@inproceedings{ren-teo-2026-mind,
title = "Mind the Implicit Gap: Quantifying Attribute Inference Leakage in Privacy-Conscious Delegation",
author = "Ren, Nicole and
Teo, James",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.998/",
doi = "10.18653/2026.findings-emnlp.998",
pages = "21080--21114",
ISBN = "979-8-89176-462-0",
abstract = "Even when explicit Personally Identifiable Information (PII) is removed from LLM queries, implicit contextual cues can still reveal sensitive user attributes. Yet current Privacy-Conscious Delegation frameworks overlook this threat entirely, and existing PII span-based evaluation metrics cannot address it. We address this gap on both fronts. First, we introduce Attribute Inference Leakage (AIL), a label-free metric that quantifies implicit privacy leakage through set-based semantic comparison of attributes inferred before and after sanitisation. Using AIL, we provide the first empirical evidence in Privacy-Conscious Delegation that even perfect PII removal eliminates only 18{\%} of implicit leakage relative to direct delegation, leaking the vast majority of inferable attributes. Second, we propose GIST, a training-free approach for context-aware generalisation to protect both explicit and implicit privacy while preserving response quality. Experiments across six local models (1B to 8B parameters) show GIST consistently achieves a Pareto improvement over state-of-the-art PAPILLON on all three evaluation dimensions of quality, explicit and implicit leakage. GIST also consistently reduces implicit leakage below the explicit leakage lower bound (perfect PII removal), hence GIST addresses a privacy dimension that PII-centric methods cannot."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="ren-teo-2026-mind">
<titleInfo>
<title>Mind the Implicit Gap: Quantifying Attribute Inference Leakage in Privacy-Conscious Delegation</title>
</titleInfo>
<name type="personal">
<namePart type="given">Nicole</namePart>
<namePart type="family">Ren</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">James</namePart>
<namePart type="family">Teo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Even when explicit Personally Identifiable Information (PII) is removed from LLM queries, implicit contextual cues can still reveal sensitive user attributes. Yet current Privacy-Conscious Delegation frameworks overlook this threat entirely, and existing PII span-based evaluation metrics cannot address it. We address this gap on both fronts. First, we introduce Attribute Inference Leakage (AIL), a label-free metric that quantifies implicit privacy leakage through set-based semantic comparison of attributes inferred before and after sanitisation. Using AIL, we provide the first empirical evidence in Privacy-Conscious Delegation that even perfect PII removal eliminates only 18% of implicit leakage relative to direct delegation, leaking the vast majority of inferable attributes. Second, we propose GIST, a training-free approach for context-aware generalisation to protect both explicit and implicit privacy while preserving response quality. Experiments across six local models (1B to 8B parameters) show GIST consistently achieves a Pareto improvement over state-of-the-art PAPILLON on all three evaluation dimensions of quality, explicit and implicit leakage. GIST also consistently reduces implicit leakage below the explicit leakage lower bound (perfect PII removal), hence GIST addresses a privacy dimension that PII-centric methods cannot.</abstract>
<identifier type="citekey">ren-teo-2026-mind</identifier>
<identifier type="doi">10.18653/2026.findings-emnlp.998</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.998/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>21080</start>
<end>21114</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Mind the Implicit Gap: Quantifying Attribute Inference Leakage in Privacy-Conscious Delegation
%A Ren, Nicole
%A Teo, James
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F ren-teo-2026-mind
%X Even when explicit Personally Identifiable Information (PII) is removed from LLM queries, implicit contextual cues can still reveal sensitive user attributes. Yet current Privacy-Conscious Delegation frameworks overlook this threat entirely, and existing PII span-based evaluation metrics cannot address it. We address this gap on both fronts. First, we introduce Attribute Inference Leakage (AIL), a label-free metric that quantifies implicit privacy leakage through set-based semantic comparison of attributes inferred before and after sanitisation. Using AIL, we provide the first empirical evidence in Privacy-Conscious Delegation that even perfect PII removal eliminates only 18% of implicit leakage relative to direct delegation, leaking the vast majority of inferable attributes. Second, we propose GIST, a training-free approach for context-aware generalisation to protect both explicit and implicit privacy while preserving response quality. Experiments across six local models (1B to 8B parameters) show GIST consistently achieves a Pareto improvement over state-of-the-art PAPILLON on all three evaluation dimensions of quality, explicit and implicit leakage. GIST also consistently reduces implicit leakage below the explicit leakage lower bound (perfect PII removal), hence GIST addresses a privacy dimension that PII-centric methods cannot.
%R 10.18653/2026.findings-emnlp.998
%U https://aclanthology.org/2026.findings-emnlp.998/
%U https://doi.org/10.18653/2026.findings-emnlp.998
%P 21080-21114
Markdown (Informal)
[Mind the Implicit Gap: Quantifying Attribute Inference Leakage in Privacy-Conscious Delegation](https://aclanthology.org/2026.findings-emnlp.998/) (Ren & Teo, Findings 2026)
ACL