ReCoPII：一种基于关系的上下文个人身份信息脱敏数据集构建框架

# ReCoPII: A Relation-Grounded Framework for Building Contextual PII Masking Datasets
Source: [https://arxiv.org/html/2610.35925](https://arxiv.org/html/2610.35925)
\[ BoldFont=texgyretermes\-bold\.otf, ItalicFont=texgyretermes\-italic\.otf, BoldItalicFont=texgyretermes\-bolditalic\.otf \] \[Path=fonts/,BoldFont=NanumGothicBold\.ttf\]

Taehwan LeeAffiliation:Department of Data Science, Hanyang UniversityAffiliation:Seoul, Republic of KoreaEmail:[peterson0620@hanyang\.ac\.kr](mailto:)

###### Abstract

Training contextual masking systems for personally identifiable information \(PII\) requires examples distinguishing maskable from preservable mentions of one entity type, but privacy restrictions limit access to real data\. Author\-based augmentation \(SPY\) labels mentions unrelated to the author as non\-PII, presuming a single data subject and overlooking others\. We propose ReCoPII \(Relation\-grounded Contextual PII masking\), a framework that builds such data without this premise: it plans ontology\-constrained entity relations, writes insertion sentences with placeholders, reconstructs annotations with code, checks the result with a separate LLM, and derives MASK/KEEP labels from entity relations\. On Korean documents from six domains, it yields ReCoPII\-Ko, a corpus with relation, privacy, and MASK/KEEP annotations, which we validate\. Across 300 pairs, four annotators agree with 88\.42% of its sampled KEEP labels, against 26\.27% for SPY\-style augmentation of the same sources\. Classifiers trained on it over\-mask less than under that reference on a matched test\. Contextual masking fine\-tuned jointly with a PII detector removes most over\-masking of detection alone within a fixed leakage budget; on human\-verified entity records, the four detectors meeting it over\-mask at most 5\.04% with at most 4\.18% leakage\. The detector is comparable to XLM\-R\-large on KDPII with about a quarter of its parameters\.

## 1Introduction

Privacy restrictions limit access to annotated personal data, motivating synthetic corpora for personally identifiable information \(PII\) detection\([Savkin et al\., 2025](https://arxiv.org/html/2610.35925#bib.bib7)\)\. Contextual masking in Korean long documents is a problem of*same type, different decisions*: mentions of one entity type need different MASK/KEEP labels, since a personal telephone number should be masked while an organization’s service number can be preserved\. Useful training data for this distinction require coherent documents whose text supports each masking label\.

Existing resources address parts of this need\. KDPII provides Korean PII span and type annotations\([Fei et al\., 2024](https://arxiv.org/html/2610.35925#bib.bib2)\)\. CAPID and PII\-Bench make contextual retention depend on relevance to a downstream question\([Ponomarenko et al\., 2026](https://arxiv.org/html/2610.35925#bib.bib6);[Shen et al\., 2026](https://arxiv.org/html/2610.35925#bib.bib8)\)\. For documents without a query, SPY generates personal details about the text’s author as PII and adds mentions unrelated to the author as non\-PII\([Savkin et al\., 2025](https://arxiv.org/html/2610.35925#bib.bib7)\)\. These approaches judge every mention against one reference point: the question in query\-conditioned settings, and the author when no question is given, which is the query\-free setting that we study\.

That author\-based criterion is insufficient when a document describes several people\. In a contract, a counterparty’s telephone number is unrelated to the author yet personal, and 703 of our 1,857 documents contain two or more maskableNAMEentities\. Its KEEP labels are therefore often not valid: in a human audit, annotators agree with only 26\.27% of sampled KEEP labels in SPY\-style augmentation of our source documents \(Table[2](https://arxiv.org/html/2610.35925#S5.T2)\), and classifiers trained on that augmentation in turn mask nearly half of the preservable mentions on a matched synthetic test \(Section[5\.3\.2](https://arxiv.org/html/2610.35925#S5.SS3.SSS2)\)\. Detection by entity type alone masks nearly all human\-verified preservable mentions \(Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4)\)\.

The author\-based rule assigns privacy outcomes from a mention’s association with one person\. A labeling framework for documents with several people and organizations must instead establish whose information a mention conveys and in what role\. We represent the domain, relation labels, and endpoint entity types as a*domain\-conditioned entity\-relation configuration*; the document supplies the evidence for each edge\-level privacy label, so the relation structure alone does not fix the privacy outcome\.

We hypothesize that deriving MASK/KEEP labels from these configurations and the document’s evidence yields valid contextual masking data without presuming a single data subject\.

Contextual Integrity motivates this hypothesis by assessing information flows through the actors and context in which they occur, a view that Privacy Checklist operationalizes for privacy judgment\([Li et al\., 2025](https://arxiv.org/html/2610.35925#bib.bib4)\)\. GoldCoin further shows that structured contextual features can guide the synthesis of privacy\-law cases\([Fan et al\., 2024](https://arxiv.org/html/2610.35925#bib.bib1)\)\.

We propose ReCoPII \(Relation\-grounded Contextual PII masking\), a framework for constructing contextual masking data from PII\-annotated documents and a domain ontology \(Figure[1](https://arxiv.org/html/2610.35925#S3.F1)\)\. The technical challenge is to add preservable mentions while keeping their textual roles, values, and annotations consistent\. We plan ontology\-constrained entity relations and let an LLM write insertion sentences containing placeholders; code fills the values and reconstructs spans, relations, and edge\-level privacy labels, and a separate LLM reviewer checks the completed text without seeing the planned labels\. Equation[1](https://arxiv.org/html/2610.35925#S3.E1)aggregates the privacy labels of incident edges into each entity’s MASK/KEEP decision\. Applying it to Korean documents from six domains yields the ReCoPII\-Ko corpus, on which we evaluate the framework\.

We then check whether the resulting data are valid and usable\. On validity, four annotators agree with 88\.42% of the sampled KEEP labels of ReCoPII\-Ko, more than three times the rate under the author\-based criterion on the same source documents\. On use, the same classifiers over\-mask less when trained on ReCoPII\-Ko than under that SPY\-style reference \(Section[5\.3\.2](https://arxiv.org/html/2610.35925#S5.SS3.SSS2)\)\. A complete system can also be trained on the data: under a fixed validation leakage budget, contextual masking fine\-tuned jointly with a detector removes most of the over\-masking of detection alone \(Table[4](https://arxiv.org/html/2610.35925#S5.T4)\), and for the four detectors that meet the budget it over\-masks at most 5\.04% of human\-verified preservable mentions with at most 4\.18% leakage\. The detector is comparable to XLM\-R\-large on KDPII with about a quarter of its parameters\.

Our contributions are threefold:

- •Method:ReCoPII, a relation\-grounded framework for building contextual masking datasets that plans ontology\-constrained augmentation, reconstructs annotations with code, checks their textual support, and derives MASK/KEEP labels from relation graphs\.
- •Resource:ReCoPII\-Ko, a Korean long\-document corpus from six domains with maskable and preservable mentions within the same entity types, annotated with relations and edge\-level privacy labels\.
- •Evaluation:Validation of these data: label and document validity in human and LLM audits, and classifiers and an integrated masking system trained on them, scored on generated labels and on human\-verified entity records\.

## 2Related Work

Rules, gazetteers, and encoder\-based sequence labelers detect PII spans and entity types\([Savkin et al\., 2025](https://arxiv.org/html/2610.35925#bib.bib7)\); our candidate detector follows this line\. Query\-conditioned approaches decide retention relative to a downstream question: CAPID fine\-tunes a local small language model to detect and type PII spans and estimate their relevance to the question\([Ponomarenko et al\., 2026](https://arxiv.org/html/2610.35925#bib.bib6)\), and PII\-Bench tests whether a system masks query\-unrelated PII\([Shen et al\., 2026](https://arxiv.org/html/2610.35925#bib.bib8)\)\. SPY builds query\-free supervision around the text’s author, and its authors note that personal information about individuals closely related to the author is not covered\([Savkin et al\., 2025](https://arxiv.org/html/2610.35925#bib.bib7)\)\. SPIA identifies the same single\-subject assumption in anonymization evaluation and measures protection per individual\([Oh et al\., 2026](https://arxiv.org/html/2610.35925#bib.bib5)\)\. We address it in data construction for contextual masking: ReCoPII keeps the query\-free setting but replaces the single\-author criterion with the domain\-conditioned entity\-relation configuration, which can represent several data subjects and organizations in one document and follows the contextual view of privacy cited in Section[1](https://arxiv.org/html/2610.35925#S1)\.

## 3Method

![Refer to caption](https://arxiv.org/html/2610.35925v1/figures/method/construction_overview.png)Figure 1:Overview of relation\-grounded data construction\. \(a\) Source documents receive entity\-relation annotations\. \(b\) Ontology\-constrained relation\-graph planning guides placeholder\-based text realization, followed by deterministic instantiation and annotation reconstruction\. \(c\) Structural validation and independent semantic review determine acceptance\. \(d\) ContextualNAMEaugmentation adds preservable name mentions and supporting relations, followed by review\.### 3\.1Task Definition

Given a Korean long documentDDwith domaindd, our task is to identify PII\-type mentions and determine whether each entity should be masked or preserved from its role in the document\. A preservable mention is a PII\-type mention that does not require masking in the given context, not a value that is inherently non\-PII\. A domain\-conditioned entity\-relation configuration specifies the relation structure; the document supplies the evidence for its privacy label\.

Figure[2](https://arxiv.org/html/2610.35925#S3.F2)illustrates this distinction in a synthetic financial document\. Both examples link the same company to a bank account throughFINANCIAL\_ASSET\_ASSOCIATION, but an employee’s payroll account is masked, whereas the company’s settlement account is preserved\. Because the endpoint types and relation label match while the roles differ, we separate PII candidate detection, which locates mentions and their types, from the contextual masking decision, which uses the document context and domain\.

\\korean한국철강WORKPLACE7934\-232\-707420BANK\_ACCOUNT\_NUMBERFINANCIAL\_ASSET\_ASSOCIATIONPII

\(a\) Personal payroll accountPII→\\rightarrowMASK\\korean본 계약은한국철강의 제관부 부서에서 근무 중인최경환의 급여 자동이체 계좌\(7934\-232\-707420\)를 통해 매월 자동이체 방식으로 보험료를 납입합니다\. \[…\]Insurance premiums are paid monthly from the payroll account \(7934\-232\-707420\) of Choe Gyeong\-hwan, who works in the can\-making department of Hanguk Cheolgang\. \[…\]

\\korean한국철강WORKPLACE055\-907337\-96139BANK\_ACCOUNT\_NUMBERFINANCIAL\_ASSET\_ASSOCIATIONNON\_PII

\(b\) Company settlement accountNON\_PII→\\rightarrowKEEP\\korean계약자는 모든 보험료를한국철강의정산 계좌인055\-907337\-96139를 통해 납부해야 합니다\.The policyholder must pay all premiums through Hanguk Cheolgang's settlement account, 055\-907337\-96139\.

Figure 2:Same company, endpoint types, and relation; different account roles in one synthetic document\. The employee’s payroll account is MASK, while the company’s settlement account is KEEP\. Account values differ\. The company remains MASK through other PII edges \(not shown\)\. Graphs use stored generated labels, not human gold\. Double\-headed arrows indicate that masking aggregates the relation at both endpoints\. Yellow highlights contextual evidence; English translations follow\. \[…\] marks omitted text\.A mentionm=\(s,b,e\)m=\(s,b,e\)identifies one occurrence in sentencessat character span\[b,e\)\[b,e\)\. An entityviv\_\{i\}groups its mentionsℳi\\mathcal\{M\}\_\{i\}and has typeτ⁡\(vi\)\\tau\(v\_\{i\}\)\. We represent document relations as a graphG=\(V,E\)G=\(V,E\), whereVVcontains entities and each directed edgea=\(vi,r,vj\)∈Ea=\(v\_\{i\},r,v\_\{j\}\)\\in Ehas relation labelrrand a separate privacy labely⁡\(a\)∈\{PII,NON\_PII\}y\(a\)\\in\\\{\\texttt\{PII\},\\texttt\{NON\\\_PII\}\\\}, assessed in the context ofDDandddrather than fixed per triplet\. An edge label does not directly determine both endpoints’ masking labels: an official contact edge can beNON\_PII, while its organization endpoint remains maskable through another relation to a person\.

We therefore aggregate all edges incident toviv\_\{i\}, irrespective of direction, into a setIiI\_\{i\}\. Letni=\|Ii\|n\_\{i\}=\|I\_\{i\}\|andpi=\|\{a∈Ii:y⁡\(a\)=PII\}\|p\_\{i\}=\|\\\{a\\in I\_\{i\}:y\(a\)=\\texttt\{PII\}\\\}\|\. The final entity masking decision is

μ⁡\(vi\)=\{0,ni\>0∧pi=0,1,otherwise\.\\mu\(v\_\{i\}\)=\\left\\\{\\begin\{array\}\[\]\{ll\}0,&n\_\{i\}\>0\\ \\land\\ p\_\{i\}=0,\\\\ 1,&\\mathrm\{otherwise\}\.\\end\{array\}\\right\.\(1\)Here,11denotes a maskable entity \(PII/MASK\) and00a preservable entity \(NON\_PII/KEEP\)\. Preservation thus requires relation evidence and no incidentPIIedge; an entity with no relations defaults to masking\.

### 3\.2Controlled Data Construction

Figure[1](https://arxiv.org/html/2610.35925#S3.F1)summarizes the construction\. We start from Basic, a source corpus of 2,355 Korean long documents across six domains and 18 entity types with sentence\-level PII spans and character\-level masking BIO tags \(Figure[3](https://arxiv.org/html/2610.35925#A1.F3)in Appendix[A](https://arxiv.org/html/2610.35925#A1)\)\. We organize its mentions into document\-level entity registries and annotate relations and edge\-level privacy labels in context, using domain\-specific relation schemas defined with GPT\-5\.6\-Sol; Equation[1](https://arxiv.org/html/2610.35925#S3.E1)then gives each entity’s masking label\. To obtain maskable and preservable outcomes within one entity type, we augment these documents with preservable entities and supporting relations, whose values come from the persona pool that also supplied the source values \(Appendix[E\.3](https://arxiv.org/html/2610.35925#A5.SS3)\)\.

##### Ontology\-constrained planning\.

An LLM that writes text and labels together can invent relations that its text does not support, so we fix the relation structure before any wording is chosen\. GPT\-4o\-mini receives the document, its graph, and the domain’s relation meanings and proposes organization\-managed entities with provisionalNON\_PIIedges\. LetΩd\\Omega\_\{d\}be the set of endpoint\-type and relation combinations that the domain ontology permits and the persona pool can instantiate in organizational contexts\. Every planned edge\(vi,r,vj\)\(v\_\{i\},r,v\_\{j\}\)must satisfy

\(τ⁡\(vi\),r,τ⁡\(vj\)\)∈Ωd\.\(\\tau\(v\_\{i\}\),r,\\tau\(v\_\{j\}\)\)\\in\\Omega\_\{d\}\.\(2\)Code rejects plans with incompatible endpoint types, unconnected new entities, or unfillable values and requests regeneration \(Appendices[E\.1](https://arxiv.org/html/2610.35925#A5.SS1)and[D\.1](https://arxiv.org/html/2610.35925#A4.SS1)\)\.

##### Placeholder realization and deterministic annotation\.

An LLM that also writes values and annotations can produce incompatible values, such as an organization with a department it lacks, or spans that do not match the text\. GPT\-4o\-mini therefore writes only insertion sentences expressing each planned role, with placeholders such as<TELEPHONE:E10\>for planned entities \(Appendix[D\.2](https://arxiv.org/html/2610.35925#A4.SS2)\)\. Code checks the placeholders against the plan and rejects sentences attributing a planned target to a competing source of the same type \(Appendix[E\.2](https://arxiv.org/html/2610.35925#A5.SS2)\)\. It then fills values through label\-independent queries to the persona pool, where related entities needing consistent attributes share a persona row, and reconstructs spans, relations, and edge\-level privacy labels from the replacement trace\. Only mentions of maskable entities enterPII\_setand masking BIO tags; candidate detection targets all registry mentions \(Appendix[E\.4](https://arxiv.org/html/2610.35925#A5.SS4)\)\.

##### Independent review and acceptance\.

Structural validity does not establish the privacy label, so a separate GPT\-5\-mini reviewer judges each relation from the completed document without the intended labels or the construction plan \(Appendix[D\.3](https://arxiv.org/html/2610.35925#A4.SS3)\)\. The reviewer labels a relationPIIwhen it attributes information to a specific individual or helps identify that individual,NON\_PIIwhen a supported relation does not, andAMBIGUOUSwhen the document gives no evidence\. A new edge judgedPIIwith a verified supporting quote, or a reported missingPIIrelation involving a new entity, rejects the document, since retaining it could leave a maskable mention unmasked; Appendix[E\.5](https://arxiv.org/html/2610.35925#A5.SS5)gives the remaining acceptance conditions and the review’s partial blinding\. A final filter removes accepted documents that contain a new entity without an incident relation, which cannot be preserved under Equation[1](https://arxiv.org/html/2610.35925#S3.E1)\(Table[13](https://arxiv.org/html/2610.35925#A2.T13)\)\.

##### NAME augmentation\.

Organization\-managed entities provide a limited range of preservable roles for names\. We therefore addNAMEmentions used as public references supported by source facts or as fictional participants in hypothetical examples, each linked by one text\-supportedNON\_PIIrelation to an existingNAMEentity and checked by a dedicated review \(Appendix[E\.6](https://arxiv.org/html/2610.35925#A5.SS6)\)\.

### 3\.3PII Candidate Detection and Contextual Masking

Candidate detection locates PII\-type mentions; contextual masking decides which of those mentions require protection\. We use both to test whether the data can train a complete masking system, and they share one encoder \(Appendix[E\.7](https://arxiv.org/html/2610.35925#A5.SS7)gives the architecture and its equations\)\.

##### PII candidate detection\.

Our detector, A\.X\+Gazetteer\+CRF\+MLP, combines A\.X, a training\-only Gazetteer, a linear\-chain CRF that decodes candidate types and token spans, and a character boundary MLP that refines their offsets, because a Korean entity boundary may fall inside a token\. We train it on KDPII; used alone, it masks every predicted candidate\.

##### Contextual masking\.

Contextual masking groups predicted mentions into entities by type and normalized surface form, a heuristic rather than coreference resolution, and learns from the labels of Equation[1](https://arxiv.org/html/2610.35925#S3.E1)in one of two variants\. The*direct head*predicts each entity’s masking labelμ⁡\(vi\)\\mu\(v\_\{i\}\)from the mean of its mention representations, without relations\.*Relation\-conditioned heads*instead predict, for each unordered entity pair, its relation labels and the probability that each relation has a PII label, and aggregate the thresholded edges with Equation[1](https://arxiv.org/html/2610.35925#S3.E1), so that every decision can be traced to the edges that caused it\.*Joint Fine\-tuning*updates the shared encoder and detector together with the heads, adding the detection objective to the contextual loss, and is run with both variants;*Frozen Detector*trains only relation\-conditioned heads\. Both train the heads from gold mentions, including KEEP mentions, and use predicted candidates at inference; thresholds and checkpoints are selected on validation data \(Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4)\)\.

## 4Dataset Statistics

ReCoPII\-Ko contains 1,857 documents derived from a cleaned Basic corpus of 2,355 documents, with 18 entity types and 25,656 annotated edges across 19 relation labels \(Table[1](https://arxiv.org/html/2610.35925#S4.T1)\)\. Of the 2,355 source documents, 1,996 pass augmentation acceptance and 1,857 remain after the isolated\-entity filter \(Appendix Table[13](https://arxiv.org/html/2610.35925#A2.T13)\)\. Appendix[A](https://arxiv.org/html/2610.35925#A1)defines the entity types and reports domain, length, type, and relation composition \(Tables[11](https://arxiv.org/html/2610.35925#A1.T11),[7](https://arxiv.org/html/2610.35925#A1.T7),[7](https://arxiv.org/html/2610.35925#A1.T7),[7](https://arxiv.org/html/2610.35925#A1.T7), and[10](https://arxiv.org/html/2610.35925#A1.T10)\)\.

