Baseline Anonymization Systems

• Baseline anonymization systems are rigorously defined algorithms that set reference privacy levels while preserving data utility across diverse modalities.
• They employ modular techniques such as feature disentanglement and controlled perturbations to ensure reproducibility and clear performance benchmarks.
• Metrics like EER, WER, and entropy are used to validate these systems, enabling systematic comparisons and incremental advances in anonymization research.

Baseline anonymization systems are canonical, rigorously specified implementations that establish reference performance points for privacy protection and utility preservation in data anonymization research. These systems are central to benchmark-driven evaluation in domains including voice/speech anonymization, text document de-identification, event log redaction, and structured data pseudonymization. Though methodologies vary by modality and adversarial model, all baselines are designed to be reproducible, interpretable, and systematically comparable, ensuring that empirical advances are measured against clearly defined standards.

1. Formal Definition and Design Principles

A baseline anonymization system is an algorithm or pipeline selected—often by a community benchmark or challenge—to represent the minimal level of privacy-preserving transformation with reproducible procedures and standard hyperparameters. The purpose is dual: (a) provide an interpretable lower bound (for utility) or upper bound (for privacy risk) for new anonymization methods, and (b) operationalize well-understood threat and utility models in a form usable for both deployment and counterfactual study.

Common principles include:

• Feature disentanglement: Separating identity-related features from content (e.g., x-vector vs. linguistic BN features in speech (Tomashenko et al., 17 Jan 2026, Gaznepoglu et al., 2023)).
• Minimal but sufficient perturbation: Applying transformations that obscure identity without seriously degrading downstream usability, e.g., random edge deletions in graphs (Jong et al., 2024), or deterministic masking of identifiers in text (Pilán et al., 2022).
• Reproducibility and transparency: Detailed reporting of the system pipeline, including all parameter and model choices, to serve as a reference for the research community.

2. Canonical Architectures by Data Type

2.1. Speech (Voice) Anonymization

Baseline systems in speech anonymization, as established in the VoicePrivacy Challenge series, implement a three-stage pipeline:

1. Feature extraction: Extraction of content (BN or phonetic features), prosody (F₀), and speaker identity (x-vector) (Tomashenko et al., 17 Jan 2026, Gaznepoglu et al., 2023, Turner et al., 2020).
2. Identity replacement: Anonymization of the speaker embedding via averaging distant x-vectors or, in more advanced baselines, using distribution-preserving generative models (Turner et al., 2020, Champion, 2023).
3. Conditional synthesis: Neural acoustic models and waveform generators resynthesize the speech conditioned on the anonymized embedding and original content/prosody features unless stated otherwise.

A representative example, B1 from VoicePrivacy 2024 (Tomashenko et al., 17 Jan 2026):

• BN: TDNN-F, 256-dim
• x-vector: TDNN, 512-dim, anonymized by averaging 100 of the 200 most distant pool x-vectors (cosine distance)
• F₀: YAAPT, unchanged
• Synthesis: NSF + HiFi-GAN
• Metrics: Equal Error Rate (EER), Word Error Rate (WER), Unweighted Average Recall (UAR) for emotion

Recent work improves upon baselines by replacing unchanged F₀ with a DNN-synthesized F₀ predicted from anonymized identity embeddings and phonetic features, closing prosodic leakage pathways and improving unlinkability without utility loss (Gaznepoglu et al., 2023).

2.2. Text De-Identification

Text anonymization baselines typically use supervised or rule-based Named Entity Recognition (NER) to mask identifier spans:

• RoBERTa→spaCy NER: All OntoNotes entity types, token-level masking (Pilán et al., 2022)
• Presidio: Hybrid rule-based + NER, masking limited to critical types with optional organization span inclusion
• Supervised sequence labeling: Fine-tuned transformers (e.g., Longformer) for context-aware masking using IOB labels, achieving superior direct-ID recall and information-weighted precision

Evaluation protocols utilize information-oriented metrics: entity-level recall for direct and quasi-identifiers, information-weighted precision, and overall F1 (Pilán et al., 2022).

2.3. Structured Log and Table Anonymization

System and network logs employ deterministic, field-specific strategies:

• IP/Port anonymization: Salted per-octet SHA-256 hashing (IP), salt-based modulus hashing (port), preserving analytical structure (Bargale et al., 29 Jul 2025)
• Timestamp anonymization: Order-preserving local noise injection
• Configurable pseudonymization for PII: HMAC-SHA256 keyed pseudonyms with full reversibility, hierarchical preservation (JSON/XML), and technical recognizer extensions (certificates, hashes, CPEs) (Kapelinski et al., 18 Nov 2025)

Utility is assessed via entropy metrics, collision rates, and structure preservation; privacy by residual linkage/leakage analysis.

