On the Impact of Anonymization on the Performance of Large Language Models
Tobias Deußer, Max Hahnbück, Lorenz Sparrenberg, Tobias Uelwer, Christian Bauckhage, Rafet Sifa
cs.CL · cs.AI
Quick verdict
Paper claims anonymization unevenly degrades LLMs (strong models, RAG hit hardest); broad benchmark, but no significance tests; capability claim confounded.
Summary
This empirical study quantifies how input anonymization affects large language model performance. The authors evaluate five models — GPT-4o mini, Teuken-7B, Llama-3.1-8B, Gemma-2-27B, and Qwen2.5-72B — on eleven benchmarks totaling 6,210 samples (ARC, BIG-Bench Hard, EQ-Bench, HellaSwag, IFEval, MedQA, MMLU-PRO, MUSR, RGB, TruthfulQA, WMT 2014 En-De), comparing original inputs against LLM-based pseudonymization that replaces entities with category-ID placeholders, mapping outputs back before scoring at temperature 0. Performance generally drops: average declines of 6.9 points for Qwen2.5-72B versus 2.3 points for Teuken-7B support the headline claim that stronger models are less robust, with GPT-4o mini similarly affected. Retrieval-focused RGB collapses by 0.22–0.47 across models, whereas TruthfulQA is the only benchmark where four of five models improve (up to +0.08 for Llama-3.1-8B) and GPT-4o mini stays flat. Supplementary GPT-4o mini experiments on MedQA, MUSR, and RGB show reversible techniques (pseudonymization, randomization, masking) beat redaction and generalization, and explicit anonymization-aware prompts add nothing. Limitations: no significance tests, confidence intervals, or variance estimates despite single runs; the capability–robustness conclusion is confounded by floor/ceiling effects; the single anonymizer (F1 >88%, recall >91%) conflates tool error with anonymization cost; no code-release statement accompanies several editorial defects.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Input pseudonymization generally degrades LLM benchmark performance, but the magnitude depends on model capability, task type, and anonymization technique.
- The most capable models tested (Qwen2.5-72B, GPT-4o mini) show the largest absolute drops (Qwen2.5-72B average −6.9 pp vs Teuken-7B −2.3 pp), suggesting stronger reliance on entity information.
- Retrieval-augmented RGB collapses under anonymization (−0.22 to −0.47 across models) while TruthfulQA is the only benchmark that holds or improves.
- Reversible, uniqueness-preserving techniques (pseudonymization, randomization, masking) outperform irreversible redaction and generalization.
- Explicitly prompting models that inputs are anonymized yields no discernible performance benefit.
Strengths
Unusually broad cross-domain scope
5 models × 11 benchmarks × 2 conditions over 6,210 samples (Tables 2–3), spanning science QA, medical QA, emotional intelligence, RAG, and translation — establishing the cross-domain baseline the prior domain-specific work (§2) lacked.
Fair, well-considered evaluation design
Outputs are de-anonymized via the stored mapping before scoring (§3.1 step 4), and few-shot prompt components are anonymized alongside questions (§3.2), so models are not penalized for emitting placeholders or for anonymized context.
Mechanism-isolating ablations
Candid qualitative analysis
Consistent, inspectable result matrix
Weaknesses
No uncertainty quantification
Confounded capability–robustness headline
Anonymizer error conflated with anonymization cost
Reproducibility gaps
Editorial sloppiness
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper asks a practical deployment question: what does pseudonymizing PII in LLM inputs cost in benchmark performance? The scope is unusually broad: five instruction-tuned models (GPT-4o mini, Teuken-7B, Llama-3.1-8B-Instruct, Gemma-2-27B, Qwen2.5-72B-Instruct) × eleven benchmarks × two conditions over 6,210 samples (Table 2), plus three secondary studies: five anonymization techniques on GPT-4o mini over MedQA/MUSR/RGB (§4.2), two anonymization-aware prefixes (§4.3), and five worked error cases (Tables 7–11). Central claims: (1) anonymization generally degrades performance; (2) stronger models (Qwen2.5-72B, GPT-4o mini) degrade most; (3) RGB collapses while TruthfulQA is the only benchmark that holds or improves; (4) reversible, uniqueness-preserving techniques beat redaction/generalization; (5) telling the model about anonymization changes nothing. The claims are hedged in the abstract but asserted with more confidence in §4 and §5 than the statistics support.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Does anonymizing input text hurt LLM performance?
According to this paper, usually yes but unevenly. Across five models and eleven benchmarks (6,210 samples), pseudonymization lowered average scores by 6.9 points for Qwen2.5-72B but only 2.3 points for Teuken-7B. Retrieval-heavy RGB fell 0.22–0.47, while TruthfulQA held or improved for all five models.
Which anonymization technique preserves LLM accuracy best?
Reversible techniques that keep entities distinguishable — pseudonymization ('London'→'<LOC>-1'), randomization, and masking ('Lo****') — clearly outperformed irreversible redaction ('[REDACTED]') and generalization ('[CITY]') in the paper's GPT-4o mini experiments on MedQA, MUSR, and RGB.
Why are stronger LLMs more affected by anonymization?
The authors argue capable models like Qwen2.5-72B rely more on specific entity information, so removing it costs them more (average −6.9 pp vs −2.3 pp for the weakest model). Note the effect is confounded: models with low baselines have less room to fall, and no significance testing is reported.
Should you tell an LLM that its input has been anonymized?
In this study, no. Prepending short or long explanations that the prompt was anonymized to GPT-4o mini on MedQA, MUSR, and RGB produced no discernible improvement over anonymized input without any prefix (§4.3, Figure 5).
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure 2's heat-map values extract only partially in grid order (the Qwen2.5-72B row shows 8 of 11 cells); all cited deltas were cross-checked against the complete Table 5.
- Figure 3's numeric averages are not embedded in the extracted text; the average-drop figures cited (6.9 / 2.3 pp) come from §4.1 body text.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.