DE-Dataset: Privacy-Preserving Data Resources

• DE-Dataset is a collection of privacy-preserving datasets that apply de-identification, anonymization, and surrogate replacement to maintain research utility.
• It encompasses varied modalities including text, clinical records, and vision data, each employing domain-specific methods to balance privacy and analytical fidelity.
• The datasets advance benchmark design through tailored construction workflows and evaluation metrics that preserve key contextual and utility features.

DE-Dataset can be understood, in current arXiv practice, as a family of datasets whose defining operation is de-identification, anonymization, or identity-disrupting transformation, with the explicit aim of preserving downstream research utility. Across recent work, this family includes text corpora in which protected spans are removed or replaced with surrogates, EHR-derived tables released under Safe Harbor-style transformations, and vision datasets in which real persons are replaced by synthetic identities rather than merely blurred. The common research problem is not privacy alone, but privacy under utility constraints: mathematical expressions must remain analyzable in tutoring dialogue, clinical note structure must remain usable for PHI extraction benchmarks, microbiology records must preserve longitudinal epidemiologic value, and pedestrian scenes must remain suitable for detection, re-identification, and tracking research (Zhou et al., 18 Feb 2026, Posada et al., 5 May 2026, Haredasht et al., 8 Mar 2025, Torre et al., 2024, Maximov et al., 2023, Zein et al., 2023).

1. Scope and representative resources

The literature represented here does not describe one universally standardized resource named “DE-Dataset.” This suggests that the term is best treated as a category label for privacy-preserving datasets rather than a single benchmark. Within that category, the resources differ substantially in modality, granularity, and privacy mechanism, but they share the same central tension between disclosure control and analytical fidelity (Zhou et al., 18 Feb 2026, Posada et al., 5 May 2026).

Resource	Domain	Reported scale
MathEd-PII (Zhou et al., 18 Feb 2026)	Math tutoring dialogue	1,000 sessions; 115,620 messages; 769,628 tokens
SHIELD (Posada et al., 5 May 2026)	Clinical notes	1,394 notes; 10,505 PHI spans; 9 categories
ARMD (Haredasht et al., 8 Mar 2025)	EHR microbiology	751,075 culture records; 283,715 patients
DermatES (Torre et al., 2024)	Spanish dermatology reports	8,881 reports; 173 raw pathologies
IncogniMOT17 / PDI (Maximov et al., 2023)	Pedestrian video and tracking	fully de-identified version of MOT17
3DG-GA (Zein et al., 2023)	Biomedical facial imagery	3000 synthetic images in the abstract; 33,000 across all $\alpha$ values in the results table

These resources also span distinct release philosophies. Some are direct benchmarks for PHI detection, such as MathEd-PII and SHIELD; some are de-identified scientific data resources intended for secondary analysis, such as ARMD; and some are synthetic replacements for sensitive visual corpora, such as IncogniMOT17 and 3DG-GA (Zhou et al., 18 Feb 2026, Haredasht et al., 8 Mar 2025, Maximov et al., 2023, Zein et al., 2023).

2. Construction paradigms

A central property of DE-datasets is that de-identification is operationalized as a dataset-construction workflow, not a final preprocessing step. MathEd-PII was built from a large corpus of already-redacted transcripts that could not be released in original form. Its workflow had three stages: an LLM reviewed each redaction with at least three messages before and three after the target message, judged whether the redaction was true PII, missed PII, or uncertain, and generated context-aware surrogate replacements; three human researchers then manually reviewed outputs, down-voted wrong cases, and iteratively refined the prompt until 95% of previously down-voted issues were fixed; the validated prompt was finally applied at scale to produce repaired annotations and privacy-preserving surrogates (Zhou et al., 18 Feb 2026).

SHIELD follows a different but related pattern. Notes were selected from Stanford Medicine STARR-OMOP using set-cover diversity sampling across age, sex, race, ethnicity, note type, and note length. Annotation was LLM-assisted but human-adjudicated: each note was pre-annotated by an LLM, then independently reviewed by two of 12 trained labelers, with disagreements resolved by a senior annotator. This design explicitly targets semantic and demographic coverage rather than random sampling (Posada et al., 5 May 2026).

