PaperlayerView exact revision on arXiv

Source-linked AI summary

Clio: Privacy-Preserving Insights into Real-World AI Use

Alex Tamkin, Miles McCain, Kunal Handa, Esin Durmus, Liane Lovitt, Ankur Rathi, Saffron Huang, Alfred Mountfield, Jerry Hong, Stuart Ritchie, Michael Stern, Brian Clarke, Landon Goldberg, Theodore R. Sumers, Jared Mueller, William McEachen, Wes Mitchell, Shan Carter, Jack Clark, Jared Kaplan, Deep Ganguli

arXiv:2412.13678v1cs.CYcs.AIcs.CLcs.CRcs.LG

TL;DR

Providers have little public evidence about real-world AI use, while privacy and practical constraints make usage data difficult to analyze. Clio uses AI assistants to surface aggregated, privacy-preserving patterns across conversations. The paper reports that these insights reveal usage patterns and support safety monitoring and enforcement.

  • Problem

    Public data about real-world AI use is scarce, while sensitive information, human-review concerns, competitive pressures, and scale complicate providers’ analysis and sharing of usage data.

    Source: §1 · pp. 1–2

  • Method

    Clio uses AI assistants to analyze conversations and surface aggregated usage patterns while preserving user privacy.

    Source: §1 · p. 2

  • Results

    Clio reveals real-world usage patterns across languages and supports safety work, including detection of coordinated misuse and monitoring for unanticipated risks.

    Source: §1 · pp. 2–3, §8 · p. 17

  • Takeaways & Limitations

    Post-deployment monitoring can complement pre-deployment tests by surfacing real-world patterns and risks that predetermined scenarios may miss.

    Source: §1 · p. 3

    Clio cannot definitively determine user intent or observe how conversations translate into real-world actions and impacts.

    Source: §5.2 · p. 13

Abstract

from arXiv · show

How are AI assistants being used in the real world? While model providers in theory have a window into this impact via their users' data, both privacy concerns and practical challenges have made analyzing this data difficult. To address these issues, we present Clio (Claude insights and observations), a privacy-preserving platform that uses AI assistants themselves to analyze and surface aggregated usage patterns across millions of conversations, without the need for human reviewers to read raw conversations. We validate this can be done with a high degree of accuracy and privacy by conducting extensive evaluations. We demonstrate Clio's usefulness in two broad ways. First, we share insights about how models are being used in the real world from one million Claude.ai Free and Pro conversations, ranging from providing advice on hairstyles to providing guidance on Git operations and concepts. We also identify the most common high-level use cases on Claude.ai (coding, writing, and research tasks) as well as patterns that differ across languages (e.g., conversations in Japanese discuss elder care and aging populations at higher-than-typical rates). Second, we use Clio to make our systems safer by identifying coordinated attempts to abuse our systems, monitoring for unknown unknowns during critical periods like launches of new capabilities or major world events, and improving our existing monitoring systems. We also discuss the limitations of our approach, as well as risks and ethical concerns. By enabling analysis of real-world AI usage, Clio provides a scalable platform for empirically grounded AI safety and governance.

1 Introduction

Clio addresses the difficulty of learning how AI assistants are used in practice when usage data is sensitive, costly to review, and impractical to analyze manually. It uses AI assistants to surface aggregated, privacy-preserving patterns across millions of interactions and applies those insights to understand usage and improve safety systems.

1 Introduction

  • Providers have little public evidence about real-world AI use, despite having usage data, because of privacy, ethical, competitive, and scale-related challenges.Millions of daily messages make manual review impractical.Source: §1 · pp. 1–2
  • Clio uses AI assistants to surface aggregated insights across millions of model interactions while preserving privacy, without requiring human reviewers to read millions of conversations.Its interface supports finding specific patterns and discovering unanticipated ones.Source: §1 · p. 2
  • Clio identifies common Claude.ai Free and Pro uses, including coding and business tasks, and finds language-linked differences such as greater discussion of elder care in Japanese and Chinese conversations.Examples of common tasks include debugging code, drafting professional emails, and analyzing business data.Source: §1 · pp. 2–3
  • Clio supports safety work by detecting coordinated misuse, monitoring for unanticipated patterns during uncertain periods, and identifying over- and under-triggering in safety classifiers.Its analyses have led to enforcement actions, including banning automated accounts generating search-optimized spam.Source: §1 · p. 3
  • The authors argue that post-deployment monitoring complements pre-deployment testing by surfacing real-world patterns and risks that predetermined scenarios may miss.Those insights can inform future pre-deployment tests and safeguards.Source: §1 · p. 3