2.4. Social Graphs

Baseline systems for social network anonymization operate at the graph level:

• Edge sampling baseline: Uniformly random edge deletions until k-anonymity (typically k=2) achieved for a chosen node equivalence criterion (Jong et al., 2024). This is contrasted with structure- and uniqueness-aware heuristics that maximize edge/utility retention.
• Metrics: Fraction of unique nodes, fraction of edges preserved post-anonymization

3. Privacy and Utility Metrics

Privacy is principally quantified by:

• Equal Error Rate (EER): For speaker anonymization, a high EER indicates that an ASV system cannot link samples (Tomashenko et al., 17 Jan 2026, Gaznepoglu et al., 2023).
• Reidentifiability rank: For text (and structured data), top-K adversarial reidentification from learned bi-encoder models or ensembles (K-anonymity in prediction) (Morris et al., 2022).
• Uniqueness fractions: For graphs, the proportion of nodes unique under a chosen anonymity measure (Jong et al., 2024).
• Cryptographic security: Collision resistance and preimage security for pseudonymous mapping (e.g., HMAC-SHA256) (Kapelinski et al., 18 Nov 2025).

Utility is assessed using:

• Word Error Rate (WER) and ASR/SER UAR: For speech, reflecting ASR performance and emotion preservation (Tomashenko et al., 17 Jan 2026).
• Information preservation: Information-weighted precision, compression-based information loss, and data structure retention.
• Analytical fidelity: For logs, retention of subnet structure, event order, and frequency distributions.

4. Typical Baseline Workflows and Algorithms

A baseline system is defined by fully specified modular operations:

Data Type	Input Features	Identity/PII Link	Core Baseline Transformation	Output Reconstruction/Format	Utility Metric	Privacy Metric
Speech	BN, F₀, x-vector	x-vector	Anonymized centroid x-vector	Conditioned NSF/HiFi-GAN synthesis	WER, UAR	EER
Text	Document tokens	Entity spans	NER- or rule-based masking	Masked tokenization, aligned with input structure	Info-weighted precision	Entity recall, re-ID rank
Logs/Tables	IPs, ports, timestamps, PII	Field values, context	Salted hash, HMAC-SHA256	Full structure preservation (JSON/XML/PDF/XLSX)	Entropy/collisions	Linkage/leakage risk
Social Graph	(V,E), node states	Unique nodes	Random edge deletion (ES)	Original graph with altered edge set	Edge preservation	Node uniqueness fraction

The operational details, including pseudocode-level descriptions and parameter choices, are always concretely specified (Tomashenko et al., 17 Jan 2026, Gaznepoglu et al., 2023, Kapelinski et al., 18 Nov 2025, Pilán et al., 2022, Jong et al., 2024, Bargale et al., 29 Jul 2025).

5. Empirical Performance and Limitations

Quantitative evaluation reveals that:

• Baseline speech anonymization (B1, 2024) achieves moderate privacy (EER~6%, WER~3%), while modern vector-quantized bottleneck or codec-LM baselines reach EER>30%, at manageable WER cost (Tomashenko et al., 17 Jan 2026).
• Text NER baselines excel at recall of direct identifiers but suffer severe over-masking (low precision), while fine-tuned sequence labelers trade annotation cost for superior privacy-utility balance (Pilán et al., 2022).
• Graph edge sampling preserves few edges (full k-anonymization: 1–6%), greatly underperforming heuristics targeting unique-node impact (up to 17× more edge retention) (Jong et al., 2024).
• Salt-based hashing/IP anonymization sustains high utility (entropy loss ≈ 0), with subnet-level interpretability, and is robust against inversion without the salt (Bargale et al., 29 Jul 2025).
• Pseudonymization frameworks that use keyed HMACs achieve perfect precision, with recall limited only by recognizer accuracy and OCR quality, and enable full reversibility with auditability (Kapelinski et al., 18 Nov 2025).

6. Critical Insights and Research Directions

Baseline anonymization systems elucidate several general findings:

• Minimal obfuscation can leak considerable identity information, especially in high-dimensional feature spaces (e.g., pitch/F₀ in speech, structural uniqueness in graphs) (Gaznepoglu et al., 2023, Jong et al., 2024).
• Naive baselines provide a floor, not a competitive target; advanced mechanisms (distribution-matched sampling, deep F₀ synthesis, context-aware masking, targeted edge/pruning) are required to approach practical privacy levels while preserving utility (Turner et al., 2020, Tomashenko et al., 17 Jan 2026, Morris et al., 2022).
• Modular, auditable designs—whereby each transformation is isolated and reversible—promote both benchmark comparison and safe deployment (Kapelinski et al., 18 Nov 2025).
• Baseline vulnerabilities inform attack models, e.g., learnable inversion of x-vector averaging (Champion, 2023) and ASR-based text reidentification (Morris et al., 2022), necessitating that future anonymizers target both feature-level and compositional linkage.

Continued research targets the joint optimization of privacy and utility, the integration of generative and adversarial mechanisms, and formal guarantees of irreversibility under realistic attacker models. The cumulative evidence underscores that baseline systems are both a diagnostic tool for privacy gaps and a template for incremental improvement across anonymization modalities.