cs.CLFeb 24, 2026
SaveAdaptive Text Anonymization: Learning Privacy-Utility Trade-offs via Prompt Optimization
Organizations: Hornetsecurity, Hem, France · Univ. Lille, Inria, CNRS, Centrale Lille, UMR 9189 - CRIStAL, F-59000 Lille, France
Abstract
Anonymizing textual documents is a highly context-sensitive problem: the appropriate balance between privacy protection and utility preservation varies with the data domain, privacy objectives, and downstream application. However, existing anonymization methods rely on static, manually designed strategies that lack the flexibility to adjust to diverse requirements and often fail to generalize across domains. We introduce adaptive text anonymization, a new task formulation in which anonymization strategies are automatically adapted to specific privacy-utility requirements. We propose a framework for task-specific prompt optimization that automatically constructs anonymization instructions for language models, enabling adaptation to different privacy goals, domains, and downstream usage patterns. To evaluate our approach, we present a benchmark spanning five datasets with diverse domains, privacy constraints, and utility objectives. Across all evaluated settings, our framework consistently achieves a better privacy-utility trade-off than existing baselines, while remaining computationally efficient and effective on open-source language models, with performance comparable to larger closed-source models. Additionally, we show that our method can discover novel anonymization strategies that explore different points along the privacy-utility trade-off frontier.
Figures & tables
Figure 1: Overview of our approach. We perform reflective prompt optimization using the GEPA algorithm Agrawal et al. (2026) . Our method adapts a base seed prompt into an optimized prompt defining the privacy and utility task requirements. The optimization operates in a strict fixed budget environment while learning sufficiently strong patterns to adapt to the anonymization objective.
| Methods | DB-Bio | SynthPAI | TAB | PUPA | MedQA |
| OpenPII | 57.6/98.1 | 9.02/97.3 | 87.1/32.2 | 75.4/70.3 | 3.80/59.5 |
| DP-Prompt | 82.1/13.2 | 95.2/1.49 | 99.2/37.4 | 84.2/49.1 | 51.6/9.82 |
| RUPTA ( GPT-5) | 74.0/98.3 | - / - | - / - | - / - | - / - |
| AF ( GPT-5) | 78.0/92.1 | 64.0/57.6 | 59.9/42.5 | 94.2/46.0 | 24.4/45.8 |
| Prompt ( GPT-5) | 63.6/100 | 18.3/88.1 | 99.3/48.6 | 99.1/72.7 | 10.7/45.5 |
| (Optimized) | 65.5/100 | 22.5/94.4 | 92.3/56.2 | 98.0/79.3 | 24.6/45.9 |
Table 2: Performance of optimized Qwen3-30B-A3B compared to GPT-5 based methods, OpenPII and DP-Prompt. Models not adaptable on other tasks are marked with -.
Figure 2: Trade-off frontier visualization on three datasets across optimized models. Each point represents a distinct anonymization prompt. The dashed line connects the overall Pareto-optimal solutions across all models, demonstrating the framework’s ability to discover diverse privacy-utility trade-offs in a single optimization run.
| Model | Priv. | Util. | Anonymized Text |
| Original | — | — | hit up charity shops for books & clothes - you’d be amazed at some finds! also big into meal prepping on sundays saves me tons during busy uni days |
| Qwen3-30B-A3B | 1.0 ✓ | 0.87 ✓ | hit up secondhand stores for books & clothes - you’d be amazed at some finds! also big into meal prepping on Sundays saves me tons during busy weekdays |
| Gemma-3-27B-it | 0.0 ✗ | 0.73 ✓ | I like to shop at thrift stores for books & clothes - you’d be amazed at some finds! Also big into meal prepping on weekends, saves me a lot during busy school days |
| Mistral-Small-3.2-24B | 0.0 ✗ | 0.52 ✗ | Check out second-hand stores for books and clothing - you might be surprised by some of the treasures! Also, big into preparing meals on Sundays saves me a lot during hectic academic days |
Table 3: Qualitative comparison on SynthPAI test sample. The original text reveals the author’s education (ground truth: bachelor’s degree).
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 4: A comparison of learning behavior of our modified GEPA implementation against each separated component and a state-of-the-art prompt optimizer reference (MIPROv2). Results are measures with Gemma-3-27B-it on SynthPAI (top) and Mistral-Small-3.2-24B on TAB (bottom).
| Methods | DB-Bio | SynthPAI | TAB | PUPA | MedQA |
| No Anonymization | 6.29 † /100 † | 0 † /100 | 0/100 | 5.62 † /99.2 † | 0/64.0 † |
Table 4: Evaluation results on original texts (encoded as privacy/utility ). Tasks requiring a backbone LLM ( Gemini-2.5-flash) are marked with .
| Methods | DB-Bio | SynthPAI | TAB | PUPA | MedQA |
| Qwen3-30B-A3B | |||||
| Seed Prompt | 64.0/100 | 12.6/92.4 | 36.2/54.0 | 82.3/72.1 | 3.52/58.6 |
| Optimized Prompt | 65.5/100 | 22.5/94.4 | 92.3/56.2 | 98.0/79.3 | 24.6/45.9 |
| Qwen-2.5-7b | |||||
| Seed Prompt | 41.2/97.3 | 5.88/91.5 | 34.3/55.3 | 79.7/87.3 | 5.18/47.1 |
| Optimized Prompt | 47.1/98.0 | 17.6/86.0 | 90.6/53.2 | 88.4/79.2 | 7.29/41.2 |
Table 5: Performance of Qwen-2.5-7b compared to Qwen3-30B-A3B and their seed prompt version (encoded as privacy/utility ).
