---
title: "The Conundrum of Trustworthy Research on Attacking"
description: "Several recent studies claim that attacks, often using LLMs, can recover the removed details. 40 references."
authors: ["Sebastian Ochs", "Ivan Habernal"]
year: 2026
venue: "Computational Linguistics"
source: "https://aclanthology.org/2026.cl-2.8/"
doi: "10.1162/coli.a.615"
licence: "CC BY-NC-ND 4.0 (Computational Linguistics, MIT Press)"
licence_url: "https://creativecommons.org/licenses/by-nc-nd/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/ochs-2026-conundrum-trustworthy-research-attacking-personally/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/ochs-2026-conundrum-trustworthy-research-attacking-personally/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/52/) / The Conundrum of Trustworthy Research on Attacking Personally Identifiable Information Removal Techniques

# The Conundrum of Trustworthy Research on Attacking Personally Identifiable Information Removal Techniques

**Authors:** Sebastian Ochs and [Ivan Habernal](https://md.research.elamur.ai/free/en/authors/ivan-habernal/) · **Year:** 2026 · **Venue:** [Computational Linguistics](https://md.research.elamur.ai/free/en/venues/cl/) ([Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/cl/2026/)) · **Publisher:** [The MIT Press](https://md.research.elamur.ai/free/en/publishers/the-mit-press/) · **Licence:** [CC BY-NC-ND 4.0 (Computational Linguistics, MIT Press)](https://creativecommons.org/licenses/by-nc-nd/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.cl-2.8/) · [PDF](https://aclanthology.org/2026.cl-2.8.pdf) · [DOI 10.1162/coli.a.615](https://doi.org/10.1162/coli.a.615) · [OpenAlex](https://openalex.org/W7135033727)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Tools that strip personally identifiable information (PII) from text are widely used to share sensitive legal and medical documents. Several recent studies claim that attacks, often using LLMs, can recover the removed details. Ochs and Habernal argue that these reported success rates are inflated.

They re-examine earlier attack evaluations and find that data leakage and contamination are rarely controlled. The supposedly private texts are often already public, or the attack model may have memorized them during pretraining. A successful recovery may therefore show what the attacker already knew, not a weakness in the sanitization.

The authors consider which data sources and setups could avoid this problem. They also run two small experiments on material unlikely to be in pretraining corpora: Czech court announcements and English YouTube travel vlogs, scored with EM@3. The results suggest that some PII can still be inferred from sanitized text alone. However, a reliable verdict requires truly private data, which public researchers generally cannot obtain. The paper therefore questions the evidence behind claims about both privacy risk and protection, and it calls for formal threat models.

## Key points
- The paper asks two research questions. Are current evaluations of PII reconstruction attacks flawed? The answer is yes, because leakage is not excluded. Can public researchers fix this without sensitive data? The answer is not in an openly verifiable, reproducible way.
- Among the attacks the paper critiques are those by Charpentier and Lison (2025), Lukas et al. (2023), Patsakis and Lykousas (2023), and Nyffenegger, Stürmer, and Niklaus (2024). Proprietary LLMs with undisclosed training data are singled out as especially hard to assess.
- The authors' own experiments use Czech court announcements (legal domain) and personal English YouTube vlogs, with a single prompt and the EM@3 metric. Acknowledged limitations are possible contamination of the Czech data and reliance on one prompt.
- The background contrasts GDPR with HIPAA's Safe Harbor method, which requires removing 18 PHI types. It also cites Weitzenboeck et al. (2022): under the strictest GDPR reading, redacted text becomes useless when the adversary holds the originals.
