DP-IPI: A Hybrid Differential Privacy Text Rewriting Mechanism for Indirect Personal Identifiers in Clinical Texts

Ibrahim Baroud; Stephen Meisenbacher; Sebastian Möller; Florian Matthes; Roland Roller

cs.CLAug 31, 2026

DP-IPI: A Hybrid Differential Privacy Text Rewriting Mechanism for Indirect Personal Identifiers in Clinical Texts

Authors: Ibrahim Baroud, Stephen Meisenbacher, Sebastian Möller, Florian Matthes, Roland Roller

Organizations: Quality & Usability Lab, Technical University of Berlin, Berlin, Germany · German Research Center for Artificial Intelligence (DFKI), Berlin, Germany · Technical University of Munich, School of CIT, Garching, Germany · Munich Center for Machine Learning, Munich, Germany

Abstract

Despite the strengths of modern anonymization and de-identification techniques, the risk of re-identification remains significant due to the indirect identifiers remaining in texts. To address this problem, recent works have applied text rewriting under Differential Privacy (DP) to prevent data linkage by perturbing texts via noise addition. Such methods privatize all tokens in a text indiscriminately, diminishing text quality and usability in critical domains such as in clinical settings. Focusing on indirect personal identifiers (IPIs), we introduce a utility-preserving DP text rewriting method that only privatizes spans containing IPIs. We show that our method effectively reduces re-identification risks in clinical texts while being producing more coherent and usable output texts, leading to higher privacy-utility trade-offs. In this, we demonstrate the effectiveness of hybrid text privatization, which leverages the promise of DP in an efficient, usable manner.

Figures & tables

Figure 1: An illustrative example of our proposed DP-IPI compared to the original DP-MLM (at $\varepsilon=25$ ). In the original text, we highlight indirect personal identifiers (IPIs) extracted by our trained IPI model (in blue ). In the two corresponding privatized texts, we highlight aspects which are wrong, misleading, or hallucinated ( red ), borderline acceptable ( orange ), and suitable IPI replacements ( green ). These annotations also include medical aspects (e.g. allergies, medications) that are either improperly privatized ( red ) or correctly left unperturbed ( green ). Note: the example is a synthetically generated patient file (using Google AI Studio), meant to mirror the MIMIC-III dataset.

Category	P	R	F1	Support
details	$0.08$	$0.25$	$0.12$	$4$
family	$0.67$	$1.00$	$0.80$	$73$
appearance	$0.61$	$0.69$	$0.65$	$29$
circumstances	$0.20$	$0.37$	$0.26$	$30$
sec	$0.75$	$0.86$	$0.80$	$14$
fclt_personnel	$0.82$	$0.95$	$0.88$	$362$

Table 1: Evaluation results on the test set for RoBERTa-large in P recision, R ecall, and

\mathbf{F_{1}}

score. Support shows the number of examples in the test set.

$\epsilon$	Method	Dia $\uparrow$	Pro $\uparrow$	MP $\uparrow$	LoS $\uparrow$	S $\uparrow$	C $\downarrow$	500R $\downarrow$	50E $\downarrow$	LLM $\downarrow$	$\gamma$ $\uparrow$
-	De-identification (baseline)	73.87	80.13	76.08	66.75	-	90	99.32%	99.60%	14.29	-
25 / 0.1	DP-MLM (RoBERTa-base)	65.48	66.92	66.83	61.19	0.80	1176	10.00%	26.80%	2.10	0.73
	DP-MLM (BioMed-RoBERTa-base)	61.29	66.52	65.06	60.02	0.66	1972	1.28%	10.40%	1.35	0.76
	DP-IPI	72.93	80.11	75.35	66.12	0.98	157	8.00%	26.00%	2.95	0.80
	SANTEXT	50.76	56.34	52.06	52.66	0.44	2013	0.20%	4.00%	0.01	0.71
	SANTEXT IPI	72.61	76.71	71.01	65.79	0.95	4292	16.32%	34.80%	1.65	0.79

Table 2: Full experiment results for MIMIC-III. Scores in bold represent the best scores between all methods for each comparable

\varepsilon

, and the underlined values denote the best scores per metric across all methods and

\varepsilon

budgets. For

\varepsilon

, the left value is that used for DP-MLM (and variants), and the right is that used for SANTEXT (and variants).

Figure 2: Privacy-Utility trade-off Pareto frontier, including all methods tested in the main experiments and the hybrid setup, for each of the four tested $\varepsilon$ budgets. Utility is calculated as the average ROC-AUC ( $\uparrow$ ) across the four downstream tasks in MIMIC-III. Privacy is calculated as $100\ -$ average re-identification accuracy across attack scenarios ( 50_eval and 500_random ).

$\epsilon$	IPI Model	Dia $\uparrow$	Pro $\uparrow$	MP $\uparrow$	LoS $\uparrow$	S $\uparrow$	C $\downarrow$	500R $\downarrow$	50E $\downarrow$	LLM $\downarrow$	$\gamma$ $\uparrow$
25	Baseline	72.93	80.11	75.35	66.12	0.98	157	8.00%	26.00%	2.95	0.80
	BioMed-RoBERTa-base	73.95	80.35	75.74	65.83	0.98	155	9.72%	23.60%	2.95	0.81
	DeBERTa-v3-large	74.17	80.56	76.67	66.17	0.99	114	21.20%	33.20%	1.97	0.79
	BERT-Base	73.64	79.75	74.30	65.92	0.98	157	8.16%	21.60%	2.99	0.81
75	Baseline	73.42	81.06	75.81	66.48	0.99	136	14.00%	27.60%	2.78	0.79
	BioMed-RoBERTa-base	74.08	80.42	75.89	66.24	0.99	113	13.28%	33.20%	3.14	0.77

Table 3: Empirical utility and privacy results for the IPI model ablation. Underlined values for privacy denote statistically significant difference from the baseline (one-sample

t

-test,

p<0.05

) across five runs.

