BENCHMARKING PERSONALLY IDENTIFIABLE INFORMATION (PII) ANONYMIZATION STRATEGIES FOR BRAZILIAN PORTUGUESE: FROM REGEX TO HYBRID LLM APPROACHES

Abstract

The Brazilian General Data Protection Law (LGPD) requires the anonymization of personally identifiable information (PII) before data sharing. We evaluate six anonymization strategies (regex, NER, zero-shot LLM, few-shot LLM, structured extraction, and a hybrid cascade) on 82 Brazilian Portuguese documents with 1,558 PII spans across 12 LLM variants. A hybrid cascade combining regex, NER, and conditional LLM invocation achieves 0.0% residual PII on the test set, matching text-to-text approaches while preserving span-level annotations. Model scale does not monotonically affect residual PII: Gemma 3-4B and Gemma 3-12B produce 2.28 and 1.56 residual respectively in zero-shot, while GPT-4o produces 3.71. The 38 strategy–model combinations provide a privacy–utility–cost analysis for Portuguese PII anonymization.