DermatES, the anonymized Spanish dermatology EHR corpus released on Hugging Face, uses a semi-automatic masking pipeline oriented to clinical text release rather than PHI benchmarking. All numeric content was removed; names, surnames, cities, locations, and hospital names were masked as [Entidad]; resources from the INE, RAE/CREA, and corpus-specific lists were combined; and 43 dermatology-specific exceptions were added so medically meaningful words such as “cabello”, “seco”, and “benigno” would not be spuriously masked. The process was manually checked by two reviewers on a 10% stratified sample, with 112 shared observations and only 4 disagreements (Torre et al., 2024).

ARMD illustrates tabular EHR de-identification. Derived from Stanford Health Care data, it anonymizes patient IDs, bins ages, groups all patients age 89 or older into a 90+ category, encodes sex as binary 0 and 1, and temporally jitters all date/time fields using random offsets while preserving relative timing. The paper states that no statistical imputation was performed, so nulls remain nulls (Haredasht et al., 8 Mar 2025).

Visual DE-datasets use stronger identity transformation. IncogniMOT replaces each MOT17 identity with a selected synthetic MOTSynth identity through a two-stage pipeline, first synthesizing an anonymous pedestrian from mask, pose, and identity vector, then adapting the synthesized person into the scene through Laplacian pyramid blending and a U-Net adaptation network trained without real pedestrians. 3DG-GA similarly creates de-identified facial drug-abuse images by fusing real drug-abuse faces with GAN-generated healthy faces, then rejecting outputs that fail forgery detection or remain linkable to parent identities under face recognition (Maximov et al., 2023, Zein et al., 2023).

3. Textual and clinical DE-datasets

Textual DE-datasets are distinguished by their annotation schema and by the extent to which privacy operations preserve semantics needed for downstream study. MathEd-PII covers 17 PII categories: PERSON, LOCATION, DATE, AGE, PHONE_NUMBER, URL, SCHOOL, GRADE_LEVEL, COURSE, NRP, IP_ADDRESS, US_DRIVER_LICENSE, US_PASSPORT, US_BANK_NUMBER, US_SSN, EMAIL_ADDRESS, and SOCIAL_HANDLE. The source corpus contained 5,263 PII redactions across 4,648 messages in 786 sessions, but after auditing and repair the benchmark reduced total PII annotations to 1,995 while also discovering 201 previously unredacted PII-containing messages (Zhou et al., 18 Feb 2026).

SHIELD uses 9 PHI categories: AGE, DATE, DOCTOR, HOSPITAL, ID, LOCATION, PATIENT, PHONE, and WEB. Its released corpus contains 1,394 notes, 10,505 gold-standard PHI spans, about 406,294 tokens, 234,815 words, and 40,865 vocabulary terms. The public-release table reports 3,620 DATE spans and 2,644 DOCTOR spans, with HOSPITAL, ID, PHONE, LOCATION, AGE, and WEB occupying smaller shares of the label distribution (Posada et al., 5 May 2026).

ARMD is not a span-annotation benchmark but a de-identified analysis resource. It contains 751,075 microbiological culture records from 283,715 adult patients, spanning 1999 to February 2024, and includes urine, blood, and respiratory cultures together with organism identification, susceptibility results for 55 antibiotics, implied susceptibility rules, and linked clinical and demographic variables. Its value lies in preserving longitudinal and clinical structure after de-identification, rather than in evaluating named-entity extraction (Haredasht et al., 8 Mar 2025).

DermatES occupies a different position again. It is a single-label multiclass pathology corpus built from 8,881 Spanish dermatology reports from first consultations and follow-up visits. The raw corpus contains 173 distinct dermatological pathologies, but the experimental setting filters to the 25 most frequent classes with at least 61 examples per class. Because the source notes were semi-automatically anonymized before release, the dataset functions simultaneously as an anonymized clinical corpus and as a benchmark for pathology classification with ontology-driven intermediate supervision (Torre et al., 2024).

Taken together, these datasets show that text de-identification is not uniform. In some corpora the target variable is the identifier span itself; in others, de-identification is an enabling condition for downstream prediction, epidemiology, or ontology-based reasoning. This suggests that a DE-dataset should be classified as much by its utility contract as by its masking mechanism.

