A study posted to arXiv on September 15, 2026 by researchers from the University of Bonn, Fraunhofer IAIS, the Lamarr Institute and Microsoft Germany found that swapping personal details for placeholder tags before text reaches a language model dragged GPT-4o mini's score on a retrieval benchmark from 0.80 to 0.32, while the same treatment lifted results on a test of factual truthfulness for four of five models.

In Short

Researchers took five AI chatbots, hid the names, places and other personal details in the questions they asked them, and measured how much worse the answers got. Hiding those details barely mattered for simple reasoning questions but badly broke tasks where the AI has to look things up in documents, and the strongest models lost the most. If you strip personal data out of text before sending it to an AI, the way you strip it and the job you ask the AI to do decide how much accuracy you give up.

The study

The paper, titled "On the Impact of Anonymization on the Performance of Large Language Models", appeared as version two of arXiv submission 2609.11335 in the computation and language category. Six authors are listed. Tobias Deußer, the corresponding author, and Max Hahnbück contributed equally; they are joined by Lorenz Sparrenberg, Tobias Uelwer, Christian Bauckhage and Rafet Sifa. Five of the six carry affiliations with the University of Bonn, Fraunhofer IAIS in Sankt Augustin or the Lamarr Institute for Machine Learning and Artificial Intelligence in Bonn. Uelwer is listed with Microsoft Germany GmbH in Cologne.

The question the team set out to answer is a practical one. Organisations increasingly remove or mask personally identifiable information before passing text to a large language model, a step intended to limit privacy exposure. Nobody, according to the authors, had systematically measured what that step costs in output quality across models and task types. Earlier work, the paper notes, tended to be confined to a single domain such as clinical or financial text, to a narrow set of tasks, usually classification, or to older architectures such as BERT.

The authors frame their conclusion bluntly. According to the paper, "anonymization is not a one-size-fits-all solution and must be co-designed with the model and task in mind to balance privacy and utility effectively."

The work drew attention beyond academic circles this week when Vadym Honcharenko, who lists his role on LinkedIn as privacy engineer at Google and his membership of the EDPB Pool of Experts, summarised it in a post that had drawn six reactions at the time it was captured. The post is a personal commentary, not a Google statement, and it rounds several of the paper's figures in ways examined further below.

How the experiment was built

The team built a six-stage pipeline. Benchmarks were downloaded, preprocessed and sampled. Questions, along with any few-shot examples in the prompt, were passed through an anonymizer that replaced personal information with placeholders while storing a mapping between original and substitute. Each model then answered both the original and anonymized versions. For anonymized answers, placeholders were mapped back to the original entities before scoring, so that the reference answers could be matched fairly. Results were then aggregated.

The anonymizer

The primary technique was pseudonymization, carried out by a tool the same group described in a 2025 paper at the COLING conference. It is itself a fine-tuned small language model that performs named entity recognition, identifies personal information and substitutes a category label plus a consistent numeric identifier. Every occurrence of "London" in a document becomes "<LOC>-1"; "Berlin" becomes "<LOC>-2". Uniqueness is preserved, which matters for any task that depends on telling one entity from another.

According to the paper, the tool achieves an F1-score above 88% and recall above 91%. Put the other way round, roughly one entity in eleven is missed. That residual leakage is not the study's subject, but it bears on how any production system built on similar tooling would perform as a privacy control rather than as a utility experiment.

Models and benchmarks

Five models were tested, chosen for spread across providers and sizes: OpenAI's GPT-4o mini, whose parameter count is undisclosed; Teuken-7B from the OpenGPT-X project at 7 billion parameters; Meta's Llama-3.1-8B at 8 billion; Google's Gemma-2-27B at 27 billion; and Alibaba's Qwen2.5-72B at 72 billion.

These are not current frontier systems. The paper's citation for GPT-4o mini records an access date of May 27, 2025, and in one example reproduced in the paper the model refers to its own knowledge cutoff of October 2023. Whether newer architectures behave differently is a question the authors themselves list as open.

Eleven benchmarks were selected on popularity, openness, language coverage and task diversity. They span grade-school science (ARC), hard reasoning (BIG-Bench Hard), emotional intelligence (EQ-Bench), commonsense reasoning (HellaSwag), instruction following (IFEval), medical knowledge (MedQA), multitask academic knowledge (MMLU-PRO), multi-step reasoning (MUSR), retrieval-augmented generation (RGB), truthfulness (TruthfulQA) and English-to-German translation (WMT 2014). Coding and mathematics were excluded because they rarely involve personal information.