- As a way forward, the authors propose formal threat models covering data access, attacker capabilities, and defenses. They judge DP, k-anonymity, and Contextual Integrity poorly suited to this problem, and they leave the formal framework itself to future work.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Technische Universität Darmstadt](https://md.research.elamur.ai/free/en/universities/technische-universitat-darmstadt/) — University, Darmstadt, Germany · 114 works · 36,326 citations
- [Ruhr University Bochum](https://md.research.elamur.ai/free/en/universities/ruhr-university-bochum/) — University, Bochum, Germany · 27 works · 1,189 citations

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,954 works · [🤝 Sociology and Political Science](https://md.research.elamur.ai/free/en/shelves/social-sciences/sociology-and-political-science/) · 626 works · [🎯 Decision Sciences](https://md.research.elamur.ai/free/en/shelves/decision-sciences/) · 249 works · [🎯 Management Science and Operations Research](https://md.research.elamur.ai/free/en/shelves/decision-sciences/management-science-and-operations-research/) · 134 works

🧭 Topics (1): [⚖️ Legal AI](https://md.research.elamur.ai/free/en/topics/legal-ai/) · 150 works

## Cite

Cite as: Sebastian Ochs and Ivan Habernal. 2026. The Conundrum of Trustworthy Research on Attacking Personally Identifiable Information Removal Techniques. Computational Linguistics.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@article{ochs2026conundrum,
  title = {{The Conundrum of Trustworthy Research on Attacking Personally Identifiable Information Removal Techniques}},
  author = {Sebastian Ochs and Ivan Habernal},
  journal = {Computational Linguistics},
  year = {2026},
  doi = {10.1162/coli.a.615},
  url = {https://doi.org/10.1162/coli.a.615}
}
```

- [← previous The Construction of the CORALSE Corpus, Now and Beyond: A Tool for Documenting Spanish Sign Language](https://md.research.elamur.ai/free/en/papers/soneira-2026-construction-coralse-corpus-now-beyond/)
- [next → The Cost of Perfect English: Pragmatic Flattening and the Erasure of Authorial Voice in L2 Writing Supported by GenAI](https://md.research.elamur.ai/free/en/papers/liu-2026-cost-perfect-english-pragmatic-flattening/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/52/)

## References

40 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Adrian, David, Karthikeyan Bhargavan, Zakir Durumeric, Pierrick Gaudry, Matthew Green, J. Alex Halderman, Nadia Heninger, Drew Springall, Emmanuel Thomé, Luke Valenta, et al. 2015. Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice. In Proceedings of the 22nd ACM SIGSAC Conference on C… [find](https://scholar.google.com/scholar?q=Adrian%2C+David%2C+Karthikeyan+Bhargavan%2C+Zakir+Durumeric%2C+Pierrick+Gaudry%2C+Matthew+Green%2C+J%2E+Alex+Halderman%2C+Nadia+Heninger%2C+Drew+Springall%2C+Emmanuel+Thome%CC%81%2C+Luke+Valenta%2C+et+al%2E+2015%2E+Imperfect+Forward+)
2. Aviram, Nimrod, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, et al. 2016. DROWN: Breaking TLS using SSLv2. In Proceedings of the 25th USENIX Conference on Security Symposium, pages 689–706. Balloccu, S… — [doi:10.18653/v1/2024](https://doi.org/10.18653/v1/2024) [find](https://scholar.google.com/scholar?q=Aviram%2C+Nimrod%2C+Sebastian+Schinzel%2C+Juraj+Somorovsky%2C+Nadia+Heninger%2C+Maik+Dankel%2C+Jens+Steube%2C+Luke+Valenta%2C+David+Adrian%2C+J%2E+Alex+Halderman%2C+Viktor+Dukhovni%2C+et+al%2E+2016%2E+DROWN%3A+Breaking+TLS+using+S)
3. Brown, Tom, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D. Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. [Language models are few-shot learners](https://md.research.elamur.ai/free/en/papers/brown-2020-language-models-few-shot-learners/). In Advances in Neural Information Processing Systems, volume 33, pages 1877–1901.