##### Official split\.

We designate a source\-group split of the current archive as the official partition, with 1,245 training, 208 validation, and 404 test documents; the ReCoPII\-Ko and SPY versions of a document share its assignment\. Documents that share a Basic source identifier or identical text form one source group, and each group stays in one partition, so no source document contributes to both training and evaluation\.

Table 1:Corpus\-level statistics of ReCoPII\-Ko and the SPY\-style version of the same 1,857 source documents\. PII mentions count sentence\-level occurrences including repeats, whereas MASK/KEEP count document\-level entity records; SPY has no relation annotations\.
##### Outcomes within entity types\.

MASK/KEEP composition is not fixed by entity type:EMAILcontains 1,233 MASK and 1,653 KEEP entities,TELEPHONE1,035 and 1,851, andNAME2,667 and 58 \(all 18 types in Appendix Table[9](https://arxiv.org/html/2610.35925#A1.T9); examples in Appendix Figure[4](https://arxiv.org/html/2610.35925#A1.F4)\)\.

## 5Experiments

### 5\.1Overall Setup

The experiments check whether the framework’s data are valid and usable\. RQ1 checks the detector used by the masking system: how accurately KDPII\-trained detectors identify PII and transfer to synthetic documents\. RQ2 asks whether the data are \(A\) valid in document quality and labels and \(B\) usable as supervision for contextual MASK/KEEP decisions; SPY\-style augmentation of the same source documents\([Savkin et al\., 2025](https://arxiv.org/html/2610.35925#bib.bib7)\)is the reference point\. RQ3 asks whether a complete masking system can be trained on the data, relative to masking every detected candidate and to LLMs given the same candidates, and compares its relation\-conditioned and direct variants as a sub\-question\.

RQ1 and RQ3 use the test partition of the official split \(Section[4](https://arxiv.org/html/2610.35925#S4)\)\. RQ2\-B predates that split and uses an earlier snapshot of ReCoPII\-Ko with a split by document ID, in which no document belongs to two partitions and no test document repeats the text of a training or validation document \(Appendix Table[8](https://arxiv.org/html/2610.35925#A1.T8)\); we therefore do not compare scores across RQ1/RQ3 and RQ2\-B\. All model evaluations score labels generated by the construction pipeline, except the human\-verified test of RQ3\.

### 5\.2RQ1: Detection and Cross\-Dataset Transfer

We train each detector on KDPII\([Fei et al\., 2024](https://arxiv.org/html/2610.35925#bib.bib2)\), using 19 of its 33 PII labels and a leakage\-aware 3,586/399/996\-document split, and evaluate its validation\-selected checkpoints from seeds 42–44 on the KDPII test set and, without synthetic training or threshold tuning, on the 404\-document official test, using exact character\-span\-and\-type micro Detection F1 \(Appendix[C\.2](https://arxiv.org/html/2610.35925#A3.SS2)\)\.

On KDPII, A\.X\+Gazetteer\+CRF\+MLP is comparable to XLM\-R\-large, the strongest language\-model baseline of the original KDPII study\([Fei et al\., 2024](https://arxiv.org/html/2610.35925#bib.bib2)\), with about a quarter of its total parameters: a pre\-specified five\-seed test gives86\.71±1\.4786\.71\\pm 1\.47versus85\.32±1\.2485\.32\\pm 1\.24, and the confidence interval of the 1\.40\-point difference,\[−0\.37,3\.04\]\[\-0\.37,3\.04\], includes zero\. Among nine KDPII\-trained encoders it also has the highest three\-seed mean on both test sets, on the synthetic test by a negligible margin \(Appendix Table[25](https://arxiv.org/html/2610.35925#A3.T25)\)\. The boundary MLP was informed by analysis of earlier test errors, and both seed extensions were decided after the three\-seed results\.

### 5\.3RQ2: Data Validity and Usability

#### 5\.3\.1RQ2\-A: Document and Label Validity

##### Setup\.

We randomly sampled 50 source documents from each of the six domains and paired the ReCoPII\-Ko and SPY versions of each, giving 300 pairs that both LLM judges and human annotators evaluate\. Three LLM judges \(Claude Haiku 4\.5, GPT\-5\.6 Luna, and Solar Pro 4\) rate sentence naturalness, coherence with the source, and whether the inserted preservable mentions are contextually valid, and select the better document, producing 900 valid judgments \(Appendix[D\.5](https://arxiv.org/html/2610.35925#A4.SS5)\); paired sign\-flip tests use Holm correction across the four measures\. Four human annotators each assess all 300 pairs without seeing the Basic source or generated privacy labels \(Appendix[B](https://arxiv.org/html/2610.35925#A2)\)\.

Table 2:RQ2\-A results on 300 matched document pairs of ReCoPII\-Ko \(R\-Ko\) and SPY \(900 LLM judgments, 1,200 human reviews\); bold marks Holm\-correctedp<0\.001p<0\.001\. LLM judges rate coherence with the source and whether each item presented as NON\_PII is valid in context\. Humans rate document coherence and, without seeing labels, judge up to two stored KEEP and two stored MASK entities per document as MASK, KEEP, or UNCERTAIN; agreement counts UNCERTAIN as disagreement with the generated label and is not adjudicated gold\. Preference ties: 8\.78% \(LLM\) and 15\.17% \(human\)\. Appendix[B](https://arxiv.org/html/2610.35925#A2)gives 95% confidence intervals\.
##### Results\.

Annotators accept most labels of ReCoPII\-Ko: they agree with 88\.42% of its sampled KEEP labels, whereas under the SPY reference KEEP agreement is 26\.27%, with about two fifths of KEEP judgments uncertain; MASK agreement is similarly high for both \(Table[2](https://arxiv.org/html/2610.35925#S5.T2)\)\. On document quality, annotators prefer the ReCoPII\-Ko document in about three quarters of reviews, and the LLM judges rate it higher in naturalness and source coherence and prefer it about twice as often as the SPY document; these differences remain significant after Holm correction, whereas the NON\_PII\-validity difference is not \(p=0\.236p=0\.236\)\. On whether preserved items are valid, the LLM judgments thus do not separate the two data sources, whereas the human judgments differ widely\.

#### 5\.3\.2RQ2\-B: Contextual Masking Supervision

##### Setup\.

We train six classifier configurations on ReCoPII\-Ko documents or, as the reference, on matched SPY\-style documents: four A\.X configurations read the full document, and KLUE\-R\-base and XLM\-R\-large read 512\-token windows\. Each input contains a supplied mention span and its entity type, and the target is MASK or KEEP without relation labels\. The training sets share 1,392 source documents with 4,140 KEEP mentions each\. Every model is scored on both versions of the 279 test documents, with 15,604 MASK mentions \(7,891 ReCoPII\-Ko and 7,713 SPY\) and 2,422 KEEP mentions \(1,211 per version\), over seeds 42–44 with document\-paired bootstrap intervals\. A preregistered validity check requires PII leakage below 5% on both original and inserted sentences of each model’s own generation method\.

Table 3:RQ2\-B mention\-level results \(%\) on the matched common test: means over three seeds for classifiers trained on SPY\-style documents \(SPY\) or ReCoPII\-Ko \(R\-Ko\)\. Gaz abbreviates Gazetteer, so the A\.X rows are the encoder alone, A\.X\+Gazetteer, A\.X\+CRF, and A\.X\+Gazetteer\+CRF\. Bold marks the better value within each model\.†marks configurations that failed the preregistered validity check and are descriptive only\. Appendix Table[18](https://arxiv.org/html/2610.35925#A2.T18)adds standard deviations\.
##### Results\.

Among the four valid A\.X configurations in Table[3](https://arxiv.org/html/2610.35925#S5.T3), classifiers trained on ReCoPII\-Ko reach 2\.54–3\.83 points higher Macro\-F1 and 5\.68–8\.84 points less over\-masking than under the SPY reference; every document\-paired confidence interval for these differences excludes zero, whereas all four leakage intervals include zero\. KLUE\-R\-base and XLM\-R\-large show the same Macro\-F1 direction but fail the validity check, with 8\.83% and 9\.78% maximum leakage on inserted sentences of their own training method, and training XLM\-R\-large on ReCoPII\-Ko raises its common\-test leakage\. RQ2\-B therefore indicates that the data are usable as contextual MASK/KEEP supervision for the valid A\.X family; the two windowed encoders remain descriptive evidence\. A context analysis shows what these decisions use: when a classifier reads the full document instead of only the entity’s value and type, entity\-level Macro\-F1 rises far more for ReCoPII\-Ko than for SPY \(Appendix Table[21](https://arxiv.org/html/2610.35925#A2.T21)\)\. Value and type thus determine most SPY decisions, whereas ReCoPII\-Ko decisions depend on textual context \(Appendix[B\.4](https://arxiv.org/html/2610.35925#A2.SS4)\)\.

Table 4:RQ3 masking results \(%\)\. Left: the official 404\-document test with generated labels \(1,750 KEEP and 11,045 MASK mentions\)\. Right: human\-verified entity records of 100 test documents \(192 reference\-KEEP entities, 238 mentions; 199 reference\-MASK entities, 670 mentions\)\. Each row is the same system on both sides: all conditions start from one KDPII\-trained detector \(seed 42\), and values with±\\pmare mean and sample SD over contextual seeds 42–44\. Joint Fine\-tuning \(FT\) uses the 1\.5% validation leakage budget; Detection only, Frozen Detector, and the single\-run LLMs, which receive the A\.X\+Gazetteer\+CRF detection\-only candidates, come from the registered runs\. Nothing was tuned on the human\-verified records\.†The only XLM\-R\-large run that met the budget \(seed 43\);‡no direct\-head run met it, so 5 of 6 XLM\-R\-large runs had no epoch within the budget\. Appendix Tables[27](https://arxiv.org/html/2610.35925#A3.T27)and[30](https://arxiv.org/html/2610.35925#A3.T30)add detector leakage and the same records scored against generated labels, and Table[31](https://arxiv.org/html/2610.35925#A3.T31)averages Detection only over detector seeds 42–44\.

### 5\.4RQ3: Integrated Masking System

##### Setup\.

RQ3 trains the system of Section[3\.3](https://arxiv.org/html/2610.35925#S3.SS3)on the data and evaluates it end to end on the official 404\-document test, where each condition masks the candidates of its own detector\.*Detection only*masks every candidate of a KDPII\-trained detector\. Frozen Detector and Joint Fine\-tuning train on the 1,245 training documents from one KDPII detector checkpoint \(seed 42\), with seeds 42–44 varying the contextual heads and joint training; Joint Fine\-tuning is run with both variants for five detectors, the three in Table[4](https://arxiv.org/html/2610.35925#S5.T4), A\.X\+Span, and KLUE\-R\-base\. The candidate\-assisted LLM baseline gives GPT\-4o\-mini, K\-EXAONE, or Solar Pro 3 the document and the A\.X\+Gazetteer\+CRF detection\-only candidates; the LLM predicts relations and edge\-level privacy labels, which Equation[1](https://arxiv.org/html/2610.35925#S3.E1)turns into MASK/KEEP decisions \(Appendix[C\.4](https://arxiv.org/html/2610.35925#A3.SS4)\)\.

##### Metrics and threshold selection\.

Over\-masking is the share of the 1,750 KEEP mentions with any masked character, and leakage is the share of the 11,045 MASK mentions with any unmasked character\. Joint Fine\-tuning selects thresholds and checkpoints by the lowest validation over\-masking among settings whose total validation leakage is at most 1\.5%\. We fixed this rule after the registered runs, from which Detection only, Frozen Detector, and the LLM baseline come, but before observing any of its results, so the variant comparison is post hoc \(Appendix[C\.4](https://arxiv.org/html/2610.35925#A3.SS4)\)\.

##### Results\.

A complete masking system can be trained on ReCoPII\-Ko: joint fine\-tuning removes almost all over\-masking, and leakage falls as well \(Table[4](https://arxiv.org/html/2610.35925#S5.T4)\)\. Masking every candidate \(Detection only\) or training only the heads \(Frozen Detector\) leaves most preservable mentions masked, whereas Joint Fine\-tuning over\-masks at most 2\.80% at no more than 1\.44% leakage across the four detectors that meet the budget \(Appendix Table[28](https://arxiv.org/html/2610.35925#A3.T28)\); the fine\-tuned detectors alone leak 0\.62–0\.90%, so the contextual heads add 0\.19–0\.68 points\. XLM\-R\-large does not meet the budget in five of its six runs, in which masking every candidate of the fine\-tuned detector already exceeds it on validation\. The candidate\-assisted LLMs release preservable mentions, but all six runs add leakage beyond that of their candidates\.

##### Human\-verified test\.

The reduction also appears when annotators verify the labels\. Because the scores above use generated labels, we also score the same systems on a human\-verified test: 100 ReCoPII\-Ko/SPY document pairs from the official test partition, in which four annotators judged sampled entity records without seeing the stored labels, and a record’s reference label is the MASK or KEEP decision of at least three of them \(Appendix[B\.3](https://arxiv.org/html/2610.35925#A2.SS3)\)\. On the 238 reference\-KEEP and 670 reference\-MASK mentions of the ReCoPII\-Ko documents \(192 and 199 entities\), Joint Fine\-tuning over\-masks 2\.52–5\.04% at 1\.14–4\.18% leakage for the four detectors that meet the budget, whereas Detection only masks nearly all preservable mentions for each of nine KDPII\-trained detectors \(three\-seed means, Appendix Table[31](https://arxiv.org/html/2610.35925#A3.T31)\)\. Against the generated labels of the same records, Joint Fine\-tuning over\-masks less \(Appendix Table[30](https://arxiv.org/html/2610.35925#A3.T30)\); a decomposition that was not pre\-specified traces the difference to two entities that the data labels MASK and the annotators judge preservable\. With 238 preservable mentions the intervals are wide, and because entity records were sampled per document, leakage here is not comparable with leakage on the full test\.

##### Insertion\-free probe\.

Almost all preservable mentions sit in inserted sentences \(1,734 of the test’s 1,750\), so these scores could partly reflect recognition of inserted sentences; a pre\-specified test finds that sentence origin affects the release of MASK mentions \(Appendix[C\.5](https://arxiv.org/html/2610.35925#A3.SS5)\)\. We therefore apply the same checkpoints and thresholds to 402 documents a separate pipeline writes whole from a planned relation graph \(generated labels, not human\-verified\)\. For the four detectors within budget, Joint Fine\-tuning still leaves most preservable mentions unmasked, over\-masking 11\.33–34\.21% against at least 88\.59% for Detection only and leaking at most 4\.95%, both above the official test’s 2\.80% and 1\.44%\. The decision does not rest on inserted sentences alone, but part of the ReCoPII\-Ko accuracy does not carry over \(Appendix[C\.7](https://arxiv.org/html/2610.35925#A3.SS7)\)\.

##### Relation\-conditioned heads versus direct head\.

On the full test, the direct head over\-masks about one to one and a half points less than relation\-conditioned heads, and the paired interval excludes zero for all four detectors; leakage differs only for A\.X\+Gazetteer\+CRF, where relation\-conditioned heads leak more \(Appendix Table[28](https://arxiv.org/html/2610.35925#A3.T28)\)\. On the human\-verified records the direction is the same, but the paired interval excludes zero only for KLUE\-R\-base, so that test does not establish the difference on its own \(Appendix Table[32](https://arxiv.org/html/2610.35925#A3.T32)\)\. This comparison shows only that a direct head suffices at inference; separately, the supervision itself is built from relations, since Equation[1](https://arxiv.org/html/2610.35925#S3.E1)derives each entity’s label from its annotated edges\. Because every relation\-conditioned decision follows from retained edges, the gap can be traced: in the 12 relation\-conditioned runs of the four detectors, 73\.2–98\.2% of over\-masked KEEP mentions are masked through an edge predicted as PII, and 84\.8–95\.7% of those edges have an endpoint pair and relation label absent from the annotated graph\. Their over\-masking therefore comes mainly from predicted relations that the annotation does not contain\.

## 6Conclusion

We presented a relation\-grounded framework that builds contextual masking data without presuming a single data subject, deriving MASK/KEEP labels for PII\-type mentions from planned and verified entity relations\. On Korean documents from six domains, annotators accept its labels: they agree with 88\.42% of its sampled KEEP labels, where author\-based labels on the same source documents reach 26\.27%\. The data are also usable: classifiers trained on them over\-mask less on a matched test, and contextual masking fine\-tuned jointly with a compact detector removes most over\-masking within a fixed leakage budget; the reduction holds on human\-verified entity records, where masking every candidate masks nearly all preservable mentions, and, to a lesser degree, on insertion\-free documents\. A direct head suffices at inference, while relation\-conditioned heads keep each decision traceable to edges but over\-mask more\. Verifying every mention with independent adjudication is the next step\. We will release the dataset and code\.

## Limitations

Contextual MASK/KEEP decisions are evaluated only on synthetic Korean documents; performance on naturally occurring documents and other languages is untested\. Except for the human\-verified test, model evaluations score generated labels, so they measure agreement with the construction pipeline rather than the correctness of each privacy decision\. The human\-verified test covers at most four sampled entity records per document, and its 238 preservable mentions give wide intervals\. Preservable mentions sit almost only in inserted sentences, so scores on the official test may partly reflect sentence origin\.

## References

- Fan et al\. \(2024\)Wei Fan, Haoran Li, Zheye Deng, Weiqi Wang, and Yangqiu Song\. 2024\.[GoldCoin: Grounding large language models in privacy laws via contextual integrity theory](https://doi.org/10.18653/v1/2024.emnlp-main.195)\.In*Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing*\.
- Fei et al\. \(2024\)Li Fei, Yejee Kang, Seoyoon Park, Yeonji Jang, Jongguyu Lee, Jongkyu Lee, Hansaem Kim, and Han\-Saem Kim\. 2024\.[KDPII: A new korean dialogic dataset for the deidentification of personally identifiable information](https://doi.org/10.1109/ACCESS.2024.3461804)\.*IEEE Access*, 12:135626–135641\.
- Holmes et al\. \(2024\)Langdon Holmes, Scott Crossley, Perpetual Baffour, Jules King, Lauryn Burleigh, Maggie Demkin, Ryan Holbrook, Walter Reade, and Addison Howard\. 2024\.[The learning agency lab – PII data detection](https://www.kaggle.com/competitions/pii-detection-removal-from-educational-data/data)\.Kaggle competition\.
- Li et al\. \(2025\)Haoran Li, Wei Fan, Yulin Chen, Jiayang Cheng, Tianshu Chu, Xuebing Zhou, Peizhao Hu, and Yangqiu Song\. 2025\.[Privacy checklist: Privacy violation detection grounding on contextual integrity theory](https://aclanthology.org/2025.naacl-long.86/)\.In*Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics*\.
- Oh et al\. \(2026\)Myeong Seok Oh, Dong\-Yun Kim, Hanseok Oh, Chaean Kang, Joeun Kang, Xiaonan Wang, Hyunjung Park, Young Cheol Jung, and Hansaem Kim\. 2026\.[Subject\-level inference for realistic text anonymization evaluation](https://aclanthology.org/2026.acl-long.778/)\.In*Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics*\.
- Ponomarenko et al\. \(2026\)Mariia Ponomarenko, Sepideh Abedini, Masoumeh Shafieinejad, D\. B\. Emerson, Shubhankar Mohapatra, and Xi He\. 2026\.[CAPID: Context\-aware PII detection for question\-answering systems](https://aclanthology.org/2026.eacl-srw.23/)\.In*Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics: Student Research Workshop*\.
- Savkin et al\. \(2025\)Maksim Savkin, Timur Ionov, and Vasily Konovalov\. 2025\.[SPY: Enhancing privacy with synthetic PII detection dataset](https://doi.org/10.18653/v1/2025.naacl-srw.23)\.In*Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Student Research Workshop*\.
- Shen et al\. \(2026\)Hao Shen, Zhouhong Gu, Haokai Hong, Weili Han, and Hongfeng Chai\. 2026\.[PII\-Bench: Evaluating query\-aware privacy protection systems](https://doi.org/10.18653/v1/2026.acl-long.227)\.In*Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics*\.