Computational limits shaped the sample. The eleven benchmarks contain 38,967 samples across 55 subtasks. Most were capped at 500 randomly selected items; BIG-Bench Hard and MMLU-PRO, which contain many subtasks, were capped at 1,000. The final evaluation set held 6,210 unique samples with an average input length of 417.62 tokens. All runs used four NVIDIA Tesla V100 GPUs with 32GB of memory each, a global random seed and a sampling temperature of 0 to keep outputs as deterministic as possible.

Where performance held and where it broke

The headline pattern is uneven damage. According to the paper, ARC, HellaSwag and IFEval typically lost under 5 percentage points after pseudonymization. MMLU-PRO lost more: Qwen2.5-72B fell from 0.71 to 0.61, and GPT-4o mini from 0.63 to 0.55. On MedQA, Gemma-2-27B slipped from 0.94 to 0.87.

RGB was a different category of failure. The benchmark tests whether a model can integrate information from several retrieved documents while filtering noise, the same basic operation behind retrieval-augmented assistants and AI search. Every model collapsed:

  • GPT-4o mini fell from 0.80 to 0.32.
  • Qwen2.5-72B fell from 0.82 to 0.38.
  • Llama-3.1-8B fell from 0.69 to 0.34.
  • Gemma-2-27B fell from 0.63 to 0.39.
  • Teuken-7B fell from 0.53 to 0.31.

The authors describe the result as a "catastrophic decline". Replacing concrete entities with abstract tags, they argue, disrupts the model's ability to join facts across sources. In RGB, the average input carries 79.49 entity mentions, 35.26 of them unique, across roughly 1,000 tokens.

Entity density alone does not explain the damage, however. MUSR inputs are longer, at 1,317 tokens on average, and carry 67.47 entity mentions, yet scores barely moved: GPT-4o mini held at 0.70 in both conditions. The authors ran correlation analyses between performance drops and total entities, unique entities and input length, and found no statistically significant relationship. Their reading is that damage depends on how much a given task leans on the meaning of specific entities, not on how many appear. The entity table does show one visible difference: RGB carries roughly four times as many distinct entities per input as MUSR, which reuses a smaller cast many times.

The strongest models lose the most

Qwen2.5-72B and GPT-4o mini posted the highest baselines, each scoring above 0.60 on 8 of the 11 tasks without anonymization. They also absorbed the largest average losses. Qwen2.5-72B's average score fell by 6.9 percentage points, according to the paper, against 2.3 points for Teuken-7B, the weakest model in the set.

The authors interpret this as evidence that more capable models lean harder on specific entity knowledge to reach their scores. The comparison carries a caveat the paper itself surfaces: Teuken-7B scored 0.00 on ARC in both conditions, and Gemma-2-27B scored 0.00 on HellaSwag in both conditions, according to the results table. A model that cannot handle a task format at all has nothing to lose, which flatters its robustness figure.

A truthfulness gain

TruthfulQA ran the other way. Llama-3.1-8B rose from 0.70 to 0.78, Qwen2.5-72B from 0.69 to 0.74, Teuken-7B from 0.45 to 0.51 and Gemma-2-27B from 0.67 to 0.68. The authors hypothesise that the benchmark's questions contain named entities that trigger confident but wrong memorised associations; hiding the name removes the trigger.

That mechanism connects to a broader line of research on why models state falsehoods fluently. Researchers from OpenAI and Georgia Tech argued in September 2025 that models hallucinate partly because evaluation rewards guessing over admitting uncertainty.

Five ways to hide a name

A second experiment compared pseudonymization with four alternatives on GPT-4o mini, using MedQA, MUSR and RGB. Generalization replaces an entity with a broad label, so "London" becomes "[CITY]". Masking obscures part of the string, as in "Lo****". Randomization substitutes a consistent random string such as "Xj92Lp". Redaction replaces the entity with a fixed marker.

The paper groups pseudonymization, randomization and masking as reversible, since each allows a one-to-one mapping back to the original, and generalization and redaction as irreversible. The reversible group generally performed better. On MUSR, generalization produced 0.58 and redaction 0.52, against 0.70 for pseudonymization and 0.73 for the original text. On RGB, the gap was starker: generalization scored 0.09 and redaction 0.12, while randomization reached 0.37 and pseudonymization 0.34. The unaltered input scored 0.80.

The ranking was not uniform, a detail the summary figures obscure. On MedQA, redaction scored 0.83, identical to pseudonymization, and randomization scored 0.81, level with generalization. Masking was the strongest anonymized variant on MedQA at 0.87, yet fell to 0.26 on RGB. The authors attribute the RGB drop to the kind of information that benchmark requires, which partial string matching cannot supply. Their overall conclusion holds on two of three benchmarks: preserving a unique identifier for each distinct entity, even an abstract one, protects utility.

There is a mechanical factor too. Irreversible methods, the paper notes, hamper not only the model but also the evaluation scripts, which expect original entities after de-anonymization in order to score answers correctly.