2 High-level design of Clio

Clio supports bottom-up discovery of usage patterns and risks, organizing conversation-derived insights for exploration while applying multiple privacy protections. Its evaluations report accurate reconstruction of synthetic topic categories and very low private-information levels in analyst-visible summaries.

2 High-level design of Clio

  • Clio supports bottom-up analysis of real-world conversations to identify broad usage patterns and coordinated misuse while preserving privacy.This approach can surface patterns that emerge naturally rather than testing only predefined behaviors.Source: §2 · p. 3, §2.1 · p. 3

2.1 Enabling exploratory search for unknown unknowns

  • Exploratory search lets analysts begin with broad questions and iteratively discover patterns, while a hierarchy supports navigation from a few dozen high-level patterns to thousands of lower-level categories.The interactive 2D interface supports targeted investigation and serendipitous discovery.Source: §2.1 · pp. 3–4

2.2 How Clio works: a brief system design overview

  • Clio extracts conversation facets, embeds and clusters natural-language attributes, generates cluster titles and summaries, organizes clusters hierarchically, and presents them for interactive exploration.The diagram shows privacy barriers between raw traffic and user-visible outputs.Source: Figure 2 · p. 4, §2.2 · pp. 4–5
  • 94% accuracy on 19,476 synthetic chat transcripts shows Clio’s reconstruction of ground-truth categories, compared with 5% for random guessing.The evaluation generated multilingual transcripts from a hierarchy of high- and low-level categories.Source: §2.2 · p. 5, Figure 4 · p. 6
  • A run over 100,000 conversations is estimated to cost $48.81.The paper presents this as evidence of the method’s relative affordability at scale.Source: §2.2 · p. 6

2.3 Privacy design

  • Clio uses a statistical, empirically validated defense-in-depth privacy approach because rich textual descriptions make formal guarantees such as differential privacy and k-anonymity difficult to apply.Its layers include privacy-aware conversation and cluster summaries, minimum cluster-size thresholds, and cluster auditing.Source: §2.3 · pp. 6–7
  • Across the privacy layers, private information in outputs visible to analysts reaches very low or undetectable levels in the reported evaluations.The figure describes an analysis of 5,000 Claude.ai conversations, and the paper reports that the combined measures drive exposure to undetectable levels on internal privacy evaluations.Source: Figure 5 · p. 7, §2.3 · p. 7

3 How are people using Claude.ai?

Clio’s analysis maps Claude.ai usage from prominent high-level tasks to more granular clusters and identifies differences across linguistic communities. The findings describe consumer usage, with comprehensive cross-lingual analysis left for future work.

3.1 Top use cases in Claude.ai

  • Web and mobile application development exceeds 10% of Claude.ai conversations, while writing, research, and education each comprise 6–10%; WildChat and LMSYS show different dominant uses.Coding represents 15–25% across the compared datasets; WildChat has many image-generation prompt requests, while LMSYS has more capability-boundary testing.Source: §3.1 · pp. 7–8, Figure 6 · p. 8

3.2 Notable granular clusters identified by Clio

  • Clio also surfaced granular clusters involving dream analysis, tabletop RPG Dungeon Master roleplay, and transportation-system optimization.These examples illustrate the lower-level task categories beyond the high-level usage taxonomy.Source: §3.2 · p. 8

3.3 How does Claude usage vary across languages?

  • Non-English conversations more often covered economic issues, aging populations and elder care, and anime or manga; Figure 7 compares language prevalence in clusters with each language’s overall base rate.The figure highlights clusters with disproportionately high Spanish, Chinese, and Japanese prevalence.Source: §3.3 · p. 8, Figure 7 · p. 9
  • A comprehensive analysis of cross-lingual differences in Claude.ai usage remains future work.Source: §3.3 · p. 9

4 Clio for safety

Clio was used to identify scaled misuse, monitor for unknown risks during uncertain or high-stakes periods, and examine safety-classifier performance. These examples illustrate safety applications rather than providing a taxonomy of all model harms.

