PaperlayerView exact revision on arXiv

Source-linked AI summary

Differentially Private Semantic Plans for Aggregate Insight Generation

Behrooz Razeghi

arXiv:2609.16283v1cs.LG

TL;DR

Aggregate summaries can depend on individual records, and cluster-level statistics do not directly measure predefined concepts comparably across collections. DP-SPIN releases a differentially private plan over fixed concepts and constrains generation to that plan; its reported plan-utility results show that full-sketch mechanisms preserve a large fraction of non-private top-L semantic mass across tested privacy budgets.

  • Problem

    Cluster–keyword releases for data-dependent clusters do not directly provide comparable collection-wide measurements of predefined semantic concepts across analyses.

    Source: §1 · p. 2

  • Method

    DP-SPIN maps records to bounded semantic contributions, releases a differentially private plan, and constrains generation and verification to that plan and public information.

    Source: §1 · p. 3

  • Results

    Full-sketch mechanisms preserve a large fraction of the semantic mass carried by the non-private top-L support over the tested privacy budgets.

    Source: §6.1 · p. 13

  • Takeaways & Limitations

    The final summary is differentially private by post-processing when downstream generation and verification depend only on the released plan and public information.

    Source: §1 · p. 3, §7 · p. 16

    The guarantee need not hold if the decoder or verifier receives an additional protected-dataset-dependent object outside the DP plan without its own DP guarantee.

    Source: §5.1 · p. 11

Abstract

from arXiv · show

\texttt{URANIA} provides end-to-end differential privacy (DP) for summaries of data-dependent clusters. However, its cluster--keyword release does not directly provide collection-wide aggregates for semantic concepts defined independently of the protected corpus. Records may express several concepts, records expressing the same concept may be assigned to different clusters, and cluster identities need not correspond across analyses. Consequently, cluster-level statistics do not directly provide comparable measurements of predefined concepts across collections or repeated analyses. We introduce \texttt{DP-SPIN}, a trusted-curator framework for aggregate measurement and summarization over semantic concepts fixed independently of the protected target records. Each record is mapped to a bounded sparse nonnegative vector over these concepts, whose sum forms a semantic sketch. A differentially private mechanism releases a semantic plan containing admitted concepts and noisy masses; normalized semantic-support values and support bins are obtained by post-processing. For user-level privacy, each user's aggregate contribution is clipped to a fixed bound. The language model receives only the plan and fixed decoding instructions, while a public verifier checks concept mentions, reported values, comparisons, and rank claims against the released plan. The final summary is differentially private by post-processing. We establish record- and user-level DP guarantees under add/drop and replacement adjacency. We evaluate \texttt{DP-SPIN} under record-level privacy on CFPB complaint narratives, Amazon All Beauty reviews, and Yelp restaurant reviews, and under user-level privacy on Amazon and Yelp. We compare \texttt{DP-SPIN} with non-private plan and summary references, DP keyword and category histogram baselines, and a \texttt{URANIA}-style baseline with a fixed public keyword vocabulary.

1 Introduction

Aggregate summaries can still depend on individual records, so withholding raw text or prompting a model not to disclose it does not establish differential privacy. DP-SPIN instead measures fixed semantic concepts through a differentially private plan that constrains what the language model can report.

1 Introduction

  • A private aggregate report can still depend on individual records through clusters, labels, exemplars, keywords, or generated statements.Every protected-corpus-dependent object exposed outside the curator must be fixed independently of the corpus or covered by differential privacy.Source: §1 · p. 1
  • Cluster–keyword statistics do not directly measure predefined concepts across collections because concepts can span clusters and cluster identities can change across analyses.A record may express several concepts, while records expressing the same concept may fall into different clusters.Source: §1 · pp. 1–2
  • DP-SPIN maps records to bounded sparse contributions over a fixed semantic atom universe and aggregates them into a semantic sketch.For user-level privacy, contributions are aggregated per user and clipped to a public bound before aggregation across users.Source: §1 · pp. 2–3
  • DP-SPIN releases a differentially private semantic plan as the only protected-corpus-dependent input to generation, then uses a public verifier to check claims against that plan.The verifier checks concept mentions, reported support, comparisons, and rank claims; generation and verification remain post-processing of the plan.Source: §1 · p. 3
  • Atom labels and descriptions are fixed independently of the target corpus, while atom admission and released noisy masses depend on it through the private plan.Any decoder-visible label derived from protected target records would require a separate differentially private release accounted for in the privacy budget.Source: §1 · p. 3
  • The paper analyzes full-sketch Laplace and Gaussian releases and sparse private atom admission, with record- and user-level guarantees under add/drop and replacement adjacency.The decoder contract limits substantive claims to information supported by the plan; the verifier checks consistency, not correctness or completeness relative to the unreleased corpus.Source: §1 · p. 3