## Appendix ADataset Statistics and Definitions

The archive census covers 2,355 cleaned Basic documents and 1,857 shared Basic/ReCoPII\-Ko/SPY IDs, distinct from the experimental cohorts\. PII counts use sentence\-levelPII\_setmentions; MASK/KEEP counts use ReCoPII\-Ko/SPY entity records, which Basic does not provide\. The 1,857 ReCoPII\-Ko documents comprise 302 career/education, 318 contract, 334 financial, 246 legal, 299 medical, and 358 support documents\. The official split \(Section[4](https://arxiv.org/html/2610.35925#S4)\) places every domain, relation label, and entity\-type/MASK–KEEP combination that occurs in at least ten source groups in all three partitions\.

Table 5:Six\-domain composition\. Basic counts and PII mentions use the full cleaned corpus; ReCoPII\-Ko and SPY entity counts use the 1,857 common documents\. Each MASK/KEEP share is calculated within its domain, not across domains\.Table 6:Corpus overview and document lengths\. Lengths count Unicode characters with stored sentences joined by single newlines and whitespace retained; quantiles use linear interpolation and are rounded to integers\. PII counts include repeated sentence\-level mentions\. MASK/KEEP are entity records and unavailable for Basic\. KDPII is an independent length reference from the full raw export before RQ1 duplicate removal\.
Table 7:PII mention composition by stored entity type\. Each cell gives the count and its share of all PII\_set mentions in that corpus\. Basic \(all\) is shown separately because it is not the paired comparison cohort\.
Table 8:Data version and split used by each experiment\. Hashes are SHA\-256 prefixes of the archive or split file\. The source\-group split links documents that share a Basic source identifier or identical text and assigns each linked group to one split\. The RQ2\-B split assigns each document ID to one of 1,392 training, 186 validation, and 279 test documents, so no document belongs to two partitions\. It predates the source\-group split and does not group documents by source: 27 of its test documents have the same Basic source identifier value as a training \(24\) or validation \(3\) document, which gives 28 document pairs\. The documents in these pairs have different texts: none of the pairs is identical, and their character 5\-gram Jaccard similarity \(median 0\.045, maximum 0\.086\) is close to that of random same\-domain pairs \(median 0\.038, 95th percentile 0\.071\); 2 of the pairs have entity values in common \(8 at most\)\. The earlier ReCoPII\-Ko snapshot \(stored asours\_fixedin our files\) applies a local label fix to the pre\-correction ReCoPII\-Ko archive, whose hash its row gives; relative to the current archive, all 1,857 document texts and relation annotations are identical, andPII\_setdiffers in 2 documents \(50,622 versus 50,620 mentions\)\.ReCoPII\-KoSPYMentionsEntitiesEntitiesEntity typeMASKKEEPMASKKEEPKEEP \(%\)MASKKEEPKEEP \(%\)ADDRESS2,6937092,16269724\.42,1491,08033\.4AGE587052500\.052410\.2BANK\_ACCOUNT\_NUMBER1,6787481,04173841\.51,0241,44158\.5CARD\_NUMBER586236110\.335710\.3DATE\_OF\_BIRTH2,19001,57600\.01,57300\.0DEPARTMENT1,3841,20077388853\.57341,41965\.9DRIVER\_LICENSE\_NUMBER166013800\.013800\.0EMAIL2,9301,7771,2331,65357\.31,2201,24150\.4MAJOR624030900\.030763167\.3MOBILE\_PHONE3,55431,98730\.21,9221,16637\.8NAME23,761582,667582\.12,66710\.0PASSPORT\_NUMBER7907200\.07200\.0POSITION92630728273\.67021,17762\.6RRN1,17601,04400\.01,04400\.0SCHOOL927130410\.33021,03677\.4TELEPHONE1,8222,0401,0351,85164\.11,01780344\.1VEHICLE\_NUMBER256015900\.015683884\.3WORKPLACE5,2811,67899086346\.698776843\.8Table 9:MASK/KEEP composition by entity type on the 1,857 common documents\. Mentions count sentence\-level occurrences in the ReCoPII\-Ko entity registry, including repeats; the ReCoPII\-Ko MASK mentions are exactly thePII\_setentries, which contain no KEEP mention\. Entities count document\-level registry records, and KEEP \(%\) uses MASK\+KEEP entities within each type\. These are dataset labels rather than model predictions\.![Refer to caption](https://arxiv.org/html/2610.35925v1/figures/synthetic_data/source_corpus_construction.png)Figure 3:Source\-corpus construction workflow used before the relation annotation and contextual augmentation described in Section[3](https://arxiv.org/html/2610.35925#S3)\. Persona enrichment supports placeholder\-based document generation across six domains, followed by automated validation, deterministic slot filling, character\-level BIO conversion, and quality verification\. The later paired\-document human audit is reported in Appendix[B](https://arxiv.org/html/2610.35925#A2)\.Relation labelEdgesPIINON\_PIINON\_PII %ASSET\_RELATION29829710\.3%BUSINESS\_SERVICE\_RELATION41040282\.0%CASE\_AND\_INCIDENT\_RELATION39939451\.3%COLLABORATION\_PARTNERSHIP1531193422\.2%CONTACT\_ASSOCIATION8,1004,4323,66845\.3%CREDIT\_AND\_GUARANTEE\_RELATION646400\.0%EDUCATION\_STATUS95165629531\.0%EVENT\_PARTICIPATION3300\.0%FINANCIAL\_ASSET\_ASSOCIATION2,2001,45774333\.8%FINANCIAL\_TRANSACTION1,0131,00760\.6%GUIDANCE\_SUPPORT13412596\.7%IDENTITY\_ASSOCIATION3,3913,39100\.0%INFORMATION\_GOVERNANCE470432388\.1%INSURANCE\_RELATION616100\.0%LOCATION\_ASSOCIATION2,8552,14870724\.8%ORGANIZATIONAL\_RELATION4,8602,4572,40349\.4%PERSONAL\_RELATIONSHIP646400\.0%PROCEDURAL\_RELATION16516053\.0%QUALIFICATION\_AND\_ASSESSMENT656146\.2%

Table 10:ReCoPII\-Ko relation\-annotation composition \(25,656 edges\)\. Edge\-level privacy labels and final endpoint masking decisions are distinct; the lower panel counts the latter combinations\. Directional endpoint\-type configurations are retained in the reproducible relation\-configuration artifact\.\(a\) Customer and department emailSUPPORT\_200397

Korean source\\korean④김현석님의 추가 문의에 따라, 현재 진행 중인 계정 보안 점검 결과를 2025년 7월 15일까지 이메일로 안내드릴 예정입니다\. 점검 완료 후에는kimhyeonseok19650226@naver\.com를 통해 보안 강화 조치에 대한 상세 보고서를 발송하며, 필요 시 추가 인증 절차를 안내해 드리겠습니다\.또한, 고객님께서는eunseong19911009@naver\.com으로 관련 내용을 전달하실 수 있으며, 이 이메일 주소는 해당 부서의 문의 창구입니다\.English translation\(4\) In response to additional questions from customer Kim Hyeon\-seok, the results of the ongoing account\-security review will be emailed by July 15, 2025\. Once the review is complete, a detailed report on security improvements will be sent to kimhyeonseok19650226@naver\.com, with instructions for further verification if needed\.The customer may also send related information to eunseong19911009@naver\.com; that address is the department’s inquiry channel\.

\(b\) Customer and corporate accountsSUPPORT\_200124

Korean source\\korean\[결과 및 메모\] 부분 환불 처리가 결정되어 두 번째 주문에 대한 결제 금액을 전액 환불하였으며, 환불 계좌는 기존 결제 시 사용된 계좌인339\-9736\-5545\-72로 지정되었다\. 또한 앱 오류 재발 방지를 위해 개발팀에 버그 리포트를 제출하고 시스템 개선 요청을 진행하였다\. 향후 유사 사례 발생 시 동일한 처리 절차를 적용하도록 내부 지침을 수정하였다\.환불 처리에 사용된 계좌는272\-324\-012263이며, 해당 계좌는STX그린로지스의 공식 정산 계좌다\.English translation\[Outcome and notes\] A partial refund was approved, and the payment for the second order was refunded in full\. The refund account was set to 339\-9736\-5545\-72, the account used for the original payment\. A bug report was sent to the development team to prevent the app error from recurring, and a system improvement was requested\. Internal guidance was updated to apply the same procedure in similar future cases\.The account used to process the refund is 272\-324\-012263, the official settlement account of STX Green Logistics\.

\(c\) Service\-office and delivery addressesSUPPORT\_200505

Korean source\\korean고객 지원 부서의 사무실 주소는서울특별시 강서구 화곡로 296\-108이며, 방문 상담이 가능합니다\.고객장미정은 반품 접수 외에도 오배송된 상품에 대한 배송비 환급을 요청하였습니다\. 물류 비용 정산 기준에 따라 배송비 전액 또는 일부를 환급하는 방안을 검토하고 있습니다\.고객장미정의 반품 상품은 현재 물류 센터에 입고되어 검수 중입니다\. 검수 완료 후 고객의 주소경기도 평택시 평택로 293 104동 523호로 재배송이 진행될 예정이며, 배송 추적 번호를 제공할 계획입니다\.English translationThe customer support department’s office is at 296\-108 Hwagok\-ro, Gangseo\-gu, Seoul, where in\-person consultation is available\.Customer Jang Mi\-jeong requested reimbursement of shipping costs for a misdelivered item in addition to filing a return\. The company is reviewing whether to reimburse the full cost or part of it under its logistics settlement rules\.The item returned by Jang Mi\-jeong is being inspected at the logistics center\. After inspection, it will be shipped again to the customer’s address at 293 Pyeongtaek\-ro, Building 104, Unit 523, Pyeongtaek\-si, Gyeonggi\-do, and a tracking number will be provided\.

\(d\) Recommendation subject and cited authorCAREER\_EDUCATION\_300930

Korean source\\korean또한, 피추천인은 2023년 하반기에 ’제로 트러스트 아키텍처 도입’ 프로젝트에 참여하며 기존 네트워크 구조를 전면 개편하는 데 기여했습니다\. 이 과정에서 그는 복잡한 정책 설계와 구현 작업을 주도하여 프로젝트 일정을 예정보다 2주 앞당겼습니다\.김순근은존 킨더바그가 제안한 제로 트러스트 보안 모델을 설계 근거로 삼아 해당 아키텍처의 정책 구조를 구체화했습니다\.English translationThe recommended candidate also joined a project to adopt a zero\-trust architecture in the second half of 2023 and helped overhaul the existing network\. He led the design and implementation of complex policies and completed the project two weeks ahead of schedule\.Kim Sun\-geun used the zero\-trust security model proposed by John Kindervag as a design basis and specified the architecture’s policy structure\.

Figure 4:Four ReCoPII\-Ko excerpts showing contextual MASK/KEEP decisions for PII\-type mentions\. Korean passages reproduce consecutive source records; English passages are translations\. Red marks MASK spans inPII\_set, and blue marks KEEP spans in the entity registry\. The same type can receive both decisions:EMAILin \(a\),BANK\_ACCOUNT\_NUMBERin \(b\),ADDRESSin \(c\), andNAMEin \(d\)\. These are generated labels, not human judgments\.FamilyStored typeDefinition \(Korean / English\)Format constraints \(observed\)PERNAME\\korean이름 / Person name*Free text*LOCADDRESS\\korean주소 / Street, building, or residential address*Free text*ORGWORKPLACE\\korean직장 / Employer or workplace*Free text*DEPARTMENT\\korean부서 / Organizational department*Free text*POSITION\\korean직위 / Job title or organizational position*Free text*SCHOOL\\korean학교 / School or educational institution*Free text*DEMMAJOR\\korean전공 / Academic major or field of study*Free text*AGE\\korean나이 / Age or age expression`\\d\{2\}`DATETIMEDATE\_OF\_BIRTH\\korean생년월일 / Date of birth`\\d\{4\}\[\-\./\]\\d\{1,2\}\[\-\./\]\\d\{1,2\}`
`\\d\{8\}`
*also Korean year/month/day wording*CODEMOBILE\_PHONE\\korean휴대폰 / Mobile telephone number`010\-\\d\{4\}\-\\d\{4\}`TELEPHONE\\korean전화 / Non\-mobile or general telephone number`0\(?:2\|\[3\-9\]\\d\)\-\\d\{3,4\}\-\\d\{4\}`PASSPORT\_NUMBER\\korean여권번호 / Passport identifier`\[A\-Z\]\\d\{3\}\[A\-Z\]\\d\{4\}`RRN\\korean주민번호 / Korean resident registration number`\\d\{6\}\-\[1\-4\]\\d\{6\}`DRIVER\_LICENSE\_NUMBER\\korean면허번호 / Driver’s license identifier`\\d\{2\}\-\\d\{2\}\-\\d\{6\}\-\\d\{2\}`VEHICLE\_NUMBER\\korean차량번호 / Vehicle registration number`\\d\{3\}\[\\uAC00\-\\uD7A3\]\\d\{4\}`BANK\_ACCOUNT\_NUMBER\\korean계좌 / Bank account identifier`\\d\{2,6\}\(?:\-\\d\{2,6\}\)\{2,3\}`
*bank\-specific digit groups*CARD\_NUMBER\\korean카드번호 / Payment card number`\\d\{4\}\(?:\-\\d\{4\}\)\{3\}`EMAIL\\korean이메일 / Email address`\[^\\s@\]\+@\[^\\s@\]\+\\\.\[^\\s@\]\+`

Table 11:The 18 stored PII entity types, Korean label names, and observed format cues\. Structured\-type patterns summarize Basic PII\_set forms and ReCoPII\-Ko entity mention forms in the current snapshots; birth dates also appear in Korean year/month/day wording\. The patterns are not verified generation\-time validators and need not cover SPY variants\. Free\-text types have no single surface regex\. The six families are display groups, not annotation labels\. The lower panel reports NAME entity records per document, not distinct people\.## Appendix BGeneration and Evaluation Details

Measured processing counts and evaluation results are grouped below by purpose\.

### B\.1Generation and annotation repair

Table[13](https://arxiv.org/html/2610.35925#A2.T13)reports the document flow of the organization\-focused augmentation, and Table[13](https://arxiv.org/html/2610.35925#A2.T13)the later annotation repair\.

Table 12:Document flow of the organization\-focused augmentation\. Documents that failed were regenerated with a new seed in up to five rounds, and each rejected document is counted once at the stage of its last failure\. The review step rejects no document itself; its findings enter the acceptance decision \(Section[3\.2](https://arxiv.org/html/2610.35925#S3.SS2.SSS0.Px3)\)\. The 147 realization failures include five documents accepted before the competing\-source check of Appendix[E\.2](https://arxiv.org/html/2610.35925#A5.SS2)was introduced that failed it on re\-examination\. Counts come from the construction team’s summary report \(SHA\-256 prefixb61b19e16118\); its per\-document audits are stored on a separate server\. The final count matches the hashed ReCoPII\-Ko and SPY archives\.
PII typeBefore correctionFinal archiveRemovedNAME23,81923,76158WORKPLACE5,2825,2811DEPARTMENT1,3851,3841POSITION9279261CARD\_NUMBER5885862Other 13 types18,68218,6820Total50,68350,62063Table 13:PII mention counts across the recoverable final annotation\-correction stage\. Both snapshots contain the same 1,857 ReCoPII\-Ko documents; the correction removed 63 sentence\-levelPII\_setspans in 58 documents without changing document text, entity registries, or relations\. Only changed types are listed separately; the other 13 types did not change\. These counts describe annotation repair after augmentation, not generation success or semantic\-review attrition\.

### B\.2Document quality and human validation

To calibrate the 1–5 naturalness scale of the LLM judges, the same judges also score 300 length\-stratified English student essays from the 6,807\-document public training split of the Kaggle PII Detection dataset\([Holmes et al\., 2024](https://arxiv.org/html/2610.35925#bib.bib3)\); their mean naturalness is 2\.74, against 2\.77 for ReCoPII\-Ko and 2\.37 for SPY\.

Four annotators, all project members, independently assess the same pool of 300 ReCoPII\-Ko/SPY document pairs under a fixed masking policy, with pair order and A/B positions randomized separately for each annotator\. Both are drawn once when the study is prepared and stored with the annotator’s assignment, so an annotator who reconnects sees the same order and positions\. The items to judge are also fixed in advance: for each document, a seeded random draw selects up to two MASK and up to two KEEP entity records, and for each ReCoPII\-Ko document up to two relations drawn uniformly from all its edges; all four annotators judge the same items\.

Each pair is evaluated in three stages \(Figure[5](https://arxiv.org/html/2610.35925#A2.F5)\)\. Annotators first rate naturalness and document coherence on a 1–5 scale and select a preferred document, then decide MASK, KEEP, or UNCERTAIN for the sampled entity records, and finally review the sampled ReCoPII\-Ko relations\. The interface cannot reveal labels in the first two stages because the server does not send them: in the quality stage it sends only the sentences of the two documents, and in the entity stage it adds the sampled entity records without their stored privacy labels or source identifiers\. The generation method is not sent at any stage, and relations are sent only in the relation stage, without their edge\-level privacy labels\. Once an annotator confirms a stage, the server rejects later changes to its responses, so quality and entity decisions cannot be revised after relations appear\. Annotators also do not see the Basic source\. The LLM source\-coherence and NON\_PII\-validity tasks in Table[2](https://arxiv.org/html/2610.35925#S5.T2)therefore differ from these human tasks\.

![Refer to caption](https://arxiv.org/html/2610.35925v1/figures/human_eval/quality_screen.png)

\(a\) Document quality ![Refer to caption](https://arxiv.org/html/2610.35925v1/figures/human_eval/entity_screen.png) \(b\) Entity MASK/KEEP judgment with labels hidden

Figure 5:Human evaluation interface, shown on a practice item \(*yeonseup 1\-beon*, “Practice 1”\) with synthetic document values; the selections come from an interface check and are not study responses\. Both screens are cropped\. \(a\) The instruction reads “Read both documents in full and rate each\. Quality responses are locked after the stage is confirmed\.” Under Document A and Document B, the annotator scores “sentence naturalness” and “contextual coherence” from 1 to 5, marks “contradiction in content” as present, absent, or cannot judge, and chooses the “overall better document” \(Document A, Document B, or tie\); the button reads “confirm quality responses→\\rightarrowentity judgment\.” \(b\) The tabs name the three stages \(document quality, entity judgment, relation review\), and the instruction reads “The existing answers are hidden\. Check every occurrence and choose the applicable option\.” For each sampled entity, shown with its value and entity type, the question “How should this information be handled in this document?” offers “must be hidden \(MASK\),” “may be left \(KEEP\),” and “cannot judge,” which is recorded as UNCERTAIN\. The remaining buttons read “go to the first highlighted occurrence,” “previous item,” “next item,” “download draft responses,” and “save and return to the list\.”The final snapshot contains 1,200 submitted pair reviews: each of the four annotators completed all 300 pairs, which come from 285 original\-source groups\. Tables[14](https://arxiv.org/html/2610.35925#A2.T14)–[16](https://arxiv.org/html/2610.35925#A2.T16)pool all submitted judgments; practice responses are excluded\. Each rating has equal weight, and every pair contributes four ratings\. We form 95% confidence intervals using 2,000 bootstrap samples of original\-source groups within domains, keeping derivative pairs and their ratings together\. These intervals condition on the four annotators\. Because every pair has all four submissions, the planned analysis of pairs completed by all four annotators coincides with these estimates\.