4.1 Identifying patterns of violative behavior

  • Clio grouped semantically similar activity to reveal coordinated SEO abuse, explicit-content generation, and unauthorized access reselling, leading to account removals after investigation.Some attempts used formats that simpler string-matching techniques would have missed.Source: §4.1 · p. 10

4.2 Monitoring for unknown unknowns during periods of increased uncertainty and high-stakes events

  • After the refreshed Claude 3.5 Sonnet computer-use launch, Clio analysis informed safety-measure refinement, understanding computer-use harms, and action on violative accounts.The run examined conversations identified as instances of Claude operating a computer.Source: §4.2 · p. 10
  • Ahead of the 2024 U.S. elections, Clio surfaced clusters for deeper review; removals mostly involved general campaigning tasks that violated policies.Review of flagged clusters could lead to additional Clio runs, limited manual review, and account removal when warranted.Source: §4.2 · p. 11

4.3 Understanding the effectiveness of our safety classifiers

  • Mean cluster concern scores and classifier flag rates correlated at r = 0.71, while their divergences highlighted possible false negatives and false positives.The authors used a model’s 1-to-5 concern scores as the ground truth for assessing classifier correctness in this analysis.Source: §4.3 · p. 11

4.3.1 False positives

  • False positives included resume advice, security-adjacent programming questions, and Dungeons & Dragons conversations; Clio also identified innocuous profile-picture clusters that classifiers overtriggered on.The authors note that personally identifiable information in resumes may contribute to mistaken flags.Source: §4.3.1 · p. 11, Figure 8 · p. 12

4.3.2 False negatives

  • Classifiers often failed to flag translations of sexually explicit content; they flagged 60% of conversations in an extreme-content writing cluster and 31% in an unconstrained roleplay cluster.Source: §4.3.2 · p. 12

5 Limitations

Clio’s pipeline can produce errors, and its outputs should be treated as preliminary leads requiring validation rather than as a sole basis for decisions. Fundamental limits also constrain what conversation analysis can establish about intent, impact, privacy, and rare behaviors.

5.1 Operational limitations

  • Errors can arise at every pipeline stage, from hallucinated or missed facets to poor clustering, overly broad labels, and oversimplified hierarchies.The authors quantify some errors in Appendix C but say they remain important when interpreting outputs.Source: §5.1 · p. 13
  • Clio’s outputs are preliminary leads that require validation; decisions based solely on them need more rigorous analysis and human oversight.The authors also caution that Clio cannot conclusively establish that a pattern or behavior is absent.Source: §5.1 · p. 13

5.2 Fundamental limitations

  • Clio cannot determine user intent definitively or observe how conversations translate into real-world actions and societal impacts.Harmful intent may be subtle across requests to different models or differ from how a user presents a request.Source: §5.2 · p. 13
  • Privacy protections limit detail, insights may not generalize beyond Claude.ai, and analysis across many conversations misses rare behaviors such as one-off extreme misuse.A safety-classifier false negative does not itself mean a user elicited a harmful response; other interventions may stop it, and other classifiers were outside this analysis.Source: §5.2 · pp. 13–14
  • Clio should be combined with qualitative studies, user surveys, and real-world impact assessments to understand societal effects.Source: §5.2 · p. 14

6 Risks, ethical considerations, and mitigations

The authors justify publishing Clio as a source of bottom-up empirical insight that complements top-down safety work, while acknowledging privacy, enforcement, misuse, and trust risks. They describe safeguards and expert feedback intended to address these concerns.

