I Am No One: Style-Aware Paraphrasing for Text Anonymization

# I Am No One: Style-Aware Paraphrasing for Text Anonymization
Source: [https://arxiv.org/html/2609.12341](https://arxiv.org/html/2609.12341)
Khan He Wachowicz Naghizade

###### Abstract

Authorship attribution models can re\-identify users from seemingly anonymized text by exploiting stable stylistic fingerprints, even after explicit identifiers are removed, posing a growing privacy risk for text publishing and analytics\. This risk extends to speech\-derived text such as ASR transcripts of meetings and call\-center conversations, where stylometric leakage can persist even after acoustic anonymization\. Differential privacy\-based anonymization often severely degrades text quality and utility\. We propose a style\-aware, prompt\-driven anonymization approach that uses pretrained large language models to construct compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning\. Across blog and review datasets, our approach reduces authorship attribution F1 by 60–70% while maintaining content quality and readability, substantially outperforming DP\-based and non\-DP baselines\.

###### keywords

Text anonymization, Authorship attribution, Stylometry, Language processing, Privacy\-preserving NLP

††address:RMIT University, Melbourne, Australia††email:ahmed\.sohair\.khan@rmit\.edu\.au, estrid\.he@rmit\.edu\.au, monica\.wachowicz@rmit\.edu\.au, e\.naghizade@rmit\.edu\.au††footnotetext:Code and Supplementary material:[https://github\.com/ahmedsohair/SAPTA26](https://github.com/ahmedsohair/SAPTA26)## 1Introduction and Related Work

The widespread sharing of online content has raised significant concerns about user privacy\. Subtle stylistic patterns embedded within user\-generated text or ASR transcripts can be leveraged to identify and trace the original author, even when users attempt to remain anonymous\. This practice, known as “authorship attribution,” poses a threat to individuals’ privacy, as it can expose users’ identities\.

Traditional anonymization techniques, such as removing explicit personal identifiers, are inadequate against modern machine learning models capable of extracting nuanced stylistic cues\[[1](https://arxiv.org/html/2609.12341#bib.bib5)\]\. Therefore, text anonymization must also obscure subtle stylistic fingerprints such as syntax, vocabulary, and discourse patterns that enable authorship attribution\[[2](https://arxiv.org/html/2609.12341#bib.bib6)\]\.

Related speech\-privacy work has mostly targeted acoustic speaker traits, yet stylometric leakage can persist in speech derived text\. Prior studies show de\-identification can impact transcription\-based depression detection\[[3](https://arxiv.org/html/2609.12341#bib.bib24)\], and recent work anonymizes*speech content style*via transcript paraphrasing to reduce identification while preserving meaning\[[4](https://arxiv.org/html/2609.12341#bib.bib25)\]\.

Recently, differential privacy \(DP\)\-based methods such as DP\-VAE\[[5](https://arxiv.org/html/2609.12341#bib.bib7)\], DP\-Prompt\[[6](https://arxiv.org/html/2609.12341#bib.bib2)\], and DP\-MLM\[[7](https://arxiv.org/html/2609.12341#bib.bib8)\]have attracted attention for textual anonymization, introducing calibrated noise under privacy budgets\. However, DP’s mathematical guarantees come with a critical trade\-off: the choice of privacy budget \(ε\\varepsilon\) drastically affects utility\. High\-ε\\varepsilonsettings yield poor privacy, while low\-ε\\varepsilonsettings degrade text to unreadability\. Figure[1](https://arxiv.org/html/2609.12341#S1.F1)demonstrates that DP\-based methods may retain identifiable stylistic patterns despite formal privacy guarantees\. This is because latent\-level DP mechanisms fail to disrupt higher\-order syntactic structures, while token\-level noise injection degrades utility without fully erasing authorship cues\.

Recent work questions whether rigorous DP is essential for defending against authorship attribution\[[8](https://arxiv.org/html/2609.12341#bib.bib9)\]\. Non\-DP paraphrasing approaches have emerged, including JAMDEC\[[9](https://arxiv.org/html/2609.12341#bib.bib19)\], which uses constrained beam decoding, and STYLEREMIX\[[10](https://arxiv.org/html/2609.12341#bib.bib1)\], which applies fine\-grained style transformations\. Other systems, such as ALISON\[[11](https://arxiv.org/html/2609.12341#bib.bib23)\], explicitly target stylistic features by ranking style\-salient phrases and replacing them, showing that direct stylometric targeting can yield strong privacy gains\. Earlier methods such as ER\-AE\[[12](https://arxiv.org/html/2609.12341#bib.bib4)\]and DP\-Paraphrase\[[13](https://arxiv.org/html/2609.12341#bib.bib14)\]also aimed to balance privacy and utility\. Yet most methods still rely on either random perturbations or general paraphrasing without explicit control over stylistic markers\.