Telling the model changes nothing

The third experiment asked whether warning the model helps. Two prefixes were attached to anonymized prompts for GPT-4o mini. The short version read: "This prompt is anonymized. Some context may be missing; respond as accurately as possible." The long version asked the model to produce the most accurate response possible despite missing contextual details.

Neither produced a meaningful change. On MedQA, scores were 0.82 with either prefix and 0.80 without. On MUSR, 0.70 with either prefix and 0.71 without. On RGB, both prefixes produced 0.29 against 0.32 with no prefix. According to the paper, current models "do not substantially alter their reasoning strategy based on such meta-information," and the impact comes from the altered content itself.

Failure modes, one question at a time

Five worked examples in the paper show what goes wrong. In an ARC question about solar eclipses, "Earth" and "Sun" became "<LOC>-1" and "<LOC>-2"; the model lost its footing and switched from the correct answer to a wrong one. In a TruthfulQA question asking which European country has the most science Nobel laureates, the model answered "United Kingdom" on the original. After "Europe" became "<LOC>-4", it replied with a placeholder of its own invention, "<COUNTRY NAME>". According to the authors, the model "does not adapt its reasoning to the anonymization scheme and may fabricate answers outside the tagging system."

A currency question in MMLU-PRO showed a reasoning inversion. With the euro at $1.36 one day and $1.40 the next, the model correctly concluded the euro had appreciated. Once the figures became "<MONETARYVALUE>-1" and "<MONETARYVALUE>-2", it reached the opposite conclusion, despite starting from the same reasoning.

Two examples moved scores in the other direction for accidental reasons. In a MedQA case, anonymization replaced three of four answer options with product tags, leaving only one readable option, which happened to be right. The authors call the gain coincidental. The same example shows the anonymizer replacing the patient's wife with a realistic invented name, "Azalea Kahler", rather than a category tag, an inconsistency the paper does not discuss. In a BIG-Bench Hard example about NASA's Spirit rover on Mars, the anonymized answer scored 1.0 and the original 0.0 although both chose option D; the evaluation script expected a particular format.

Discrepancies in the paper and in the commentary

Several numbers do not reconcile across the paper's own tables and figures. The text states that on TruthfulQA "all five models either maintain or improve performance". The results table shows GPT-4o mini moving from 0.61 to 0.60, and the heatmap records a change of -0.02. Elsewhere the paper says performance improved "for most models", which matches the data.

The text describes RGB drops of "30-60 percentage points for most models". The heatmap puts them between 22 and 47 points. Expressed as a relative loss instead, the range is roughly 38% to 60%, with GPT-4o mini's fall from 0.80 to 0.32 amounting to 60%.

GPT-4o mini's unaltered MedQA score appears as 0.88 in the main table, 0.90 in the technique comparison and 0.89 in the prefix experiment. Its pseudonymized RGB score is 0.32 in the main table and 0.34 in the technique comparison. The paper does not explain the variation, despite a temperature setting of 0 across all runs. Figure 1's caption, describing the pipeline, refers to an "encoder-only contradiction detection approach", which appears to be carried over from another publication.

Honcharenko's LinkedIn summary compresses some of these points further. It states that reasoning and instruction-following tasks saw "performance drops under 5%", where the paper measures percentage points. It says retrieval-heavy tasks "dropped by 30-60%", a range closer to the relative loss than to the paper's stated points. It describes pseudonymization as improving factual-accuracy scores "across the board", which the table contradicts for GPT-4o mini. And it says reversible methods "far outperformed blunt redaction", which holds for MUSR and RGB but not MedQA, where the two tied.

His broader argument does not depend on those roundings. According to the post, when product or engineering teams claim that sanitization breaks utility, "that claim shouldn't be accepted or dismissed in the abstract. It demands empirical evaluation." He also sketches a routing architecture as one possible design, "pseudonymising inputs where reasoning is sufficient, and reserving raw access strictly for tasks where entity grounding is essential."

The study also carries disclosures worth noting. The pseudonymization tool under test was built by the same research group. One co-author works for Microsoft Germany, while GPT-4o mini, one of the two models singled out for the largest losses, comes from OpenAI. The acknowledgments state that Google's Gemini 2.5 Pro and OpenAI's GPT-4o were used to refine the text of the paper, with the authors retaining responsibility. Funding came partly from Germany's Federal Ministry of Education and Research and the state of North Rhine-Westphalia through the Lamarr Institute.

Why this matters for marketing and advertising

Marketing teams have moved language models into workflows that touch personal data at volume: summarising customer support transcripts, clustering survey responses, drafting audience briefs from CRM notes, powering brand assistants that answer from product documentation. Pseudonymizing that text before it reaches a third-party model is a common compliance reflex. The study puts numbers on what the reflex costs, and shows the cost is concentrated in retrieval work.