Model	P	R	$\mathbf{F_{1}}$
RoBERTa-large (baseline)	0.81	0.94	0.87
BERT-Base	0.78	0.92	0.85
DeBERTa-v3-large	0.83	0.94	0.88
BioMed-RoBERTa-base	0.83	0.93	0.88

Table 4: Ablation results on the test set for RoBERTa-large , DeBERTa-v3-large , BioMed-RoBERTa-base and BERT-Base in P recision, R ecall, and

\mathbf{F_{1}}

. Support shows the number of examples in the test set.

$\epsilon$	Method	Dia $\uparrow$	Pro $\uparrow$	MP $\uparrow$	LoS $\uparrow$	S $\uparrow$	C $\downarrow$	500R $\downarrow$	50E $\downarrow$	LLM $\downarrow$	$\gamma$ $\uparrow$
25	DP-MLM	65.48	66.92	66.83	61.19	0.80	1176	10.00%	26.80%	2.10	0.73
25	DP-IPI	72.93	80.11	75.35	66.12	0.98	157	8.00%	26.00%	2.95	0.80
	Hybrid	69.76	74.20	70.74	62.66	0.84	609	2.48%	11.20%	4.79	0.72
50	DP-MLM	69.84	72.21	71.72	63.05	0.85	815	13.60%	26.80%	4.76	0.66
50	DP-IPI	74.00	80.53	75.13	66.52	0.99	139	9.20%	26.40%	2.57	0.82
	Hybrid	70.03	75.30	70.70	62.60	0.85	540	3.96%	14.80%	4.83	0.71

Table 5: A comparison of DP-MLM (RoBERTa-base), DP-IPI, and risk-aware noise allocation, in which we apply lenient DP perturbation with

\varepsilon=100

on all non-IPI tokens to provide a minimal privacy guarantee on all tokens.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 3 — Figure 3: The prompt used to produce the LLM score for each of the original and private text counterparts.

Panel of Figure 4 — Figure 4: The prompt used to generate background information for each patient based on their admission note.

Panel of Figure 5 — Figure 5: An example of a background information text generated using the prompt presented in Figure 4 from a fictitious admission note similar to the ones in MIMIC-III.

Differential Privacy

Differential privacy limits how much an algorithm’s outputs can reveal about any one person’s data, with formal guarantees.

See all 276 papers

Differentially-Private Text Rewriting reshapes Linguistic Style
Apr 29, 2026Stefan ArnoldPrivacy-Preserving Language Models Differential Privacy
Friedrich-Alexander-Universität Erlangen-Nürnberg, Germany
Differentially Private De-identification of Dutch Clinical Notes: A Comparative Evaluation
Apr 23, 2026Michele Miranda, Xinlan Yan, Nishant Mishra +4Healthcare Differential Privacy
Sapienza University of Rome · Amsterdam UMC · University of Amsterdam +1
Beyond Theoretical Bounds: Empirical Privacy Loss Calibration for Text Rewriting Under Local Differential Privacy
Mar 24, 2026Weijun Li, Arnaud Grivet Sébert, Qiongkai Xu +2Differential Privacy Privacy Auditing
School of Computing, FSE, Macquarie University, Sydney, Australia

Apr 29, 2026J/K move · Enter open · S save

Differentially-Private Text Rewriting reshapes Linguistic Style

Stefan Arnold

Friedrich-Alexander-Universität Erlangen-Nürnberg, Germany

Privacy-Preserving Language Models Differential Privacy Privacy-Utility Tradeoff

Open paper AskPDF arXiv

Differential Privacy (DP) for text matured from disjointed word-level substitutions to contiguous sentence-level rewriting by leveraging the generative capacity of language models. While this form of text privatization is best suited for balancing formal privacy guarantees with grammatical coherence, its impact on the register identity of text remains largely unexplored. By conducting a multidimensional stylistic profiling of differentially-private rewriting, we demonstrate that the cost of privacy extends far beyond lexical variation. Specifically, we find that rewriting under privacy constraints induces a systematic functional mutation of the text's communicative signature. This shift is characterized by the severe attrition of interactive markers, contextual references, and complex subordination. By comparing autoregressive paraphrasing against bidirectional substitution across a spectrum of privacy budgets, we observe that both architectures force convergence toward a non-involved and non-persuasive register. This register-blind sanitization effectively preserves semantic content but structurally homogenizes the nuanced stylistic markers that define human-authored discourse.

Abstract

Differential Privacy

Explore similar work

Differentially-Private Text Rewriting reshapes Linguistic Style

Differentially Private De-identification of Dutch Clinical Notes: A Comparative Evaluation

Beyond Theoretical Bounds: Empirical Privacy Loss Calibration for Text Rewriting Under Local Differential Privacy