Automated anonymization of non-structured and semi-structured documents

Abstract

A method for anonymizing documents wherein, upon a user's request 100 for anonymization of a document 10, firstly the document 10 is classified 110 by detecting 11 its format 12. For standard content like Word, Excel, or raw text, plugins 141, 142, 143 extract the content directly. For image formats 13, an OCR task 130 is initiated via plugin 144 and PDF documents 14, with mixed content, are converted to images 121 and undergo the same OCR 130 process. After extraction 140, content is fed into a prediction model that identifies PII in the text 15 using NLP and patterns. Based on PII labeling 150, a redaction plugin 16 specific to the detected format 12 modifies the document using processes like masking. The anonymized modified document is then delivered 17 to the user via a GUI or API.

Description

[0001] AUTOMATED ANONYMIZATION OF NON-STRUCTURED AND SEMI- STRUCTURED DOCUMENTS TECHNICAL FIELD The present invention relates generally to computing systems and, specifically, usingartificial intelligence and has its application within Personal Data Anonymizationtechniques.More particularly, the present invention refers to an automated method designed forthe anonymization and pseudonymization of information found within non-structured and semi-structured documents. BACKGROUND OF THE INVENTION In today's age, where personal data protection stands paramount, the task of shielding identifiable information in documents presents numerous challenges. While structured databases have methodologies in place for systematic encryption or redaction, non- structured and semi-structured documents, which include formats like emails, handwritten notes, reports, and social media updates, typically contain information in an unpredictable and free-flowing manner.In the context of anonymization procedures, particularly in data processing anddocument handling, the terms "entity" and "element" have specific meanings: -An entity in anonymization refers to any individual, group, object, or conceptthat can be distinctly identified. This is often a personal or sensitive piece of information that needs to be protected or anonymized. For example, in a text document, entities might include personal names, addresses, phone numbers,or other identifiers that could be used to trace back to an individual. In a broader data context, entities could also refer to businesses, locations, or any other definable item. -An element of a document refers to any distinct part of the document that cancontain information. This might include text strings, paragraphs, tables, images, metadata, etc. Each element can contain one or more entities that might need anonymization. For instance, a paragraph (element) in a report could contain the name of a person (entity) and their email address (another entity). In anonymization procedures, identifying these entities and elements is crucial. The goal is to modify or remove entities (like personal data) within the elements of the document (like paragraphs, tables, etc.) to prevent the identification of individuals, thereby ensuring privacy and compliance with data protection regulations. Traditional techniques, such as basic pattern-matching algorithms or manual redaction, although employed, are inundated with challenges. Notably: Manual Limitations: Human-based redaction is not only cumbersome but fraught with errors, often leading to missed sensitive information or unintended disclosure. Algorithmic Limitations: Conventional algorithms might generate false positives, orneglect data that does not align with predefined patterns, given the varied nature ofsemi-structured documents. Furthermore, the intricate formats and varying quality of documents have compounded the issue. For instance, PDFs, being hybrid in nature, contain a blend of text, diagrams, images, and more. Existing methods often require these documents to be converted into images for text recognition, further complicating the process. A significant challenge has also been the identification and redaction of Personal Identifiable Information (PII) within these documents. While conventional NaturalLanguage Processing (NLP) methods and models show promise in understandingtext content, the diversity of document formats, the plethora of layouts, and the different document quality tiers make PII identification an intricate endeavour.In light of these challenges, there is an evident gap in the current technology - a voidthat calls for a system adept at automatically recognizing and managing varied document formats, while precisely detecting and anonymizing PII. The ideal solution would need to ensure that the semantics and context of the content remain unaltered, irrespective of the document's distribution of content. Furthermore, training such a system poses its own set of challenges. A contradiction emerges: the requirement of PII-containing documents for system training in an era where these exact PII elements need utmost protection. The need for a rich dataset, built while navigating the complexities of data protection regulations and ensuring the sanctity of sensitive information, is paramount.Therefore, there is a need of providing a ML model to anonymize different types ofdocuments, non-structured or semi-structured, while keeping a balance between afully automated workflow and the best possible PII detection. SUMMARY OF THE INVENTION The problems found in prior art techniques are generally solved or circumvented, and technical advantages are generally achieved, by the disclosed embodiments whichprovide a method (and related computer program product) for anonymizingdocuments. An aspect of the present invention refers to a computer-implemented method definedby the independent claim 1. The dependent claims define advantageousembodiments. Another aspect of the invention relates to a computer program product comprising instructions that, when the program is executed by a computer, cause it to carry out the method defined above. Another aspect of the invention relates to a computer-readable medium comprising instructions that, when executed by the computer, cause it to execute the method defined above.The method in accordance with the above-described aspects of the invention has anumber of advantages with respect to the aforementioned prior art, which can besummarized as follows: -The automated classification and extraction of the content of different types ofdocuments. Existing solutions either work only with raw text or processmultiple types of documents but are aimed at data lakes and specially datagovernance tasks. The present invention is truly agnostic on the documenttype and format. -The training and provision of a unique model capable of finding personallyidentifiable information (PII) in unstructured and semi-structured documents with high confidence. -Flexibility of the approach, integration possibilities with third party productsand future growth capabilities. BRIEF DESCRIPTION OF THE DRAWINGS To complete the description that is being made and with the object of assisting in a better understanding of the characteristics of the invention, in accordance with a preferred example of practical embodiment thereof, accompanying said description as an integral part thereof, is a set of drawings