4. Carlini, Nicholas, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. 2023. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations. https://doi.org/10.52202/075280-1708 Carlini, Nicholas, Florian… [↗](https://doi.org/10.52202/075280-1708)
5. Carrell, David S., Bradley A. Malin, David J. Cronkite, John S. Aberdeen, Cheryl Clark, Muqun Li, Dikshya Bastakoty, Steve Nyemba, and Lynette Hirschman. 2020. [Resilience of clinical text de-identified with “hiding in plain sight” to hostile reidentification attacks by human readers](https://md.research.elamur.ai/free/en/papers/chalkidis-2019-neural-legal-judgment-prediction-english/). Journal of the…
6. Costa, Paul T. and Robert R. McCrae. 2008. The Revised NEO Personality Inventory (NEO-PI-R). In The SAGE Handbook of Personality Theory and Assessment: Volume 2—Personality Measurement and Testing. SAGE Publications Ltd, pages 179–198. https://doi.org/10.4135/9781849200479.n9 Costa-jussà, Marta R.… — [doi:10.1038/s41586-024](https://doi.org/10.1038/s41586-024) [↗](https://doi.org/10.4135/9781849200479.n9)
7. Diffie, W. and M. Hellman. 1976. New directions in cryptography. IEEE Transactions on Information Theory, 22(6):644–654. https://doi.org/10 .1109/TIT.1976.1055638 Dorr, D. A., W. F. Phillips, S. Phansalkar, S. A. Sims, and J. F. Hurdle. 2006. Assessing the difficulty and time cost of de-identificati… — [doi:10.1055/s-0038-1634080](https://doi.org/10.1055/s-0038-1634080) [find](https://scholar.google.com/scholar?q=Diffie%2C+W%2E+and+M%2E+Hellman%2E+1976%2E+New+directions+in+cryptography%2E+IEEE+Transactions+on+Information+Theory%2C+22%286%29%3A644%E2%80%93654%2E+https%3A%2F%2Fdoi%2Eorg%2F10+%2E1109%2FTIT%2E1976%2E1055638+Dorr%2C+D%2E+A%2E%2C+W%2E+F%2E+Phillips%2C+S%2E+Phans)
8. Elazar, Yanai and Yoav Goldberg. 2018. [Adversarial removal of demographic attributes from text data](https://md.research.elamur.ai/free/en/papers/elazar-2018-adversarial-removal-demographic-attributes-text/). In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 11–21. https://doi.org/10.18653/v1/D18-1002 [↗](https://doi.org/10.18653/v1/D18-1002)
9. European Commission. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regu… [find](https://scholar.google.com/scholar?q=European+Commission%2E+2016%2E+Regulation+%28EU%29+2016%2F679+of+the+European+Parliament+and+of+the+Council+of+27+April+2016+on+the+protection+of+natural+persons+with+regard+to+the+processing+of+personal+data+a)
10. Ford, Elizabeth, John A. Carroll, Helen E. Smith, Donia Scott, and Jackie A. Cassell. 2016. Extracting information from the text of electronic medical records to improve case detection: A systematic review. Journal of the American Medical Informatics Association, 23(5):1007–1015. https://doi.org/10… — [doi:10.1093/jamia/ocv180](https://doi.org/10.1093/jamia/ocv180) [find](https://scholar.google.com/scholar?q=Ford%2C+Elizabeth%2C+John+A%2E+Carroll%2C+Helen+E%2E+Smith%2C+Donia+Scott%2C+and+Jackie+A%2E+Cassell%2E+2016%2E+Extracting+information+from+the+text+of+electronic+medical+records+to+improve+case+detection%3A+A+systematic+r)
11. Holmes, Langdon, Scott Crossley, Harshvardhan Sikka, and Wesley Morris. 2023. PIILO: An open-source system for personally identifiable information labeling and obfuscation. Information and Learning Sciences, 124(9/10):266–284. https://doi.org/10.1108/ILS-04 -2023-0032 Huang, Baixiang, Canyu Chen, an… [↗](https://doi.org/10.1108/ILS-04)
12. Ippolito, Daphne, Florian Tramer, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher Choquette Choo, and Nicholas Carlini. 2023. [Preventing generation of verbatim memorization in language models gives a false sense of privacy](https://md.research.elamur.ai/free/en/papers/ippolito-2023-preventing-generation-verbatim-memorization-language/). In Proceedings of the 16th International Natural La…