We posit that effective anonymization should focus on neutralizing author\-specific style attributes rather than indiscriminate noise injection\. This leads to our central research question:How can we leverage stylistic transformations to anonymize user\-generated text while preserving content utility, without resorting to noise injection?

We propose a style\-aware, prompt\-driven anonymization approach that uses large language models to construct explicit stylistic profiles by capturing text length, punctuation patterns, vocabulary choices, and tone\. It then rewrites text to obscure these markers while preserving content\. Unlike methods relying on noise injection or general paraphrasing, our approach provides fine\-grained control to balance anonymization and semantic content preservation\. Experiments on two real\-world datasets spanning short\-form and long\-form text show that, by avoiding explicit noise injection, style\-focused rewriting can effectively reduce authorship attribution accuracy while maintaining near\-original meaning and improving readability\.

![Refer to caption](https://arxiv.org/html/2609.12341v1/DPExample.png)Figure 1:Original text \(*left*\) and DP anonymized version \(*right*\)\. Stylistic cues remain in DP version that may support re\-identification\.
## 2Methodology

Given authors𝒜=\{A1,…,AN\}\\mathcal\{A\}=\\\{A\_\{1\},\\dots,A\_\{N\}\\\}with corpora𝒟i\\mathcal\{D\}\_\{i\}, we produce anonymized versions𝒟^i\\hat\{\\mathcal\{D\}\}\_\{i\}by rewriting each input textx∈𝒟ix\\in\\mathcal\{D\}\_\{i\}into an anonymized outputx^\\hat\{x\}\. Our goal is that an authorship attribution classifierℱ⁡\(⋅\)\\mathcal\{F\}\(\\cdot\)cannot reliably recover the true author\. Formally, we aim to ensureℱ⁡\(x^\)≠i\\mathcal\{F\}\(\\hat\{x\}\)\\neq i\(or assigns a low probability to authorii\), while preserving semantic content and fluency\. Rather than injecting random noise, we reframe anonymization as acontrolled stylistic transformationproblem\. Our framework \(Figure[2](https://arxiv.org/html/2609.12341#S2.F2)\) consists of two tightly coupled modules: aStyle\-Profiling Modulethat extracts each author’s stylistic fingerprint from minimal samples, and aStyle\-Guided Rewriting Modulethat uses this profile as a control signal to neutralize those cues\.

### 2\.1Style\-Profiling Module

The success of authorship attribution lies in the extraction of distinct stylistic patterns\. Informed by classical stylometry, we characterize these fingerprints along four key dimensions: sentence length, vocabulary choice, tone, and punctuation patterns\[[14](https://arxiv.org/html/2609.12341#bib.bib20),[15](https://arxiv.org/html/2609.12341#bib.bib21),[16](https://arxiv.org/html/2609.12341#bib.bib22)\]\. Rather than learning implicit style representations, we aim to extract human\-interpretable style descriptions for these dimensions\.

Given training texts𝒟itrain\\mathcal\{D\}\_\{i\}^\{\\text\{train\}\}for authorAiA\_\{i\}, we sampleKKrepresentative texts forming a style evidence set𝒮i=\{x1,…,xK\}\\mathcal\{S\}\_\{i\}=\\\{x\_\{1\},\\dots,x\_\{K\}\\\}\. We prompt an LLM to summarize the author’s writing style across the four key stylometric dimensions, extracting these into a human\-readable profilesis\_\{i\}\. This module has two key controls: \(i\)Profile sizeKKspecifies the number of author samples used for style profiling\. We find empirically thatK=5K=5provides stable, author\-distinctive profiles across both datasets, and \(ii\)Style channelscontrols which stylistic dimensions to include in the profile, i\.e\., all \(full profile capturing all dimensions\) or individual dimensions \(e\.g\., Length\-only, Tone\-only\)\. This enables us to identify the most critical stylistic markers for anonymization\.

### 2\.2Style\-Guided Rewriting Module

Given source textxxand its profilesis\_\{i\}, the anonymized outputx^\\hat\{x\}is generated by prompting an LLM to rewrite while suppressing the identified stylistic cues\. The prompt instructs preservation of semantic content\. Unlike generic paraphrasing baselines that rewrite uniformly, our approach provides fine\-grained control: the style profile specifies which dimensions to neutralize, enabling targeted anonymization\. This module isattacker\-agnostic—we assume no access to the adversary’s classifier and do not optimize against any specific attacker\.