2 Related Work

Related work includes heuristic safeguards for aggregate insight generation, formal-DP methods for private cluster summaries, and techniques that protect LLM inference contexts. DP-SPIN targets collection-wide measurement of predefined semantic concepts instead.

Aggregate insight approaches

  • CLIO uses LLM-based summarization, clustering, filtering, and privacy auditing for aggregate insights [11], while CLIOPATRA shows adversarial conversations can induce leakage from target conversations [1].URANIA privately clusters conversations and releases per-cluster keyword histograms for summaries of data-dependent groups.Source: §2 · p. 4
  • DP-SPIN targets collection-wide aggregates over predefined concepts, which cluster sizes and per-cluster keyword histograms do not directly provide or make comparable across analyses.A record may express multiple concepts, and records expressing one concept may appear in different clusters.Source: §2 · p. 4

Prompt and context privacy

  • CAPE perturbs prompts with a context-aware differentially private mechanism, DP-GTR rewrites group text under local DP [7], and DP-Fusion bounds designated sensitive-token influence.These methods protect context supplied to an LLM, unlike DP-SPIN's curator-held collection and private aggregate representation.Source: §2 · p. 4

Private top-L selection

  • Private top-L methods select high-scoring coordinates without releasing a full vector [9, 10]; DP-SPIN separately composes privacy costs for atom admission and noisy value release.The paper also situates its mechanisms among Laplace, Gaussian, exponential, post-processing, and composition primitives.Source: §2 · p. 4

3 Problem Formulation

DP-SPIN models a private text collection as bounded semantic contributions over a fixed atom universe, then releases a differentially private plan for aggregate reporting. The formulation specifies protected-unit adjacency, contribution control, and constraints on plan-based generation.

3 Problem Formulation

  • The input is a finite collection of private text records, and the target output is a natural-language aggregate summary generated from a DP plan and public instructions.The protected unit may be one record or all records associated with one user; user contributions are clipped to a fixed bound.Source: §3 · pp. 4–5

3.1 Adjacency

  • Add/drop adjacency adds or removes one protected unit, while replacement adjacency changes one unit; user-level variants treat all records for one user as a unit.The user-level definitions cover both adding or removing a user and replacing one user's records.Source: §3.1 · pp. 5–6

3.2 Fixed semantic atom universe

  • The finite atom universe and decoder-visible labels or descriptions are fixed independently of protected target records; target-derived labels require a separately accounted DP mechanism.Atoms may represent topics, intents, complaint categories, risks, claim categories, or sentiment–topic pairs.Source: §3.2 · p. 6

3.3 Contribution map and semantic sketch

  • Each record maps to a sparse nonnegative semantic contribution with bounded mass, using a mapping rule fixed independently of the protected target dataset.One admissible mapping retains up to K highest-scoring atoms under a fixed tie-breaking rule and normalizes their weights to total mass at most one.Source: §3.3 · p. 6
  • The semantic sketch aggregates assigned mass by atom, which need not be an integer count; for user-level privacy, each user's aggregate vector is clipped before summation.The user-level clipped vector has an ℓ1 norm bounded by the public contribution bound.Source: §3.3 · p. 6

3.4 Semantic plan and decoder contract

  • The released plan contains admitted atoms and noisy masses, with labels and descriptions for admitted atoms; normalized support and support bins are derived from released values.The normalized support uses a public denominator fixed independently of target records; it need not equal a fraction of protected units or be bounded by one.Source: §3.4 · pp. 6–7
  • Algorithm 1 maps records to bounded vectors, aggregates and clips by protected-unit mode, releases the DP plan, and generates and verifies summaries from that plan.Downstream generation and verification use the released plan, public decoding instructions, and public verifier rules.Source: Figure 2 · p. 5, §3.4 · p. 7
  • The decoder contract permits claims supported by admitted labels, released masses or bins, justified comparisons or ranks, and public text; a verifier may reject violations.Regeneration and fallback remain post-processing when candidates, feedback, and decisions depend only on the same plan and public information.Source: §3.4 · p. 7

4 DP-SPIN Mechanism

DP-SPIN maps records to bounded semantic contributions, releases a differentially private plan, then generates and verifies summaries using only that plan and public instructions.

