The 5 levels of pseudonymisation

For decades, attempts to pseudonymise sensitive data have been stuck with blunt tools that simply find sensitive data and hide it. Often, this means that the data can’t be used for its intended purpose because hiding data undermines its integrity and utility. But there are different levels of sophistication in pseudonymisation which we describe here, including a new frontier of semantic twinning.

Blanket redaction

The most basic approach is to remove sensitive information without replacing it:

“Dr Sarah Williams, a retired Welsh GP, moved from Cardiff to Swansea.”

becomes:

“Dr [REDACTED], a retired Welsh GP, moved from [REDACTED] to [REDACTED].”

This is highly effective at hiding sensitive information but it destroys all of its semantic properties, as well as relationships between any entities that have been redacted.

Technologically, this method is cheap and easy to deploy. Rules that can be encoded as regular expressions can catch familiar patterns, such as email addresses and telephone numbers, while relatively lightweight named entity recognition (NER) models can identify names, organisations and locations.

Type labels

A slightly more sophisticated approach is to replace a piece of sensitive information with a label that says something about what was removed:

“Dr [PERSON_1], a retired Welsh GP, moved from [LOCATION_1] to [LOCATION_2].”

Now some bare semantics and relational structure survives.

This requires a little more machinery but not much: entity recognition, consistent label assignment, and a secure mapping between labels and the original values. But this is still fundamentally a basic classification approach, and many data analytics tasks are not possible with it.

Type substitution

A more nuanced approach will use actual pseudonyms, replacing names with names, and locations with locations and so on. The earlier example might become:

“Dr Emily Jones, a retired Welsh GP, moved from Manchester to London.”

The sentence now remains natural and much of its utility survives.

The technology for this is more sophisticated because the system has to generate plausible replacements and keep them consistent throughout a document. It may also need to account for correlated bits of text that are not the direct target of substitution, such as grammatical gender, titles and relationships between entities.

Nonetheless, substitutions of this kind are still limited by being largely blind to context.

If the original also says:

“She left a small Welsh university to join a multinational bank.”

a connection will be broken between ‘Welsh’ and ‘Cardiff’, which has been replaced by ‘Manchester’.

Contextual substitution

At the fourth level, a system starts to consider what properties of a piece of sensitive data connect it to other bits of information that surround it.

Suppose the original is:

“Sarah graduated from a small Catholic school in rural Wales before moving to London, the first time she had ever lived in a big city.”

A poor substitution might produce:

“Emily graduated from a small Catholic school in Manchester before moving to Whitby, the first time she had ever lived in a big city.”

Although locations have been replaced with locations, they don’t make sense in context – Whitby is not a big city, and Sarah would have lived in a city before if she had lived in Manchester.

To preserve sense, a system needs to understand semantic context rather than simply classifying entities. Increasingly, language models can assess which information is important to the meaning of a passage and which information can safely be changed, but there are tradeoffs in the size and cost of a model, and whether it can be run locally so that security of the data isn’t compromised by sending it over the internet to a model provider.

Semantic twinning

The most sophisticated approach asks an even more targeted question: what does a piece of information actually do in the context of a task? If this can be answered, it can be substituted with something which guarantees that the data preserves its utility.

Consider:

“Sarah left her job at the Royal London Hospital after eight years and joined a smaller hospital in Cambridge, where she became a consultant.”

A semantic twin will notice various features of the targets to pseudonymise: the Royal London Hospital is not merely an organisation, it’s specifically a large, well-known teaching hospital and Sarah’s former employer, while Cambridge, as well as being a location, is the site of a major university. If these features are relevant to a task being performed with the data, they can be preserved:

“Emily left her job at St. George’s Hospital after eight years and joined a smaller AI startup in Oxford, where she became the company’s first head of research.”

This requires the most sophisticated model intelligence and has been impossible to achieve until recently with the development of small language models (SLMs), many of which are just as good as LLMs at specific tasks while being economical enough to run locally and therefore privately.

The result is a fundamentally different class of pseudonymiser: instead of being a coarse filter that removes potentially relevant information, it’s an interpreter and a translator that changes the surface form of the semantic features that matter.