Table 14:Human document\-quality assessment: four annotators each review all 300 ReCoPII\-Ko/SPY pairs \(600 document versions\), giving 1,200 pair reviews\. Brackets give 95% bootstrap confidence intervals\. Each rating has equal weight\. Document coherence concerns the completed document; unlike the LLM source\-coherence task, annotators do not see the Basic source\. Preference shares include ties\.Table 15:Human MASK/KEEP audit of document\-level entity records, with 95% confidence intervals in brackets\. Each document supplies up to two stored MASK and two stored KEEP records\. Agreement compares human decisions with generated stored labels; UNCERTAIN counts as disagreement unless explicitly excluded\. Decidable\-only KEEP agreement uses 2,399 ReCoPII\-Ko and 1,378 SPY judgments\. Pairwise inter\-annotator agreement pools all annotator pairs on the same entity, treating UNCERTAIN as a category\. These values are neither mention\-level F1 nor corpus\-wide accuracy\. Adjudicated corrections remain unavailable\.Table 16:Human relation audit, with 95% confidence intervals in brackets\. Annotators inspect up to two sampled ReCoPII\-Ko relations per document after locking quality and entity responses; relation availability makes this stage partially blinded\. Support asks whether the text supports the relation\. Privacy agreement compares human PII/NON\_PII decisions with generated edge\-level privacy labels, including UNCERTAIN as disagreement\. SPY relations are outside this audit\. Pairwise agreement pools all annotator pairs on the same relation\.Agreement with a generated label measures how often a human decision supports that annotation\. It does not supply independently adjudicated reference labels\. Adjudicated reference labels are not yet available, so the audit reports agreement and uncertainty rather than correction rates or human F1\.

### B\.3Human\-verified test

Generated labels can agree with a model for reasons unrelated to their correctness, so Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4)also scores its systems on entity records whose labels annotators verified\. The human\-verified test consists of 100 ReCoPII\-Ko/SPY document pairs from the test partition of the official split\. 73 of them are the pairs of the 300\-pair pool above that fall in this partition\. The other 27 were added afterwards and judged by the same four annotators with the same protocol and interface: they were drawn at random within domains from test\-partition source groups that contain no pair of the pool and whose documents are also test documents under the split of RQ2\-B, by a rule fixed before any model output on these documents was inspected\. As a result, 34 of the 100 pairs are held out under both splits\.

As in the audit above, each annotator decides MASK, KEEP, or UNCERTAIN for up to two stored\-MASK and up to two stored\-KEEP entity records per document without seeing the stored labels, considering all occurrences of the entity\. A record’s reference label is the MASK or KEEP decision given by at least three of the four annotators; a record without such a majority has no reference label and is not scored\. We chose this rule after inspecting how many records each candidate rule yields from the annotators’ votes and before any system output was compared with the records\. Table[17](https://arxiv.org/html/2610.35925#A2.T17)gives the outcome for the 794 records\. In the ReCoPII\-Ko documents, 391 of the 400 records receive a reference label, which yields the 192 reference\-KEEP and 199 reference\-MASK entities used for scoring\. For the stored\-KEEP records of SPY documents, the annotators confirm KEEP for 24 of 194, choose MASK for 46, and reach no majority for 124\.

The unit of this test is a sampled entity record\. It verifies at most four entities per document and not every mention, so over\-masking and leakage in Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4)are restricted to the mentions of entities that have a reference label in the ReCoPII\-Ko version of each document\.

Table 17:Human\-verified test: 100 ReCoPII\-Ko/SPY document pairs from the official test partition, each judged by four annotators without seeing stored labels \(794 sampled entity records, up to two stored\-MASK and two stored\-KEEP records per document\)\. A record’s reference label is the MASK or KEEP decision of at least three of the four annotators;*none*marks records without such a majority\. Agree is the share of individual judgments that match the stored label\. 34 of the pairs are also held out under the RQ2\-B split\.
### B\.4MASK/KEEP prediction

Table[20](https://arxiv.org/html/2610.35925#A2.T20)gives the RQ2\-B training pools and common test, Table[18](https://arxiv.org/html/2610.35925#A2.T18)the results of Table[3](https://arxiv.org/html/2610.35925#S5.T3)with standard deviations, Table[20](https://arxiv.org/html/2610.35925#A2.T20)the class\-wise results, and Table[21](https://arxiv.org/html/2610.35925#A2.T21)the context analysis\. Training XLM\-R\-large on ReCoPII\-Ko raises its common\-test PII leakage from 0\.09% to 0\.28%, a difference of 0\.18 points \(95% CI \[0\.09, 0\.28\]\)\. For the context analysis, we train the same six architectures under four inputs, holding each model’s split and training procedure fixed: the entity type only, its surface value plus type, the containing sentence, and the full document\. Mention\-level MASK probabilities are averaged per entity and thresholded at 0\.5, and we score entity\-level Macro\-F1 over seeds 42–44\. The preregistered measure is the full\-document gain over value plus type; because KLUE\-R\-base and XLM\-R\-large read the full document as a 512\-token window, we also report the sentence gain, whose input is identical for every architecture\. The full\-document gain is 16\.27–19\.55 points for ReCoPII\-Ko and 1\.63–2\.39 points for SPY, and the sentence gain is 15\.32–19\.03 versus 1\.42–2\.16 points, with every document\-paired interval excluding zero\. Value plus type already reaches 96\.80–97\.31 Macro\-F1 on SPY but only 79\.60–83\.09 on ReCoPII\-Ko\. Entity value and type therefore determine most SPY decisions, whereas ReCoPII\-Ko decisions depend on local textual context, most of which the containing sentence already provides\.

Table 18:RQ2\-B mention\-level results \(%\) on the matched common test, as mean±\\pmstandard deviation over three seeds for classifiers trained on SPY\-style or ReCoPII\-Ko documents\. Gaz abbreviates Gazetteer\. Bold marks the better value within each model\.†marks configurations that failed the preregistered validity check; they are descriptive and excluded from the inferential conclusion\. Table[20](https://arxiv.org/html/2610.35925#A2.T20)gives class\-wise precision, recall, and F1\.Table 19:RQ2\-B matched training pools and common test for all six models in Table[3](https://arxiv.org/html/2610.35925#S5.T3)\. The experiment on the earlier ReCoPII\-Ko snapshot uses supplied mention spans and types with generated labels; these are not human\-verified gold or the current shared ZIP census\. Both training conditions score the same ReCoPII\-Ko/SPY paired\-version test mentions\.
Table 20:MASK\- and KEEP\-class precision, recall, and F1 on the RQ2\-B common test \(%; mean±\\pmsample SD over seeds 42–44\)\.†marks the two windowed models that failed the preregistered own\-version leakage check; their scores are descriptive\.

Table 21:RQ2\-B context analysis: entity\-level Macro\-F1 \(%\)\. R\-Ko denotes ReCoPII\-Ko\. Input\-condition values are mean±\\pmstandard deviation over three seeds; each gain subtracts Value\+type from Sentence or Full doc\., with a document\-paired bootstrap 95% confidence interval in brackets\. The full\-document gain is the preregistered primary measure\.†Full doc\. is a 512\-token window around each mention\.

## Appendix CModel Diagnostics

We first compare detector components and alternative architectures, then examine detection errors and contextual MASK/KEEP decisions\.

### C\.1Detector Component and Architecture Analysis

Table[22](https://arxiv.org/html/2610.35925#A3.T22)separates Gazetteer/CRF component changes, the contribution of the MLP at inference, and alternative A\.X architectures\.

Table 22:A\.X component and architecture analysis on KDPII\. Scores are percentages, reported as mean±\\pmsample SD over seeds 42–44, with the same split and exact character\-span\-and\-type matching as Table[23](https://arxiv.org/html/2610.35925#A3.T23)\. Macro\-F1 averages all 19 types\. Parameter counts are total trained parameters, all trainable, including the MLP when disabled only at inference\.##### Training settings\.

The A\.X models use encoder/head learning rates of2×10−5/10−42\\times 10^\{\-5\}/10^\{\-4\}, batch size 32, a 256\-token limit, and at most 12 epochs with early stopping after three validation checks without improvement\. KLUE\-BERT\-base and its CRF variant use the same settings\. Checkpoints are selected by validation micro\-F1, using MLP outputs for the MLP variant\. All encoders are fully fine\-tuned, and Gazetteers use training annotations only\.

##### Gazetteer and CRF\.

Under matched training settings, adding a CRF raises mean micro\-F1 from 82\.65 to 84\.74; adding the Gazetteer to the CRF model yields 85\.26\. The Gazetteer alone yields 82\.36, below the encoder\-only mean, so the observed gain depends on the configuration\.

##### MLP inference ablation\.

We disable the MLP at inference while retaining the same jointly trained checkpoints and CRF predictions\. Mean micro\-F1 decreases from86\.63±2\.0186\.63\\pm 2\.01to85\.27±1\.6685\.27\\pm 1\.66, a difference of 1\.36 points\. This isolates the use of the MLP during decoding\. Comparing the separately trained Gazetteer\+CRF and MLP variants instead gives a 1\.37\-point difference, which combines the MLP with the change to partial\-token BIO training targets\.

##### Alternative architectures\.

The gated variant, A\.X\+GatedGazetteer\+CRF, uses a context\-dependent sigmoid gate on Gazetteer features; A\.X\+Span replaces BIO tagging with a biaffine span classifier\. Their mean micro\-F1 scores of 83\.74 and 84\.49 are below 85\.26 for A\.X\+Gazetteer\+CRF under these settings\.

### C\.2Complete Detection and Transfer Results

Table[23](https://arxiv.org/html/2610.35925#A3.T23)gives the Detection F1 of six KDPII\-trained encoders and three prompted LLMs on both test sets\. Both test sets use exact character\-span\-and\-type micro Detection F1: KDPII evaluates 19 PII labels, and on the synthetic test MASK mentions are positives, so detecting a KEEP mention counts as a false positive\. The encoders are evaluated without synthetic training, threshold tuning, or relation/privacy inference\. K\-EXAONE, GPT\-4o\-mini, and Solar Pro 3 perform direct zero\-shot and three\-shot extraction from raw text, using the same 19\-type prompt on both test sets and three fixed KDPII training documents as demonstrations \(Appendix[D\.4](https://arxiv.org/html/2610.35925#A4.SS4)\); each condition runs once at temperature zero, without synthetic examples, detector candidates, or gold annotations\.

Table 23:Exact character\-span\-and\-type Detection F1 on KDPII and the synthetic test \(%\)\. Encoders use the same KDPII\-trained checkpoints on both datasets \(mean±\\pmsample SD, seeds 42–44\)\. Prompted LLMs directly extract spans from text, using the same prompt and, for three\-shot, the same KDPII training examples on both datasets \(single runs\)\. Synthetic MASK mentions are positives; KEEP detections are false positives\. Bold marks the best encoder mean across nine architectures or the best LLM score within each prompting setting\. Full encoder results appear in Appendix Table[25](https://arxiv.org/html/2610.35925#A3.T25)\. MLP denotes character boundary refinement\.The comparison with XLM\-R\-large in Section[5\.2](https://arxiv.org/html/2610.35925#S5.SS2)uses five seeds for each model under our common split and 19\-label protocol, and its 95% interval comes from a bootstrap over test dialogues and seeds\. On the synthetic test, the margin of A\.X\+Gazetteer\+CRF\+MLP is 0\.38 points over KLUE\-BERT\-base\+CRF and 0\.09 over A\.X\+Gazetteer\+CRF \(Table[25](https://arxiv.org/html/2610.35925#A3.T25)\)\. These descriptive margins, without a significance claim, rank zero\-shot transfer from KDPII training rather than performance after synthetic training\. Under the fixed extraction prompt and output budget, GPT\-4o\-mini has the highest synthetic Detection F1 among the prompted LLMs in both settings: 60\.73 for zero\-shot and 51\.18 for three\-shot\. All three LLMs score lower with KDPII demonstrations on the synthetic test, whereas the demonstrations improve their KDPII scores\. Thus, the benefit of these fixed examples does not carry over to this synthetic cohort\.

Table[24](https://arxiv.org/html/2610.35925#A3.T24)preserves precision, recall, macro\-F1, and parameter counts for the main encoders, alongside single\-run zero\-/three\-shot prompted LLM results on KDPII\. Prompted systems are not fine\-tuned on KDPII; Table[23](https://arxiv.org/html/2610.35925#A3.T23)reports their direct synthetic detection results with the same extraction prompt and KDPII demonstrations\. GPT\-4o\-mini has the highest three\-shot micro\-F1 \(62\.93\), while K\-EXAONE has the highest three\-shot recall \(64\.69\)\.

Table 24:RQ1 exact character\-span\-and\-type results on KDPII \(%\)\. Supervised values are mean±\\pmsample standard deviation over seeds 42–44; prompted values are single runs\. Macro\-F1 averages the 19 type\-level F1 scores\. Parameter counts are total parameters, all trainable for supervised models; prompted\-model counts are unavailable\. Bold marks the best result within each training or prompting setting\.Table 25:All nine KDPII\-trained detectors on both test sets\. Settings and metrics match Table[23](https://arxiv.org/html/2610.35925#A3.T23); all values are exact character\-span\-and\-type Detection F1, reported as mean±\\pmsample SD over detector seeds 42–44 \(%\)\. Bold identifies the best mean across these nine models\. Gazetteer\+CRF, GatedGazetteer\+CRF, and Span are included to expose the complete comparison\.Table[25](https://arxiv.org/html/2610.35925#A3.T25)reports Detection F1 for all nine KDPII\-trained architectures on both test sets\. The three additional A\.X variants are separated from the representative encoder comparison\. The character boundary MLP has the highest mean on KDPII \(86\.63%\) and the synthetic test \(69\.40%\)\. The synthetic runs use original detector training seeds, not contextual\-head training seeds\.

### C\.3Detection and Masking Diagnostics

Figure[6](https://arxiv.org/html/2610.35925#A3.F6)shows RQ2\-B MASK/KEEP performance by document length; its caption specifies the evaluation unit and data version\.

Figure 6:RQ2\-B MASK/KEEP Macro\-F1 by test\-document length for six models trained on SPY or ReCoPII\-Ko \(mean over seeds 42–44; shading shows one sample SD; vertical axis spans 0\.70–0\.95\)\. Length counts Unicode characters in each stored document; the 558 versioned documents from 279 source IDs are divided into five near\-equal groups, with cut points at 1,866, 1,989\.6, 2,147\.2, and 2,320\.8 characters\. Scores use supplied candidate spans and pipeline\-generated labels of the earlier ReCoPII\-Ko snapshot on the same common test, rather than human gold\. Each bin pools ReCoPII\-Ko and SPY document versions, so differences across bins are descriptive and may reflect changes in version composition\.†marks models that failed the preregistered own\-version leakage check\.
### C\.4Integrated Masking Results

##### Budget rule\.

For the variant comparison of Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4), each epoch is scored by the lowest validation over\-masking among grid settings whose total validation leakage is at most 1\.5%; an epoch without such a setting is not a checkpoint candidate\. Training runs at least five and at most ten epochs, with patience three counted from the first feasible epoch\. On test, we report budgets of 1%, 1\.5%, and 2% at thresholds chosen on validation, with 1\.5% as the primary budget\. The grids are relation thresholds\{0\.3,0\.5,0\.7\}\\\{0\.3,0\.5,0\.7\\\}by privacy thresholds\{0\.3,0\.5,0\.7,0\.9\}\\\{0\.3,0\.5,0\.7,0\.9\\\}plus masking every candidate for the relation\-conditioned heads, and MASK thresholds\{0,0\.1,…,0\.8,0\.85,0\.9,0\.95,0\.99\}\\\{0,0\.1,\\ldots,0\.8,\\allowbreak 0\.85,0\.9,0\.95,0\.99\\\}for the direct head\. Because Joint Fine\-tuning also updates the detector, its candidates come from a detector adapted to synthetic data\. XLM\-R\-large does not meet the budget in five of its six runs: masking every candidate of the jointly fine\-tuned detector already leaked more than 1\.5% on validation in every epoch \(1\.59–3\.29% with relation\-conditioned heads and 3\.78–8\.37% with the direct head\), so no threshold satisfied the rule\.

##### Candidate\-assisted LLM baseline\.

The LLMs receive the A\.X\+Gazetteer\+CRF detection\-only candidates, which we verified to be identical in all 404 documents\. Each LLM predicts relations among all 19 labels, without domain restriction, and edge\-level privacy labels\. Each condition runs once at temperature zero; three\-shot prompts use three fixed synthetic training documents\. The six LLM runs leak 13\.17–24\.28%\.

##### Registered runs\.

Table[27](https://arxiv.org/html/2610.35925#A3.T27)repeats the full\-test columns of Table[4](https://arxiv.org/html/2610.35925#S5.T4)and adds the leakage of each condition’s detector; it marks XLM\-R\-large as not meeting the budget, whereas Table[4](https://arxiv.org/html/2610.35925#S5.T4)also shows its single feasible run\. Table[28](https://arxiv.org/html/2610.35925#A3.T28)gives the variant comparison of Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4)for five detectors and three leakage budgets, and Table[29](https://arxiv.org/html/2610.35925#A3.T29)gives the registered runs for all eight detectors, from which Detection only, Frozen Detector, and the fixed 0\.5 threshold diagnostics are taken\. At each epoch, the registered runs searched relation thresholds\{0\.3,0\.5,0\.7\}\\\{0\.3,0\.5,0\.7\\\}and privacy thresholds\{0\.3,0\.5,0\.7,0\.9\}\\\{0\.3,0\.5,0\.7,0\.9\\\}on validation data, together with masking every candidate, and admitted only settings that added no validation leakage relative to the current detector; the admissible setting and epoch with the lowest validation over\-masking were selected\. Because this rule also chose checkpoints and stopped training, it kept some runs at masking every candidate, including all registered direct\-head runs of A\.X\+Gazetteer\+CRF; we therefore compare the two variants under the budget rule of Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4), fixed before any of its results were observed but after the registered runs, so that comparison is post hoc and its variants differ in parameter count\. Under the registered rule, Frozen Detector fell back to masking every candidate in all three seeds of A\.X\+Gazetteer\+CRF\+MLP and A\.X\+Gazetteer\+CRF, and XLM\-R\-large lowered over\-masking from 98\.86% to 87\.70% while its leakage rose from 14\.46% to 14\.57%\. Under the budget rule, the single feasible XLM\-R\-large run \(relation\-conditioned heads, seed 43\) is reported as one run and not summarized as a mean\. Every run uses the same settings: AdamW with learning rates of2×10−52\\times 10^\{\-5\}for the encoder,10−410^\{\-4\}for the other detector parameters, and5×10−45\\times 10^\{\-4\}for the relation and privacy heads; weight decay 0\.01; 10% warmup; gradient accumulation over eight documents; gradient clipping at 1\.0; bfloat16; and at most ten epochs with patience three\. For Frozen Detector, training compares a hash of the encoder’s first weight tensor before and after training to confirm that it is unchanged\.

### C\.5Sentence\-Origin Analysis

Preservable mentions sit almost only in inserted sentences \(Table[C\.5](https://arxiv.org/html/2610.35925#A3.SS5), panel A\), so low over\-masking could reflect recognition of inserted sentences instead of an entity’s role\. A head that followed such a rule would also release the maskable mentions that inserted sentences contain, 522 of the 11,045 MASK mentions\. This analysis therefore asks whether sentence origin changes the release of MASK mentions\. It covers the 25 variant\-comparison runs with test outputs: three seeds and both variants for A\.X\+Span, A\.X\+Gazetteer\+CRF\+MLP, A\.X\+Gazetteer\+CRF, and KLUE\-R\-base, and the relation\-conditioned XLM\-R\-large run with seed 43, all at the thresholds chosen on validation for the 1\.5% budget\. A sentence counts as a source sentence when its exact text occurs in Basic\. Release is measured among mentions fully covered by the run’s own detector, so that it reflects the head’s decision\.

