Context loss through anonymisation: why AI answers can get worse

Why can anonymisation make the AI answer worse?

An AI model answers from the text it receives. A pseudonymisation tool (often a proxy in front of an external model) replaces names, dates, places or identification numbers with placeholders before sending, and puts the real details back into the answer. This protects the person, but it also takes information away from the model. If the replaced detail is part of the content of the task, it is missing for the answer.

Three examples, all made up:

Task	What is replaced	What the model then lacks
Summarise a doctor’s letter	Age, admission date, place of residence	Whether a lab value is abnormal for a 43-year-old woman or an 85-year-old man; how long the stay lasted
Answer a citizen’s enquiry	Street, district	Which office, which development plan, which local bylaw applies
Discharge letter for relatives	Names of the patient, her daughter, the GP	Who tells whom what, when all three appear as PERSON_1 to PERSON_3

What do studies show about the loss of quality?

The research is young, but the direction is consistent:

• Quality usually drops, depending on the task. A study by Deußer and others (September 2026) tested five language models on eleven benchmarks, each with the original text and with pseudonymised text. Result: performance generally falls, considerably so for tasks that involve looking things up in texts. A test of truthful answers, by contrast, improved for most models.
• High-performing models lose the most. According to the same study, the most capable models dropped the most, presumably because they make the best use of the concrete details.
• Reversible placeholders beat redaction. Methods that keep people and places distinguishable (placeholders or random substitute values) performed considerably better than redaction or generalisation.
• A note to the model does not help. Telling the model that the text is pseudonymised brought no measurable benefit.
• As early as 2023, Yermilov and others showed a gap between original and pseudonymised text for text classification and summarisation, depending on the method.

The studies test general benchmark tasks, not German doctor’s letters or administrative decisions. How large the loss is for your texts can only be shown by a test with your own examples.

Where do the typical errors arise?

• Numbers and time: If date of birth and admission date are replaced, the model cannot calculate an age, a duration or a deadline.
• Place: In public administration and healthcare, responsibility, legal basis and contact person often depend on the place.
• Relationships: Several people in one text (patient, relatives, doctor) blur together when placeholders do not show a role.
• Restoring the details: If the model merges, translates or changes placeholders, the tool puts the real details back incorrectly or not at all.
• Over-detection: If the tool mistakes technical terms, medicines or abbreviations for names, these are missing too.

How can the loss be reduced?

• Replace only what identifies. An age group instead of the age, the region instead of the street, a consistently shifted date instead of the date, so that intervals are preserved.
• Keep roles. Placeholders such as “patient”, “daughter”, “GP” instead of PERSON_1 to PERSON_3.
• Test with your own cases. Have the same ten to twenty typical tasks answered once with and once without replacement and compare the answers on their content, without giving real data to the external model (for example with made-up cases).
• Check the restored details. Spot-check whether all details come back correctly.

Every detail you leave in increases the risk that the person remains identifiable. Quality and protection pull against each other here; your organisation weighs them up with the data protection officer. Why combinations of age, place and a rare diagnosis can make a person identifiable is explained in the guide Re-identification risk.

Is there a way without context loss?

Yes: the AI model runs where the data may be processed and receives the complete text. Then nothing needs to be replaced. Which solution fits depends on the data and the task; for less sensitive texts, a proxy can be a sensible choice. The two approaches are weighed up in the guide Anonymisation or your own AI infrastructure.

How does this work with basebox?

With basebox, the platform and the AI model run in your environment: on a server just for you, without an internet connection if you wish, or in a separate environment in our cloud, kept apart from other customers, in the Munich East data centre. By default, basebox sends your data to no AI model of another provider. That is why patient data may go in without you anonymising it first, and the model sees the complete text. An external model is only available as a separate app that you have set up explicitly; whether you approve it for personal data is for you to decide with your data protection officer (details). The approaches are compared in the guide Anonymisation or your own AI infrastructure.