 8 attributes.
  - 196 relabeled Reddit samples from Dou et al. (2023), covering 5 attributes.
- **Baselines:** Azure Language Service (ALS), DP-BART-PR+, Dou-SD and FgAA (Staab et al., 2024).
- **Ablation with Phi-3-small:**
  - Conditioning on a target value is the decisive factor: leakage falls from 36.0% to 9.5%.
  - Adding the ground-truth value lowers leakage further, to roughly 7–8%.
  - Utility stays around 92%.
- **Early stopping:** Stopping once the adversary fails improves both privacy and utility. Giving the adversary the ground truth hurts all metrics.
- **On-device distillation:**
  - Setup: Qwen2-1.5B with LoRA, trained on 664 filtered extra synthetic examples.
  - Leakage: drops from 40.8% to 18.1%.
  - Utility: goes from 94.3% to 88.2%.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,954 works · [🤝 Sociology and Political Science](https://md.research.elamur.ai/free/en/shelves/social-sciences/sociology-and-political-science/) · 626 works

## Cite

Cite as: Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka, Ricardo Mendes, Xue Jiang and Xuebing Zhou. 2025. IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization. Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{frikha2025incognitext,
  title = {{IncogniText: Privacy-enhancing Conditional Text Anonymization via LLM-based Private Attribute Randomization}},
  author = {Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka, Ricardo Mendes, Xue Jiang and Xuebing Zhou},
  booktitle = {Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics},
  year = {2025},
  doi = {10.18653/v1/2025.ijcnlp-long.134},
  url = {https://doi.org/10.18653/v1/2025.ijcnlp-long.134}
}
```

- [← previous Improving Reasoning Capabilities in Small Models through Mixture-of-layers Distillation with Stepwise Attention on Key Information](https://md.research.elamur.ai/free/en/papers/chen-2025-improving-reasoning-capabilities-small-models/)
- [next → Investigating Idiomaticity in Word Representations](https://md.research.elamur.ai/free/en/papers/he-2025-investigating-idiomaticity-word-representations/)
- [↑ back to papers of 2025](https://md.research.elamur.ai/free/en/papers/2025/page/9/)

## References

27 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Aahill. What is azure ailanguage-azureaiservices, july 2023. [find](https://scholar.google.com/scholar?q=Aahill%2E+What+is+azure+ailanguage%2Dazureaiservices%2C+july+2023%2E)
2. Marah Abdin, Sam Ade Jacobs, Ammar Ahmad Awan, Jyoti Aneja, Ahmed Awadallah, Hany Awadalla, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Harkirat Behl, et al. 2024. [Phi-3 technical report: A highly capable language model locally on your phone](https://md.research.elamur.ai/free/en/papers/abdin-2024-phi-3-technical-report-highly/). arXiv preprint arXiv:2404.14219.
3. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). arXiv preprint arXiv:2303.08774.
4. Federico Albanese, Daniel Ciolek, and Nicolas D’Ippolito. 2023. Text sanitization beyond specific domains: Zero-shot redaction & substitution with large language models. arXiv preprint arXiv:2311.10785. — [arXiv:2311.10785](https://arxiv.org/abs/2311.10785) [find](https://scholar.google.com/scholar?q=Federico+Albanese%2C+Daniel+Ciolek%2C+and+Nicolas+D%E2%80%99Ippolito%2E+2023%2E+Text+sanitization+beyond+specific+domains%3A+Zero%2Dshot+redaction+%26+substitution+with+large+language+models%2E+arXiv+preprint+arXiv%3A2311%2E1078)
5. Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, Binyuan Hui, Luo Ji, Mei Li, Junyang Lin, Runji Lin, Dayiheng Liu, Gao Liu, Chengqiang Lu, Keming Lu, Jianxin Ma, Rui Men, Xingzhang Ren, Xuancheng Ren, Chuanqi Tan, Sinan Tan, Jianhong Tu, P… — [Qwen Technical Report](https://md.research.elamur.ai/free/en/papers/bai-2023-qwen-technical-report/)
6. Thomas Brewster. Chatgpt has been turned into a social media surveillance assistant, november 2023. [find](https://scholar.google.com/scholar?q=Thomas+Brewster%2E+Chatgpt+has+been+turned+into+a+social+media+surveillance+assistant%2C+november+2023%2E)
7. Yao Dou, Isadora Krsek, Tarek Naous, Anubha Kabra, Sauvik Das, Alan Ritter, and Wei Xu. 2023. Reducing privacy risks in online self-disclosures with language models. arXiv preprint arXiv:2311.09538. [find](https://scholar.google.com/scholar?q=Yao+Dou%2C+Isadora+Krsek%2C+Tarek+Naous%2C+Anubha+Kabra%2C+Sauvik+Das%2C+Alan+Ritter%2C+and+Wei+Xu%2E+2023%2E+Reducing+privacy+risks+in+online+self%2Ddisclosures+with+language+models%2E+arXiv+preprint+arXiv%3A2311%2E09538%2E)
8. Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3– 4):211–407. [find](https://scholar.google.com/scholar?q=Cynthia+Dwork%2C+Aaron+Roth%2C+et+al%2E+2014%2E+The+algorithmic+foundations+of+differential+privacy%2E+Foundations+and+Trends%C2%AE+in+Theoretical+Computer+Science%2C+9%283%E2%80%93+4%29%3A211%E2%80%93407%2E)
9. Daniel Yacob Espinosa and Grigori Sidorov. 2023. Using bert to profiling cryptocurrency influencers. In CLEF (Working Notes), pages 2568–2573. [find](https://scholar.google.com/scholar?q=Daniel+Yacob+Espinosa+and+Grigori+Sidorov%2E+2023%2E+Using+bert+to+profiling+cryptocurrency+influencers%2E+In+CLEF+%28Working+Notes%29%2C+pages+2568%E2%80%932573%2E)
10. European Parliament and Council of the European Union. Regulation (EU) 2016/679 of the European Parliament and of the Council. [find](https://scholar.google.com/scholar?q=European+Parliament+and+Council+of+the+European+Union%2E+Regulation+%28EU%29+2016%2F679+of+the+European+Parliament+and+of+the+Council%2E)
11. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. [LoRA: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). In International Conference on Learning Representations.