4.1 Stage I: Bounded semantic assignment

  • Each record contributes a K-sparse nonnegative vector with total mass at most one; user-level aggregates are clipped to bound B before sketch aggregation.Source: §4.1 · p. 8

4.2 Stage II: Differentially private plan release

  • The noisy-sketch mode adds sensitivity-calibrated noise to the full sketch, then selects top-L atoms and computes support values and bins by post-processing.Source: §4.2 · p. 8

Sparse private atom admission.

  • Sparse release sequentially admits L atoms with the exponential mechanism, then releases noisy masses only for admitted atoms using a separate value-release stage.The selection and value-release privacy costs are combined by sequential composition.Source: Sparse private atom admission · p. 8

4.3 Stage III: Contract-constrained verbalization

  • The decoder receives the released plan and public instructions, while normalized support values, bins, and ranks are computed by post-processing.Source: §4.3 · pp. 8–9
  • A public verifier checks candidate summaries against the decoder contract; after a fixed maximum of attempts, the mechanism returns an accepted candidate or a plan-based fallback.Generation, feedback, verification, and fallback use the same released plan and public rules.Source: §4.3 · p. 9

5 Sensitivity Analysis

The section derives sensitivity bounds for bounded semantic sketches and establishes that downstream summaries preserve the plan's differential privacy guarantee under a plan-only access boundary.

5 Sensitivity Analysis

  • Record-level add/drop adjacency gives ℓ1- and ℓ2-sensitivity at most 1; after user clipping, add/drop sensitivity is at most B in both norms.Source: §5 · pp. 9–10

5.1 Release mechanisms

  • Noisy-sketch mechanisms calibrate Laplace or Gaussian noise to global sensitivity, while sparse release composes sequential private atom selection with DP release of selected values.Source: §5.1 · pp. 10–11
  • The final released summary remains (ε, δ)-differentially private when downstream generation, verification, and fallback use only the private plan and information fixed independently of the dataset.Source: §5.1 · p. 11
  • The guarantee does not extend to an additional protected-data-dependent object exposed to the decoder or verifier outside the released plan without its own DP guarantee.Source: §5.1 · p. 11

6 Experiments

Experiments test plan utility, private admission, and plan-based verbalization across record- and user-level settings. Full-sketch mechanisms retain substantial semantic mass, while user-level tests and controlled probes examine how utility varies with privacy budget and support.

6 Experiments

  • Experiments use CFPB complaints, Amazon All Beauty reviews, and Yelp reviews; user-level tests cover only Amazon and Yelp, with bounded sparse record assignments.CFPB lacks stable user identifiers for grouping records; the main assignment configuration uses K = 3 and ℓ1 mass at most one per record.Source: §6 · p. 12

Release mechanisms.

  • Gaussian and Laplace mechanisms perturb the full sketch before selecting atoms, while sparse admission uses sequential exponential selection and releases noisy masses for admitted atoms.Comparisons include DP keyword and category histograms and a matched-public-vocabulary URANIA-style implementation; reported metrics include Overlap@L and support-mass loss.Source: Release mechanisms · pp. 12–13

6.1 Plan utility across datasets

  • With K = 3 and L = 10, full-sketch releases preserve a large fraction of non-private top-L semantic mass and lose less mass than sparse private admission at smaller ε.LossL generally decreases as ε increases, especially for private top-L admission; because it is unnormalized, compare its values within each dataset panel.Source: Figure 3 · p. 13, §6.1 · pp. 13–14, Figure 4 · p. 13