4. Vision-oriented DE-datasets and synthetic identity replacement

Vision DE-datasets shift the privacy problem from textual PHI to biometric and quasi-biometric identity leakage. IncogniMOT formalizes this as the Pedestrian Dataset De-Identification task, where evaluation jointly measures de-identification quality and downstream training performance. The pipeline’s first stage, Pose2Person, uses a SPADE-based GAN conditioned on instance mask, body joints, and a synthetic identity, trained only on synthetic MOTSynth identities. The second stage, Person2Scene, applies Laplacian pyramid blending and a U-Net with residual blocks trained on masked-out real scenes to better match real-image statistics without learning real identities (Maximov et al., 2023).

The results make the privacy–utility trade-off explicit. In baseline comparison, IncogniMOT reports deID 82.7, reID 65.1, and Faster R-CNN AP 65.3; white cutout gives deID 85.3 but AP only 9.4; black-white blur gives deID 66.5 and AP 35.6; and CIAGAN reports deID 78.9 and AP 46.5. In syn2real experiments, fine-tuning on IncogniMOT17 consistently improves over MOTSynth-only training and narrows the gap to real MOT17 for re-identification, detection, and tracking, although it does not fully match real-data fine-tuning in benchmark settings (Maximov et al., 2023).

3DG-GA addresses a related problem in biomedical imagery. Starting from 120 real facial drug-abuse images from the Faces of Meth project, it generates high-resolution $1024 \times 1024$ synthetic faces by aligning drug-abuse and healthy GAN-generated faces, fusing them with a mixing coefficient $\alpha$, filtering them through XceptionNet forgery detection, and discarding outputs recognized as real parent identities. The abstract emphasizes a 3000-image synthetic dataset, whereas the results table summarizes 3000 images for each $\alpha$ value from 0.0 to 1.0, reaching 33,000 images in total (Zein et al., 2023).

The paper also verifies that de-identification does not erase clinically relevant phenotype by measuring facial asymmetry using SSIM over eyes, cheeks, and mouth. Reported symmetry decreases after drug use—for example, 66.5% before versus 46.4% after for eyes—supporting the claim that the generated images preserve meaningful drug-abuse traits while breaking direct identity linkage (Zein et al., 2023).

A common misconception is that face blurring is sufficient. The pedestrian work explicitly rejects that assumption, arguing that clothing, body shape, gait, tattoos, and scene context still permit recognition. The visual DE-dataset literature represented here therefore prefers replacement by synthetic identity over obscuration alone (Maximov et al., 2023).

5. Utility preservation, benchmark design, and evaluation

Utility preservation is the central methodological differentiator of modern DE-datasets. MathEd-PII is the clearest example because it identifies a specific failure mode—“numeric ambiguity”—in which math expressions resemble dates, IDs, or other structured identifiers. Using a density-based math segmentation method with selected thresholds $T_{anchor}=0.05$ and $T_{sim}=0.3$, the paper shows that 55.5% of false redactions occur in math-dense segments even though those segments cover only 36.6% of the corpus, while true PII is much less common there at 22.2%. In math segments the upstream system produced 2,539 false positives versus 520 true PII instances, roughly 4.88:1 (Zhou et al., 18 Feb 2026).

The comparative results show why dataset design and domain context cannot be separated. Presidio (Large) achieved precision 0.254, recall 0.747, and F1 0.379, whereas the best segment-aware Gemini 3 Pro configuration achieved precision 0.888, recall 0.764, and F1 0.821; Claude 4.5 Opus reached precision 0.934 and F1 0.820. Segment-aware prompting reduced false positives by as much as 90%, cut DATE false positives from 3,386 in Presidio LG to 16 for Gemini 3 Pro, and eliminated US_DRIVER_LICENSE false positives entirely (Zhou et al., 18 Feb 2026).

SHIELD frames benchmark value differently. Instead of focusing on a specific failure mode, it quantifies how different a modern corpus is from legacy de-identification benchmarks. Using MedCPT embeddings, SHIELD versus i2b2 has Fréchet Text Distance 14.44, with mean shift 6.40 and covariance divergence 8.04; the 95% CI is [14.08, 14.78]. Unigram-based Jensen-Shannon Divergence for SHIELD versus i2b2 is 0.193, with weighted JSD 0.145 and 95% CI [0.188, 0.198]. The paper interprets this as evidence that SHIELD occupies a distinct region of clinical embedding and vocabulary space (Posada et al., 5 May 2026).

