大语言模型对抗智能体重新识别的匿名化

摘要

具备网络搜索能力的自主型LLM改变了文本匿名化的威胁模型：微弱的上下文线索可能成为可交叉引用的重新识别证据，但同样的细节也承载着文本的下游分析价值。现有防御手段要么移除显式标识符，要么对文本进行扰动以实现形式化隐私保护，要么针对非网络推理模型测试改写文本，均未充分探索在抵御自主型网络搜索重新识别与保留实用价值之间的操作空间。我们提出AURA（保留实用性的自适应匿名化框架），这是一个基于LLM的掩码-重构框架，将隐私定位与保留实用性的重构解耦，并通过对抗性隐私检查与实用性保留检查筛选候选方案。我们利用网络搜索代理执行的重新识别攻击对真实用户访谈记录进行AURA评估，同时基于受访者档案事实、编码手册事实及联合上下文实用性网格开展实用性评估。结果表明，AURA通过自适应隐私范围增强对自主型重新识别的抵抗能力，并在固定隐私范围内采用掩码-重构匿名化方法更好地保留上下文实用性，从而优化了隐私-实用性边界。

English

Agentic LLMs with web search change the threat model for text anonymization: weak contextual cues can become cross-referenceable evidence for re-identification, yet those same details also carry downstream analytic value of the text. Existing defenses either remove explicit identifiers, perturb text for formal privacy, or test rewritten text against non-web inference models, leaving underexplored the operating region between resistance to agentic web-search re-identification and utility retention. We introduce AURA (Anonymization with Utility-Retention Adaptation), an LLM-powered mask-reconstruct framework that decouples privacy localization from utility-preserving reconstruction and selects candidates with adversarial privacy and utility-retention checks. We evaluate AURA on real-user interview transcripts using re-identification attacks carried out by web-search agents, along with a utility evaluation based on interviewee-profile facts, codebook facts, and the joint contextual utility grid. Our results show that AURA improves the privacy-utility frontier by using adaptive privacy scope to strengthen resistance to agentic re-identification and using a mask-reconstruct anonymization method to better preserve contextual utility under fixed privacy scope.