I Am No One: Style-Aware Paraphrasing for Text Anonymization
Ahmed Sohair Khan, Estrid He, Monica Wachowicz, Elham Naghizade
cs.CL · cs.CR
Quick verdict
LLM style-profile rewriting cuts authorship F1 60-73% with fluency kept; promising, but no significance tests, weak attacker models, missing non-DP baselines.
Summary
This method paper addresses stylometric re-identification: authorship attribution models can deanonymize text even after explicit identifiers are removed. The authors propose a two-module, prompt-driven pipeline built on LLaMA-3.2-3B-Instruct (with MiniCPM3-4B to test model-agnosticism). A Style-Profiling Module prompts the LLM to produce a human-readable author profile from just five sample texts across four stylometric dimensions (sentence length, vocabulary, tone, punctuation); a Style-Guided Rewriting Module then rewrites new text while suppressing the profiled cues. On AUTHOR10 (10 bloggers, 15,070 posts) authorship F1 falls from 66.45 to 26.02, and on ILLINOIS9 (9 Google reviewers, 3,959 reviews) from 76.78 to 20.76, with perplexity near original levels (42.47 vs 41 on AUTHOR10) and the best fluency-aware gain (0.442 and 0.584) among all compared methods - beating ALISON (F1 29.53/29.72 but PPL 368-461) and strict DP-Prompt (F1 7.13/23.42 but PPL up to 8,770). Ablations show the full profile is the most stable configuration, although Length-only nearly matches it on ILLINOIS9, and semi-guided rewriting reaches similar F1 with slightly worse utility. Supplementary results claim robustness to a white-box adversary that retrains on anonymized data (F1 from 77 to 35 on ILLINOIS9). Main limitations: no statistical significance testing, a single attacker classifier per dataset, heuristic privacy without formal guarantees, and StyleRemix/JAMDEC cited but not empirically compared.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Explicit LLM-constructed style profiles from only five samples per author are sufficient control signals for anonymizing rewrites.
- Style-guided rewriting reduces authorship attribution F1 from 66.45 to 26.02 on AUTHOR10 and from 76.78 to 20.76 on ILLINOIS9 while keeping perplexity near original levels.
- The approach achieves the best fluency-aware privacy-utility trade-off (0.442 and 0.584) among all compared DP-based and non-DP baselines.
- Gains persist against a white-box adversary that retrains on anonymized data (F1 from 77 to 35 on ILLINOIS9) and on out-of-domain Yelp/IMDB text (F1 drops >85%).
- Explicit style profiles materially outperform generic paraphrasing (unguided F1 36.61 vs 26.02 on AUTHOR10).
Strengths
Interpretable, targeted obfuscation mechanism
Human-readable per-author profiles over four stylometric dimensions act as explicit control signals; Table 3 shows the full profile is the most stable configuration, and the channel ablation (Length-only F1 19.32 vs Full 20.76 on ILLINOIS9) is genuinely informative about which cues matter.
Strong fluency-adjusted trade-off against both DP and non-DP baselines
Table 2: best fluency-aware gain on both datasets (0.442 AUTHOR10, 0.584 ILLINOIS9) with PPL near original (42.47 vs 41), whereas strict DP at epsilon=25 reaches F1 7.13 only at PPL 8,770 and ALISON pays PPL 368.30/461.37 for comparable F1.
Two-dataset, two-model evaluation with a rare-token-aware utility metric
Candid limitations and disclosure
Weaknesses
No statistical rigor
Missing closest non-DP baselines
Narrow attacker model in the main text
Internal tension on the utility metric
Small closed-set evaluation and model sensitivity
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This method paper (arXiv 2609.12341, cs.CL/cs.CR, RMIT University) targets stylometric re-identification: authorship attribution models can deanonymize text after explicit identifiers are removed, including ASR transcripts. The authors propose a prompt-driven, non-DP framework with two modules: a Style-Profiling Module that prompts an LLM to produce an interpretable per-author profile from K=5 samples across four dimensions (sentence length, vocabulary, tone, punctuation), and a Style-Guided Rewriting Module that rewrites text while suppressing the profiled cues. Central claims: (1) style-guided rewriting cuts authorship F1 by roughly 60-73% on two datasets; (2) it dominates DP-based (DP-Prompt variants) and stylometric (ALISON) baselines on the fluency-aware trade-off; (3) gains persist against a white-box retrained adversary (Section 4.3, supplementary) and out of domain on Yelp/IMDB (F1 drop >85%). The attacker-agnostic design (Section 2.2) is claimed as a feature.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What problem does this paper address?
Authorship attribution models can identify writers from writing style alone, even in text that has been 'anonymized' by removing names and explicit identifiers. This paper proposes using a large language model to rewrite text so that these stylistic fingerprints are suppressed while the meaning stays intact.
How much does the method reduce re-identification?
In the paper's experiments, authorship classifier F1 drops from 66.45 to 26.02 on a 10-blogger dataset and from 76.78 to 20.76 on a 9-reviewer Google Reviews dataset - roughly 61% and 73% relative reductions - while text fluency (perplexity) stays close to original levels.
Does the method offer mathematical privacy guarantees like differential privacy?
No. It is a heuristic, prompt-driven rewriting approach without formal differential privacy guarantees. The authors argue (citing prior work) that DP's utility cost is often prohibitive, and they evaluate privacy empirically via authorship classifier F1 rather than via any formal bound.
Is code available for this paper?
Yes. The paper points to a public GitHub repository (github.com/ahmedsohair/SAPTA26) containing code and supplementary material.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Supplementary material (white-box adversary setup, K ablation over {2,5,10,20}, LLM-as-judge, NER retention, Yelp/IMDB out-of-domain results) is referenced but not included in the provided text, so those claims could not be independently verified.
- Table 2 bold/underline emphasis is flattened by PDF extraction; metric rankings in this review are recomputed from the tabulated numbers rather than the typography.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.