Sanitizing sensitive text data typically involves removing personally identifiable information (PII) or generating synthetic data under the assumption that these methods adequately protect privacy; however, their effectiveness is often only assessed by measuring the leakage of explicit identifiers but ignoring nuanced textual markers that can lead to re-identification. We challenge the above illusion of privacy by proposing a new framework that evaluates re-identification attacks to quantify individual privacy risks upon data release. Our approach shows that seemingly innocuous auxiliary information -- such as routine social activities -- can be used to infer sensitive attributes like age or substance use history from sanitized data. For instance, we demonstrate that Azure's commercial PII removal tool fails to protect 74\% of information in the MedQA dataset. Although differential privacy mitigates these risks to some extent, it significantly reduces the utility of the sanitized text for downstream tasks. Our findings indicate that current sanitization techniques offer a \textit{false sense of privacy}, highlighting the need for more robust methods that protect against semantic-level information leakage.

翻译：文本敏感数据脱敏通常涉及移除个人可识别信息（PII）或生成合成数据，其前提假设是这些方法能充分保护隐私；然而，现有评估往往仅通过测量显式标识符的泄露来衡量效果，却忽略了可能导致重新识别的细微文本标记。我们通过提出一个评估重新识别攻击的新框架来挑战上述隐私假象，该框架可量化数据发布时的个体隐私风险。我们的研究表明，看似无害的辅助信息——例如日常社交活动——可用于从脱敏数据中推断年龄或药物使用史等敏感属性。例如，我们证明Azure商用PII移除工具未能保护MedQA数据集中74%的信息。虽然差分隐私能在一定程度上缓解这些风险，但会显著降低脱敏文本在下游任务中的可用性。我们的发现表明，当前脱敏技术仅提供一种\textit{虚假的隐私感}，这凸显了需要开发更鲁棒的方法来防范语义层面的信息泄露。