Table 26:Sentence\-origin analysis on the 404\-document test\. A: gold mentions by sentence origin\. B: share of detected mentions that the head releases, as the range over runs with the median in parentheses; the number of runs follows each head, and KEEP in source sentences has 16 mentions\. C: released over detected gold MASK mentions, pooled over mentions and the 25 runs; organization types areWORKPLACE,DEPARTMENT, andSCHOOL\.
##### Release rates \(descriptive\)\.

Panel B gives the share of detected mentions that each head releases\. Both heads release MASK mentions more often in inserted sentences \(1\.77–11\.61% across the 25 runs\) than in source sentences \(0\.04–0\.63%\)\. The 16 KEEP mentions in source sentences are too few to estimate preservation in unedited text\.

##### Test of an origin effect \(pre\-specified\)\.

A higher release rate in inserted sentences could also arise if those sentences held entity types or documents that are harder to decide, so we fixed a test and its decision rule before running it\. The test estimates the Mantel–Haenszel odds ratio of release, inserted versus source, within strata that hold these factors fixed, with 95% intervals from the Robins–Breslow–Greenland variance\. The rule reports an origin effect beyond document and type difficulty if the interval of the odds ratio stratified by document and entity type lies above 1 in at least two thirds of the runs, no detectable effect if it includes 1 in at least two thirds, and an inconclusive result otherwise\. Stratified by entity type, the interval lies above 1 in 25 of 25 runs \(odds ratios 3\.6–91\.8, median 8\.3\), and stratified by document in 25 of 25 runs \(7\.2–119\.5, median 32\.7\)\. Stratified by document and entity type, it lies above 1 in 14 of the 15 runs where the odds ratio can be estimated \(5\.9–32\.0, median 11\.5\); the other 10 runs have empty stratum sums\. Under the rule, sentence origin affects release beyond document and type difficulty\.

##### Organization types \(not pre\-specified\)\.

Panel C separates this effect by entity type\. In inserted sentences, the heads release 5\.23% of organization mentions, against 0\.91% in source sentences, and none of the 500 mentions of other types\. The same gap appears within entities: for the 6,112 entity–run pairs with mentions of both origins, 4\.64% of inserted mentions are released against 0\.85% of source mentions, although the label is assigned per entity\. The heads thus do not release whatever an inserted sentence contains\. The released organizations are entities that Equation[1](https://arxiv.org/html/2610.35925#S3.E1)labels MASK through aPIIedge elsewhere in the document, while the inserted sentence presents them in an organizational role; the pattern is consistent with a conflict between these two roles\. At the median release rates, inserted\-sentence MASK mentions, 4\.7% of all MASK mentions, contribute about 0\.2 points of leakage\.

##### Limits\.

Organization types make up 96% of the detected MASK mentions in inserted sentences \(12,228 of 12,728\), which leaves about 20 mentions of other types per run, so their zero releases are weak evidence on their own\. For organization types, the data cannot separate a role conflict from a stylistic cue specific to these types\. Whether the heads preserve KEEP mentions in unedited text cannot be tested with 16 such mentions\. Appendix[C\.7](https://arxiv.org/html/2610.35925#A3.SS7)therefore applies the same systems to documents written without inserted sentences\.

Table 27:RQ3 masking results on the official 404\-document test \(%; generated labels\)\. Over\-masking is the share of 1,750 KEEP mentions with any masked character; leakage is the share of 11,045 MASK mentions with any unmasked character; Det\. leakage masks every candidate of the current detector\. Values with±\\pmare mean and sample SD over contextual seeds 42–44 from one KDPII\-trained detector \(seed 42\)\. Joint Fine\-tuning \(FT\) uses thresholds and checkpoints selected on validation data under a 1\.5% total\-leakage budget; Detection only, Frozen Detector, and the single\-run LLMs, which receive the A\.X\+Gazetteer\+CRF detection\-only candidates, come from the registered runs\.‡5 of 6 XLM\-R\-large runs had no epoch within the budget: masking every candidate still leaked 1\.59–3\.29% \(relation\-conditioned\) and 3\.78–8\.37% \(direct\) on validation\. Appendix Table[28](https://arxiv.org/html/2610.35925#A3.T28)reports five detectors and three budgets\.Relation\-conditionedDirectRelation−\-directDetectorBudgetOver\-maskLeakageOver\-maskLeakageOver\-maskLeakageA\.X\+Span1%2\.42±0\.402\.42\\pm 0\.401\.10±0\.201\.10\\pm 0\.201\.28±0\.291\.28\\pm 0\.291\.36±0\.301\.36\\pm 0\.30\+1\.14 \[0\.51, 1\.86\]\-0\.26 \[\-0\.66, 0\.06\]1\.5%2\.25±0\.232\.25\\pm 0\.231\.19±0\.291\.19\\pm 0\.291\.20±0\.171\.20\\pm 0\.171\.44±0\.311\.44\\pm 0\.31\+1\.05 \[0\.50, 1\.68\]\-0\.25 \[\-0\.64, 0\.06\]2%2\.25±0\.232\.25\\pm 0\.231\.19±0\.291\.19\\pm 0\.291\.07±0\.291\.07\\pm 0\.291\.74±0\.231\.74\\pm 0\.23\+1\.18 \[0\.58, 1\.91\]\-0\.55 \[\-0\.97, \-0\.21\]A\.X\+Gazetteer\+CRF\+MLP1%66\.93±56\.0966\.93\\pm 56\.090\.86±0\.130\.86\\pm 0\.1366\.80±56\.7166\.80\\pm 56\.710\.72±0\.140\.72\\pm 0\.14\+0\.13 \[\-0\.15, 0\.43\]\+0\.15 \[0\.02, 0\.27\]1\.5%2\.36±0\.432\.36\\pm 0\.431\.20±0\.341\.20\\pm 0\.341\.10±0\.031\.10\\pm 0\.031\.13±0\.221\.13\\pm 0\.22\+1\.26 \[0\.61, 2\.02\]\+0\.06 \[\-0\.15, 0\.27\]2%2\.36±0\.432\.36\\pm 0\.431\.20±0\.341\.20\\pm 0\.341\.10±0\.031\.10\\pm 0\.031\.13±0\.221\.13\\pm 0\.22\+1\.26 \[0\.61, 2\.02\]\+0\.06 \[\-0\.15, 0\.27\]A\.X\+Gazetteer\+CRF1%2/3 seeds feasible34\.11±56\.6634\.11\\pm 56\.660\.89±0\.090\.89\\pm 0\.09——1\.5%2\.57±0\.572\.57\\pm 0\.571\.32±0\.241\.32\\pm 0\.241\.41±0\.091\.41\\pm 0\.090\.97±0\.170\.97\\pm 0\.17\+1\.16 \[0\.70, 1\.66\]\+0\.34 \[0\.17, 0\.52\]2%2\.57±0\.552\.57\\pm 0\.551\.47±0\.301\.47\\pm 0\.301\.41±0\.091\.41\\pm 0\.090\.97±0\.170\.97\\pm 0\.17\+1\.16 \[0\.68, 1\.71\]\+0\.49 \[0\.28, 0\.73\]KLUE\-R\-base1%35\.68±55\.5235\.68\\pm 55\.520\.74±0\.110\.74\\pm 0\.112/3 seeds feasible——1\.5%2\.80±0\.402\.80\\pm 0\.400\.95±0\.120\.95\\pm 0\.121\.33±0\.141\.33\\pm 0\.141\.00±0\.511\.00\\pm 0\.51\+1\.47 \[0\.84, 2\.13\]\-0\.05 \[\-0\.29, 0\.19\]2%2\.80±0\.402\.80\\pm 0\.400\.95±0\.120\.95\\pm 0\.121\.33±0\.141\.33\\pm 0\.141\.00±0\.511\.00\\pm 0\.51\+1\.47 \[0\.84, 2\.13\]\-0\.05 \[\-0\.29, 0\.19\]XLM\-R\-large1%1/3 seeds feasible0/3 seeds feasible——1\.5%1/3 seeds feasible0/3 seeds feasible——2%1/3 seeds feasible0/3 seeds feasible——Table 28:RQ3 Joint Fine\-tuning with relation\-conditioned heads and with the direct head on the official 404\-document test \(%; generated labels; mean±\\pmsample SD over contextual seeds 42–44\), at thresholds selected on validation data for total\-leakage budgets of 1%, 1\.5% \(primary\), and 2%\. Difference columns give relation\-conditioned minus direct with 95% intervals from 2,000 bootstrap resamples of source\-document groups\. A variant is summarized only when all three seeds have a feasible threshold; at 1% some seeds select masking every candidate, which produces the large standard deviations\.Table 29:Registered runs for all eight KDPII\-trained detectors on the official 404\-document test \(%; generated labels; mean±\\pmsample SD over contextual seeds 42–44\), with relation\-conditioned heads\. Their rule selected thresholds and checkpoints that add no validation leakage relative to the current detector; Mask\-all counts seeds that fell back to masking every candidate, and @0\.5 columns use fixed relation and privacy thresholds as a diagnostic that does not select models\.

### C\.6Human\-Verified Test Results

Table[30](https://arxiv.org/html/2610.35925#A3.T30)gives the human\-verified scores of the systems in Table[4](https://arxiv.org/html/2610.35925#S5.T4), with Detection only averaged over detector seeds 42–44, beside the scores of the same records against their generated labels, and Table[31](https://arxiv.org/html/2610.35925#A3.T31)covers every system scored on the human\-verified test \(Appendix[B\.3](https://arxiv.org/html/2610.35925#A2.SS3)\) with document\-bootstrap intervals\. All systems use the predictions that already existed for the official test documents, with the thresholds each had selected on validation\. The systems, the two metrics, and the secondary views below were fixed before any system was scored, except where a view is marked as not pre\-specified\. The intervals show how little 238 preservable mentions resolve: for the eight jointly fine\-tuned systems of the four detectors, the over\-masking intervals have lower ends of 0\.0–1\.0% and upper ends of 6\.8–10\.4%\. Scored against the generated labels of the same records, Joint Fine\-tuning over\-masks 0\.41–2\.89% and leaks 0\.78–3\.63%\. The candidate\-assisted LLMs over\-mask 30\.25–97\.06% and leak 19\.55–36\.27%\. The direct\-extraction LLMs of RQ1, which mask every span they extract from raw text, over\-mask 54\.62–60\.50% and leak 42\.99–63\.58%\.

Table[32](https://arxiv.org/html/2610.35925#A3.T32)asks whether the Joint Fine\-tuning result depends on which records are counted and how\. Three pre\-specified views give lower over\-masking: on the 34 pairs held out under both splits, the eight systems of the four detectors over\-mask 0\.00–0\.42% and leak 0\.00–1\.37%; on records where all four annotators agree, the direct head over\-masks 0\.00–1\.95% and relation\-conditioned heads 2\.38–3\.03%; and when an entity is counted once, over\-masking is 1\.04–2\.78% and leakage 2\.85–4\.69%\. The fourth pre\-specified view, an estimate for the 100 documents that weights each entity by the inverse of its sampling probability, gives 8\.09–10\.58% over\-masking with very wide intervals, because it is dominated by the entities described next, which carry large sampling weights\.

After the primary results, we added the view restricted to records whose reference label equals the stored label \(not pre\-specified\)\. In the ReCoPII\-Ko documents, 6 of the 238 reference\-KEEP mentions belong to two entities that are stored as MASK, and 4 of the 670 reference\-MASK mentions belong to four entities that are stored as KEEP\. A system trained on stored labels is expected to follow the stored label on these records\. On the records where the two labels agree, the direct head over\-masks 0\.00–1\.29% and relation\-conditioned heads 1\.72–2\.59%\. The caption of Table[32](https://arxiv.org/html/2610.35925#A3.T32)also lists the paired over\-masking difference between the two variants; its interval excludes zero only for KLUE\-R\-base\.

Table 30:RQ3 systems scored on the human\-verified test \(%\): 192 reference\-KEEP entities \(238 mentions\) and 199 reference\-MASK entities \(670 mentions\) in the ReCoPII\-Ko version of 100 test documents\. Over\-masking and leakage follow the RQ3 definitions restricted to these mentions\. The right half scores the same records against their stored \(generated\) labels\. Values with±\\pmare mean and sample SD over seeds \(detector seeds 42–44 for detection only, contextual seeds 42–44 otherwise\); thresholds are those each system selected on validation, and nothing was tuned on this set\.†Single run that met the 1\.5% budget\. LLMs are single runs over the A\.X\+Gazetteer\+CRF candidates\. Appendix Table[31](https://arxiv.org/html/2610.35925#A3.T31)gives document\-bootstrap intervals and all systems\.GroupSystemOver\-mask↓\\downarrow95% CILeakage↓\\downarrow95% CIDet\. leakageDetection onlyA\.X\+Gazetteer\+CRF\+MLP98\.88±0\.8798\.88\\pm 0\.87\[97\.6, 99\.9\]17\.56±1\.5017\.56\\pm 1\.50\[9\.8, 28\.0\]—A\.X\+Gazetteer\+CRF99\.30±0\.2499\.30\\pm 0\.24\[98\.4, 100\.0\]18\.51±2\.2118\.51\\pm 2\.21\[10\.6, 29\.0\]—A\.X\+GatedGazetteer\+CRF99\.44±0\.6499\.44\\pm 0\.64\[98\.6, 100\.0\]16\.07±2\.2416\.07\\pm 2\.24\[8\.8, 26\.4\]—A\.X\+Span99\.86±0\.2499\.86\\pm 0\.24\[99\.6, 100\.0\]15\.37±2\.3915\.37\\pm 2\.39\[8\.2, 25\.4\]—A\.X99\.58±0\.4299\.58\\pm 0\.42\[99\.1, 100\.0\]16\.27±1\.7616\.27\\pm 1\.76\[8\.5, 26\.6\]—KLUE\-R\-base100\.00±0\.00100\.00\\pm 0\.00\[100\.0, 100\.0\]14\.93±1\.2814\.93\\pm 1\.28\[7\.1, 25\.2\]—KLUE\-BERT\-base99\.72±0\.2499\.72\\pm 0\.24\[99\.3, 100\.0\]15\.47±0\.7515\.47\\pm 0\.75\[8\.1, 25\.6\]—KLUE\-BERT\-base\+CRF99\.86±0\.2499\.86\\pm 0\.24\[99\.6, 100\.0\]14\.98±1\.4114\.98\\pm 1\.41\[7\.7, 25\.0\]—XLM\-R\-large99\.44±0\.2499\.44\\pm 0\.24\[98\.7, 100\.0\]18\.76±1\.5018\.76\\pm 1\.50\[12\.5, 25\.9\]—Frozen DetectorA\.X\+Gazetteer\+CRF\+MLP99\.16±0\.0099\.16\\pm 0\.00\[97\.9, 100\.0\]19\.25±0\.0019\.25\\pm 0\.00\[10\.8, 29\.8\]—A\.X\+Gazetteer\+CRF99\.16±0\.0099\.16\\pm 0\.00\[97\.8, 100\.0\]19\.55±0\.0019\.55\\pm 0\.00\[10\.9, 30\.0\]—A\.X\+GatedGazetteer\+CRF97\.76±2\.1697\.76\\pm 2\.16\[95\.7, 99\.3\]13\.68±0\.1713\.68\\pm 0\.17\[6\.9, 23\.6\]—A\.X\+Span100\.00±0\.00100\.00\\pm 0\.00\[100\.0, 100\.0\]12\.99±0\.0012\.99\\pm 0\.00\[6\.5, 22\.6\]—KLUE\-R\-base100\.00±0\.00100\.00\\pm 0\.00\[100\.0, 100\.0\]16\.12±0\.0016\.12\\pm 0\.00\[8\.2, 26\.4\]—KLUE\-BERT\-base100\.00±0\.00100\.00\\pm 0\.00\[100\.0, 100\.0\]16\.27±0\.0016\.27\\pm 0\.00\[8\.8, 26\.1\]—KLUE\-BERT\-base\+CRF94\.68±5\.8394\.68\\pm 5\.83\[92\.1, 96\.9\]16\.57±0\.0016\.57\\pm 0\.00\[8\.6, 27\.1\]—XLM\-R\-large91\.46±1\.9491\.46\\pm 1\.94\[88\.3, 94\.6\]17\.31±0\.0017\.31\\pm 0\.00\[11\.8, 24\.0\]—Joint Fine\-tuningA\.X\+Span, relation\-conditioned4\.20±0\.424\.20\\pm 0\.42\[0\.4, 9\.3\]1\.69±0\.231\.69\\pm 0\.23\[0\.4, 3\.4\]1\.24±0\.231\.24\\pm 0\.23A\.X\+Span, direct3\.08±0\.643\.08\\pm 0\.64\[0\.1, 7\.6\]4\.18±1\.764\.18\\pm 1\.76\[0\.7, 10\.1\]3\.23±1\.793\.23\\pm 1\.79A\.X\+Gazetteer\+CRF\+MLP, relation\-conditioned5\.04±1\.115\.04\\pm 1\.11\[0\.6, 10\.4\]1\.14±0\.601\.14\\pm 0\.60\[0\.4, 2\.0\]0\.45±0\.300\.45\\pm 0\.30A\.X\+Gazetteer\+CRF\+MLP, direct2\.52±0\.002\.52\\pm 0\.00\[0\.0, 6\.8\]1\.74±1\.121\.74\\pm 1\.12\[0\.7, 3\.0\]0\.45±0\.390\.45\\pm 0\.39A\.X\+Gazetteer\+CRF, relation\-conditioned4\.48±0\.644\.48\\pm 0\.64\[0\.6, 9\.5\]1\.94±0\.541\.94\\pm 0\.54\[0\.9, 3\.2\]0\.95±0\.090\.95\\pm 0\.09A\.X\+Gazetteer\+CRF, direct3\.78±0\.003\.78\\pm 0\.00\[0\.0, 9\.0\]1\.99±0\.741\.99\\pm 0\.74\[0\.7, 3\.5\]1\.34±0\.391\.34\\pm 0\.39KLUE\-R\-base, relation\-conditioned4\.90±0\.244\.90\\pm 0\.24\[1\.0, 10\.1\]1\.24±0\.231\.24\\pm 0\.23\[0\.3, 2\.4\]0\.40±0\.230\.40\\pm 0\.23KLUE\-R\-base, direct3\.08±0\.643\.08\\pm 0\.64\[0\.1, 7\.6\]1\.94±0\.681\.94\\pm 0\.68\[0\.5, 4\.1\]1\.19±0\.261\.19\\pm 0\.26XLM\-R\-large, relation\-conditioned†9\.66\[4\.0, 16\.0\]1\.49\[0\.6, 2\.7\]0\.90Candidate\-assisted LLMK\-EXAONE, 0\-shot97\.06\[93\.4, 99\.6\]19\.55\[10\.9, 30\.0\]—K\-EXAONE, 3\-shot64\.71\[55\.8, 73\.2\]20\.90\[12\.3, 30\.9\]—GPT\-4o\-mini, 0\-shot60\.92\[52\.8, 68\.8\]23\.88\[15\.4, 34\.5\]—GPT\-4o\-mini, 3\-shot30\.25\[22\.1, 38\.7\]36\.27\[23\.3, 50\.0\]—Solar Pro 3, 0\-shot86\.13\[79\.3, 92\.3\]20\.90\[12\.2, 31\.4\]—Solar Pro 3, 3\-shot40\.76\[31\.7, 50\.2\]21\.34\[12\.7, 31\.8\]—Direct\-extraction LLMGPT\-4o\-mini, 0\-shot54\.62\[46\.9, 62\.3\]49\.55\[39\.9, 58\.2\]—GPT\-4o\-mini, 3\-shot56\.30\[48\.9, 64\.0\]58\.81\[49\.4, 67\.0\]—K\-EXAONE, 0\-shot58\.82\[51\.4, 66\.4\]44\.33\[32\.7, 55\.3\]—K\-EXAONE, 3\-shot56\.72\[48\.5, 65\.1\]63\.58\[53\.8, 72\.2\]—Solar Pro 3, 0\-shot60\.50\[53\.0, 68\.0\]43\.73\[32\.8, 54\.7\]—Solar Pro 3, 3\-shot57\.56\[50\.4, 65\.1\]42\.99\[31\.9, 54\.0\]—

Table 31:All systems on the human\-verified test \(%; 192 reference\-KEEP entities \(238 mentions\) and 199 reference\-MASK entities \(670 mentions\); ReCoPII\-Ko documents\)\. Mean and sample SD over seeds where seeds exist; intervals are 95% percentile intervals from 2,000 bootstrap resamples of the 100 documents, applied to the seed\-averaged rate\. Det\. leakage masks every candidate of the jointly fine\-tuned detector\. Direct\-extraction LLMs mask every span they extract from raw text\.†Single run that met the 1\.5% budget\.Table 32:Sensitivity of the human\-verified results for Joint Fine\-tuning \(seed means, %; OM = over\-masking\)\. Held out in both splits: the 34 pairs that are test documents under both the official and the RQ2\-B split \(80 KEEP and 194 MASK mentions\)\. Unanimous: records on which all four annotators agree \(154 and 620 mentions\)\. Labels agree: records whose reference label equals the stored label \(232 and 666 mentions; added after the primary results\)\. Entity level counts an entity if any of its mentions is affected\. The weighted estimate weights each entity by the inverse of its sampling probability\. Over\-masking of relation\-conditioned heads minus the direct head on all 100 documents, in points with 95% document\-bootstrap intervals: A\.X\+Span \+1\.12 \[\-0\.15, 3\.02\]; A\.X\+Gazetteer\+CRF\+MLP \+2\.52 \[0\.00, 6\.05\]; A\.X\+Gazetteer\+CRF \+0\.70 \[0\.00, 1\.98\]; KLUE\-R\-base \+1\.82 \[0\.29, 3\.83\]\.†Single run that met the 1\.5% budget\.
### C\.7Insertion\-Free Probe

The insertion\-free probe applies the systems of Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4)to documents without inserted sentences, which the official test lacks \(Appendix[C\.5](https://arxiv.org/html/2610.35925#A3.SS5)\)\.