wherein, by way of illustration and not restrictively, the following has been represented:FIG.1 shows a workflow of the method for anonymizing different types of documents,according to a possible embodiment of the present invention.FIG.2 shows a sequence diagram of the components and steps involved in theanonymization method, according to a possible embodiment of the present invention.DESCRIPTION OF EMBODIMENTSThe present invention may be embodied in other specific systems and / or methods.The described embodiments are to be considered in all respects as only illustrative and not restrictive. In particular, the scope of the invention is indicated by theappended claims rather than by the description and drawings herein. All changes thatcome within the meaning and range of equivalency of the claims are to be embraced within their scope. FIG.1 shows an Activity Diagram that illustrates an overview of the presentsolution workflow, which comprises the following main steps:100 Anonymization or pseudonymization request: Interaction of the userthrough a graphical user interface (GUI) or by using an application programminginterface (API) to input / output a document 10.110 Classification of the document 10 to be anonymized according to its format120 Conversion130 Application of optical character recognition (OCR)140 Extraction of the content from the document 10 based on its type / format150 Application of a natural language processing (NLP) predictor modelto detect personally identifiable information (PII)160 Redaction and Masking of the anonymized documentReferring to FIG.1 further in detail, once the user requests 100 theanonymization (or pseudonymization) of the document 10, the first step is theclassification 110 of the document 10 by detecting 11 its format 12: docx, pdf, etc. Ina possible embodiment, this task is focused on content type detection. In anotherpossible embodiment, the internal content and structure of the document can also beanalyzed to preprocess the information and bring layout context to the NLPcomponent. Additionally, business context information can also be extracted to enablean automated results checker such as “if the content is of this kind, at least thisnumber of PII terms should be detected”. If the document format is non-structured orsemi-structured content, like Word (non-structured content), Excel (tabular content)or raw text, the document is sent to one of different plugins, 141, 142, 143, whosemission is to extract the internal content, with different versions specialized for each format. The key here is again automation: the system itself has the knowledge on howto extract and format the information to maximize the NLP predictions. If the document10 is in image format 13, a previous step is added: a task of OCR 130 that convertsthe document content into text through the mixed content plugin 144. For PDFdocuments 14, which comprises mixed (non-structured and structured) content, anadditional challenge arises: PDF is a hybrid format that can include text, images,diagrams and literally any type of static information, layouts and even form fields, and so, to keep the automated workflow, the solution consists in converting every page ofthe document to images 121 and then sending them to the same OCR 130 componentinvolved in image documents. Once the step 140 is completed by applying the plugin,141, 142, 143 or 144, corresponding to the detected format 12 of the document 10,the extracted content of the document 10 is loaded into the prediction model, whichlabels the PII in the text 15 by using a combination of context-aware NLP detectionand a patterns engine. Based on the PII labeling performed in the step 150, a pluginfrom another set of redaction plugins 16, the redaction plugin corresponding to thedetected format 12, retrieves the original document and apply the correspondingmodifications (masking, blacklining, tokenization, etc.). The modified anonymizeddocument is delivered 17 to the user through the GUI or API. In order to obtain a single prediction model capable of finding PII inunstructured and semi-structured documents with high confidence, the followingtechnologies and processes are implemented:- Leverage the efficiency and effectiveness of the predictions through the useof a state-of-the-art ML stack: -A Hugging Face BERT-architecture multi-language model isused as the base layer. This model was trained with the content of Wikipedia and its internal architecture consists of 12 layers, 12 attention heads, 110 million parameters and has output size of 768 dimensions. It serves as the typical encoder needed in a Transformer family model. This architecture isgenerally considered the state-of-the art for NLP models outside the LLM world and its implementation means the best technological approach that is currently available. -Manual and automated labeling using tools like UBIAI, Prodigy,Argilla, Tesseract, Textract, OpenCV and CRF. Post-processing third party and ad-hoc tools are used to constantly monitor the weights and biases of the model and the outcome of the automated context extraction of a test set of documents. This way, the theoretical precision and recall, as well as the empirical results of the end-to-end process are contrasted against each other. Multiple tools are used to thoroughly and constantly test the model performance. Not only lab testing but with wildlife documents and edge cases.- Gathering and distillation of a high quality dataset:- Lack of documents for proper training is an historical pain pointfor AI models training. And in this case a paradox is faced: the need of documents with PII in order to train a model for detecting them, in a highly regulated market whose PII is the target to be protected. There are a number of repositories with public access available online, but often with poor-quality data, scraping protected and / or restrictive usage policies in place. Theproposed model is not generalist like the large language models, which can be trained with almost any written content available on the Internet. In the present case, the corpus had to fulfill the condition that its contents includedthe same type of information that is to be protected. With all these challenges and constraints, the task at hand consisted of finding repositories, assessing the legal restrictions in each case with the help of external legal staff, gathering the documents and classifying them in order to get the richest ones. Most of the time the post-processing involved cleansing and data augmentation techniques. In some other cases, anonymizing the content with synthetic data of similar nature and extension. -One of the outcomes is a high-quality dataset that, through theconsent of the clients and corresponding DPAs (Data Protection Agreements)signing, was constantly fed. The labeling of this dataset is made with the mostcareful measures in place, already stated in the ISO 27001 implementation.- The prediction model itself is a neural network with theencoders, embeddings, weights of the network and six neurons, one for each infotype of context-based PII to be detected (person name, dates, company name, address, location and amount). The following Table 1 is a table with the weights and biases measured overthe trained ML model (prediction model), showing precision and recall among othervariables:

[0002] Table 1 In the above Table 1, specific definitions of the following variables are used:- The variable « loss » represents a measure of how well the model'spredictions match the true values. A value of « loss » quantifies the differencebetween the predicted and actual values. Hence, a lower value of « loss »indicates that the model is making better predictions, while a higher value of «loss » suggests the opposite. During training, the goal is to minimize this valueof « loss », which can lead to a more accurate model.- The variable of « precision » represents a measure of how much surethe model is about a certain entity prediction. The higher, the lower the chance of failing. An entity is defined as personal data, grouped or not, within theelements of a document (e.g., in the phrase “Mr. Julio López González has been sued”, the set of words “Julio López González” represents a named entity, in this case, the name of a male person).- The variable of « recall » represents a measure of how many entitieswere anonymized. The higher, the more entities are anonymized and the fewer remain unanonymized. -The variable called « f1» in Table 1 refers to the armonic average valueof the variables « precision » and « recall ».This trained model has come from a thoroughly distilled corpus and is very specializedon the task at hand, as well as it achieves the goal of providing a balance between afully automated workflow and the best possible PII detection. Regardless of how gooda NLP model can be at understanding the content of a text, a main challenge is thevirtually infinite variety of formats, layouts and document qualities that the model canface. The proposed model deals with this complexity in a way as generic as possiblebut at the same time flexible enough to adapt to different use cases. This goal is achieved by an algorithm introduced in all layers of the system and that concentrates and represents the abstractions that can be found in a document and its operations, so that the automated anonymization method can extract the content in such a waythat the context and the semantics of the text are not lost despite the enormousvariability of content distribution. This algorithm is also optimized to representinternally the concrete information in the most efficient way for the operations that need to be carried out during the described functional flows, the algorithmrepresenting the elements that can hold PII inside a document, i.e.:- Text blocks- Tables- Images (which in turn can also contain sub-elements)- Individual graphic elements (e.g.: logos, QR codes, barcodes,handwritten signatures, etc.) -Metadata (author, creator, form fields information, digitalsignature, etc.)The elements above listed (text blocks, tables, etc.) can, in turn, contain the entitiesshown in FIG. 2. The algorithm brings the context to the NLP model for a betterprediction of the PII presence.Thus, the highly specialized dataset used in training the model, the abstractionlayer / algorithm to represent the elements of the document that are candidates to holdPII and the coordinated flow of the method result in an efficient content extraction,effective predictions and secure return of the anonymized document to the user. FIG.2 shows a high-level sequence diagram of the components and stepsinvolved in the pseudonymization, as follows:- Once the user requests 212 the protection of a document, either through aWeb User Interface or Web UI 21 either through a Representational State TransferApplication Programming Interface or REST API, and after a license validation 211against a configuration API of a customer controller 22, the automated contentextraction according to the steps described in FIG.1 begins and involves the exchangeof the request “predict()” for prediction of PII in the content 213 from the API controllerof the anonymization algorithm 23 to the NLP API controller 24 which analyzes thetext and, in response, delivers 214 the entities.- After the prediction of PII in the content ends, the next step is to fake 215 theNamed Entities, i.e., PII words or phrases. For that sake, the faker component 25calculates unique, faked, pseudonyms 216 for each delivered entity.- With the PII predictions and the faked pseudonyms, the original documentcontent is regenerated 217, effectively pseudonymizing the personal data.- The modified document is sent back 218 to the client.The entire method is encompassed within a singular or multiple containerizedenvironments for enhanced automation and ease of deployment. In a possibleembodiment, a relational database is used by the execution environment, thedatabase being outside the APIs execution environment or it can be “packed” with therest of the components inside a Docker Compose network (among othercontainerization options). In fact, the whole set of execution environments (businessAPIs, models APIs, NLP API and database) can be packed with the help of any known containerization technologies.The steps of the automated anonymization are executed by one processor of apersonal computer, a laptop, a tablet, a smartphone or any programmable deviceproviding an interface to input / output documents. Note that in this text, the term “comprises” and its derivations (such as “comprising”, etc.) should not be understood in an excluding sense, that is, these terms should not be interpreted as excluding the possibility that what is described and defined may include further elements, steps, etc.