6.1 Justification for building and publishing Clio

  • Clio offers bottom-up real-world evidence that can reveal unanticipated uses and misuse, complement pre-deployment testing, and inform safety and governance.The authors argue that openly discussing the system can support responsible norms around privacy and societal benefit.Source: §6.1 · p. 14

6.2 Privacy considerations

  • Privacy risks include PII persisting across pipeline stages and aggregated data revealing sensitive facts about communities, though evaluations suggest these risks are unlikely.The authors say they regularly audit privacy protections and plan to use newer Claude models to improve safeguards.Source: §6.2 · pp. 14–15

6.3 False positives

  • Automated enforcement based on problematic clusters could falsely restrict non-violating users, so Clio clusters are not used as the sole basis for automated enforcement.The authors also measure system performance across distributions, including in multilingual evaluations.Source: §6.3 · p. 15

6.4 Potential for misuse

  • Misuse could threaten privacy or civil liberties; safeguards include access controls, data minimization, retention policies, and no geography-based analysis.Within Clio, the authors collect conversation summaries rather than full conversations.Source: §6.4 · p. 15

6.5 User trust

  • Perceived invasiveness could erode user trust, so the authors plan public transparency, public-interest disclosures, and engagement with user communities.They report meeting civil society organizations and making adjustments in response to feedback.Source: §6.5 · p. 15

6.6 Feedback from civil society experts

  • Civil society consultations shaped multilingual validation, privacy mechanisms, and priority research areas, while raising questions about government data access and user protections.Source: §6.6 · pp. 15–16

7 Related work

Clio extends work on analyzing assistant use, privacy-preserving analytics, exploratory visualization, and AI governance by applying these approaches to large-scale assistant interactions.

7.1 Analyzing the use of AI assistants

  • Prior datasets and studies analyze assistant conversations, but Clio provides an in-depth privacy-preserving analysis of millions of direct interactions on a major AI assistant.The cited work includes WildChat [Zhao et al., 2024], LMSYS [Zheng et al., 2023], and studies of Bing Copilot [Suri et al., 2024] and ChatGPT [Eloundou et al., 2024].Source: §7.1 · p. 16

7.2 Privacy-preserving analytics in AI

  • Clio combines AI-assisted removal of personally identifiable information with strict aggregation thresholds to protect privacy while deriving insights from conversations.Source: §7.2 · p. 16

7.3 Bottom-up visualization and exploratory Search

  • Building on text-insight systems [Lam et al., 2024, Wan et al., 2024, Nomic, 2024], Clio adds hierarchical, privacy-preserving exploration focused on AI assistant interactions at scale.Its bottom-up pattern discovery can surface unexpected behavior not captured by predetermined evaluation frameworks.Source: §7.3 · p. 17

7.4 Mitigating and anticipating risks from AI

  • Clio provides real-world usage and misuse evidence that can complement theoretical governance frameworks and inform more targeted strategies.The authors describe this as a way to bridge top-down governance goals with practical implementation [Stein et al., 2024].Source: §7.4 · p. 17

8 Conclusion

The paper presents Clio as a privacy-preserving platform for bottom-up discovery of real-world AI assistant use, complementing top-down safety approaches. Its analysis surfaces usage patterns and coordinated misuse, and demonstrates applications to safety monitoring.

8 Conclusion

  • Clio analyzes millions of conversations to reveal cross-language usage differences, coordinated misuse, and patterns that can inform safety monitoring.The authors describe monitoring during launches of new capabilities and before major elections, and view empirical understanding as increasingly crucial as AI systems become more capable and integrated into society.Source: §8 · p. 17

A Author Contributions

  • Tamkin led the project and paper, while McCain built the scalable system and ran most experiments.The other authors contributed to experiments, analysis, framing, infrastructure, or guidance.Source: A Author Contributions · p. 22

B System architecture: how does Clio work?

Clio turns a target conversation dataset into privacy-preserving, navigable usage patterns. It extracts multiple facets, clusters conversations by semantic similarity, labels and organizes clusters hierarchically, and presents them for exploration.

B System architecture: how does Clio work?

