Ziwen Li, Jianing Wen, Tianshi Li
4 min
Abstract
Agentic LLMs with web search change the threat model for text anonymization: weak contextual cues can become cross-referenceable evidence for re-identification, yet those same details also carry downstream analytic value of the text. Existing defenses either remove explicit identifiers, perturb text for formal privacy, or test rewritten text against non-web inference models, leaving underexplored the operating region between resistance to agentic web-search re-identification and utility retention. We introduce AURA (\textbf{A}nonymization with \textbf{U}tility-\textbf{R}etention \textbf{A}daptation), an LLM-powered \textit{mask-reconstruct} framework that decouples privacy localization from utility-preserving reconstruction and selects candidates with adversarial privacy and utility-retention checks. We evaluate AURA on real-user interview transcripts using re-identification attacks carried out by web-search agents, along with a utility evaluation based on interviewee-profile facts, codebook facts, and the joint contextual utility grid. Our results show that AURA improves the privacy-utility frontier by using adaptive privacy scope to strengthen resistance to agentic re-identification and using a mask-reconstruct anonymization method to better preserve contextual utility under fixed privacy scope.
Sam: That's a critical question, and the authors address it directly. They use something called "adversarial selection"—essentially, they test the anonymized text against simulated attackers, like a security team deliberately trying to break into a system, to see if any identifying information slips through.
Alex: So the system plays a game of cat and mouse with itself to find the gaps?
Sam: That's right. By constantly probing for weaknesses before the text is ever released, it learns to be more cautious where it matters most. The goal is to keep what the researchers call the "privacy-utility frontier" well-balanced—meaning the system protects identity without hollowing out the analytical value of the data.
Alex: That's a meaningful distinction. It's not just about hiding information—it's about preserving the reason we collected it in the first place.
Sam: Precisely. And that balance is genuinely difficult to strike. Most privacy tools treat it as a binary choice: either the data is safe, or it's useful. AURA's contribution, if the findings hold up, is demonstrating that you can pursue both at once—by being surgical rather than blunt.
Alex: A careful approach to a problem that's only going to become more pressing as AI systems get better at connecting dots. Thanks for listening to ResearchPod.