LLM匿名化對抗代理式再識別

摘要

具備網路搜尋能力的自主性大型語言模型改變了文字匿名化的威脅模型：微弱的上下文線索可能成為可交叉引用的重新識別證據，然而這些相同的細節也承載著文本的後續分析價值。現有的防禦措施要不移除明確識別符、擾動文本以達到正式隱私保護，要不針對非網路推論模型測試改寫後的文本，因而在抵抗自主性網路搜尋重新識別與效用保留之間的運作區間仍未被充分探索。我們提出AURA（具效用保留適應性的匿名化），一個由大型語言模型驅動的遮蔽-重建框架，將隱私定位與效用保留重建分離，並透過對抗性隱私與效用保留檢查來選出候選結果。我們利用由網路搜尋代理執行的重新識別攻擊，在真實用戶訪談記錄上評估AURA，同時基於受訪者輪廓事實、編碼簿事實及聯合上下文效用網格進行效用評估。結果顯示，AURA透過自適應隱私範圍來強化對自主性重新識別的抵抗能力，並運用遮蔽-重建匿名化方法在固定隱私範圍下更佳保留上下文效用，從而改進了隱私-效用邊界。

English

Agentic LLMs with web search change the threat model for text anonymization: weak contextual cues can become cross-referenceable evidence for re-identification, yet those same details also carry downstream analytic value of the text. Existing defenses either remove explicit identifiers, perturb text for formal privacy, or test rewritten text against non-web inference models, leaving underexplored the operating region between resistance to agentic web-search re-identification and utility retention. We introduce AURA (Anonymization with Utility-Retention Adaptation), an LLM-powered mask-reconstruct framework that decouples privacy localization from utility-preserving reconstruction and selects candidates with adversarial privacy and utility-retention checks. We evaluate AURA on real-user interview transcripts using re-identification attacks carried out by web-search agents, along with a utility evaluation based on interviewee-profile facts, codebook facts, and the joint contextual utility grid. Our results show that AURA improves the privacy-utility frontier by using adaptive privacy scope to strengthen resistance to agentic re-identification and using a mask-reconstruct anonymization method to better preserve contextual utility under fixed privacy scope.