This module has one key control:Rewrite modedetermines how the style profile guides rewriting\.Style\-guidedprovides the explicit profile to the LLM \(our main approach\), enabling precise control over which stylistic markers are suppressed\.Semi\-guidedinstructs the LLM to rewrite in a neutral style without providing the explicit profile\. This aims to test whether explicit profiles improve both privacy and utility\.Unguidedperforms generic paraphrasing with no mention of style, serving as a lower\-bound baseline\.

![Refer to caption](https://arxiv.org/html/2609.12341v1/method.png)Figure 2:\(1\) Style\-Profiling Module generates per\-author profilessis\_\{i\}fromKKsamples; \(2\) Style\-Guided Rewriting Module uses profiles to guide rewriting of textxxinto anonymizedx^\\hat\{x\}\.

## 3Experimental Setup

### 3\.1Datasets and Baselines

Following\[[8](https://arxiv.org/html/2609.12341#bib.bib9)\], we useAuthor10, a subset of the Blog Authorship Corpus\[[17](https://arxiv.org/html/2609.12341#bib.bib10)\]containing 15,070 long\-form blogs from 10 authors\. For short\-form evaluation, we constructIllinois9, a subset of Google Reviews\[[18](https://arxiv.org/html/2609.12341#bib.bib3)\]with 3,959 reviews from top 9 most frequent reviewers in Illinois\. Table[1](https://arxiv.org/html/2609.12341#S3.T1)summarizes both datasets in terms of authors, documents per author \(D/A\), words per sentence \(W/S\), and sentences per document \(S/D\)\.

Table 1:Dataset Statistics forAuthor10andIllinois9We compare against three DP\-based variants from\[[8](https://arxiv.org/html/2609.12341#bib.bib9)\]: \(i\)DP, strict DP\-Prompt with privacy budgetsϵ∈\{25,100,250\}\\epsilon\\in\\\{25,100,250\\\}; \(ii\)Quasi\-DP, omitting logit clipping but retaining temperature\-based sampling; and \(iii\)Non\-DP, paraphrasing without DP constraints\. Additionally, we includeALISON\[[11](https://arxiv.org/html/2609.12341#bib.bib23)\], a stylometry\-grounded non\-DP baseline\.

### 3\.2Evaluation Metrics

Utility metrics\.We evaluate utility using three complementary metrics: \(1\) cosine similarity \(CS\): As in\[[8](https://arxiv.org/html/2609.12341#bib.bib9)\], we embed each text with three pre\-trained modelsall\-minilm\-l6\-v2,all\-mpnet\-base\-v2, andgte\-small\[[19](https://arxiv.org/html/2609.12341#bib.bib12)\]and report the averaged*cosine similarity \(CS\)*across the models; \(2\) perplexity \(PPL\)\[[5](https://arxiv.org/html/2609.12341#bib.bib7)\], measured with GPT\-2\[[20](https://arxiv.org/html/2609.12341#bib.bib13)\]to assess fluency; and \(3\) weighted KL divergence, which quantifies information loss by assigning greater importance to rare, informative tokens:

DW​\-​KL\(P∥Q\)=∑t∈VIDF\(t\)P\(t\)logP⁡\(t\)Q⁡\(t\),D\_\{\\mathrm\{W\\text\{\-\}KL\}\}\(P\\parallel Q\)=\\sum\_\{t\\in V\}\\mathrm\{IDF\}\(t\)\\,P\(t\)\\,\\log\\frac\{P\(t\)\}\{Q\(t\)\},\(1\)wherePPandQQare term\-frequency distributions andIDF⁡\(t\)\\mathrm\{IDF\}\(t\)weights rare tokens\. While cosine similarity may remain high despite dropping rare words \(e\.g\., named entities, domain\-specific terms\), weighted KL divergence penalizes such losses\. This is crucial for ensuring anonymized texts retain informational content, not just surface\-level semantic similarity\. \[See supplementary material for more details\.\]

Privacy metrics\.We assess privacy using four complementary metrics: \(1\) BLEU\[[21](https://arxiv.org/html/2609.12341#bib.bib11)\], to measure lexical divergence between original and anonymized texts; \(2\) authorship attribution F1, which quantifies how effectively the anonymized text conceals the original author’s identity\. A lower F1 indicates stronger privacy\. Following standard adversarial setups, authorship classifiers are trained on original data and evaluated on anonymized data, utilizing DeBERTa\-v3\[[22](https://arxiv.org/html/2609.12341#bib.bib17)\]forAuthor10and BERT\[[23](https://arxiv.org/html/2609.12341#bib.bib18)\]\(proven effective on short texts\) forIllinois9; \(3\) relative gain \(γ\\gamma\)\[[13](https://arxiv.org/html/2609.12341#bib.bib14),[8](https://arxiv.org/html/2609.12341#bib.bib9)\], which highlights privacy\-utility trade\-off:

γ=SpSo−ApAo,\\gamma=\\frac\{S\_\{p\}\}\{S\_\{o\}\}\-\\frac\{A\_\{p\}\}\{A\_\{o\}\},\(2\)whereAAandSSdenote authorship F1 and cosine similarity, respectively, on original \(subscriptoo\) and anonymized \(subscriptpp\) data\. Higherγ\\gammaindicates a better privacy–utility trade\-off\. \(4\) fluency\-aware gain, which extendsγ\\gammaby penalizing perplexity degradation:

γf=12​\(SpSo\+min⁡\(PoPp,1\)\)−ApAo,\\gamma\_\{f\}=\\frac\{1\}\{2\}\\left\(\\frac\{S\_\{p\}\}\{S\_\{o\}\}\+\\min\\left\(\\frac\{P\_\{o\}\}\{P\_\{p\}\},1\\right\)\\right\)\-\\frac\{A\_\{p\}\}\{A\_\{o\}\},\(3\)wherePPdenotes perplexity\. This metric prevents methods from improving privacy by severely degrading readability\.

### 3\.3Parameter Settings

We useLlama\-3\.2\-3B\-Instruct\[[24](https://arxiv.org/html/2609.12341#bib.bib16)\]as the base LLM for both profiling and rewriting, chosen for its instruction\-following ability and open\-source availability\. We also evaluateMiniCPM3\-4B\[[25](https://arxiv.org/html/2609.12341#bib.bib15)\]to test model agnosticism\. For style profiling, we useK=5K=5samples per author, which we found sufficient empirically \(see supplementary material for analysis overK∈\{2,5,10,20\}K\\in\\\{2,5,10,20\\\}\)\.

## 4Results and Discussion

Table 2:Comparison with baseline anonymization methods onAuthor10andIllinois9\.Original TextDP \(ε\\varepsilon\)Quasi\-DP \(ε\\varepsilon\)Non\-DP \(kk\)ALISONOursε\\varepsilon/kk251002502510025050103–LLamaMiniCPMAuthor10CS↑\\uparrow10\.5890\.8120\.8320\.3470\.8100\.8330\.7100\.7500\.7870\.7040\.7020\.820BLEU↓\\downarrow10\.0770\.1230\.1530\.0010\.1210\.1530\.0490\.0630\.0880\.0940\.0230\.213PPL↓\\downarrow418770928905169269829258161080837368\.3042\.4761\.53Author F1↓\\downarrow66\.457\.1358\.1060\.606\.5957\.8461\.1346\.8349\.8853\.1029\.5326\.0249\.46Relative Gain \(γ\\gamma\)–0\.482\-0\.062\-0\.0800\.248\-0\.060\-0\.0870\.005\-0\.001\-0\.0120\.2600\.3100\.076Fluency\-aware Gain \(γflu\\gamma\_\{\\mathrm\{flu\}\}\)–0\.190\-0\.446\-0\.4730\.076\-0\.445\-0\.481\-0\.325\-0\.357\-0\.381\-0\.0370\.442\-0\.001Illinois9CS↑\\uparrow10\.5920\.8940\.9140\.5950\.8920\.9160\.8120\.8400\.8790\.6060\.7090\.890BLEU↓\\downarrow10\.0130\.4320\.4970\.0150\.4240\.5200\.2550\.2920\.3730\.0940\.0220\.310PPL↓\\downarrow98\.83220\.6689\.1596\.99222\.1689\.6394\.9382\.1975\.8984\.72461\.3753\.3643\.05Author F1↓\\downarrow76\.7823\.4261\.7364\.8621\.8459\.9065\.3549\.3251\.2254\.9429\.7220\.7647\.90Relative Gain \(γ\\gamma\)–0\.2870\.0900\.0690\.3110\.1120\.0650\.1700\.1730\.1630\.2200\.4390\.266Fluency\-aware Gain \(γf\\gamma\_\{\\mathrm\{f\}\}\)–0\.2150\.1430\.1120\.2350\.1660\.1070\.2640\.2530\.2240\.0230\.5840\.321
- •*Note:*Best results are inbold; second\-best areunderlined\. Higherγ\\gammaandγf\\gamma\_\{\\mathrm\{f\}\}indicate better privacy–utility trade\-offs\.