6.2 Record-level and user-level settings

  • For Amazon and Yelp at B = 1, full-sketch mechanisms keep MassRetained close to one across tested privacy budgets, while private admission is more budget-sensitive.The decoder interface remains unchanged: it receives only the released differentially private plan.Source: Figure 5 · p. 14, §6.2 · p. 14

6.3 Controlled probe-atom experiment

  • For a known public probe coordinate, plan admission generally rises with injected support, while summary mentions follow the trend but may lag because admitted atoms are not always verbalized.The probe is added before release and tests private admission, not discovery of a new label from protected text.Source: Figure 6 · p. 14, §6.3 · pp. 14–15

6.4 Ablations

  • Ablations vary atom dictionary size m, assignment sparsity K, plan size L, protected-unit count, and user-level clipping bound B, measuring support recovery and semantic-mass loss.Overlap@L measures exact support recovery; LossL measures non-private semantic mass lost by the released atom set.Source: §6.4 · p. 15

6.5 Plan verbalization and baseline summaries

  • The decoder receives only the released plan and public instructions; release-conditioned evaluations separate faithfulness from insightfulness, and selected summaries illustrate plan-based generation.OpenAI scores are evaluation measures, not part of the privacy mechanism; displayed examples are terminology-normalized with admitted themes unchanged.Source: §6.5 · pp. 15–16, Table 3 · p. 16

7 Conclusion

DP-SPIN releases a differentially private semantic plan from bounded semantic contributions, and the appendix analyzes utility at the plan level rather than the generated summary.

7 Conclusion

  • DP-SPIN maps protected records to bounded sparse semantic vectors, forms a semantic sketch, and releases a differentially private plan; the final summary is private by post-processing.For user-level privacy, record vectors are aggregated and clipped per user before summation.Source: §7 · p. 16

A Utility Analysis

  • The utility analysis evaluates perturbation, high-mass atom recovery, and support-mass loss for the released plan, separately from generated-text consistency.The plan-level metrics are evaluated relative to the non-private semantic sketch.Source: A Utility Analysis · p. 19

A.1 Full-sketch release

  • The full-sketch release adds noise to the semantic sketch, and the top-L margin is defined by the gap between the Lth and next-largest coordinates.Source: §A.1 · p. 19

A.2 Uniform coordinate error

The appendix bounds full-sketch coordinate error and relates it to top-L recovery and support-mass loss, while separately describing sparse private admission and evaluation metrics.

A.2 Uniform coordinate error

  • The appendix derives high-probability maximum-coordinate perturbation bounds for Gaussian and Laplace noise on a full semantic sketch.Source: §A.2 · p. 19

A.3 Top-L recovery and support-mass loss

  • A uniform error bound of τ limits support-mass loss to 2Lτ, and a top-L margin ΓL greater than 2τ guarantees exact top-L recovery.Source: §A.3 · p. 20

A.4 Sparse private atom admission

  • Sparse private admission selects L atoms sequentially with the exponential mechanism and releases noisy values only for admitted coordinates; exact top-L recovery needs additional mass separation.The analysis does not claim a computational-scaling advantage over full-sketch perturbation.Source: §A.4 · p. 21

B Evaluation Metrics

  • Metrics based on the non-private sketch are used only for offline evaluation and are not part of the released differentially private mechanism.Source: B Evaluation Metrics · p. 23

B.1 Notation recap

  • The evaluation defines the non-private top-L atom set and measures the non-private semantic mass assigned to any selected set of atoms.Source: §B.1 · p. 23

B.2 Plan-level recovery metrics

This section defines plan-recovery and noisy-value metrics, then specifies checks and evaluation measures for summaries generated from private plans. It also describes controlled probe-atom measures.