##### Documents\.

The probe has 402 documents from the six domains, with 2,244 KEEP and 3,183 MASK mentions \(1,925 and 1,929 entities\)\. KEEP mentions are 41\.35% of its mentions, against 13\.68% in the official test\. A separate pipeline produced them: it plans an entity\-relation graph with edge\-level privacy labels under the same ontology and writes the whole document from that plan, with no source document and no inserted sentence\. GPT\-5\-mini writes the content of each section, and GPT\-4o\-mini plans the context of each relation and rewrites sections that fail checks\. Code builds and validates the annotation, and a document is accepted only if a GPT\-5\-mini reviewer reproduces the planned privacy label of every relation from the text alone\. Of 600 candidates, 100 per domain, 402 were accepted\. Entity values come from the persona pool of Appendix[E\.3](https://arxiv.org/html/2610.35925#A5.SS3), and 211 of the KEEP and 828 of the MASK mentions share value and type with a mention of the official training or validation split\. The pipeline rejects candidates whose text overlaps ReCoPII\-Ko: no accepted sentence equals a ReCoPII\-Ko sentence, and no two documents share a fifth of their sentences\.

##### Labels\.

Labels follow Equation[1](https://arxiv.org/html/2610.35925#S3.E1)applied to the stored relations, and every document passes the graph validation used for the official data\. In 37 documents, 39 relations that repeated an earlier relation with the same label were dropped, which cannot change a label\. The labels are generated and not human\-verified, so the rates below measure agreement with generated labels\.

##### Systems and checks\.

Nothing is retrained or tuned on the probe: every system uses the checkpoints, the thresholds selected on official validation data, and the prompts of the official test, with the metrics of Section[5\.4](https://arxiv.org/html/2610.35925#S5.SS4)\. Each of the 54 inference runs first reproduced its stored predictions on eight official test documents, and the probe scorer matches the official metric code on all 88 system outputs\.

##### Results\.

Table[34](https://arxiv.org/html/2610.35925#A3.T34)repeats the rows of Table[4](https://arxiv.org/html/2610.35925#S5.T4): for the four detectors that meet the budget, Joint Fine\-tuning over\-masks 11\.33–34\.21% and leaks 2\.03–4\.95%, where the same systems give 1\.10–2\.80% and 0\.95–1\.44% on the official test; Detection only over\-masks 88\.59–95\.99% and leaks 8\.07–13\.82% for these detectors and XLM\-R\-large\. The decision releases 45\.22–82\.51% of the KEEP mentions that its fine\-tuned detector masks and adds 0\.77–2\.21 points of leakage to that detector’s own 0\.79–2\.94% \(Table[35](https://arxiv.org/html/2610.35925#A3.T35)\)\. The systems thus still release most of the preservable mentions that masking every candidate would hide, at leakage of a few percent, so the decision does not rest on inserted sentences alone\. Both rates are nevertheless well above the official test, so part of the accuracy on ReCoPII\-Ko does not carry over\.

In pre\-specified breakdowns, over\-masking is 9\.70–31\.07% on the six types with at least 500 KEEP mentions in the official training split and 22\.49–64\.80% on the other types \(group sizes in the caption of Table[35](https://arxiv.org/html/2610.35925#A3.T35)\); Table[33](https://arxiv.org/html/2610.35925#A3.T33)lists every type\. With all thresholds fixed at 0\.5, the systems over\-mask 15\.39–33\.32% and leak 1\.92–4\.47%, so the gap does not come from the selected thresholds\. On mentions whose value and type do not occur in the official training or validation split, over\-masking is 10\.84–32\.43%, against 16\.11–51\.34% on those that do\. Relation\-conditioned heads over\-mask more than the direct head for three of the four detectors, by 5\.42–18\.89 points; for A\.X\+Span the paired interval includes zero \(caption of Table[35](https://arxiv.org/html/2610.35925#A3.T35)\)\.

Within the probe, the six candidate\-assisted LLM runs over\-mask 16\.76–85\.29% at 12\.19–25\.89% leakage, and the direct\-extraction LLMs over\-mask 36\.41–45\.45% at 45\.40–49\.70% leakage \(Tables[34](https://arxiv.org/html/2610.35925#A3.T34)and[36](https://arxiv.org/html/2610.35925#A3.T36)\)\. Every Joint Fine\-tuning system leaks less, at most 4\.95%, than every LLM run, at least 12\.19%; on over\-masking alone, three\-shot GPT\-4o\-mini \(16\.76%\) is below all Joint Fine\-tuning systems but one\. Three unusable answers leave a document fully masked \(at most 13 of the 402 documents in a run\)\. We do not compare an LLM’s score between the official test and the probe, because the probe pipeline keeps only documents whose relation privacy an LLM reviewer reproduces from the text, and GPT\-4o\-mini, one of the baselines, took part in generating them \(planning and rewriting\)\.

##### Limits\.

The probe was run after the main results, with its systems, decision rules, metrics, and type grouping fixed before any model was run on it \(Table[36](https://arxiv.org/html/2610.35925#A3.T36)marks the rows added later\)\. Construction by insertion, the share of KEEP mentions, and the absence of human verification all differ between the official test and the probe, so the gap cannot be assigned to one of them\. The probe is also LLM\-generated under the same ontology and persona pool, and by the label definition its preservable mentions are organization\-managed values and reference persons; it removes the contrast between source and inserted sentences, not wording regularities that generated preservable mentions may share\.

Table 33:Insertion\-free probe by entity type \(%\): unweighted mean over the 8 three\-seed Joint Fine\-tuning systems\. Train KEEP counts KEEP mentions in the official training split\. Descriptive only\.Table 34:The systems of Table[4](https://arxiv.org/html/2610.35925#S5.T4)on the insertion\-free probe \(%\)\. Left: the official 404\-document test \(1,750 KEEP and 11,045 MASK mentions\)\. Right: 402 documents \(2,244 KEEP and 3,183 MASK mentions\) that a separate pipeline writes as a whole from a planned relation graph, with no sentence inserted into an existing document; their labels are generated and not human\-verified\. Every system is applied with the checkpoints, thresholds, and prompts of the left side; nothing is retrained or tuned on the probe\. Values with±\\pmare mean and sample SD over contextual seeds 42–44; Detection only uses the seed\-42 detector, and the LLM rows are single runs on the A\.X\+Gazetteer\+CRF detection\-only candidates\.†The only XLM\-R\-large run that met the 1\.5% budget;‡no direct\-head run met it\.Over\-mask↓\\downarrowLeakage↓\\downarrowOver\-mask by type groupDetectorReleasedDetectorVariantMean±\\pmSD95% CIMean±\\pmSD95% CIKEEP\-supportedOtherleakageshareA\.X\+SpanRelation\-conditioned28\.42±3\.2128\.42\\pm 3\.21\[26\.1, 30\.7\]2\.45±0\.632\.45\\pm 0\.63\[1\.8, 3\.2\]24\.99±2\.7624\.99\\pm 2\.7651\.86±7\.1751\.86\\pm 7\.170\.91±0\.110\.91\\pm 0\.1168\.98Direct26\.80±12\.7926\.80\\pm 12\.79\[24\.8, 28\.9\]2\.03±0\.662\.03\\pm 0\.66\[1\.6, 2\.6\]25\.06±12\.1125\.06\\pm 12\.1138\.69±17\.4238\.69\\pm 17\.420\.79±0\.030\.79\\pm 0\.0372\.58A\.X\+Gazetteer\+CRF\+MLPRelation\-conditioned30\.23±1\.5130\.23\\pm 1\.51\[28\.1, 32\.2\]3\.39±0\.763\.39\\pm 0\.76\[2\.6, 4\.3\]27\.19±2\.3327\.19\\pm 2\.3351\.05±6\.8951\.05\\pm 6\.892\.39±0\.752\.39\\pm 0\.7551\.84Direct11\.33±3\.8111\.33\\pm 3\.81\[9\.9, 12\.8\]4\.95±0\.924\.95\\pm 0\.92\[4\.0, 6\.0\]9\.70±3\.829\.70\\pm 3\.8222\.49±5\.1922\.49\\pm 5\.192\.74±0\.582\.74\\pm 0\.5882\.51A\.X\+Gazetteer\+CRFRelation\-conditioned34\.21±6\.3534\.21\\pm 6\.35\[32\.1, 36\.3\]3\.72±0\.823\.72\\pm 0\.82\[2\.9, 4\.6\]31\.07±6\.3531\.07\\pm 6\.3555\.71±6\.5055\.71\\pm 6\.502\.94±1\.212\.94\\pm 1\.2145\.22Direct19\.10±6\.9019\.10\\pm 6\.90\[17\.1, 21\.0\]3\.02±0\.253\.02\\pm 0\.25\[2\.3, 3\.8\]16\.48±6\.7416\.48\\pm 6\.7437\.06±12\.4837\.06\\pm 12\.482\.00±0\.102\.00\\pm 0\.1071\.82KLUE\-R\-baseRelation\-conditioned26\.29±2\.5126\.29\\pm 2\.51\[24\.2, 28\.4\]3\.72±0\.723\.72\\pm 0\.72\[3\.0, 4\.5\]20\.67±3\.1920\.67\\pm 3\.1964\.80±3\.1764\.80\\pm 3\.172\.76±0\.842\.76\\pm 0\.8458\.72Direct20\.87±2\.7120\.87\\pm 2\.71\[18\.8, 22\.9\]3\.86±2\.213\.86\\pm 2\.21\[3\.1, 4\.7\]15\.58±2\.9715\.58\\pm 2\.9757\.11±2\.0557\.11\\pm 2\.051\.90±0\.411\.90\\pm 0\.4169\.28XLM\-R\-largeRelation\-conditioned†38\.41\[35\.5, 41\.3\]2\.80\[2\.2, 3\.5\]33\.5072\.031\.9551\.35

Table 35:Joint Fine\-tuning on the insertion\-free probe \(%\), with the thresholds selected on official validation for the 1\.5% budget\. Intervals resample the 402 documents 2,000 times and apply to the seed\-averaged rate\. KEEP\-supported types are the six entity types with at least 500 KEEP mentions in the official training split \(ADDRESS, BANK\_ACCOUNT\_NUMBER, DEPARTMENT, EMAIL, TELEPHONE, WORKPLACE; 1,958 probe KEEP mentions\); the other types have 286 probe KEEP mentions and at most 45 KEEP mentions each in training\. Detector leakage masks every candidate of the fine\-tuned detector\. Released share is the percentage of KEEP mentions masked by that detector which the decision releases\. Relation\-conditioned minus direct over\-masking, in points with paired 95% intervals: A\.X\+Span \+1\.62 \[\-0\.22, \+3\.51\]; A\.X\+Gazetteer\+CRF\+MLP \+18\.89 \[\+17\.22, \+20\.67\]; A\.X\+Gazetteer\+CRF \+15\.11 \[\+13\.44, \+16\.75\]; KLUE\-R\-base \+5\.42 \[\+3\.96, \+7\.03\]\.†Single run that met the budget\.Official testInsertion\-free probeGroupSystemOver\-mask↓\\downarrowLeakage↓\\downarrowOver\-mask↓\\downarrowLeakage↓\\downarrowDetection onlyA\.X\+Span99\.839\.1595\.998\.07A\.X\+Gazetteer\+CRF\+MLP95\.6613\.0288\.5912\.38A\.X\+Gazetteer\+CRF98\.1112\.7091\.5311\.78A\.X\+GatedGazetteer\+CRF96\.9110\.9694\.169\.27KLUE\-R\-base99\.2610\.9791\.8910\.46KLUE\-BERT\-base99\.5411\.7592\.919\.61KLUE\-BERT\-base\+CRF99\.2610\.7690\.959\.52XLM\-R\-large98\.8614\.4692\.2513\.82Frozen DetectorA\.X\+Span99\.609\.1695\.51±0\.4795\.51\\pm 0\.478\.14±0\.058\.14\\pm 0\.05A\.X\+Gazetteer\+CRF\+MLP95\.6613\.0288\.59±0\.0088\.59\\pm 0\.0012\.38±0\.0012\.38\\pm 0\.00A\.X\+Gazetteer\+CRF98\.1112\.7091\.53±0\.0091\.53\\pm 0\.0011\.78±0\.0011\.78\\pm 0\.00A\.X\+GatedGazetteer\+CRF94\.5511\.0092\.72±2\.0992\.72\\pm 2\.099\.40±0\.139\.40\\pm 0\.13KLUE\-R\-base99\.2610\.9791\.89±0\.0091\.89\\pm 0\.0010\.46±0\.0010\.46\\pm 0\.00KLUE\-BERT\-base99\.5411\.7592\.91±0\.0092\.91\\pm 0\.009\.61±0\.009\.61\\pm 0\.00KLUE\-BERT\-base\+CRF95\.0510\.8488\.83±1\.4788\.83\\pm 1\.479\.72±0\.219\.72\\pm 0\.21XLM\-R\-large87\.7014\.5788\.27±1\.1088\.27\\pm 1\.1014\.29±0\.1714\.29\\pm 0\.17Direct\-extraction LLMGPT\-4o\-mini, 0\-shot51\.7745\.6743\.5845\.40GPT\-4o\-mini, 3\-shot53\.8358\.6038\.2449\.70K\-EXAONE, 0\-shot58\.8651\.4436\.4146\.15K\-EXAONE, 3\-shot56\.4659\.5145\.4546\.15Solar Pro 3, 0\-shot59\.6648\.9843\.5846\.75Solar Pro 3, 3\-shot57\.7753\.4243\.9849\.17Table 36:Reference systems on the insertion\-free probe \(%\), beside their official\-test values\. Detection only masks every candidate of the seed\-42 KDPII\-trained detector; Frozen Detector uses its registered thresholds \(mean±\\pmsample SD over contextual seeds 42–44, official\-test means on the left\)\. Direct\-extraction LLMs mask every span they extract from raw text \(single runs\)\. The Frozen Detector rows and three Detection only rows were added after the first partial scoring of the probe\.

## Appendix DLLM Prompts

This section reports the prompts used in the three LLM\-based steps of the augmentation pipeline: relation\-graph planning \(Section[3\.2](https://arxiv.org/html/2610.35925#S3.SS2.SSS0.Px1)\), placeholder\-based text realization \(Section[3\.2](https://arxiv.org/html/2610.35925#S3.SS2.SSS0.Px2)\), and independent review \(Section[3\.2](https://arxiv.org/html/2610.35925#S3.SS2.SSS0.Px3)\)\. It then reports the prompts of the two LLM evaluations: direct PII extraction in RQ1 \(Appendix[D\.4](https://arxiv.org/html/2610.35925#A4.SS4)\) and document\-quality judgment in RQ2\-A \(Appendix[D\.5](https://arxiv.org/html/2610.35925#A4.SS5)\)\. For each system and user prompt, we provide the original Korean prompt followed by an English translation\. Payload fields are reported separately in Tables[D\.1](https://arxiv.org/html/2610.35925#A4.SS1)–[D\.3](https://arxiv.org/html/2610.35925#A4.SS3)\. Output schemas are omitted\. Deterministic value filling and document acceptance do not call an LLM\.

### D\.1Relation\-Graph Planning

We use GPT\-4o\-mini with a maximum of 3,000 output tokens\. Rule 1\-1 in the user prompt is included only whenreusable\_existing\_entitiesis nonempty\.

Table 37:Payload supplied to the relation\-graph planner\.\\koreanSystem Prompt \(Korean\)너는 한국어 개인정보 데이터셋의 관계 주석 설계자다\.주어진 문서에 이미 있는 내용은 절대 바꾸지 않는다\. 대신 이 문서에 자연스럽게 덧붙일 수 있는 ‘공개된 조직 정보’ 노드와 그 사이의 관계만 계획한다\.가장 중요한 제약은 이것이다\. 네가 새로 만드는 모든 노드는 그 노드에 연결된 모든 관계가 NON\_PII여야 한다\. 즉 특정 개인에게 귀속되는 정보가 아니라, 조직이 공식적으로 공개하고 공동으로 관리하는 정보여야 한다\.개인에게 귀속됨 \(PII\): 김민수의 휴대폰 번호, 박지영의 소속 부서조직이 공개·공동 관리 \(NON\_PII\): 회사 대표번호, 공식 정산 계좌, 공개 조직도‘공개’는 공공기관·정부기관·공기업을 뜻하지 않는다\. 민간 회사도 대표번호와 조직 구성을 공개한다\. 그런 근거 없는 기관 표현은 쓰지 않는다\.계획만 세운다\. 문장은 다음 단계에서 쓴다\.

Figure 7:Korean system prompt for relation\-graph planning\.System Prompt \(English Translation\)You are a relation\-annotation designer for a Korean PII dataset\.Never alter any content already present in the given document\. Plan only the nodes representing “publicly disclosed organizational information” that can be added naturally to the document and the relations among those nodes\.The most important constraint is that every relation incident to every node you create must be labeled NON\_PII\. In other words, the information must not be attributable to a specific individual; it must be information officially disclosed and jointly managed by an organization\.Attributed to an individual \(PII\): Kim Min\-su’s mobile\-phone number; Park Ji\-young’s department affiliation\.Publicly disclosed and jointly managed by an organization \(NON\_PII\): a company’s main telephone number; an official settlement account; a public organizational chart\.“Public” does not mean that the organization is a public agency, government body, or state\-owned enterprise\. Private companies also disclose their main telephone numbers and organizational structures\. Do not use unsupported descriptions that imply a public institution\.Produce only the plan\. The sentences will be written in the next stage\.

