K-文化的一切——从回归到 K-美妆，发送到您的邮箱订阅邮件

METAL MEDIA

Redakto - The Incognito Tab for LLMs

arXiv:2608.182602026-08-20

把文本喂给AI大模型前先自动抹掉姓名地址,一款开源工具证明脱敏不掉性能

Redakto是一款开源工具,能在文本进入大语言模型(LLM)之前自动识别并抹除或替换姓名、地址等个人身份信息(PII)。研究团队在电子邮件、临床病历和法律文书三类数据上做了测试,并提供网页应用、REST API以及可供LLM助手直接调用的Model Context Protocol(MCP)接口。实验显示,脱敏后的文本在两个下游任务上的表现与未处理的原文相差不大。

METAL MEDIA 解读图

把文本喂给AI大模型前先自动抹掉姓名地址,一款开源工具证明脱敏不掉性能

  1. 01在德语邮件数据集CodE Alltag和法律文书数据集LER上,个人信息检测准确率(macro F1)达到约0.95;而标注数据较少的临床语料GraSCCo上表现较低,原因被归结为训练数据不足而非模型结构问题
  2. 02对比了三种脱敏方式:替换成语义相近的占位词、随机遮蔽、通用遮蔽,其中语义占位词方式最能保留原文可用性
  3. 03用两个下游任务直接检验脱敏文本的实用性:识别医生在问诊对话中的意图,以及判断欧洲人权法院案例文书中是否存在人权侵犯
  4. 04即便文档中个人信息密度极高(平均每篇约86个,最多可达数百个),性能下降主要来自文档变长变复杂,而非脱敏操作本身
  5. 05系统由Streamlit前端和FastAPI后端组成,支持Docker和Kubernetes容器化部署,代码和模型均已开源
这是 METAL MEDIA 制作的解读图，并非论文作者提供的原图。

他们做了什么

  1. 在德语邮件数据集CodE Alltag和法律文书数据集LER上,个人信息检测准确率(macro F1)达到约0.95;而标注数据较少的临床语料GraSCCo上表现较低,原因被归结为训练数据不足而非模型结构问题
  2. 对比了三种脱敏方式:替换成语义相近的占位词、随机遮蔽、通用遮蔽,其中语义占位词方式最能保留原文可用性
  3. 用两个下游任务直接检验脱敏文本的实用性:识别医生在问诊对话中的意图,以及判断欧洲人权法院案例文书中是否存在人权侵犯
  4. 即便文档中个人信息密度极高(平均每篇约86个,最多可达数百个),性能下降主要来自文档变长变复杂,而非脱敏操作本身
  5. 系统由Streamlit前端和FastAPI后端组成,支持Docker和Kubernetes容器化部署,代码和模型均已开源
Figure 1: PII-detection performance on GraSCCo
Figure 1: PII-detection performance on GraSCCo
Table 1: PII-detection performance on CodE Alltag
ModelPrecRecF1
xlm-roberta-large0.9442 ±0.00.9358 ±0.00.9399 ±0.0
gelectra-large0.9433 ±0.00.9371 ±0.00.9401 ±0.0
bert-base-german-cased0.9251 ±0.00.9160 ±0.00.9204 ±0.0
Figure 2: Medical Intent classification on anonymized texts
Figure 2: Medical Intent classification on anonymized texts
Table 2: PII-detection performance on LER
ModelPrecRecF1
xlm-roberta-large0.940.950.94
gelectra-large0.950.960.95
bert-base-german-cased0.950.940.95
Figure 3: Entity density wise performance (Macro-F1) comparison for different redaction strategies (xlm-roberta-large)
Figure 3: Entity density wise performance (Macro-F1) comparison for different redaction strategies (xlm-roberta-large)
Table 3: Examples of redaction strategies applied to a clinical text
VersionText
Originalmiss edwards is here for evaluation of facial pain this is a 54-year-old female
Semantic Label Maskingmiss [PERSON] is here for evaluation of facial pain this is a [DATE] female
Random Maskingmiss lhyZXSX is here for evaluation of facial pain this is a vejE4fPRUxkG female
Generic Maskingmiss XXXX is here for evaluation of facial pain this is a XXXX female
Figure 4: Entity density wise performance (Macro-F1) comparison for different redaction strategies (bert-large-cased)
Figure 4: Entity density wise performance (Macro-F1) comparison for different redaction strategies (bert-large-cased)
Table 4: Binary Violation prediction on anonymized texts
Redaction Strategyxlm-roberta-largebert-large-casedelectra-large-discri.
No Redaction0.86 ±0.010.85 ±0.010.84 ±0.01
Semantic Label Masking0.86 ±0.010.84 ±0.010.82 ±0.02
Random Masking0.85 ±0.010.82 ±0.020.82 ±0.01
Generic Masking0.84 ±0.020.85 ±0.010.82 ±0.02
Figure 6: System design of Redakto
Figure 6: System design of Redakto

为什么重要

欧盟隐私相关法规让医院、法律机构和政府部门在使用LLM时顾虑重重,而这项研究用实验证据表明脱敏不会明显损害任务效果,直接回应了这一顾虑。由于工具开源且可自行部署,开发者和研究者无需把敏感数据发给第三方服务,就能安全地把LLM用起来。

本文术语

  • 个人身份信息(PII) · 姓名、地址、出生日期等能识别特定个人的信息
  • 大语言模型(LLM) · 基于海量文本训练、能理解和生成语言的AI模型
  • 假名化(pseudonymization) · 不直接删除个人信息,而是替换成其他标识,保持文本可读
  • Model Context Protocol(MCP) · 让LLM助手或智能体能够直接调用外部工具的一种连接标准
  • macro F1 · 对各类别准确率取平均得到的指标,避免结果被某一类别主导

无法转载的图表

  • Figure 5: Entity density wise performance (Macro-F1) comparison for different redaction strategies (electra-large-discriminator)
在原文中查看图表 →

论文原文摘要（英文）

Large Language Models (LLMs) are being increasingly used in everyday applications. A major challenge in the context of LLMs or Artificial Intelligence (AI) in general is to ensure privacy when using them, meaning that personally identifiable information (PII) is removed from any text that enters an LLM. These challenges have become more urgent with novel EU legislation. Uncertainty around LLM usage with respect to privacy concerns in EU countries can be a major blocker for the speed of innovation and transfer from research to applications. Here we present \textbf{Redakto}, a tool that can be used for anonymizing text prior to feeding it to an LLM or other downstream text processing. We provide state-of-the-art functionalities for both redaction of PII but also when used for pseudonymization. These functionalities are exposed such that they can easily be used by end-users, through the Redakto web application, and by developers and researchers, via REST APIs and model context protocol (MCP) hooks. The implementation is fully open source, requires modest compute resources, and can be readily deployed on local hardware. In contrast to prior work and in order to better assess the quality of the anonymized texts, we conduct extensive empirical evaluations on textual data from legal and medical domain with respect to both privacy and utility of the redacted texts. Our empirical results demonstrate that the texts anonymized with different redaction strategies achieve utility scores on par with the original texts, suggesting that anonymization with Redakto can be used for LLM tasks without substantial negative impact for the tasks we explored.

作者 · Saurav Kumar Saha, Tom R\"ohr, Felix Bie{\ss}mann

在 arXiv 阅读

最新论文

全部论文 →

METAL MEDIA 最新报道

图片来源： Saurav Kumar Saha et al., arXiv:2608.18260, CC BY-SA 4.0