13. Kifer, Daniel, John M. Abowd, Robert Ashmead, Ryan Cumings-Menon, Philip Leclerc, Ashwin Machanavajjhala, William Sexton, and Pavel Zhuravlev. 2022. [find](https://scholar.google.com/scholar?q=Kifer%2C+Daniel%2C+John+M%2E+Abowd%2C+Robert+Ashmead%2C+Ryan+Cumings%2DMenon%2C+Philip+Leclerc%2C+Ashwin+Machanavajjhala%2C+William+Sexton%2C+and+Pavel+Zhuravlev%2E+2022%2E)
14. Bayesian and frequentist semantics for common variations of differential privacy: Applications to the 2020 Census. arXiv preprint arXiv:2209.03310. — [arXiv:2209.03310](https://arxiv.org/abs/2209.03310) [find](https://scholar.google.com/scholar?q=Bayesian+and+frequentist+semantics+for+common+variations+of+differential+privacy%3A+Applications+to+the+2020+Census%2E+arXiv+preprint+arXiv%3A2209%2E03310%2E+%E2%80%94+%5BarXiv%3A2209%2E03310%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2209%2E0331)
15. Kifer, Daniel and Ashwin Machanavajjhala. 2011. No free lunch in data privacy. In Proceedings of the 2011 ACM SIGMOD International Conference on Management of Data (PODS 11), pages 193–204. https://doi.org/10.1145/1989323.1989345 Kim, Siwon, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and… — [doi:10.1145/1989323.1989345](https://doi.org/10.1145/1989323.1989345) [↗](https://doi.org/10.1145/1989323.1989345)
16. Kleinberg, Bennett, Toby Davies, and Maximilian Mozes. 2022. Textwash – automated open-source text anonymisation. arXiv:2208.13081. — [arXiv:2208.13081](https://arxiv.org/abs/2208.13081) [find](https://scholar.google.com/scholar?q=Kleinberg%2C+Bennett%2C+Toby+Davies%2C+and+Maximilian+Mozes%2E+2022%2E+Textwash+%E2%80%93+automated+open%2Dsource+text+anonymisation%2E+arXiv%3A2208%2E13081%2E+%E2%80%94+%5BarXiv%3A2208%2E13081%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2208%2E13081%29)
17. Klimt, Bryan and Yiming Yang. 2004. The Enron corpus: A new dataset for email classification research. In Machine Learning: ECML 2004, pages 217–226. https://doi.org/10.1007/978-3-540-30115-8 22 Kocetkov, Denis, Raymond Li, Loubna Ben allal, Jia LI, Chenghao Mou, Yacine Jernite, Margaret Mitchell,… [↗](https://doi.org/10.1007/978-3-540-30115-8)
18. Leonard, Robert A., Juliane E. R. Ford, and Tanya Karoli Christensen. 2017. Forensic linguistics: Applying the science of linguistics to issues of the law. Hofstra Law Review, 45(3):Article 11. [find](https://scholar.google.com/scholar?q=Leonard%2C+Robert+A%2E%2C+Juliane+E%2E+R%2E+Ford%2C+and+Tanya+Karoli+Christensen%2E+2017%2E+Forensic+linguistics%3A+Applying+the+science+of+linguistics+to+issues+of+the+law%2E+Hofstra+Law+Review%2C+45%283%29%3AArticle+11%2E)
19. Li, Haoran, Wei Fan, Yulin Chen, Cheng Jiayang, Tianshu Chu, Xuebing Zhou, Peizhao Hu, and Yangqiu Song. 2025. [Privacy checklist: Privacy violation detection grounding on contextual integrity theory](https://md.research.elamur.ai/free/en/papers/liu-2019-roberta-robustly-optimized-bert-pretraining/). In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for…
20. Liu, Zhengliang, Yue Huang, Xiaowei Yu, Lu Zhang, Zihao Wu, Chao Cao, Haixing Dai, Lin Zhao, Yiwei Li, Peng Shu, Fang Zeng, Lichao Sun, Wei Liu, Dinggang Shen, Quanzheng Li, Tianming Liu, Dajiang Zhu, and Xiang Li. 2023. [DeID-GPT: Zero-shot medical text de-identification by GPT-4](https://md.research.elamur.ai/free/en/papers/lukas-2023-analyzing-leakage-personally-identifiable-information/). arXiv:2303.11032 L…
21. Meisenbacher, Stephen and Florian Matthes. 2024. Thinking outside of the differential privacy box: A case study in text privatization with language model prompting. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 5656–5665. https://doi.org/10.18653/v1… [↗](https://doi.org/10.18653/v1…)