Privacy\-Utility Trade\-off\.Across both datasets, our style\-guided rewriting approach reduces authorship attribution F1 by 60–70% relative to the original text\. OnAuthor10, authorship F1 drops from 66\.45 to 26\.02, substantially outperforming the strongest non\-DP baseline,Alison\(F1=29\.53\), and non\-DP paraphrasing \(F1=53\.10\)\. WhileAlisonpreserves semantic similarity \(CS≈\\approx0\.70\), it suffers from significantly higher perplexity \(368\.30\) compared to our method \(42\.47\), indicating that our profile\-based generation yields more fluent text\. Strict DP \(ε=25\\varepsilon=25\) achieves high privacy \(F1≈\\approx7\.13\) but at a catastrophic utility cost, with perplexity exploding to≈\\approx8,770\. In contrast, our approach maintains near\-original readability \(PPL 42\.47 vs\. original 41\)\. Table[2](https://arxiv.org/html/2609.12341#S4.T2)also demonstrates the framework’s adaptability across different base LLMs\. WhileLlamaperforms more aggressive stylistic neutralization \(yielding lower Authorship\-F1 scores\),MiniCPMleans towards stronger surface\-level content preservation \(yielding higher CS\)\. Crucially, both models substantially reduce the authorship signal compared to the original text and the baselines\. This indicates that the style\-guided rewriting approach is robust and its overall effectiveness is not strictly bound to a single underlying architecture\.

### 4\.1Fullvs\.Single\-Dimension Style Profiles

All earlier results rely on the default configuration where the LLM produces a*Full*profile based on four features: tone, vocabulary choice, length, and punctuation\. To measure the impact of each cue, we repeat exactly the same procedure with four single\-dimension profiles \(*Tone*,*Length*,*Vocab*, and*Punc*\)\.

Table 3:Ablation on style channels \(Illinois9\)\. See the supplementary document for full results\.As Table[3](https://arxiv.org/html/2609.12341#S4.T3)shows, the*Full*profile delivers the best overall privacy–utility trade\-off\. However, the*Length*\-only variant comes surprisingly close forIllinois9\. It matches or slightly exceeds the*Full*profile in privacy gain while preserving marginally higher cosine similarity\. We attribute this to the short, structurally uniform nature of reviews, where sentence length is already a strong authorial fingerprint\. On the more variedAuthor10corpus the gap narrows:*Tone*,*Length*, and even*Vocab*come within 0\.2–0\.3 pt of the Full profile on both F1 and CS\. While no single cue dominates across datasets, the Full profile remains the most*stable*choice for the privacy–utility trade\-offs\.

### 4\.2Style\-Guided, Semi\-Guided, and Unguided Rewrites

Table 4:Rewrite Modes onAuthor10andIllinois9\.To evaluate the impact of explicit style profiles on anonymization performance, Table[4](https://arxiv.org/html/2609.12341#S4.T4)shows our defaultstyle\-guidedrewriting mode against thesemi\-guidedandunguided\(paraphrase\) baselines\. OnAuthor10thesemi\-guidedsetting achieves slightly better Author\-F1 scores but at the cost of noticeably worse utility:*PPL*rises,*CS*falls, and*weighted KL divergence*increases, indicating greater distortion of informative tokens\. Further analyses in the Supplementary Material \(LLM\-as\-judge and named\-entity retention experiments\) confirm that ourstyle\-guidedrewrite maintains more informational content while achieving nearly the same privacy levels as thesemi\-guidedvariant\. Taken together, these patterns also hint that the authorship classifier is not relying solely on stylistic cues but also draws on residual content when identifying the author\. A fullyunguided/paraphraseversion does even worse, yielding the largest utility loss while leaving a sizable authorship signal, underscoring the value of explicit style guidance\.

### 4\.3Qualitative Insights and Robustness

Table 5:Illustrative long\-form rewrite example fromAuthor10\(excerpted for space\)\.The central dilemma of text anonymization is removing stylistic fingerprints without erasing essential content\. Table[5](https://arxiv.org/html/2609.12341#S4.T5)illustrates this trade\-off with a representative long\-form example fromAuthor10\. The original post contains multiple discourse elements: discussing an article, continuing an earlier thread, and asking for blog design suggestions\. The DP rewrite \(ε=100\\varepsilon=100\) avoids attribution but drastically collapses the text into a single sentence, discarding the majority of the original meaning\. The Non\-DP \(k=25k=25\) baseline produces a similarly truncated sentence but still fails to mask the author, demonstrating that severe lexical reduction alone does not guarantee privacy\. In contrast, our style\-guided rewrite successfully avoids identification while preserving the full discourse structure and intent\. This superior retention of informative lexical content is further reflected by its lower W\-KL divergence \(43\.54 vs\. 48\.62 for the baselines\)\.