B.2 Plan-level recovery metrics

  • Overlap@L measures top-L atom-set recovery, retained non-private mass fraction captures admitted top-L mass, and support-mass loss reports omitted mass in sketch units.Retained mass can remain high despite missing near-boundary atoms; when its denominator is zero, the implementation reports 0 by convention.Source: §B.2 · p. 23

B.3 Noisy-value error metrics

  • Full-sketch releases use L1, L2, and infinity-norm errors, while sparse admission reports noisy-value errors only on admitted atoms.Errors are computed from raw noisy masses before display clipping or support binning.Source: §B.3 · p. 23

B.4 Decoder-contract metrics

  • A fixed public verifier checks summary mentions, values, bins, comparisons, and ranks against the released plan, accepting only when it detects no violation.It measures consistency with the release, not correctness or completeness relative to protected records; UCR is also zero when no comparison is detected.Source: §B.4 · p. 24

B.5 Non-private reference text evaluation

  • Text-level evaluation compares summaries decoded from the released differentially private plan and non-private top-L semantic plan using token, bigram, and keyphrase Jaccard similarities and TF–IDF cosine similarity.For all Jaccard metrics, if both sets are empty, the implementation reports similarity 1 by convention.Source: §B.5 · p. 25
  • Template-decoder scores mainly reflect overlap between fixed plan verbalizations, whereas OpenAI-decoder scores also capture paraphrasing, compression, and reordering.Non-private reference plans and summaries are used offline and are not given to the private-summary decoder; plan recovery remains the primary utility measure.Source: §B.5 · p. 25

B.6 Embedding-space semantic similarity

  • When enabled, embedding similarity is a secondary verbalization measure and duplicates TF–IDF cosine similarity when that backend is used.The embedding backend maps summaries to vectors for cosine comparison.Source: §B.6 · p. 26

B.7 Comparative summary evaluation

  • A fixed evaluator compares private and non-private summaries as verbalizations of the same reference plan, scoring coverage, faithfulness, clarity, and concision.Its aggregate preference is the mean of the encoded DP, tie, or NP choice across runs.Source: §B.7 · p. 26

B.8 Controlled probe-atom admission and mention measures

  • Controlled public probe atoms measure plan admission before decoding and probe-string mentions afterward, not discovery of new labels from protected records.Their non-private rank is used only offline to indicate proximity to the top-L boundary before the private release.Source: §B.8 · pp. 26–27

C Experimental Configuration

This section specifies the experimental configuration for defining fixed semantic atoms, bounding record- or user-level contributions, and releasing differentially private plans. It covers the CFPB protocol, Amazon atom dictionary, splits and assignments, and run aggregation.

C.1 Protected unit

  • Record-level runs protect individual records, while user-level runs group records by reviewer; CFPB is record-only, whereas Amazon All Beauty and Yelp support both settings.Runs select nrecords or nusers protected units, respectively, under add/drop adjacency; user-level grouping uses a stable user identifier.Source: §C.1 · p. 28

C.2 Auxiliary and protected target splits; D.2 Auxiliary and protected target splits

  • Auxiliary data fit the representation and construct atoms, while protected target data enter only through bounded assignments, aggregation, and the DP release.For user-level experiments the splits are user-disjoint; raw target records, excerpts, per-record vectors, non-private sketch values, and unreleased atoms are not provided to the decoder.Source: §C.2 · p. 28, §D.2 · p. 32

C.3 Public denominator

  • Normalized semantic support uses the configured public denominator nrecords or nusers, not the realized neighboring-dataset size, and its clipping, normalization, and binning are post-processing.The normalized value need not equal the fraction of protected units expressing the atom.Source: §C.3 · p. 28

C.4 Atom and plan parameters

  • Each record maps to at most K atoms with total ℓ1 mass at most one; released plans contain L admitted atoms, and dictionaries are fixed before target processing.Yelp uses m ∈{50, 100}, with m = 200 only for an ablation. Amazon’s auxiliary-only phrase construction applies a minimum support of 25 and yields m = 46.Source: §C.4 · p. 29

C.5 Privacy mechanism and budgets

  • The add/drop releases use Gaussian sketch plus top-L, Laplace sketch plus top-L, or private top-L admission with Gaussian values.The private top-L mechanism splits ε between sequential exponential-mechanism admission and selected-value release; user-level clipping bounds are B ∈{1, 2}, with B = 5 only as an ablation.Source: §C.5 · p. 29

C.6 Selection and random seeds; C.7 Generated configurations and run isolation; C.8 Run outputs; C.9 Grouped run summaries

  • Seeds control deterministic protected-unit selection and reproducible mechanism randomness, while generated per-run configurations and clean-run policies keep grouped summaries tied to consistent experiment grids.Run directories store configurations, released plans, summaries, verifier attempts, and metrics; grouping excludes effective record count as a user-level key and reports it as group statistics instead.Source: §C.6 · p. 30, §C.7 · p. 30, §C.8 · p. 30