22. Google Security Advisory. Morris, John, Justin Chiu, Ramin Zabih, and Alexander Rush. 2022. Unsupervised text deidentification. In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 4777–4788. https://doi.org/10.18653/v1/2022.findings -emnlp.352 Mouhammad, Nina, Johannes Da… [↗](https://doi.org/10.18653/v1/2022.findings)
23. Neamatullah, Ishna, Matthew M. Douglass, Li-Wei H. Lehman, Andrew T. Reisner, Mauricio Villarroel, William J. Long, Roger G. Mark, and Gari D. Clifford. 2008. Automated de-identification of free-text medical records. BMC Medical Informatics and Decision Making, 8(1):32. https://doi.org/10.1186/1472… [↗](https://doi.org/10.1186/1472…)
24. Olstad, Annika Willoch, Anthi Papadopoulou, and Pierre Lison. 2023. Generation of replacement options in text sanitization. In Proceedings of the 24th Nordic Conference on Computational Linguistics (NoDaLiDa), pages 292–300. OpenAI, :, Sandhini Agarwal, Lama Ahmad, Jason Ai, Sam Altman, Andy Appleba… [find](https://scholar.google.com/scholar?q=Olstad%2C+Annika+Willoch%2C+Anthi+Papadopoulou%2C+and+Pierre+Lison%2E+2023%2E+Generation+of+replacement+options+in+text+sanitization%2E+In+Proceedings+of+the+24th+Nordic+Conference+on+Computational+Linguistics+%28N)
25. Pal, Anwesan, Radhika Bhargava, Kyle Hinsz, Jacques Esterhuizen, and Sudipta Bhattacharya. 2024. The empirical impact of data sanitization on language models. In Neurips Safe Generative AI Workshop 2024. [find](https://scholar.google.com/scholar?q=Pal%2C+Anwesan%2C+Radhika+Bhargava%2C+Kyle+Hinsz%2C+Jacques+Esterhuizen%2C+and+Sudipta+Bhattacharya%2E+2024%2E+The+empirical+impact+of+data+sanitization+on+language+models%2E+In+Neurips+Safe+Generative+AI+Workshop+20)
26. Papadopoulou, Anthi, Yunhao Yu, Pierre Lison, and Lilja Øvrelid. 2022. Neural text sanitization with explicit measures of privacy risk. In Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 12th International Joint Conference on Nat… [find](https://scholar.google.com/scholar?q=Papadopoulou%2C+Anthi%2C+Yunhao+Yu%2C+Pierre+Lison%2C+and+Lilja+%C3%98vrelid%2E+2022%2E+Neural+text+sanitization+with+explicit+measures+of+privacy+risk%2E+In+Proceedings+of+the+2nd+Conference+of+the+Asia%2DPacific+Chapter)
27. Pillutla, Krishna, Swabha Swayamdipta, Rowan Zellers, John Thickstun, Sean Welleck, Yejin Choi, and Zaid Harchaoui. 2021. [MAUVE: Measuring the gap between neural text and human text using divergence frontiers](https://md.research.elamur.ai/free/en/papers/pillutla-2021-mauve-measuring-gap-between-neural/). In Proceedings of the 35th International Conference on Neural Information Processing Syste…
28. Potter, Danielle, Raven Brothers, Andrej Kolacevski, Jacob E. Koskimaki, Amy McNutt, Robert S. Miller, Jatin Nagda, Anil Nair, Wendy S. Rubinstein, Andrew K. Stewart, Iris J. Trieb, and George A. Komatsoulis. 2020. Development of CancerLinQ, a health information learning platform from multiple elect… [find](https://scholar.google.com/scholar?q=Potter%2C+Danielle%2C+Raven+Brothers%2C+Andrej+Kolacevski%2C+Jacob+E%2E+Koskimaki%2C+Amy+McNutt%2C+Robert+S%2E+Miller%2C+Jatin+Nagda%2C+Anil+Nair%2C+Wendy+S%2E+Rubinstein%2C+Andrew+K%2E+Stewart%2C+Iris+J%2E+Trieb%2C+and+George+A%2E+Koma)
29. Seegmiller, Parker and Sarah Preum. 2023. Statistical depth for ranking and characterizing transformer-based text embeddings. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 9600–9611. https://doi.org/10.18653/v1/2023 .emnlp-main.596 Soldaini, Luca, R… [↗](https://doi.org/10.18653/v1/2023)
30. Staab, Robin, Mark Vero, Mislav Balunovic, and Martin Vechev. 2025. Language models are advanced anonymizers. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Staab%2C+Robin%2C+Mark+Vero%2C+Mislav+Balunovic%2C+and+Martin+Vechev%2E+2025%2E+Language+models+are+advanced+anonymizers%2E+In+The+Thirteenth+International+Conference+on+Learning+Representations%2E)
