Risk-Adaptive Masking for Privacy–Utility Balance in OCR-Based Document De-Identification

OCR-based document de-identification must protect personally identifiable information (PII) while preserving information needed for document analysis. Uniform masking may insufficiently protect high-risk PII or unnecessarily remove useful low-risk context. This study proposes a risk-adaptive masking framework that selects treatment based on PII type, identification risk, document-use environment, and analytical necessity. Eighteen PII types were organized into three risk-treatment groups, and processing environments were classified as controlled internal use, controlled third-party provision, or uncontrolled external use. The framework was evaluated using XFUND-PII, CORD-PII, SROIE-PII, and DocVQA-PII, constructed by injecting synthetic PII into the corresponding public datasets. Weak, Moderate, Strong, and Risk-adaptive masking were compared in terms of privacy protection, downstream-task utility, and masking cost. First, for privacy protection, Risk-adaptive and Strong achieved identical mean PII-region coverage on XFUND-PII, CORD-PII, and DocVQA-PII. On SROIE-PII, Risk-adaptive coverage was 4.09 percentage points lower than Strong; the prespecified coverage criterion was not statistically confirmed. Second, Risk-adaptive satisfied the prespecified downstream-utility criterion across all datasets. Third, compared with Strong masking, Risk-adaptive masking reduced masked page area by up to 25.03%, depending on the dataset. Overall, Risk-adaptive maintained comparable document-analysis performance while achieving similar PII-region coverage and less masking on most datasets.