B.1 Extracting facets

  • Clio extracts multiple facets per conversation, using direct computation or models to capture attributes such as turn count, language, and topic.Multiple facets let users explore intersections, including how use cases vary by language.Source: §B.1 · p. 22

B.2 Semantic Clustering

  • Clio embeds summary facets and uses k-means to group semantically similar conversations, with the summarization prompt shaping which conversations cluster together.The system also enforces a minimum number of unique users per cluster to help prevent identification of individuals or small groups.Source: §B.2 · pp. 22–23

B.3 Cluster Labeling and Hierarchization

  • A model labels clusters from sampled conversation summaries, then generates a hierarchy that lets users move from broad categories to specific clusters.The hierarchy helps make hundreds or thousands of clusters interpretable and navigable.Source: §B.3 · p. 23

B.4 Data Exploration and Visualization

  • Clio presents clusters in map and tree views, with facet and temporal breakdowns and overlays for exploring distributions and changes.A traces feature can show representative examples for synthetic or public data, or for authorized employees with a business need.Source: §B.4 · p. 23

B.5 Example summaries and clustering

  • WildChat examples illustrate how Clio turns conversation summaries into clusters and recursively assigns them to higher levels, forming a three-level hierarchy.The example cost estimate is $0.0005 per conversation under stated model-pricing and processing assumptions.Source: Table 1 · p. 24, §B.5 · p. 25

C Validation: How much should you trust Clio results?

Clio’s component-level manual evaluations assess summary accuracy and agreement on potentially harmful content. Reviewers found that summaries were usually accurate, while model harm rankings had strong directional agreement with human ratings.

C.1 Manual review

  • Manual review evaluated pipeline stages individually, with Table 4 summarizing the accuracy or correlation of different stages against ground truth.The broader validation also included automated end-to-end tests on a multilingual synthetic dataset.Source: §C.1 · p. 25, C Validation: How much should you… · p. 25, Table 4

C.1.1 Conversation summaries

  • 96% of reviewed conversations were summarized accurately, including 93% of random conversations and 98% of concerning conversations.The main failure mode was omission of some requests in long, multi-topic conversations.Source: §C.1.1 · p. 26

C.1.2 Concerning content identification

  • 0.84 was the Spearman correlation between Claude’s and human assessments of potential harmfulness, indicating strong directional agreement.The evaluation used 200 conversations and a 1–5 harmfulness scale.Source: §C.1.2 · p. 26

C.1.3 Base-level clusterer

Manual review found high accuracy in base-level and hierarchical cluster titles, with a small average share of conversations that did not clearly belong in their assigned clusters. The synthetic-data evaluation used generated conversations spanning regular and concerning topics.

C.1.3 Base-level clusterer

  • 99% of clusters from random conversations and 96% of clusters from Trust and Safety-flagged conversations had accurate titles.On average, 3% of conversations in each cluster did not clearly belong; flagged-content titles were often inaccurate because they described harm too generically.Source: §C.1.3 · pp. 26–27

C.1.4 Hierarchical clusterer

  • 97% of hierarchical cluster titles accurately reflected their contents, with 95% accuracy on random conversations and 99% on Trust and Safety-flagged conversations.The reviewed hierarchical clusters came from both random and flagged conversations.Source: §C.1.4 · p. 27

C.1.5 Summary

  • Across components, manual review found robust performance on random and potentially concerning content, with only slight decreases for concerning data.Summary omissions mainly arose in lengthy, multi-topic conversations; concerning-content assessments showed strong correlation with human evaluations.Source: §C.1.5 · p. 27

C.2 End-to-end evaluation with synthetic data

  • The synthetic-data evaluation tested Clio end to end on regular and concerning conversations, using high-level categories expanded into subcategories and varied prompts.Prompts varied in length, tone, and language, and Claude continued each conversation as if responding to a real user.Source: §C.2 · p. 27, §C.2.1 · p. 27

C.2.2 Evaluation

Clio reconstructed regular synthetic topic distributions with higher accuracy than concerning ones and maintained high accuracy across tested languages. Its unsupervised clusters formed sensible partitions, though some categories were valid but suboptimal.