| Task | Domain | Privacy Threat | Privacy Metric | Utility Metric | Test Size |
| DB-Bio | Biographies | Identity re-identification | LLM attacker (top-3 accuracy) | Occupation classification | 239 |
| SynthPAI | Social media | Attribute inference | LLM attacker accuracy | ROUGE-1 | 617 |
| TAB | Legal documents | Sensitive span leakage | Span masking recall | Semantic similarity | 555 |
| PUPA | User prompts | PII exposure | PII detection recall | LLM-as-judge quality | 350 |
| MedQA | Medical QA | Patient re-identification | Stylistic similarity | Medical QA | 125 |
Table 6: Overview of the five anonymization tasks in our benchmark. Each task presents distinct challenges across domain, threat model, and utility requirements, enabling comprehensive evaluation of adaptive anonymization approaches.
| Methods | DB-Bio | SynthPAI | TAB | PUPA | MedQA |
| DP-Prompt ( ) | 61.2/33.8 | 85.7/5.34 | 95.6/40.4 | 76.7/54.2 | 50.6/11.7 |
| DP-Prompt ( ) | 82.1/13.2 | 95.2/1.49 | 99.2/37.4 | 84.2/49.1 | 51.6/9.82 |
| DP-MLM ( ) | 58.1/20.3 | 80.6/2.94 | 91.8/25.0 | 72.9/31.4 | 48.1/7.02 |
| DP-MLM ( ) | 77.2/7.26 | 88.5/0.75 | 95.2/22.4 | 80.0/28.5 | 49.0/5.89 |
| (Optimized) | 65.5/100 | 22.5/94.4 | 92.3/56.2 | 98.0/79.3 | 24.6/45.9 |
Table 7: Performance of optimized Qwen3-30B-A3B compared with DP-based rewriting methods across two privacy budgets. Results are reported as privacy/utility, with higher being better on both axes. Smaller generally improves privacy but substantially reduces utility.
| Method | Priv. | Util. | Cont. | Hall. |
| OpenPII | 0.52 | 0.87 | 0.78 | 0.84 |
| DP-Prompt | 0.90 | 0.08 | 0.27 | 0.78 |
| RUPTA ( GPT-5) | 0.91 | 0.87 | 0.57 | 0.70 |
| AF ( GPT-5) | 0.58 | 0.86 | 0.82 | 0.42 |
| Prompt ( GPT-5) | 0.62 | 0.91 | 0.86 | 0.80 |
| (Optimized) | 0.89 | 0.85 | 0.63 | 0.81 |
Table 8: Human evaluation of anonymization methods (judgments across DB-Bio and PUPA ). Scores are the proportion of positive binary judgments (higher is better) for privacy protection ( Priv. ), utility preservation ( Util. ), content faithfulness ( Cont. ), and absence of hallucinations ( Hall. ).
| Task: DB-Bio | |
| Method | Output |
| Original | Robin McLaurin Williams (July 21, 1951 - August 11, 2014) was an American stand-up comedian, actor, director, producer, writer, singer and voice artist. Starting as a stand-up comedian in San Francisco and Los Angeles in the mid-1970s, he is credited with leading San Francisco’s comedy renaissance. After rising to fame as Mork in Mork & Mindy (1978-1982), Williams went on to establish a career in both stand-up comedy and feature film acting. He was known for his improvisational skills. |
| OpenPII | [PERSON_NAME] [PERSON_NAME] [PERSON_NAME] ([DATE] - [DATE]) was an American stand-up comedian, actor, director, producer, writer, singer and voice artist. Starting as a stand-up comedian in [LOCATION_CITY] [LOCATION_STATE] and [LOCATION_CITY] [LOCATION_STATE] in the [TIME_PERIOD], he is credited with leading [LOCATION_CITY] [LOCATION_STATE] comedy renaissance. After rising to fame as [PERSON_NAME] in [PERSON_NAME] & [PERSON_NAME] ([YEAR] - [YEAR]), [PERSON_NAME] went on to establish a career in both stand-up comedy and feature film acting. He was known for his improvisational skills. |
| DP-Prompt | A performer with a background in stand-up rose to prominence after early work in clubs and later became famous for a role before establishing a successful career. His work spanned multiple roles, and he became especially known for energetic improvisation. |
| RUPTA ( GPT-5) | A person (born and passed away during unspecified times) was a notable figure in the entertainment industry, with roles spanning from various forms of artistry including acting, directing, producing, and voice artistry. Starting as a stand-up comedian in an unspecified location during an unspecified time, this individual is credited with leading an unspecified cultural movement in that location. After gaining recognition in an unspecified role (during an unspecified period), they went on to establish a career in stand-up comedy and feature film acting. |
| AF ( GPT-5) | An individual who was active from the late 20th century into the early 21st century was an entertainer known for work as a comedian, performer, director, producer, writer, singer, and voice artist. Starting as a stand-up comedian in a region of the United States during the 1970s, this person is credited with contributing to a local comedy renaissance. After rising to fame through a popular television role around that time, they went on to establish a career in both stand-up comedy and film acting and became known for their improvisational skills. |
Table 9: Additional qualitative examples for each text anonymization method.
More in this topic
Privacy-Utility Tradeoff
Privacy-utility tradeoffs study how to limit disclosure of sensitive information while preserving useful data, models, and services.
See all 71 papers