Retrieval is also where the industry's attention sits. The technique of grounding model output in fetched documents underpins AI search products and enterprise assistants alike. PPC Land's April 2026 examination of AI infrastructure costs described the choice a trained model faces when asked about something specific or proprietary: retrieve it, or produce a plausible guess. The RGB result suggests that tagging the entities in retrieved material pushes models back toward the second option.

The "<COUNTRY NAME>" example has a commercial parallel. IAB Tech Lab's AAMP 2.3 release in July 2026 added a pricing provenance field after buying agents generated invented CPM figures when real price data was missing. In both cases the model fills a gap with output shaped like an answer rather than stating that information is absent.

The paper uses "anonymization" as an umbrella term. European regulators do not. The EDPB's Guidelines 01/2025, adopted in January 2025, hold that pseudonymised data remains personal data under Article 4(5) of the GDPR even when the re-identification key sits with another party. The reversible techniques the study favours all keep exactly such a key: the mapping table that restores "<LOC>-1" to "London". In the EDPB's framing, a system built that way is still processing personal data, with the obligations that follow.

The line between the two categories is itself contested. The Court of Justice ruled in September 2025 in EDPS v Single Resolution Board that identifiability is assessed from the recipient's perspective, so pseudonymised data may not be personal data for a party with no reasonable means to reverse it. The European Commission's Digital Omnibus package would write a version of that relativity into the GDPR, a proposal the EDPB and EDPS opposed in a joint opinion in February 2026. The EDPB then adopted Guidelines 02/2026 on Anonymisation on July 7, 2026, replacing the 2014 test with criteria including No Inference; consultation runs to October 30, 2026. The broader field of de-identificationtherefore sits mid-revision just as studies like this one quantify what each method costs.

Model providers sit inside that picture as recipients. Whether a pseudonymized prompt counts as personal data for the company running the model, under the relative approach, would turn on whether that company can reverse the tags. The study's architecture keeps the mapping on the sender's side, which is the configuration the SRB reasoning addresses.

Regulators outside the EU are moving on adjacent questions. South Korea revised its rules on pseudonymous data for AIin March 2026. The Council of Europe's data protection committee scheduled draft guidelines on privacy and large language models for its Bureau meeting on September 16 and 17, 2026 in Paris. Those guidelines build on the EDPB's April 2025 report on privacy risks in LLMs, which set out a risk methodology for organisations deploying such systems. Separately, research covered by PPC Land in July 2025 estimated that models memorise between 0.1% and 10% of training data, which raises privacy exposure on the model side rather than the prompt side.

What the numbers do and do not show

The results measure benchmark scores, not campaign or business outcomes. Each benchmark was capped at 500 or 1,000 samples, the models belong to a 2024 generation, and one anonymizer configuration dominates the main results. The technique comparison and prefix tests cover a single model on three benchmarks. None of that invalidates the direction of the findings, but it limits how far the exact figures travel.

What the paper does establish is that the question has no single answer. A support-ticket classifier and a document-retrieval assistant fed the same pseudonymized text would, on this evidence, degrade by very different amounts. Principles such as data minimisation push organisations to send models less personal information; the study shows that the method chosen to comply determines how much usefulness survives.

The authors point to two directions for future work. One is finer-grained anonymization that targets entity types selectively according to what a task needs. The other is models that are inherently robust to missing personal data, or fine-tuned to understand anonymized representations. According to the paper, "ongoing evaluation will be crucial to track whether this privacy-utility trade-off changes with new architectures and capabilities."

Timeline

Summary

Who: Six researchers from the University of Bonn, Fraunhofer IAIS, the Lamarr Institute and Microsoft Germany, led by corresponding author Tobias Deußer, with the paper later summarised on LinkedIn by Google privacy engineer Vadym Honcharenko.

What: A systematic study of how pseudonymizing personal information in prompts affects five language models across 11 benchmarks and 6,210 samples, finding modest losses on reasoning tasks, a collapse on retrieval tasks, gains on TruthfulQA for four of five models, larger losses for stronger models, better results for reversible techniques on two of three benchmarks, and no benefit from telling the model its input was anonymized.

When: Version two of the paper was posted to arXiv on September 15, 2026.

Where: The research was conducted in Germany, in Bonn, Sankt Augustin and Cologne, and published on arXiv; the findings bear on organisations processing personal data under the GDPR and comparable regimes.

Why: Organisations routinely strip personal data from text before sending it to language models, but the cost to output quality had not been measured across models and tasks; the results show that cost varies sharply by task and method, at a moment when European rules on pseudonymisation and anonymisation are being revised.