Extensive robustness checks are detailed in the supplementary material\. These include evaluations against a method\-aware, white\-box adversary who retrains the authorship classifier on anonymized data; our approach still substantially weakens stylometric cues, reducing attacker F1 by 55% \(from 77 to 35\) onIllinois9\. We also verify out\-of\-domain generalization on Yelp and IMDB datasets, where authorship F1 similarly drops by more than 85%\.

## 5Conclusion

We present a text anonymization framework that employs explicit, prompt\-driven stylistic profiling to effectively mask author identity while preserving semantic content\. Our approach demonstrates robust performance across both long\-form and short\-form text datasets, significantly outperforming differential privacy\-based and paraphrasing baselines\. Evaluations show that our style\-guided anonymization better retains original content and meaning compared to noise\-based approaches, and remains effective even against a method\-aware white\-box adversary\. These results highlight the critical role of precise stylistic manipulation in achieving a favorable privacy–utility trade\-off\.

Limitations and Future Work\.While promising, our framework presents several avenues for future work\. First, it relies on the underlying LLM’s capacity to extract predefined style features, potentially missing nuanced rhetorical patterns or syntactic idiosyncrasies that serve as authorial fingerprints\. Future research should explore unsupervised style\-profiling to reduce reliance on hand\-picked cues\. Second, standard authorship F1 metrics can conflate style obfuscation with content loss, necessitating new evaluation frameworks that disentangle these factors\. Third, our experiments focus on text corpora; extending evaluation to ASR\-transcribed text would clarify how stylometric leakage interacts with acoustic anonymization pipelines\. Finally, extending this approach to address user fairness and multimodal contexts \(e\.g\., timestamps or geolocation metadata\) remains a critical next step for real\-world deployment\.

## 6Generative AI Use Disclosure

During the preparation of this manuscript, the authors utilized generative AI tools to assist in editing, condensing, and polishing the text\. The authors comprehensively reviewed and edited all AI\-generated suggestions, take full responsibility for the content of the publication, and confirm that generative AI was not used to produce the core scientific contributions, methodology, or results\.

## 7Acknowledgements

The authors gratefully acknowledge the RMIT Advanced Computing Ecosystem \(RACE\) for providing computational resources and technical support for this research\.