D.3 Public atom labels

  • CFPB atoms concatenate Product, Issue, and Sub-issue values from the auxiliary split, retaining the top m combinations by auxiliary support with deterministic tie-breaking.Main CFPB experiments use m ∈{50, 100, 200}; the protected target split is governed by record-level add/drop adjacency with the auxiliary split fixed.Source: §D.2 · p. 32, §D.3 · p. 33

D.4 Record-to-atom assignment

  • Each CFPB target narrative maps to a sparse nonnegative vector over the fixed dictionary, preserving up to K highest-scoring atoms and normalizing total weight to at most one.Thus each vector satisfies ∥vi∥0 ≤K and ∥vi∥1 ≤1.Source: §D.4 · p. 33

D.5 Aggregate semantic sketch

  • Records contribute bounded sparse nonnegative mass to atoms, so the aggregate sketch can contain fractional semantic masses and has record-level add/drop L1 sensitivity at most one.A record contributes to at most K atoms with total mass at most one.Source: §D.4 · p. 33, §D.5 · p. 34

D.6 Differentially private semantic-plan release

  • The curator adds Laplace or Gaussian noise calibrated to sketch sensitivity, selects the top L atoms by post-processing, and derives support values and bins from noisy values and a public denominator.Under record-level add/drop adjacency with record L1 norm at most one, the stated sketch sensitivities are Δ1(C) ≤1 and Δ2(C) ≤1.Source: §D.6 · p. 34

D.7 CFPB protocol summary

  • The CFPB protocol constructs public Product / Issue / Sub-issue atoms from auxiliary records, fits the assignment representation on auxiliary or public data, and maps target narratives to bounded assignments before aggregation and private plan release.The decoder receives only the released plan and public decoding rules.Source: §D.7 · p. 34

E.6 User-level Amazon assignment

  • Amazon record-level units are individual reviews, while user-level units include all target reviews by one reviewer, whose aggregate assignment is clipped to bound B.Under user-level add/drop adjacency, sensitivity is B rather than 1; the main experiments use B ∈{1, 2}, with B = 5 as a clipping-bound ablation.Source: §E.1 · p. 35, §E.6 · p. 37

E.2 Auxiliary and target splits

  • Amazon splits are review-level for record privacy and reviewer-level for user privacy, keeping all reviews from a reviewer in one split and target reviewers out of representation fitting.All target reviews from each protected reviewer are aggregated and clipped before the private release.Source: §E.2 · p. 35

E.3 Amazon atom labels

  • Because All_Beauty lacks a fine-grained issue taxonomy, decoder-visible atoms are auxiliary-split review-theme phrases fixed before protected target reviews are processed.If target reviews are used to construct decoder-visible labels, that data-dependent release must be included in privacy accounting.Source: §E.3 · pp. 35–36

E.4 Amazon dictionary construction

  • Filtering and support-based ranking of auxiliary All_Beauty phrases yields a fixed public dictionary of 46 atom labels for all Amazon runs.Candidates are canonicalized and merged, with auxiliary document support of at least 25 required after filtering and merging.Source: §E.4 · p. 36

E.5 Record-level Amazon assignment

  • Each Amazon target review maps to a fixed sparse vector over public atoms with at most K nonzero entries and total mass at most one.The assignment map and text representation are fixed before processing the protected target split and use public or auxiliary text.Source: §E.5 · p. 37

E.7 Dataset and run evaluation measures

The appendix details the run measures and dataset-specific protocols for Amazon All_Beauty and Yelp Restaurants, including fixed atom dictionaries and record- and user-level assignments.

