Search papers, labs, and topics across Lattice.
This paper introduces RedactionBench, a benchmark designed to address the nuanced challenges of redacting personally identifiable information (PII) across various contexts, emphasizing the importance of contextual integrity in privacy. By employing a novel character-level metric, R-Score, the authors evaluate the performance of 35 models on their benchmark, highlighting the inadequacies of current systems in handling contextual redaction. The findings reveal a significant disparity in human perceptions of privacy, with only 47.7% agreement on contextual redactions, underscoring the complexity of privacy semantics beyond mere entity recognition.
Contextual redaction remains a perplexing challenge, with human evaluators showing only 47.7% consensus on what constitutes a privacy violation.
Large Language Models are increasingly applied to sensitive domains that require redaction of personally identifiable information (PII). While redacting PII is a data cleaning prerequisite, existing benchmarks conflate extraction mechanics with privacy semantics. A public phone number is not equivalent to a phone number in a medical record. Whether information constitutes a violation depends heavily on who holds it, why, and in what context, fundamentally differentiating redaction from simple entity recognition. Grounded in contextual integrity, we introduce RedactionBench, a manually annotated benchmark comprising 200 diverse documents across 11 domains, mostly seeded from real-world sources. We also introduce R-Score, a novel character-level metric that treats semantically similar redactions equally and nullifies shallow formatting choices, such as varying masking styles for phone numbers. Evaluations across Named Entity Recognition models, entity extraction Small Language Models, and frontier models equipped with agentic tools demonstrate that contextual redaction remains an unsolved problem. A human evaluation with over 80 users on RedactionBench reveals a stark dichotomy in privacy perceptions. Annotators show consensus with target labels for mandatory redactions (89.4 percent) and safe text preservations (94.1 percent), but fail to agree on contextual redactions (47.7 percent). This variance demonstrates the subjective nature of contextual privacy and motivates R-Score, which decouples contextual ambiguity from strict precision. We compare 35 models across families and report their performance in redacting PII. Finally, we release RedactionBench to establish a baseline for future privacy-preserving systems, hoping to inspire efficient model design and standardized evaluations.