12. Timour Igamberdiev and Ivan Habernal. 2023. Dp-bart for privatized text rewriting under local differential privacy. arXiv preprint arXiv:2302.07636. [find](https://scholar.google.com/scholar?q=Timour+Igamberdiev+and+Ivan+Habernal%2E+2023%2E+Dp%2Dbart+for+privatized+text+rewriting+under+local+differential+privacy%2E+arXiv+preprint+arXiv%3A2302%2E07636%2E)
13. Yansong Li, Zhixing Tan, and Yang Liu. 2023. Privacy-preserving prompt tuning for large language model services. arXiv preprint arXiv:2305.06212. — [arXiv:2305.06212](https://arxiv.org/abs/2305.06212) [find](https://scholar.google.com/scholar?q=Yansong+Li%2C+Zhixing+Tan%2C+and+Yang+Liu%2E+2023%2E+Privacy%2Dpreserving+prompt+tuning+for+large+language+model+services%2E+arXiv+preprint+arXiv%3A2305%2E06212%2E+%E2%80%94+%5BarXiv%3A2305%2E06212%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2305%2E06212%29)
14. Chin-Yew Lin. 2004. [Rouge: A package for automatic evaluation of summaries](https://md.research.elamur.ai/free/en/papers/lin-2004-rouge-package-automatic-evaluation-summaries/). In Text summarization branches out, pages 74–81.
15. Fenglin Liu, Hongjian Zhou, Yining Hua, Omid Rohanian, Lei Clifton, and David Clifton. 2024. Large language models in healthcare: A comprehensive benchmark. medRxiv, pages 2024–04. [find](https://scholar.google.com/scholar?q=Fenglin+Liu%2C+Hongjian+Zhou%2C+Yining+Hua%2C+Omid+Rohanian%2C+Lei+Clifton%2C+and+David+Clifton%2E+2024%2E+Large+language+models+in+healthcare%3A+A+comprehensive+benchmark%2E+medRxiv%2C+pages+2024%E2%80%9304%2E)
16. Seth Neel and Peter Chang. 2023. Privacy issues in [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). arXiv preprint arXiv:2312.06717.
17. Shakked Noy and Whitney Zhang. 2023. Experimental evidence on the productivity effects of generative artificial intelligence. Science, 381(6654):187–192. [find](https://scholar.google.com/scholar?q=Shakked+Noy+and+Whitney+Zhang%2E+2023%2E+Experimental+evidence+on+the+productivity+effects+of+generative+artificial+intelligence%2E+Science%2C+381%286654%29%3A187%E2%80%93192%2E)
18. Reynier Ortega-Bueno, Berta Chulvi, Francisco Rangel, Paolo Rosso, and Elisabetta Fersini. 2021. Profiling irony and stereotype spreaders on twitter (irostereo). In CLEF 2022 Labs and Workshops, Notebook Papers. [find](https://scholar.google.com/scholar?q=Reynier+Ortega%2DBueno%2C+Berta+Chulvi%2C+Francisco+Rangel%2C+Paolo+Rosso%2C+and+Elisabetta+Fersini%2E+2021%2E+Profiling+irony+and+stereotype+spreaders+on+twitter+%28irostereo%29%2E+In+CLEF+2022+Labs+and+Workshops%2C+Noteb)
19. Ildikó Pilán, Pierre Lison, Lilja Øvrelid, Anthi Papadopoulou, David Sánchez, and Montserrat Batet. 2022. [The text anonymization benchmark (tab): A dedicated corpus and evaluation framework for text anonymization](https://md.research.elamur.ai/free/en/papers/pilan-2022-text-anonymization-benchmark-tab-dedicated/). Computational Linguistics, 48(4):1053–1101.