31. Stevens, Marc, Elie Bursztein, Pierre Karpman, Ange Albertini, and Yarik Markov. 2017. The first collision for full SHA-1. In Advances in Cryptology – CRYPTO 2017, pages 570–596. https://doi.org/10.1007/978-3-319 -63688-7 19 Stubbs, Amber and Özlem Uzuner. 2015. Annotating longitudinal clinical nar… [↗](https://doi.org/10.1007/978-3-319)
32. Sweeney, Latanya. 2000. Simple demographics often identify people uniquely. Health (San Francisco), 671(2000):1–34. [find](https://scholar.google.com/scholar?q=Sweeney%2C+Latanya%2E+2000%2E+Simple+demographics+often+identify+people+uniquely%2E+Health+%28San+Francisco%29%2C+671%282000%29%3A1%E2%80%9334%2E)
33. Sweeney, Latanya. 2002. k-anonymity: A model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5):557–570. https://doi.org/10.1142/S0218488502001648 Sweeney, Latanya, Ji Su Yoo, Laura J. Perovich, Katherine E. Boronow, Phil Brown, and Julia Gree… [↗](https://doi.org/10.1142/S0218488502001648)
34. Terzidou, Kalliopi. 2023. Automated anonymization of court decisions: Facilitating the publication of court decisions through algorithmic systems. In Proceedings of the Nineteenth International Conference on Artificial Intelligence and Law, ICAIL ’23, pages 297–305. https://doi.org/10.1145/3594536… — [doi:10.1145/3594536](https://doi.org/10.1145/3594536) [↗](https://doi.org/10.1145/3594536…)
35. Congress. 1996. Health Insurance Portability and Accountability Act of 1996. U.S. Public Law. Public Law 104-191. [find](https://scholar.google.com/scholar?q=Congress%2E+1996%2E+Health+Insurance+Portability+and+Accountability+Act+of+1996%2E+U%2ES%2E+Public+Law%2E+Public+Law+104%2D191%2E)
36. U.S. Government. 2013. Code of Federal Regulations, Title 45, Section 164.514b(1) (2013). [https://www.ecfr.gov/current/title-45/part-164/section-164](https://www.ecfr.gov/current/title-45/part-164/section-164) .514\#p-164.514(b) Utpala, Saiteja, Sara Hooker, and Pin-Yu Chen. 2023. Locally differentially private document generation using zero shot prompting. I… — [doi:10.18653/v1/2023.findings](https://doi.org/10.18653/v1/2023.findings) [↗](https://www.ecfr.gov/current/title-45/part-164/section-164)
37. Wei, Jason, Yi Tay, Rishi Bommasani, Colin Raffel, Barret Zoph, Sebastian Borgeaud, Dani Yogatama, Maarten Bosma, Denny Zhou, Donald Metzler, Ed H. Chi, Tatsunori Hashimoto, Oriol Vinyals, Percy Liang, Jeff Dean, and William Fedus. 2022. [Emergent abilities of large language models](https://md.research.elamur.ai/free/en/papers/wei-2022-emergent-abilities-large-language-models/). Transactions on M…
38. Survey Certification. Weitzenboeck, Emily M., Pierre Lison, Malgorzata Cyndecka, and Malcolm Langford. 2022. The GDPR and unstructured data: Is anonymization possible? International Data Privacy Law, 12(3):184–206. https://doi.org/10 .1093/idpl/ipac008 Xie, Chulin, Zinan Lin, Arturs Backurs, Sivakan… [find](https://scholar.google.com/scholar?q=Survey+Certification%2E+Weitzenboeck%2C+Emily+M%2E%2C+Pierre+Lison%2C+Malgorzata+Cyndecka%2C+and+Malcolm+Langford%2E+2022%2E+The+GDPR+and+unstructured+data%3A+Is+anonymization+possible%3F+International+Data+Privacy+Law%2C+)
39. Yang, Tianyu, Xiaodan Zhu, and Iryna Gurevych. 2025. Robust utility-preserving text anonymization based on large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 28922–28941. https://doi.org/10.18653/v1/2025.a… [↗](https://doi.org/10.18653/v1/2025.a…)
40. Zhang, Meng, Xiangyang Luo, and Ningbo Huang. 2025. Social media user geolocation based on large language models. In Data Security and Privacy Protection, pages 304–312. https://doi.org/10.1007/978-981-97-8540 -7 19 Zhong, Haoxi, Chaojun Xiao, Cunchao Tu, Tianyang Zhang, Zhiyuan Liu, and Maosong Su… — [doi:10.1007/978-981-97-8540](https://doi.org/10.1007/978-981-97-8540) [↗](https://doi.org/10.1007/978-981-97-8540)

*Updated 2 November 2026*