Method and apparatus for facilitating document sanitization

One embodiment provides a system for facilitating sanitizing a modified version of a document relative to one or more sensitive topics. During operation, the system determines a privacy risk for a term in the modified version relative to the sensitive topics, wherein the privacy risk measures the extent to which the sensitive topic(s) can be inferred based on the term. Next, the system determines an information utility and privacy loss or gain for the modified version, where the information utility reflects the extent to which the modified version has changed and the privacy loss or gain reflects the extent to which the modified version is reduced in sensitivity.