The Limits of Word Level Differential Privacy
As the issues of privacy and trust are receiving increasing attention within
the research community, various attempts have been made to anonymize textual
data. A significant subset of these approaches incorporate differentially
private mechanisms to perturb word embeddings, thus replacing individual words
in a sentence. While these methods represent very important contributions, have
various advantages over other techniques and do show anonymization
capabilities, they have several shortcomings. In this paper, we investigate
these weaknesses and demonstrate significant mathematical constraints
diminishing the theoretical privacy guarantee as well as major practical
shortcomings with regard to the protection against deanonymization attacks, the
preservation of content of the original sentences as well as the quality of the
language output. Finally, we propose a new method for text anonymization based
on transformer based language models fine-tuned for paraphrasing that
circumvents most of the identified weaknesses and also offers a formal privacy
guarantee. We evaluate the performance of our method via thorough
experimentation and demonstrate superior performance over the discussed
mechanisms.