C.2.2 Evaluation

  • 94% accuracy across 20 high-level clusters on regular synthetic data compared with 84% across 18 high-level clusters on concerning synthetic data.The authors attribute some of the decrease to model evasiveness, lower-quality synthetic data, and overlap between concerning categories.Source: §C.2.2 · p. 28, Figure 10 · p. 28
  • Clio maintained overall accuracy above 92% across all tested languages on the regular synthetic dataset.The language breakdown is reported in Table 5.Source: §C.2.2 · p. 28, Table 5 · p. 29
  • On regular synthetic data, Clio’s unsupervised clusters formed sensible partitions, including software-development and health-and-fitness questions grouped into relevant categories.Figure 11 compares ground-truth categories with Clio’s top-level unsupervised categories.Source: Figure 11 · p. 29, §C.2.2 · p. 30
  • Some clusters were valid but suboptimal: many geopolitics conversations landed in a broad cluster combining complex topics and technology troubleshooting.This grouping was technically correct but not monosemantic.Source: §C.2.2 · p. 30
  • On concerning synthetic data, Clio assigned most academic-cheating requests to cheating-related clusters and most violence-and-extremism requests to reasonable related categories.Figures 13 and 14 show breakdowns for academic cheating and glorifying violence and extremism.Source: §C.2.2 · p. 30, Figure 12 · p. 30, Figure 13 · p. 31
  • Together, the experiments increased the authors’ confidence in the accuracy of Clio’s results.The concerning-data figure indicates reduced accuracy relative to regular data while still tracking the underlying distribution.Source: Figure 10 · p. 28, §C.2.2 · p. 31

D Privacy Evaluations

Clio’s privacy evaluations found that private information declined through summarization, with the final cluster summaries visible to analysts receiving the strongest privacy ratings. A separate test found the automated privacy auditor achieved 98% accuracy.

D.1 Validating the auditor

  • The auditor was prompted to classify privacy on a 1-to-5 scale, with ratings of 3 or above treated as acceptable protection.Its test examples paired real privacy-preserving clusters with edited clusters containing fictional private information.Source: D Privacy Evaluations · p. 31, §D.1 · p. 32

D Privacy Evaluations

  • About 10% of raw conversations contained private information, compared with about 1.5% after summarization.The baseline classified ratings of 1 or 2 out of 5 as containing private information.Source: D Privacy Evaluations · pp. 31–32
  • Almost all analyst-visible cluster summaries scored 5 on the privacy scale, a few scored 4, and none scored 3 or below.The authors describe this as the final and most important privacy step.Source: D Privacy Evaluations · p. 32

D.1 Validating the auditor

  • 98% accuracy on a hand-designed test set: the privacy auditor classified whether examples met the privacy threshold.The test set contained 1,237 examples, and the binary threshold was a rating of 3 or above.Source: §D.1 · p. 32

E How are people using other AI assistants?

Clio’s analysis found different usage patterns in WildChat and LMSYS-Chat-1M than in Claude.ai, while coding was common across all three datasets. WildChat examples include ethical analysis, fictional worldbuilding, and film critique.

E How are people using other AI assistants?

  • Coding made up 15–25% of conversations in both WildChat and LMSYS-Chat-1M, while their usage distributions differed significantly from Claude.ai.WildChat had many Midjourney prompt-generation requests; LMSYS had more boundary-testing prompts, including a large cluster for extreme sexual, hateful, and abusive content.Source: E How are people using other AI… · p. 33, Figure 15 · p. 33

E.0.1 Ethics and social behavior analysis

  • WildChat’s ethics and social behavior analysis cluster included moral dilemmas and discussions of social institutions.One example asks whether life is merely a cruel joke; the assistant responds by discussing hardship, relationships, and personal growth.Source: E How are people using other AI… · p. 33, §E.0.1 · p. 34

E.0.2 Empire and monarchy worldbuilding

E.0.3 Generate and analyze film content and critiques

F Data Sources & Internal Access Policies

This section describes the sampled Claude.ai consumer conversations and restricted-access, aggregation, and model-assisted processing used to organize usage patterns, including the prompts and exploratory interface. It also specifies the privacy auditor and rubric for assessing cluster descriptions, with fictionalized examples.