E.7 Dataset and run evaluation measures

  • The implementation groups run summaries by privacy setting, contribution bound, mechanism, dictionary size, and effective privacy parameters, and records verifier measures including unsupported-atom and unsupported-comparison rates.For user-level Amazon runs, varying review counts are reported as mean, minimum, maximum, and standard deviation rather than used as grouping keys.Source: §E.7 · pp. 37–38

E.9 Amazon protocol summary

  • Amazon uses All_Beauty, with one review as the record-level unit and all target reviews by a reviewer as the user-level unit; user-level splits are reviewer-disjoint.The fixed public dictionary has 46 two-word theme labels built from auxiliary reviews; each review is assigned to at most K atoms with total mass at most one.Source: §E.9 · p. 38

F Yelp Reviews Atom Construction and Assignment Protocol

  • Yelp Restaurants is formed by joining reviews to business metadata and retaining businesses whose categories include Restaurants; user-level splits keep each reviewer’s reviews together.The Yelp protocol records dataset statistics, including reviewer counts and the distribution of per-reviewer contribution sizes.Source: F Yelp Reviews Atom Construction and… · p. 40, §F.2 · p. 40

F.2 Auxiliary and target splits

  • Yelp record-level privacy treats one restaurant review as a protected unit; user-level privacy treats all target reviews by one reviewer as a unit.For user-level experiments, the auxiliary and target splits are reviewer-disjoint, so a reviewer’s reviews are assigned entirely to one split.Source: §F.1 · p. 40, §F.2 · p. 40

F.4 Yelp dictionary construction

  • Yelp atom labels are extracted and filtered from auxiliary restaurant-review text, canonicalized, merged, and ranked by auxiliary support before retaining the top m labels.The main dictionary sizes are m ∈ {50, 100}; m = 200 is used only as a finer-dictionary ablation, and the support values are auxiliary-split statistics.Source: §F.3 · p. 40, §F.4 · p. 41, §F.5 · p. 41

F.6 Record-level Yelp assignment

  • Each Yelp target review maps to a sparse vector over the fixed dictionary, with at most K assigned atoms and total contribution mass at most one.The illustrated K = 3 assignment allocates mass across long wait, friendly staff, and food quality.Source: §F.6 · p. 41

F.7 User-level Yelp assignment

  • User-level Yelp runs aggregate each reviewer’s record assignments, then clip the vector to bound B; this sets sensitivity to B and trades retained mass against noise.Main runs use B ∈ {1, 2}; B = 5 is a clipping-bound ablation.Source: §F.7 · p. 42

F.8 Dataset and run statistics

This section documents the Yelp experiment protocols and a decoder constrained by a released differentially private plan, including verifier checks and retries against that same plan.

F.8 Dataset and run statistics

  • Yelp run records include dataset and grouped utility/verifier statistics, while record- and user-level experiments protect reviews or reviewers, respectively.User-level runs use a user-disjoint split and clip each reviewer aggregate to ℓ1 norm at most B; each review maps to at most K atoms with total mass at most one.Source: §F.8 · p. 42, §F.9 · p. 42

G Contract-Constrained Decoder and Public Plan Verifier

G.2 Decoder modes

  • The audit decoder uses canonical atom markers and may report released masses or bins, while the display decoder can omit markers and express values as support bins.Both modes post-process the same released plan and receive no additional private information.Source: §G.2 · p. 44

G.3 Non-private-reference decoding

  • A non-private top-L sketch plan and its display summary serve only as offline references for utility evaluation.Audit summaries are used for verifier checks; display summaries are used for qualitative examples and text-level metrics.Source: §G.3 · pp. 44–45

G.4 Canonical atom references and decoder contract

  • The audit contract permits claims tied to admitted atoms, their descriptions, released values, supported comparisons or ranks, and public DP framing.Importance-ordering claims are not allowed because the plan contains no separate importance score.Source: §G.4 · p. 45

G.5 Decoder implementations

  • A template decoder deterministically verbalizes the plan, while an LLM decoder is restricted by a public policy to verbalizing released plan content.Audit mode requires canonical markers; display mode can omit them while using released support bins.Source: §G.5 · pp. 45–46

G.6 Public verifier

  • The public verifier checks audit summaries against the released plan, including admitted markers, support bins, numeric claims, comparisons, ranks, and raw-record patterns.For example, a rank claim is accepted only when the atom has released rank one.Source: §G.7 · pp. 46–47

G.7 Verifier checks

  • The verifier rejects an unadmitted atom and an exact count that is neither released nor permitted post-processing of the plan.The audit example includes a noisy mass for “long wait,” but the generated claim that exactly 612 records mention it is rejected.Source: §G.7 · p. 47

