Llm-based privacy detectors struggle to find joint privacy cues
QuasiLeak-Bench: Evaluating LLM-Based Privacy Detectors on Policy-Conditioned Quasi-Evidence Group Recovery
Computation and LanguageCryptography and Security
Summary
Messages often contain small clues that alone don’t reveal much, but together can expose private information. The authors call these sets of clues quasi-evidence groups. They created QuasiLeak-Bench, a way to test how well detectors spot these groups and respect privacy rules. Most existing detectors don’t do well on this task, but training a smaller model with their data improves results, showing the problem can be learned.
What this means in practice
- •For privacy compliance teams: Assess automated tools’ ability to detect subtle privacy risks in messages according to company policies using the QuasiLeak-Bench benchmark.
- •For llm developers: Improve and fine-tune local large language models for detecting joint privacy-revealing clues in text, enhancing privacy-sensitive applications.
Authors
Yufan Zhu, Yangfan Jiang, Yang Fei, Shizheng Hou, Shubhankar Mohapatra, Xiaokui Xiao
Abstract
Natural language messages often contain quasi-identifiers that are weak in isolation but can jointly reveal an individual's private attributes. We call such a jointly revealing set of cues a quasi-evidence group. Existing privacy benchmarks focus on explicit identifiers, attribute inference, or task-driven disclosures, leaving inference from quasi-evidence groups largely unmeasured. In practice, whether exposing such a quasi-evidence group violates privacy also depends on sender-specified disclosure policies. We introduce QuasiLeak-Bench, a benchmark for policy-conditioned quasi-evidence group recovery, which evaluates whether detectors recover complete quasi-evidence groups and flag the disclosures the given policy prohibits. To obtain reliable ground truth at scale, a reverse-construction pipeline first selects weak quasi-identifiers, composes them into quasi-evidence groups verified to jointly reveal a target attribute, and generates documents around this evidence, followed by automated quality control. Experiments show that existing privacy detectors transfer poorly to QuasiLeak-Bench, and locally deployable LLM-based detectors fall far behind proprietary models, mainly because they miss most quasi-evidence groups altogether. However, a 4B model fine-tuned on our training split surpasses the strongest prompted model on held-out documents, showing that the task is learnable.