20. Francisco Rangel, Gretel Liz de la Peña-Sarracén, María Alberta Chulvi-Ferriols, Elisabetta Fersini, and Paolo Rosso. 2021. Profiling hate speech spreaders on twitter task at pan 2021. In Proceedings of the Working Notes of CLEF 2021, Conference and Labs of the Evaluation Forum, Bucharest, Romania,… [find](https://scholar.google.com/scholar?q=Francisco+Rangel%2C+Gretel+Liz+de+la+Pe%C3%B1a%2DSarrac%C3%A9n%2C+Mar%C3%ADa+Alberta+Chulvi%2DFerriols%2C+Elisabetta+Fersini%2C+and+Paolo+Rosso%2E+2021%2E+Profiling+hate+speech+spreaders+on+twitter+task+at+pan+2021%2E+In+Proceedings+)
21. Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. 2023. Beyond memorization: Violating privacy via inference with large language models. arXiv preprint arXiv:2310.07298. — [arXiv:2310.07298](https://arxiv.org/abs/2310.07298) [find](https://scholar.google.com/scholar?q=Robin+Staab%2C+Mark+Vero%2C+Mislav+Balunovic%CC%81%2C+and+Martin+Vechev%2E+2023%2E+Beyond+memorization%3A+Violating+privacy+via+inference+with+large+language+models%2E+arXiv+preprint+arXiv%3A2310%2E07298%2E+%E2%80%94+%5BarXiv%3A2310%2E0729)
22. Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. 2024. Large language models are advanced anonymizers. arXiv preprint arXiv:2402.13846. — [arXiv:2402.13846](https://arxiv.org/abs/2402.13846) [find](https://scholar.google.com/scholar?q=Robin+Staab%2C+Mark+Vero%2C+Mislav+Balunovic%CC%81%2C+and+Martin+Vechev%2E+2024%2E+Large+language+models+are+advanced+anonymizers%2E+arXiv+preprint+arXiv%3A2402%2E13846%2E+%E2%80%94+%5BarXiv%3A2402%2E13846%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2402%2E138)
23. Zhongxiang Sun. 2023. A short survey of viewing large language models in legal aspect. arXiv preprint arXiv:2303.09136. [find](https://scholar.google.com/scholar?q=Zhongxiang+Sun%2E+2023%2E+A+short+survey+of+viewing+large+language+models+in+legal+aspect%2E+arXiv+preprint+arXiv%3A2303%2E09136%2E)
24. Latanya Sweeney. 2000. Simple demographics often identify people uniquely. Health (San Francisco), 671(2000):1–34. [find](https://scholar.google.com/scholar?q=Latanya+Sweeney%2E+2000%2E+Simple+demographics+often+identify+people+uniquely%2E+Health+%28San+Francisco%29%2C+671%282000%29%3A1%E2%80%9334%2E)
25. Michael Tschuggnall and Günther Specht. 2014. Enhancing authorship attribution by utilizing syntax tree profiles. In Proceedings of the 14th Conference of the European Chapter of the Association for Computational Linguistics, volume 2: Short Papers, pages 195–199. [find](https://scholar.google.com/scholar?q=Michael+Tschuggnall+and+G%C3%BCnther+Specht%2E+2014%2E+Enhancing+authorship+attribution+by+utilizing+syntax+tree+profiles%2E+In+Proceedings+of+the+14th+Conference+of+the+European+Chapter+of+the+Association+for+C)
26. Target Anon Adv ES Privacy (↓) BLEU ROUGE Utility ✗ Inf uncond ✓ 38.1 64.8 67.8 98.4 ✓ Inf uncond ✓ 14.5 74.6 75.2 92.1 14.7 75.7 77.4 93.0 ✓ GT uncond ✓ ✓ GT+Inf uncond ✓ 15.2 74.1 75.0 91.8 13.9 70.6 71.6 92.7 ✓ GT+Inf GT ✓ Benjamin Weggenmann, Valentin Rublack, Michael Andrejczuk, Justus Mattern,… — [Finetuned Language Models Are Zero-Shot Learners](https://md.research.elamur.ai/free/en/papers/wei-2021-finetuned-language-models-zero-shot/)
27. Jiacen Xu, Jack W Stokes, Geoff McDonald, Xuesong Bai, David Marshall, Siyue Wang, Adith Swaminathan, and Zhou Li. 2024. Autoattacker: A large language model guided system to implement automatic cyber-attacks. arXiv preprint arXiv:2403.01038. — [arXiv:2403.01038](https://arxiv.org/abs/2403.01038) [find](https://scholar.google.com/scholar?q=Jiacen+Xu%2C+Jack+W+Stokes%2C+Geoff+McDonald%2C+Xuesong+Bai%2C+David+Marshall%2C+Siyue+Wang%2C+Adith+Swaminathan%2C+and+Zhou+Li%2E+2024%2E+Autoattacker%3A+A+large+language+model+guided+system+to+implement+automatic+cyber)

*Updated 1 November 2026*