Figure 8:English translation of the planner system prompt\.\\koreanUser Prompt \(Korean\)아래 문서에 덧붙일 NON\_PII 노드와 관계를 계획하라\.\{payload JSON\}지켜야 할 규칙1\.new\_nodes는 3개 이상 6개 이하로 만든다\. 노드 타입은 스키마에 나열된 공개 조직 정보 타입만 쓴다\.1\-1\.reusable\_existing\_entities에 있는 원본 엔티티를 관계의 출발점으로 쓸 수 있다\. 문서 소재에 자연스럽게 맞으면 쓰고, 맞지 않으면 신규 노드끼리 연결한다\.2\.new\_relations의type\_combination은allowed\_type\_combinations의combination값 중 하나다\. 고른 조합의 source 타입·target 타입이 실제 노드 타입과 같아야 한다\. 예를 들어WORKPLACE \-CONTACT\_ASSOCIATION\-\> TELEPHONE을 골랐다면source는 WORKPLACE 노드여야 하고target은 TELEPHONE 노드여야 한다\.3\. 새 노드에 연결되는 관계는 전부 NON\_PII여야 한다\. 하나라도 개인에게 귀속되면 그 노드는 목적을 잃는다\.non\_pii\_rationale에 왜 개인 귀속이 아닌지 적는다\.4\. 새 노드는 모두 최소 하나의 관계에 연결돼야 한다\. 떠 있는 노드는 만들지 않는다\.5\. 같은 엔티티 쌍에는 관계를 하나만 만든다\. 같은 두 노드를 방향만 바꿔 두 번 연결하는 것도 안 된다\. source와 target에 같은 노드를 쓰면 안 된다\.WORKPLACE \-\.\.\.\-\> WORKPLACE처럼 양쪽 타입이 같은 조합을 고르려면 WORKPLACE 노드를 서로 다른 것으로 두 개 만들어야 한다\.6\.existing\_relations의 기존 관계를 다시 적지 않는다\. 새로 더할 것만 적는다\.7\. 이 문서의 종류와 소재에 맞는 조직을 고른다\. 문서와 무관한 소재를 끌어오지 않는다\.8\.public\_context와role에는 실제 엔티티 값을 미리 정해 쓰지 않는다\.

Figure 9:Korean user prompt for relation\-graph planning\.User Prompt \(English Translation\)Plan the NON\_PII nodes and relations to be added to the document below\.\{payload JSON\}Rules1\. Create between three and sixnew\_nodes\. Use only the public organizational\-information node types listed in the schema\.1\-1\. A source entity inreusable\_existing\_entitiesmay serve as the source of a relation\. Use it when it fits the document naturally; otherwise, connect the new nodes to one another\.2\. Thetype\_combinationof each item innew\_relationsmust be one of thecombinationvalues inallowed\_type\_combinations\. The source and target types in the selected combination must match the actual node types\. For example, ifWORKPLACE \-CONTACT\_ASSOCIATION\-\> TELEPHONEis selected,sourcemust be a WORKPLACE node andtargetmust be a TELEPHONE node\.3\. Every relation incident to a new node must be NON\_PII\. If even one relation attributes the node to an individual, the node no longer serves its intended purpose\. Explain innon\_pii\_rationalewhy the relation is not attributable to an individual\.4\. Every new node must participate in at least one relation\. Do not create isolated nodes\.5\. Create only one relation for each entity pair\. Do not connect the same two nodes twice by reversing their direction, and do not use the same node as both source and target\. A combination such asWORKPLACE \-\.\.\.\-\> WORKPLACErequires two distinct WORKPLACE nodes\.6\. Do not repeat any relation inexisting\_relations\. Report only relations to be added\.7\. Select organizations that fit the type and subject matter of the document\. Do not introduce unrelated subject matter\.8\. Do not preselect or write literal entity values inpublic\_contextorrole\.

Figure 10:English translation of the planner user prompt\.
### D\.2Placeholder\-Based Text Realization

We use GPT\-4o\-mini with a maximum of 3,000 output tokens\.

Table 38:Payload supplied to the sentence realizer\. Type\-specific values ofhow\_to\_write\_itare reported in Table[D\.2](https://arxiv.org/html/2610.35925#A4.SS2)\.Table 39:Type\-specific writing instructions included in the realizer payload\. The table summarizes the operational wording while preserving the attribution constraint supplied to the realizer\.\\koreanSystem Prompt \(Korean\)너는 한국어 실무 문서를 쓰는 작성자다\.이미 완성된 문서에 몇 문장을 끼워 넣는 일을 한다\. 원문은 한 글자도 고치지 않는다\. 너는 새로 넣을 문장과 그 문장을 어느 원문 문장 뒤에 넣을지만 돌려준다\.새 문장에는 실제 값 대신 placeholder를 쓴다\.<WORKPLACE:E7\>— 값이 그대로 들어간다\.<WORKPLACE:E7\>\{josa:은/는\}— 값의 받침에 맞는 조사가 붙는다\.조사 marker에 쓸 수 있는 쌍: 은/는, 이/가, 을/를, 과/와, 으로/로, 이다/다, 이며/며, 이고/고, 이라/라, 이란/란, 이나/나, 이든/든, 으로서/로서, 으로써/로써, 으로도/로도, 으로는/로는, 으로만/로만, 과도/와도, 과는/와는, 과의/와의, 과만/와만\.placeholder 바로 뒤에 조사를 직접 붙이면 “한빛물류은” 같은 문장이 되므로 반드시 marker를 쓴다\.

Figure 11:Korean system prompt for sentence realization and insertion\.System Prompt \(English Translation\)You are a writer of Korean business documents\.Your task is to insert several sentences into an already completed document\. Do not change a single character of the source document\. Return only the new sentences and the source sentence after which each one should be inserted\.Use placeholders rather than literal values in the new sentences\.<WORKPLACE:E7\>— The value is inserted without modification\.<WORKPLACE:E7\>\{josa:\\korean은/는\}— The Korean particle is selected according to whether the value ends in a final consonant\.The particle marker may use the following pairs:\\korean은/는, 이/가, 을/를, 과/와, 으로/로, 이다/다, 이며/며, 이고/고, 이라/라, 이란/란, 이나/나, 이든/든, 으로서/로서, 으로써/로써, 으로도/로도, 으로는/로는, 으로만/로만, 과도/와도, 과는/와는, 과의/와의, and 과만/와만\.Appending a particle directly after a placeholder can produce an ungrammatical expression such as “\\korean한빛물류은\.” Always use the marker\.

Figure 12:English translation of the realizer system prompt\.\\koreanUser Prompt \(Korean\)원문 뒤에 끼워 넣을 문장을 써라\.\{payload JSON\}지켜야 할 규칙1\.original\_document의 문장은 하나도 고치지 않는다\. 출력에 원문을 다시 담지 않는다\.2\.insertions는 서로 다른after\_sent\_idx2곳 이상에 나눠 넣는다\. 전체 추가 문장은 6개를 넘지 않는다\.2\-1\.insertion\_zones는 원문을 앞부분·가운데·뒷부분으로 나눈 것이다\. 되도록 서로 다른 구간에서 골라 문서 전반에 퍼지게 넣는다\. 바로 옆 문장들에 몰아넣지 않는다\. 각 구간에서 그 자리의 소재와 이어지는 내용을 쓴다\.3\.relations\_to\_express의 관계가 모두 문서에서 읽어낼 수 있어야 한다\. 두 endpoint가 꼭 같은 문장에 있을 필요는 없지만, 앞뒤 문맥만 보고 그 관계를 추출할 수 있을 만큼은 분명해야 한다\.3\-1\. 각 placeholder의how\_to\_write\_it을 따르고, 조직의 공개 정보라는 근거가 문서에 드러나게 쓴다\.4\.entities\_to\_introduce의 placeholder는 전부 최소 한 번 쓴다\. 목록에 없는 placeholder나 새 entity id는 만들지 않는다\.4\-1\.relations\_to\_express의 관계에existing\_entity\_placeholders의 엔티티가 끝점으로 나오면 그 placeholder도 반드시 문장에 쓴다\. 그 조직의 이름을 직접 적거나 다른 조직으로 바꿔 쓰면 안 된다\. 예를 들어<WORKPLACE:E9\>가 계좌의 소유 주체라면 “한서대학교의 정산 계좌인 …”은 틀리고 “<WORKPLACE:E9\>의 정산 계좌인 …”은 맞다\.5\. 관계 하나를 문장 하나로 기계적으로 풀지 않는다\. 하나의 업무·절차·안내 안에서 여러 관계가 자연스럽게 드러나게 쓴다\.6\. 실제 이름·번호·계좌를 쓰지 않는다\. 반드시 placeholder만 쓴다\.7\. “이 정보는 공개 정보다”, “개인정보가 아니다” 같은 메타 설명 문장을 쓰지 않는다\. 그냥 업무 문서처럼 쓴다\.8\. 삽입 지점 바로 앞 문장을 읽고 그 어미와 시제, 경어체를 그대로 따라 쓴다\. 문장을 쉼표나 “ 하며”로 끊고 넘기지 않는다\.9\. 공공기관·정부기관·국가기관이라는 근거 없는 표현을 쓰지 않는다\.10\.role을 문장에 그대로 옮겨 적거나 placeholder 앞에서 같은 뜻을 반복하지 않는다\.11\. 새 placeholder는 모두 조직이 공식적으로 공개하고 공동 관리하는 정보로 쓴다\. 문서에 나오는 개인\(고객님, 귀하, 본인, 갑, 을, 환자, 신청인, 의뢰인 등\)의 연락처·계좌·소속으로 쓰면 그 노드는 개인 귀속이 되어 문서 전체가 탈락한다\.12\. 연락처를 죽 늘어놓는 안내문처럼 쓰지 않는다\. 원문에서 이미 진행 중인 사건·절차·업무의 일부로 녹여 쓴다\. 같은 문형을 반복하지 않는다\.13\. 타입에 맞는 말로 가리킨다\. WORKPLACE는 회사·기관 이름이고 DEPARTMENT는 그 안의 부서 이름이다\. WORKPLACE placeholder 앞에 “부서”를 붙이지 않는다\.14\.never\_write\_these\_values의 원문 값을 새 문장에 그대로 쓰지 않는다\. 마스킹에서 빠질 수 있다\. 그 사람은 “담당자”, “신청인” 같은 보통명사로 가리킨다\.15\. 삽입된 티가 나지 않을 만큼 원문 소재·문체·흐름과 자연스럽게 이어 쓴다\.

Figure 13:Korean user prompt for sentence realization and insertion\.User Prompt \(English Translation\)Write the sentences to be inserted after sentences in the source document\.\{payload JSON\}Rules1\. Do not alter any sentence inoriginal\_document\. Do not reproduce the source document in the output\.2\. Distributeinsertionsacross at least two distinctafter\_sent\_idxvalues\. Add no more than six sentences in total\.2\-1\.insertion\_zonesdivides the source document into its first, middle, and final thirds\. When possible, choose different zones and distribute insertions across the document rather than clustering them around adjacent sentences\. At each location, write content that continues the local subject matter\.3\. Every relation inrelations\_to\_expressmust be recoverable from the document\. Its endpoints need not occur in the same sentence, but the relation must be clear enough to extract from the surrounding context\.3\-1\. Follow each placeholder’show\_to\_write\_itinstruction and make the evidence that it is public organizational information explicit in the document\.4\. Use every placeholder inentities\_to\_introduceat least once\. Do not create a placeholder or entity ID absent from the list\.4\-1\. If an entity inexisting\_entity\_placeholdersis an endpoint of a relation inrelations\_to\_express, its placeholder must appear in the sentence\. Do not write the organization’s literal name or replace it with another organization\. For example, if<WORKPLACE:E9\>owns an account, “the settlement account of Hanseo University” is invalid, whereas “the settlement account of<WORKPLACE:E9\>” is valid\.5\. Do not mechanically express one relation per sentence\. Express multiple relations naturally within a single task, procedure, or notice\.6\. Do not write literal names, numbers, or accounts\. Use only placeholders\.7\. Do not add metalinguistic statements such as “this is public information” or “this is not personal information\.” Write ordinary business\-document prose\.8\. Read the sentence immediately preceding an insertion point and preserve its ending, tense, and honorific style\. Do not leave a sentence hanging after a comma or a connective ending such as “\-hamyeo\.”9\. Do not introduce unsupported descriptions such as public agency, government agency, or national institution\.10\. Do not copyroleverbatim into a sentence or repeat the same meaning immediately before a placeholder\.11\. Present every new placeholder as information officially disclosed and jointly managed by an organization\. If it is written as the contact information, account, or affiliation of a person in the document, the node becomes individually attributable and the entire document is rejected\.12\. Do not produce a notice that merely lists contact details\. Integrate the new content into an event, procedure, or task already underway in the source document, and avoid repetitive sentence patterns\.13\. Refer to each type appropriately\. WORKPLACE is the name of a company or institution, whereas DEPARTMENT is a unit within it\. Do not place the word “department” before a WORKPLACE placeholder\.14\. Do not reproduce any source value innever\_write\_these\_valuesin a new sentence because it may escape masking\. Refer to the person with a common noun such as “staff member” or “applicant\.”15\. Connect the inserted sentences naturally to the source document’s subject matter, style, and flow so that they do not appear inserted\.

Figure 14:English translation of the realizer user prompt\.
### D\.3Independent Relation and Privacy Review

We usegpt\-5\-miniwith minimal reasoning effort and a maximum of 6,000 output tokens\. The reviewer does not receive the planned privacy labels, indicators of which entities or relations are new, or thenon\_pii\_rationale\.

Table 40:Payload supplied to the independent reviewer\.\\koreanSystem Prompt \(Korean\)너는 한국어 개인정보 데이터셋의 독립 검수자다\.문서가 어떻게 만들어졌는지, 어떤 라벨이 의도됐는지는 모른다\. 알 필요도 없다\. 너는 완성된 문서만 읽고 판단한다\.Privacy 판단 기준PII: 특정 개인에게 식별자·연락처·주소·소속·학력·금융정보를 귀속시키거나 개인을 식별·연결하는 데 기여하는 관계\.NON\_PII: 실제 의미 관계이지만 개인 귀속이 아닌 관계\. 조직이 공식적으로 공개하고 공동으로 관리하는 채널·조직 구성·정산 계좌 등\.값이 어떻게 생겼는지로 판단하지 않는다\. 문서에서 그 값이 어떤 역할로 쓰이는지, 어떤 관계의 끝점인지로 판단한다\.판단 근거가 아님: 이메일에 사람 이름이나 생년월일이 들어 있다는 사실; 번호가 휴대폰 형식인지 유선 형식인지; Entity Type 이름, Relation 이름, 이메일 도메인\.판단 근거임: 문서가 그 값을 특정 개인의 것으로 귀속시키는가; 문서가 그 값을 조직의 공식 창구·공동 관리 자산으로 쓰는가\.예를 들어 “문의처: 고객지원팀 02\-000\-0000 abc19800101@naver\.com”에서 그 메일은 생김새가 개인 메일이어도 문서 안에서는 부서 문의 창구다\. 이때는 NON\_PII다\. 반대로 “김민수 씨의 연락처는 02\-000\-0000입니다”는 번호가 유선이어도 PII다\.문서 안에 판정 근거가 없으면 AMBIGUOUS다\.

Figure 15:Korean system prompt for independent relation and privacy review\.System Prompt \(English Translation\)You are an independent reviewer of a Korean PII dataset\.You do not know how the document was created or which labels were intended, and you do not need to know\. Judge only the completed document\.Privacy criteriaPII: A relation that attributes an identifier, contact detail, address, affiliation, education record, or financial information to a specific individual, or that helps identify or link an individual\.NON\_PII: A genuine semantic relation that is not attributable to an individual, such as an organization’s officially disclosed and jointly managed channel, organizational structure, or settlement account\.Do not judge a value by its appearance\. Judge the role it plays in the document and the relation for which it serves as an endpoint\.Not evidence: an email address contains a person’s name or date of birth; a number resembles a mobile or landline format; the entity\-type name, relation name, or email domain\.Valid evidence: the document attributes the value to a specific individual; the document uses the value as an organization’s official channel or jointly managed asset\.For example, in “Contact: Customer Support Team, 02\-000\-0000, abc19800101@naver\.com,” the email address functions as the department’s inquiry channel even though it looks like a personal address, so the relation is NON\_PII\. Conversely, “Kim Min\-su’s contact number is 02\-000\-0000” is PII even though the number resembles a landline\.If the document contains no evidence supporting a decision, label it AMBIGUOUS\.

Figure 16:English translation of the reviewer system prompt\.\\koreanUser Prompt \(Korean\)아래 문서를 검수하라\.\{payload JSON\}검수 항목1\.relations\_to\_check의 각 관계를 정확히 한 번씩 판정한다\.extractable: 문서 문맥에서 그 관계를 실제로 읽어낼 수 있는가\. 두 endpoint가 같은 문장에 있을 필요는 없다\.observed\_privacy\_label: 그 관계가 PII인지 NON\_PII인지 문맥으로 정한다\. 값의 생김새가 아니라 문서에서 그 값이 맡는 역할로 정한다\. 판단 근거가 문서에 없으면 AMBIGUOUS다\.evidence\_quote:document의 한 문장에서 글자 하나 바꾸지 않고 옮긴 연속 부분 문자열이어야 한다\. 필요하면 문장 전체를 쓴다\.2\.missing\_relations: 목록에 없는데 문서에 분명히 있는 관계를 보고한다\. 억지로 채우지 않는다\. 없으면 빈 배열이다\. 문맥으로 입증되지 않는 엔티티는 연결되지 않은 채 남아도 된다\.3\.outside\_ontology\_relation\_found:allowed\_relations로 설명할 수 없는 관계가 문서에 있으면 true\.4\.insertion\_naturalness:recently\_inserted\_sent\_idx의 문장들이 앞뒤 원문과 자연스럽게 이어지는지 상/중/하로 평가한다\.상: 삽입 문장이 전후 문맥과 의미적으로 일관되고 자연스럽게 연결되며 조사와 어미가 모두 자연스럽다\.중: 뜻은 통하지만 삽입된 티가 난다\. 문체가 튀거나 연결이 어색하다\.하: 문맥이 끊기거나 문법·조사가 틀렸거나 원문과 사실이 어긋난다\.naturalness\_reason에 그렇게 본 이유를 한두 문장으로 쓴다\.

Figure 17:Korean user prompt for independent relation and privacy review\.User Prompt \(English Translation\)Review the document below\.\{payload JSON\}Review items1\. Judge every relation inrelations\_to\_checkexactly once\.extractable: Can the relation actually be recovered from the document context? The two endpoints need not occur in the same sentence\.observed\_privacy\_label: Determine from context whether the relation is PII or NON\_PII\. Base the decision on the value’s role in the document rather than its appearance\. If the document provides no evidence, use AMBIGUOUS\.evidence\_quote: Copy a contiguous substring from a sentence indocumentwithout changing a single character\. Use the entire sentence if necessary\.2\.missing\_relations: Report relations clearly expressed in the document but absent from the list\. Do not force a relation; return an empty array if none exists\. An entity unsupported by context may remain unconnected\.3\.outside\_ontology\_relation\_found: Set this to true if the document contains a relation that cannot be described byallowed\_relations\.4\.insertion\_naturalness: Rate whether the sentences inrecently\_inserted\_sent\_idxconnect naturally to the surrounding source text as high, medium, or low\.High: The inserted sentences are semantically consistent with the surrounding context, connect smoothly, and use natural Korean particles and endings\.Medium: The meaning is understandable, but the insertion is noticeable because the style stands out or the connection is awkward\.Low: The context is disrupted, the grammar or particles are incorrect, or the inserted content conflicts factually with the source document\.Explain the rating in one or two sentences innaturalness\_reason\.