## References

- \[1\]P\. Lison, I\. Pilán, D\. Sanchez, M\. Batet, and L\. Øvrelid\(2021\)Anonymisation models for text data: state of the art, challenges and future directions\.InProceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing \(Volume 1: Long Papers\),C\. Zong, F\. Xia, W\. Li, and R\. Navigli \(Eds\.\),Online,pp\. 4188–4203\.External Links:[Link](https://aclanthology.org/2021.acl-long.323/),[Document](https://dx.doi.org/10.18653/v1/2021.acl-long.323)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p2.1)\.
- \[2\]K\. Sundararajan and D\. Woodard\(2018\)What represents “style” in authorship attribution?\.InProceedings of the 27th International Conference on Computational Linguistics,E\. M\. Bender, L\. Derczynski, and P\. Isabelle \(Eds\.\),Santa Fe, New Mexico, USA,pp\. 2814–2822\.External Links:[Link](https://aclanthology.org/C18-1238/)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p2.1)\.
- \[3\]P\. Lopez\-Otero, L\. D\. Fernández, A\. Abad, and C\. García\-Mateo\(2017\)Depression detection using automatic transcriptions of de\-identified speech\.InInterspeech,External Links:[Link](https://api.semanticscholar.org/CorpusID:5182808)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p3.1)\.
- \[4\]Y\. Sinha, M\. Y\. Raivakhovskyi, M\. Schubert, and I\. Siegert\(2024\)Safeguarding speech content style: enhancing privacy beyond speaker identity\.4th Symposium on Security and Privacy in Speech Communication\.External Links:[Link](https://api.semanticscholar.org/CorpusID:273282872)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p3.1)\.
- \[5\]B\. Weggenmann, V\. Rublack, M\. Andrejczuk, J\. Mattern, and F\. Kerschbaum\(2022\)DP\-vae: human\-readable text anonymization for online reviews with differentially private variational autoencoders\.InProceedings of the ACM Web Conference 2022,WWW ’22,New York, NY, USA,pp\. 721–731\.External Links:ISBN 9781450390965,[Link](https://doi.org/10.1145/3485447.3512232),[Document](https://dx.doi.org/10.1145/3485447.3512232)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p4.1),[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p1.1)\.
- \[6\]S\. Utpala, S\. Hooker, and P\. Chen\(2023\)Locally differentially private document generation using zero shot prompting\.InFindings of the Association for Computational Linguistics: EMNLP 2023,H\. Bouamor, J\. Pino, and K\. Bali \(Eds\.\),Singapore,pp\. 8442–8457\.External Links:[Link](https://aclanthology.org/2023.findings-emnlp.566/),[Document](https://dx.doi.org/10.18653/v1/2023.findings-emnlp.566)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p4.1)\.
- \[7\]S\. Meisenbacher, M\. Chevli, J\. Vladika, and F\. Matthes\(2024\)DP\-MLM: differentially private text rewriting using masked language models\.InFindings of the Association for Computational Linguistics: ACL 2024,L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 9314–9328\.External Links:[Link](https://aclanthology.org/2024.findings-acl.554/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.554)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p4.1)\.
- \[8\]S\. Meisenbacher and F\. Matthes\(2024\)Thinking outside of the differential privacy box: a case study in text privatization with language model prompting\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,Y\. Al\-Onaizan, M\. Bansal, and Y\. Chen \(Eds\.\),Miami, Florida, USA,pp\. 5656–5665\.External Links:[Link](https://aclanthology.org/2024.emnlp-main.324/),[Document](https://dx.doi.org/10.18653/v1/2024.emnlp-main.324)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p5.1),[§3\.1](https://arxiv.org/html/2609.12341#S3.SS1.p1.1),[§3\.1](https://arxiv.org/html/2609.12341#S3.SS1.p2.1),[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p1.1),[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p2.1)\.
- \[9\]J\. Fisher, X\. Lu, J\. Jung, L\. Jiang, Z\. Harchaoui, and Y\. Choi\(2024\)JAMDEC: unsupervised authorship obfuscation using constrained decoding over small language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),K\. Duh, H\. Gomez, and S\. Bethard \(Eds\.\),Mexico City, Mexico,pp\. 1552–1581\.External Links:[Link](https://aclanthology.org/2024.naacl-long.87/),[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.87)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p5.1)\.
- \[10\]J\. Fisher, S\. Hallinan, X\. Lu, M\. L\. Gordon, Z\. Harchaoui, and Y\. Choi\(2024\)StyleRemix: interpretable authorship obfuscation via distillation and perturbation of style elements\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,Y\. Al\-Onaizan, M\. Bansal, and Y\. Chen \(Eds\.\),Miami, Florida, USA,pp\. 4172–4206\.External Links:[Link](https://aclanthology.org/2024.emnlp-main.241/),[Document](https://dx.doi.org/10.18653/v1/2024.emnlp-main.241)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p5.1)\.
- \[11\]E\. Xing, S\. Venkatraman, T\. Le, and D\. Lee\(2024\)ALISON: fast and effective stylometric authorship obfuscation\.InProceedings of the Thirty\-Eighth AAAI Conference on Artificial Intelligence and Thirty\-Sixth Conference on Innovative Applications of Artificial Intelligence and Fourteenth Symposium on Educational Advances in Artificial Intelligence,AAAI’24/IAAI’24/EAAI’24\.External Links:ISBN 978\-1\-57735\-887\-9,[Link](https://doi.org/10.1609/aaai.v38i17.29901),[Document](https://dx.doi.org/10.1609/aaai.v38i17.29901)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p5.1),[§3\.1](https://arxiv.org/html/2609.12341#S3.SS1.p2.1)\.