SHIELD also supplies a deployment-oriented evaluation ceiling and student baseline. Gemini 2.5 Flash is used as teacher, and the best distilled DeBERTa v3 student achieves micro-averaged span-level precision 0.88 and recall 0.86 on standard workstation hardware. Per-category results are strong for DATE, DOCTOR, ID, PATIENT, and PHONE, but weaker for HOSPITAL and LOCATION, and the cross-dataset experiments show that institution-specific entities remain difficult to transfer (Posada et al., 5 May 2026).

In vision, evaluation likewise couples privacy and utility. IncogniMOT uses query-gallery retrieval with CMC rank-$k$, AP for detection, and MOTA and IDF1 for tracking. 3DG-GA uses realism filtering, anonymity checking by face recognition, and phenotype preservation through asymmetry analysis. The implication is consistent across modalities: a DE-dataset is not adequate if privacy is achieved by destroying the signal that motivated release in the first place (Maximov et al., 2023, Zein et al., 2023).

6. Release models, benchmark evolution, and limitations

Release mechanisms are themselves part of DE-dataset design. MathEd-PII uses privacy-preserving surrogates that preserve conversational coherence. SHIELD uses type-appropriate cryptographic surrogate replacement: PATIENT and DOCTOR names become HIPS pseudonyms; DATE uses patient-specific deterministic jitter of 3–90 days via HMAC-SHA256; ID and MRN become irreversible keyed one-way hashes; PHONE and LOCATION use format-preserving surrogates; and AGE is banded into ranges. DermatES is publicly available under CC BY 4.0 on Hugging Face, while ARMD is publicly available on Dryad in linked CSV tables designed for reuse in Python, R, SPSS, and SAS (Zhou et al., 18 Feb 2026, Posada et al., 5 May 2026, Torre et al., 2024, Haredasht et al., 8 Mar 2025).

The evolution of these datasets is closely tied to the evolution of de-identification models. Earlier neural work showed that recurrent architectures could outperform CRF-based systems on i2b2 2014 and a MIMIC-derived dataset without handcrafted rules, reaching F1 97.848 on i2b2 and 99.229 on MIMIC (Dernoncourt et al., 2016). Later contextual modeling with CEDI argued that sentence-bounded biLSTM-CRF systems miss cross-sentence dependencies in clinical notes and reported statistically significant gains over NeuroNER on the 2006 i2b2, 2014 i2b2, and 2016 CEGS N-GRID benchmarks (Lee et al., 2021). SHIELD then makes the benchmark-level argument that public corpora such as i2b2 2006/2014 are over a decade old and no longer capture the semantic and demographic diversity of modern narratives (Posada et al., 5 May 2026).

Several limitations recur across the literature. First, domain transfer remains uneven: SHIELD-trained models generalize well on universal structured PHI such as DATE, ID, and PHONE, but poorly on institution-specific HOSPITAL and LOCATION labels (Posada et al., 5 May 2026). Second, synthetic or transformed visual data narrow but do not eliminate the synthetic-to-real gap; IncogniMOT17 is especially effective when combined with synthetic pretraining rather than used alone (Maximov et al., 2023). Third, aggressive anonymization can distort the task itself: DermatES removes all numeric content, whereas MathEd-PII shows that in mathematics tutoring numerals are often the lesson rather than the learner (Torre et al., 2024, Zhou et al., 18 Feb 2026).

A final misconception is that de-identification is a settled preprocessing problem. The recent benchmark literature instead treats it as a domain-sensitive modeling problem. In tutoring data, generic PII detectors systematically over-redact mathematical content; in enterprise clinical text, large cloud LLMs may be accurate but impractical under governance and cost constraints; in pedestrian datasets, face-only anonymization is inadequate; and in biomedical face synthesis, realism, anonymity, and phenotype retention must be optimized jointly. DE-datasets therefore function less as static sanitized corpora than as experimentally controlled compromises between privacy, transferability, and task fidelity (Zhou et al., 18 Feb 2026, Posada et al., 5 May 2026, Maximov et al., 2023, Zein et al., 2023).