Claims

CLAIMS1. A computer-implemented method for anonymizing documents, the methodcomprising receiving an anonymization request of a document from a user, the method characterized by comprising the following steps executed by oneor more processors: -detecting a document format of the received document from a plurality ofdocument formats; -selecting a plugin from a plurality of plugins which are configured to extractcontent from documents, the plugin being selected based on the detectedformat of the received document;- extracting content from the received document by means of the selectedplugin; -applying a natural language processing model to predict personal identifiableinformation within the extracted content; -modifying the received document by at least pseudonymizing the predictedpersonal identifiable information; and- sending the modified document to the user in response to the anonymizationrequest.

2. The method according to claim 1, wherein modifying the received documentfurther comprises masking, blacklining and / or tokenization.

3. The method according to claim 1, wherein sending the modified document tothe user is performed through a user interface or an application programming interface used to receive the anonymization request from the user.

4. The method according to claim 1, wherein the natural language processingmodel is a BERT-architecture multi-language model configured to identifypersonal identifiable information.

5. The method according to claim 1, further comprising the step of applying analgorithm configured to represent abstraction of elements within the document,said elements including text blocks, tables, images, individual graphic elements, and metadata.

6. The method according to claim 1, wherein the plurality of plugins configuredto extract content from documents comprising non-structured content, tabularcontent, raw text and images.

7. The method according to claim 1, wherein, if the detected format is PDFformat, the method further comprises converting the received document intoimages before extracting content.

8. The method according to claim 1, further comprising the step of applyingoptical character recognition if the detected format of the received document is an image format.

9. The method according to claim 1, wherein the steps are executed by oneprocessor of a personal computer, a laptop, a tablet, a smartphone or anyprogrammable device providing an interface to input documents.

10. A computer program product comprising instructions that, when the programis executed by a computer, cause the computer to carry out the method of claims 1-8.

11. A computer-readable medium comprising instructions that, when executed bya computer, cause the computer to carry out the method of claims 1-8.

Images