- \[12\]H\. Bo, S\. H\. H\. Ding, B\. C\. M\. Fung, and F\. Iqbal\(2021\)ER\-AE: differentially private text generation for authorship anonymization\.InProceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,K\. Toutanova, A\. Rumshisky, L\. Zettlemoyer, D\. Hakkani\-Tur, I\. Beltagy, S\. Bethard, R\. Cotterell, T\. Chakraborty, and Y\. Zhou \(Eds\.\),Online,pp\. 3997–4007\.External Links:[Link](https://aclanthology.org/2021.naacl-main.314/),[Document](https://dx.doi.org/10.18653/v1/2021.naacl-main.314)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p5.1)\.
- \[13\]J\. Mattern, B\. Weggenmann, and F\. Kerschbaum\(2022\)The limits of word level differential privacy\.InFindings of the Association for Computational Linguistics: NAACL 2022,M\. Carpuat, M\. de Marneffe, and I\. V\. Meza Ruiz \(Eds\.\),Seattle, United States,pp\. 867–881\.External Links:[Link](https://aclanthology.org/2022.findings-naacl.65/),[Document](https://dx.doi.org/10.18653/v1/2022.findings-naacl.65)Cited by:[§1](https://arxiv.org/html/2609.12341#S1.p5.1),[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p2.1)\.
- \[14\]D\. I\. Holmes\(1994\)Authorship attribution\.Computers and the Humanities28\(2\),pp\. 87–106\.External Links:[Document](https://dx.doi.org/10.1007/BF01830689),[Link](https://link.springer.com/article/10.1007/BF01830689)Cited by:[§2\.1](https://arxiv.org/html/2609.12341#S2.SS1.p1.1)\.
- \[15\]E\. Stamatatos\(2009\)A survey of modern authorship attribution methods\.Journal of the American Society for Information Science and Technology60\(3\),pp\. 538–556\.External Links:[Link](https://www.cnts.ua.ac.be/~walter/educational/material/Stamatatos_survey2009.pdf)Cited by:[§2\.1](https://arxiv.org/html/2609.12341#S2.SS1.p1.1)\.
- \[16\]A\. Usha and S\. M\. Thampi\(2017\)Authorship analysis of social media contents using tone and personality features\.InSecurity, Privacy, and Anonymity in Computation, Communication, and Storage,G\. Wang, M\. Atiquzzaman, Z\. Yan, and K\. R\. Choo \(Eds\.\),Cham,pp\. 212–228\.External Links:ISBN 978\-3\-319\-72389\-1Cited by:[§2\.1](https://arxiv.org/html/2609.12341#S2.SS1.p1.1)\.
- \[17\]J\. Schler, M\. Koppel, S\. Argamon, and J\. W\. Pennebaker\(2006\)Effects of age and gender on blogging\.\.InAAAI spring symposium: Computational approaches to analyzing weblogs,Vol\.6,pp\. 199–205\.Cited by:[§3\.1](https://arxiv.org/html/2609.12341#S3.SS1.p1.1)\.
- \[18\]J\. Li, J\. Shang, and J\. McAuley\(2022\)UCTopic: unsupervised contrastive learning for phrase representations and topic mining\.InProceedings of the 60th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),S\. Muresan, P\. Nakov, and A\. Villavicencio \(Eds\.\),Dublin, Ireland,pp\. 6159–6169\.External Links:[Link](https://aclanthology.org/2022.acl-long.426/),[Document](https://dx.doi.org/10.18653/v1/2022.acl-long.426)Cited by:[§3\.1](https://arxiv.org/html/2609.12341#S3.SS1.p1.1)\.
- \[19\]Z\. Li, X\. Zhang, Y\. Zhang, D\. Long, P\. Xie, and M\. Zhang\(2023\)Towards general text embeddings with multi\-stage contrastive learning\.arXiv preprint arXiv:2308\.03281\.Cited by:[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p1.1)\.
- \[20\]A\. Radford, J\. Wu, R\. Child, D\. Luan, D\. Amodei, I\. Sutskever,et al\.\(2019\)Language models are unsupervised multitask learners\.OpenAI blog1\(8\),pp\. 9\.Cited by:[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p1.1)\.
- \[21\]K\. Papineni, S\. Roukos, T\. Ward, and W\. Zhu\(2002\)Bleu: a method for automatic evaluation of machine translation\.InProceedings of the 40th annual meeting of the Association for Computational Linguistics,pp\. 311–318\.Cited by:[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p2.1)\.
- \[22\]P\. He, J\. Gao, and W\. Chen\(2023\)DeBERTaV3: improving deberta using electra\-style pre\-training with gradient\-disentangled embedding sharing\.External Links:2111\.09543Cited by:[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p2.1)\.
- \[23\]J\. Devlin, M\. Chang, K\. Lee, and K\. Toutanova\(2019\)BERT: pre\-training of deep bidirectional transformers for language understanding\.InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 \(Long and Short Papers\),J\. Burstein, C\. Doran, and T\. Solorio \(Eds\.\),Minneapolis, Minnesota,pp\. 4171–4186\.External Links:[Link](https://aclanthology.org/N19-1423/),[Document](https://dx.doi.org/10.18653/v1/N19-1423)Cited by:[§3\.2](https://arxiv.org/html/2609.12341#S3.SS2.p2.1)\.
- \[24\]H\. Touvron, T\. Lavril, G\. Izacard, X\. Martinet, M\. Lachaux, T\. Lacroix, B\. Rozière, N\. Goyal, E\. Hambro, F\. Azhar,et al\.\(2023\)Llama: open and efficient foundation language models\.arXiv preprint arXiv:2302\.13971\.Cited by:[§3\.3](https://arxiv.org/html/2609.12341#S3.SS3.p1.1)\.
- \[25\]S\. Hu, Y\. Tu, X\. Han, C\. He, G\. Cui, X\. Long, Z\. Zheng, Y\. Fang, Y\. Huang, W\. Zhao,et al\.\(2024\)MiniCPM: unveiling the potential of small language models with scalable training strategies\.arXiv preprint arXiv:2404\.06395\.Cited by:[§3\.3](https://arxiv.org/html/2609.12341#S3.SS3.p1.1)\.