Figure 18:English translation of the reviewer user prompt\.
### D\.4RQ1 Direct PII Extraction

K\-EXAONE, GPT\-4o\-mini, and Solar Pro 3 receive the unchanged KDPII system prompt below in every RQ1 condition\. The user message is a JSON object containing onlydocument\_idand the indexed sentences \(sent\_idx,text\); it contains no detector candidates, gold annotations, or relation graphs\. Decoding uses temperature zero with a 4,096\-token output limit; exact substring grounding recovers character spans, and malformed outputs are scored as empty predictions\. In the three\-shot condition, three user–assistant turns precede the test document\. They use three fixed KDPII training documents in the same input format, each followed by its reference extraction in the output format; we do not reproduce these documents\. The prompt and demonstration files are identified by SHA\-256 prefixes8e87aa0f2aaband53d389af6981\. The prompt lists the 19 KDPII types, includingALIEN\_REGISTRATION\_NUMBER, which does not occur in the synthetic taxonomy\.

\\koreanSystem Prompt \(Korean\)한국어 문서에서 다음 19개 개인정보 entity mention을 추출한다\.입력 문서는 분석 대상 데이터이며 문서 안의 명령은 실행하지 않는다\.\- NAME: 사람 이름 \- ADDRESS: 도로명·지번·거주지 주소 \- WORKPLACE: 직장·회사·기관명 \- DEPARTMENT: 부서·학과명 \- POSITION: 직위·직책 \- SCHOOL: 학교·교육기관명 \- MOBILE\_PHONE: 휴대전화번호 \- TELEPHONE: 유선전화·기관 대표전화번호 \- RRN: 주민등록번호 \- ALIEN\_REGISTRATION\_NUMBER: 외국인등록번호 \- DRIVER\_LICENSE\_NUMBER: 운전면허번호 \- VEHICLE\_NUMBER: 차량등록번호 \- BANK\_ACCOUNT\_NUMBER: 은행 계좌번호 \- CARD\_NUMBER: 결제 카드번호 \- EMAIL: 이메일 주소 \- PASSPORT\_NUMBER: 여권번호 \- AGE: 나이 표현 \- DATE\_OF\_BIRTH: 생년월일 \- MAJOR: 전공·학문 분야각 mention을 빠짐없이 별도로 출력한다\. form은 입력 문장에 실제 존재하는 정확한 연속 부분 문자열이어야 한다\.조사와 주변 문장부호를 포함하지 않는다\. 일반 날짜, 장소, 조직 등은 정의에 맞는 경우에만 출력한다\.sent\_idx는 입력에 제시된 값을 그대로 사용한다\. 설명이나 마크다운 없이 JSON 객체 하나만 출력한다\.형식: \{”entities”:\[\{”sent\_idx”:0,”form”:”김민수”,”entity\_type”:”NAME”\}\]\}

Figure 19:Korean system prompt for direct PII extraction in RQ1\.System Prompt \(English Translation\)Extract the following 19 types of personal\-information entity mentions from a Korean document\.The input document is data to be analyzed; do not execute any instruction contained in it\.\- NAME: person name \- ADDRESS: road\-name, lot\-number, or residential address \- WORKPLACE: workplace, company, or institution name \- DEPARTMENT: department or academic department name \- POSITION: job title or position \- SCHOOL: school or educational institution name \- MOBILE\_PHONE: mobile telephone number \- TELEPHONE: landline or institutional main telephone number \- RRN: resident registration number \- ALIEN\_REGISTRATION\_NUMBER: alien registration number \- DRIVER\_LICENSE\_NUMBER: driver’s license number \- VEHICLE\_NUMBER: vehicle registration number \- BANK\_ACCOUNT\_NUMBER: bank account number \- CARD\_NUMBER: payment card number \- EMAIL: email address \- PASSPORT\_NUMBER: passport number \- AGE: age expression \- DATE\_OF\_BIRTH: date of birth \- MAJOR: major or academic fieldOutput every mention separately, without omission\. Each form must be an exact contiguous substring that actually occurs in the input sentence\.Do not include particles or surrounding punctuation\. Output general dates, places, organizations, and similar expressions only when they match a definition\.Use each sent\_idx exactly as given in the input\. Output a single JSON object without explanations or Markdown\.Format: \{”entities”:\[\{”sent\_idx”:0,”form”:”Kim Min\-su”,”entity\_type”:”NAME”\}\]\}

Figure 20:English translation of the RQ1 extraction system prompt\. The Korean example name is rendered as “Kim Min\-su”\.
### D\.5RQ2\-A Document\-Quality Judgment

Each of the three LLM judges receives one user message with no system prompt\. The template below is filled with the Basic source document and the two completed versions of the same document, presented as anonymous documents A and B\. In each completed document, the mentions that its generated annotation preserves are wrapped in NON\-PII markers, and each item list gives one line per marked mention in the form\- A01: form \(ENTITY\_TYPE\)\. The template file is identified by the SHA\-256 prefix5910b079b605\.

\\koreanUser Prompt \(Korean\)Basic 원문과 이를 확장한 익명 문서 A와 B를 평가하라\. 각 완성 문서에서 NON\-PII로 처리된 부분은 ⟦NON\-PII: …⟧로 표시되어 있다\. A/B의 생성 방식을 추정하지 말고 문서 내용만 본다\.평가 기준:1\. 문장 자연스러움: NON\-PII 표시 부분을 포함한 완성 문서가 문법적으로 자연스러운가? A와 B 각각 1~5점\.2\. 원문 연결성: NON\-PII 표시 부분이 Basic의 인물·조직·사건·문서 목적과 자연스럽게 연결되는가? A와 B 각각 1~5점\.3\. NON\-PII 판단 타당성: NON\-PII로 처리된 각 항목을 가리지 않는 판단이 문맥상 타당한가? 항목별 true/false\.4\. 전체 선호: A와 B 중 어느 완성 문서가 Basic 원문을 더 자연스럽게 확장했는가? A/B/Tie\.\[Basic\] \{basic\_document\}\[A\] \{document\_a\_marked\}\[A의 NON\-PII 항목\] \{items\_a\}\[B\] \{document\_b\_marked\}\[B의 NON\-PII 항목\] \{items\_b\}설명이나 마크다운 없이 다음 형식의 JSON만 출력하라\. ¡…¿는 네가 판단한 값으로 채우고, …에는 나머지 item\_id를 모두 넣는다:\{”naturalness”:\{”A”:¡1\-5 정수¿,”B”:¡1\-5 정수¿\},”connection”:\{”A”:¡1\-5 정수¿,”B”:¡1\-5 정수¿\},”non\_pii\_validity”:\{”A”:\{”A01”:¡true—false¿, …\},”B”:\{”B01”:¡true—false¿, …\}\},”preference”:”¡A—B—Tie¿”\}점수는 1~5 정수, preference는 A/B/Tie 중 하나이며, NON\-PII 객체에는 제시된 모든 item\_id를 정확히 한 번씩 포함하라\.

Figure 21:Korean user prompt for RQ2\-A document\-quality judgment\.User Prompt \(English Translation\)Evaluate the Basic source document and anonymous documents A and B, which extend it\. In each completed document, the parts treated as NON\-PII are marked as ⟦NON\-PII: …⟧\. Do not infer how A or B was generated; consider only the content of the documents\.Evaluation criteria:1\. Sentence naturalness: Is the completed document, including the parts marked NON\-PII, grammatically natural? Score A and B each from 1 to 5\.2\. Connection to the source: Do the parts marked NON\-PII connect naturally to the people, organizations, events, and purpose of the Basic document? Score A and B each from 1 to 5\.3\. Validity of NON\-PII decisions: Is the decision not to mask each item treated as NON\-PII valid in context? Answer true or false for each item\.4\. Overall preference: Which completed document, A or B, extends the Basic document more naturally? A, B, or Tie\.\[Basic\] \{basic\_document\}\[A\] \{document\_a\_marked\}\[NON\-PII items of A\] \{items\_a\}\[B\] \{document\_b\_marked\}\[NON\-PII items of B\] \{items\_b\}Output only JSON in the following format, without explanations or Markdown\. Fill each ¡…¿ with your judgment, and put all remaining item\_ids in each …:\{”naturalness”:\{”A”:¡integer 1\-5¿,”B”:¡integer 1\-5¿\},”connection”:\{”A”:¡integer 1\-5¿,”B”:¡integer 1\-5¿\},”non\_pii\_validity”:\{”A”:\{”A01”:¡true—false¿, …\},”B”:\{”B01”:¡true—false¿, …\}\},”preference”:”¡A—B—Tie¿”\}Scores must be integers from 1 to 5, preference must be A, B, or Tie, and each NON\-PII object must contain every presented item\_id exactly once\.

Figure 22:English translation of the RQ2\-A judge prompt\.

## Appendix EConstruction and Model Details

Section[3](https://arxiv.org/html/2610.35925#S3)states why each construction step is needed and what it computes\. This appendix records the checks and settings that implement those steps, so that the pipeline and the detector can be reproduced\.

### E\.1Relation\-Graph Planning

An allowed workplace–contact–telephone configuration, for example, supplies a candidate relation structure\. Membership inΩd\\Omega\_\{d\}constrains endpoint types and the relation label; the generated text must establish the role that supports the proposed privacy label\. The planner proposes organization\-managed entities and provisionalNON\_PIIedges, optionally using eligible existing organization anchors\. Before realizing the plan, we assign final identifiers and remove duplicate pairs and self\-relations\. Plan validation then requires compatible endpoint types, a relation for every new entity, and available values for the selected combinations\. An unfillable organization–department combination is rejected before sentence generation\. Remaining violations trigger regeneration with validation feedback\.

### E\.2Placeholder Validation

The realized text must make the planned role interpretable in the surrounding document, such as a number used for an official service rather than a customer’s personal contact, without explicitly revealing the intended privacy label\. Before filling values, we normalize placeholder syntax and verify that entity references, insertion positions, and endpoint coverage agree with the plan, with no exposed literal identifiers\. Endpoint presence alone is insufficient: if the plan links organization A to an account but the sentence calls it organization B’s account, that sentence would teach an unsupported relation\. A deterministic rule compares the planned source’s identifier and type with source placeholders in the target’s sentence, rejecting an explicit competing source of the same type\. Endpoints may otherwise occur in different sentences, with semantic extractability assessed by the independent LLM reviewer\.

### E\.3Value Instantiation

The persona pool is built on NVIDIA’s Nemotron\-Personas\-Korea, which its dataset card describes as synthesized from real\-world demographic, geographic, and personality trait distributions of South Korea\.111[https://huggingface\.co/datasets/nvidia/Nemotron\-Personas\-Korea](https://huggingface.co/datasets/nvidia/Nemotron-Personas-Korea)Independently selecting an organization and a department could create an incompatible pair, so related entities requiring consistent attributes draw from the same persona row\. We select their values through constrained SQL queries from the shared persona pool, without conditioning on privacy labels\. Reusing an existing organization constrains the query to its value\. Further checks prevent incompatible assignments and identifier collisions within a document\. Seeded selection yields a value map that drives deterministic placeholder replacement and Korean particle resolution, keeping repeated mentions consistent\.

### E\.4Annotation Reconstruction and Final Verification

Replacement records exact mention spans directly, avoiding ambiguous string searches when values recur\. The replacement trace updates entity records and relation endpoints and remaps sentence indices and mention references after insertion\. Augmentation preserves the relation\-enriched input’s text and masking annotations, including originally masked mentions\. Masking BIO tags alone would omit preservable candidates, so candidate detection targets use all registry mentions\. Before semantic review, deterministic checks validate mention spans, BIO alignment, relation endpoints, and masking targets\. Final verification checks preservation of source text, mention spans, relation endpoints, and agreement ofPII\_setand masking BIO tags with the masking target𝒮mask\(D\)=⋃i:μ⁡\(vi\)=1ℳi\\mathcal\{S\}\_\{\\mathrm\{mask\}\}\(D\)=\\bigcup\_\{i:\\,\\mu\(v\_\{i\}\)=1\}\\mathcal\{M\}\_\{i\}, the mentions of all maskable entities \(Section[3\.2](https://arxiv.org/html/2610.35925#S3.SS2.SSS0.Px2)\)\. Appendix Table[13](https://arxiv.org/html/2610.35925#A2.T13)separately records the later annotation repair applied to the current archive\.

### E\.5Review Labels, Relation Processing, and Acceptance

The reviewer receives the completed document, domain ontology, entities, and relations\. Intended privacy labels, the construction plan, and explicit indicators of new entities or relations are withheld; original and new relations are shuffled\. For this organization\-focused augmentation, the reviewer labels a relationPIIwhen it attributes information to a specific individual or contributes to identifying or linking that individual\. It assignsNON\_PIIto a supported semantic relation that does not attribute information to an individual, such as an organization’s officially disclosed, jointly managed channel or settlement account\. These decisions use the value’s role in the document; surface form, entity type, and relation name alone do not establish privacy\. When the document provides no supporting evidence for a privacy decision, the reviewer assignsAMBIGUOUS\. For each relation, it also assesses extractability and supplies a supporting quote for automatic comparison with the document\. The reviewer reports missing relations and ontology violations and rates insertion naturalness as high, medium, or low; a high rating requires semantic consistency with surrounding text, smooth discourse integration, and natural Korean particles and endings\.

Relation processing records aPIIflag for each new edge judgedPII, unless its evidence fails the quote check\. Other new edges are kept only when supported, extractable, and labeledNON\_PII\. Supported missingNON\_PIIedges involving new entities are added after ontology, endpoint, and duplication checks; reported missingPIIrelations involving new entities are flagged regardless of quote verification\. Original relations remain unchanged, with review disagreements recorded for audit\. Document acceptance then uses these flags and the updated graph: a new edge judgedPIIwith a verified supporting quote, or a reported missingPIIrelation involving a new entity, rejects the document, and acceptance otherwise requires at least three new preservable entities, at least two insertion sites, no reported ontology violation, and a high naturalness rating \(Section[3\.2](https://arxiv.org/html/2610.35925#S3.SS2.SSS0.Px3)\)\. Because insertion positions are shown for the naturalness rating, the review is partially blinded\.

### E\.6Contextual NAME Augmentation

Public references must not imply invented contact or endorsement\. Fictional roles must be clear from the passage and its surrounding context, while the existing person’s role remains unchanged\. A dedicated semantic review checks local relevance, the contextual basis for preservation, relation type and direction, and repeated wording that could expose masking labels\. Each accepted name enters the entity registry with a single, text\-supportedNON\_PIIrelation to an existingNAMEentity\. This creates different masking outcomes within the same entity type without treating public status alone as sufficient for preservation\. Figure[4](https://arxiv.org/html/2610.35925#A1.F4)\(d\) in Appendix[A](https://arxiv.org/html/2610.35925#A1)illustrates a private recommendation subject and a cited public author\.

### E\.7Detector and Contextual Masking Details

This subsection gives the computations that Section[3\.3](https://arxiv.org/html/2610.35925#S3.SS3)summarizes; Figure[23](https://arxiv.org/html/2610.35925#A5.F23)shows how the components connect and which of them each training setting updates\.

![Refer to caption](https://arxiv.org/html/2610.35925v1/figures/method/two_stage_model_overview.png)Figure 23:PII candidate detection and contextual masking with a shared A\.X encoder, shown with relation\-conditioned heads; Stage A and Stage B in the illustration denote these two functions\. The detector supplies candidate spans and token features, and relation and privacy MLPs score entity pairs whose scores are aggregated into MASK/KEEP decisions\. Snowflakes and flames mark components that are frozen or trained in Frozen Detector \(a\) and Joint Fine\-tuning \(b\)\. The direct variant replaces the relation and privacy MLPs with one entity\-level MLP\.##### Detector\.

Given token representationshkh\_\{k\}, exact Gazetteer matches supply type indicatorsgkg\_\{k\}, and a learned projectionϕ\\phiaugments the encoder features to produce BIO emissions:

xk=\[hk;ϕ⁡\(gk\)\],ok=W​xk\+b\.x\_\{k\}=\[h\_\{k\};\\phi\(g\_\{k\}\)\],\\qquad o\_\{k\}=Wx\_\{k\}\+b\.\(3\)The CRF decodes candidate types and token spans\. The character boundary MLP then scores start and end positions within the first and last predicted tokens, using token features, local character features, and the predicted type, while keeping the CRF’s type\. Training combines the CRF objective with character\-boundary cross\-entropy, weighted by 0\.1; BIO targets include tokens that partially overlap a gold mention\. Checkpoints are selected using validation F1 after boundary refinement\.

##### Shared contextual features\.

Both contextual variants reuse the detector’s features and soft BIO evidence,h~k=\[xk;softmax⁡\(ok\)\]\\widetilde\{h\}\_\{k\}=\[x\_\{k\};\\operatorname\{softmax\}\(o\_\{k\}\)\]\. We encode sentences in overlapping windows and average representations at shared token offsets\. Mentions with the same predicted type and normalized surface form are grouped into an entity; this is a grouping heuristic, not a coreference model\. Mean pooling over the tokensKiK\_\{i\}of entityii’s mentions givesui=\|Ki\|−1​∑k∈Kih~ku\_\{i\}=\|K\_\{i\}\|^\{\-1\}\\sum\_\{k\\in K\_\{i\}\}\\widetilde\{h\}\_\{k\}, andtit\_\{i\}anddddenote type and domain one\-hot vectors\. Both variants use MLPs with hidden widths 512 and 256\.

##### Direct head\.

The direct head scores each candidate entity fromuiu\_\{i\}, the document meanh¯\\bar\{h\}ofh~k\\widetilde\{h\}\_\{k\},tit\_\{i\}, anddd:

si=σ⁡\(fD​\(\[ui;h¯;ti;d\]\)\)\.s\_\{i\}=\\sigma\(f\_\{D\}\(\[u\_\{i\};\\bar\{h\};t\_\{i\};d\]\)\)\.\(4\)Training minimizes binary cross\-entropy against the entity masking labelμ⁡\(vi\)\\mu\(v\_\{i\}\)of Equation[1](https://arxiv.org/html/2610.35925#S3.E1)\. At inference, an entity is masked whensis\_\{i\}reaches a threshold, and a candidate without a score is masked\.

##### Relation\-conditioned heads\.

Each unordered entity pair\(i,j\)\(i,j\)is scored from the pair representation

zi​j=\[\\displaystyle z\_\{ij\}=\[ui\+uj;\|ui−uj\|;ui⊙uj;\\displaystyle u\_\{i\}\+u\_\{j\};\|u\_\{i\}\-u\_\{j\}\|;u\_\{i\}\\odot u\_\{j\};\(5\)ci​j;ti\+tj;d\]\.\\displaystyle c\_\{ij\};t\_\{i\}\+t\_\{j\};d\]\.Here,ci​jc\_\{ij\}pools tokens between the entities’ token envelopes, falling back to the document mean when the interval is empty\. The representation is invariant to endpoint order; the model does not predict edge direction\. A relation MLPfRf\_\{R\}predicts the probability vectorpi​jp\_\{ij\}over the 19 relation labels, and a privacy MLPfPf\_\{P\}receives this vector, the pair representation, and a one\-hot relation indicatorere\_\{r\}:

pi​j\\displaystyle p\_\{ij\}=σ⁡\(fR​\(zi​j\)\),\\displaystyle=\\sigma\(f\_\{R\}\(z\_\{ij\}\)\),\(6\)qi​j​r\\displaystyle q\_\{ijr\}=σ⁡\(fP​\(\[zi​j;pi​j;er\]\)\)\.\\displaystyle=\\sigma\(f\_\{P\}\(\[z\_\{ij\};p\_\{ij\};e\_\{r\}\]\)\)\.Thusqi​j​rq\_\{ijr\}, the probability that relationrrhas a PII label, depends on document context as well as the predicted relations\. Training uses weighted binary cross\-entropy for relations over all entity pairs and privacy cross\-entropy on annotated edges\. At inference, domain\-valid relations and privacy labels are thresholded, and Equation[1](https://arxiv.org/html/2610.35925#S3.E1)turns the retained edges into masked spans\. In every setting, gradients do not pass through discrete span decoding\.