F Data Sources & Internal Access Policies

  • Clio’s paper results use Claude.ai Free and Pro consumer conversations, excluding business customers and some accounts; raw data stays in a restricted environment while only aggregate clusters are shared more broadly.Only a small number of authorized staff can access the private environment; Clio’s aggregate outputs exclude personal information.Source: F Data Sources & Internal Access… · p. 36

G.1 Input & Sampling

  • Sampling either selects model completions and keeps each conversation’s latest output, weighting longer conversations more, or samples conversations directly, weighting lengths equally.Both strategies provide Clio the transcript through the selected latest turn.Source: §G.1 · p. 36

G.2 Preprocessing Raw Conversations

  • Before analysis, preprocessing standardizes transcripts into XML and handles internal additions such as function calls, system prompts, multimodal information, and metadata.Source: §G.2 · p. 37

G.3 Screener

  • Clio can screen conversations with Claude 3 Haiku at temperature 0.2, using a run-specific question and a constrained Yes-or-No response format.The example election screener asks whether a conversation relates to U.S. politics, voting, democratic participation, or the 2024 U.S. election, even loosely.Source: §G.3 · p. 37

G.4 Extractor (Conversation Summaries); G.4.1 Facet Extractor Details

  • Clio’s Claude 3 Haiku extractor is prompted to answer open-ended questions concisely in English without PII or proper nouns; facets include overall request and human languages, while concern scores range from 1 to 5.Source: §G.4 · pp. 37–38, §G.4.1 · p. 38

G.5 Base-Level Clusterer

  • For non-categorical or numeric facets, Clio embeds summaries and applies k-means; Claude names and describes clusters using 50 in-cluster and 50 nearby out-of-cluster summaries as contrast.The precise k values are withheld because they could reveal the volume at which coordinated behavior might evade detection as a distinct cluster.Source: §G.5 · pp. 39–40

G.6 Projector

  • The 2D projector uses UMAP on 768-dimensional conversation embeddings, but it does not affect paper results and serves only the internal exploratory interface.Its settings are n_neighbors = 15, min_dist = 0, and the cosine metric.Source: §G.6 · p. 40

G.7 Hierarchizer

  • The hierarchizer iteratively embeds clusters, groups them into neighborhoods, proposes and deduplicates higher-level clusters, assigns parent clusters, and renames them until reaching the desired top-level count.It uses nearby clusters outside each neighborhood to reduce boundary overcounting or undercounting; the authors report that explored HDBSCAN and agglomerative methods performed worse than the Claude-based approach.Source: §G.7 · pp. 40–41

G.7.1 Prompts and Hyperparameters

  • Cluster prompts group names semantically, preserve specificity and coverage, assign clusters to the best-fitting category, and produce concise descriptions and names.They also direct the model to describe harmful or sensitive behavior specifically when relevant.Source: §G.7.1 · pp. 42–45

G.8 Privacy Auditor

  • The privacy auditor uses Claude 3.5 Sonnet (June 2024) at temperature 0.05 to assess whether cluster outputs are too specific despite meeting quantitative aggregation thresholds.Its 1-to-5 scale ranges from identifiable details to general information without specific identifying details.Source: §G.8 · p. 45
  • The auditor checks for names, identifying locations, unique identifiers, traceable events or circumstances, and how specific the information is.The prompt asks for a justification tied to the content’s privacy-preserving nature.Source: §G.8 · p. 46
  • The auditor returns a justification and a privacy-preservation rating on a 1–5 scale; sexual or explicit content can still be privacy preserving.The prompt requests that the justification explain how specific elements relate to privacy preservation.Source: §G.8 · p. 46
  • The examples are fictional, and proper nouns coinciding with real people, businesses, or programs were modified after privacy analysis and before publication.Source: §G.8 · p. 46
Loading 2412.13678v1…