G.8 Regeneration loop

  • After rejection, the decoder may retry with verifier feedback using the same plan, with a deterministic template summary if attempts fail.The loop allows a fixed public maximum number of attempts and records the failure status and verifier measures if all attempts fail.Source: §G.8 · p. 47
  • Candidate summaries, verifier decisions, feedback, regeneration, and display formatting use only the released plan and public rules, so they are post-processing and consume no additional privacy budget.The process does not access protected records, raw excerpts, per-record assignment vectors, or the non-private sketch.Source: §G.8 · pp. 47–48

G.9 Scope and Limitations of Verification

The verifier checks whether generated summaries conform to the released plan, but does not establish that the plan or summary is complete or semantically correct against protected records. The appendix specifies decoder constraints and evaluation prompts.

G.9 Scope and Limitations of Verification

  • The verifier checks plan consistency, not completeness, equality with non-private masses, or semantic correctness against the protected corpus.It never receives raw protected records, and privacy comes from the DP release mechanism and post-processing rather than the verifier.Source: §G.9 · p. 48
  • A verifier-consistent summary may omit themes absent from the admitted plan, reflect noisy rather than non-private values, and paraphrase only as supported by admitted markers and public descriptions.The verifier enforces the public decoder contract and reports plan-consistency measures; it is not a semantic audit of the corpus.Source: §G.9 · p. 48

H.1 DP-SPIN audit decoder prompt

  • The audit decoder receives only the released plan and permits quantitative or semantic-support claims only when released masses or support bins support them.Its prompt disallows unlisted themes, invented examples, individual-record claims, and unsupported comparisons.Source: H Decoder and Evaluation Prompts · p. 49, §H.1 · p. 49

H.2 DP-SPIN display decoder prompt

  • The display decoder uses the same released plan but omits atom identifiers and exact noisy masses, limiting support language to released bins.It is instructed not to introduce unlisted themes or infer causes, identities, or subgroups beyond plan labels and descriptions.Source: §H.2 · p. 49

H.3 Non-private reference decoder prompt substitution

  • Non-private reference summaries are offline evaluation outputs, not part of the DP release or inputs to the decoder producing the DP summary.Other non-private baselines receive sampled target records or heuristically redacted samples; the URANIA-style baseline receives public keywords and noisy cluster sizes.Source: §H.3 · p. 50, §H.4 · p. 50, §H.5 · p. 50

H.6 LLM judge prompt

  • The LLM judge evaluates summaries against their released objects for coverage, specificity, insightfulness, faithfulness, privacy safety, and clarity, but its scores are not a formal DP audit.Judge outputs are used only for offline evaluation and do not affect the released summary.Source: §H.6 · p. 51

I Controlled Probe Atom Insertion Experiment

The controlled probe experiment measures how often a known public atom is admitted as synthetic support varies; the accompanying appendix specifies a matched URANIA-style public-keyword baseline and its record-level privacy boundary.

I.2 Probe record construction

  • The probe is a known public dictionary coordinate, not a label discovered from protected records; its synthetic records are excluded from atom construction and representation fitting.The experiment is for evaluation and does not alter the ordinary atom dictionary or main utility benchmark.Source: I Controlled Probe Atom Insertion… · p. 52, §I.2 · p. 52

I.3 Per-support configuration

  • Each support setting uses a target corpus of n0 + s records and the same public denominator, so displayed support is normalized assignment support, not population prevalence.This keeps support bins tied to the corpus size configured for that run.Source: §I.3 · pp. 52–53

I.4 Probe release and admission indicator

  • Across repeated runs, the probe admission rate is the fraction of differentially private plans that include the probe atom.Each run aggregates bounded record-to-atom assignment vectors into a semantic sketch before releasing the plan.Source: §I.4 · p. 53

I.5 Interpretation

  • Increasing probe support raises its non-private mass, while larger noise under a smaller privacy budget can reduce randomized admission of the probe atom.Admission is measured under the full DP release pipeline; admission does not imply raw probe text is released, and non-admission does not imply zero non-private support.Source: §I.5 · p. 53

J Our URANIA-Style Public-Keyword Baseline

  • The URANIA-style baseline retains private clustering, noisy cluster-size filtering, private per-cluster keyword histograms, and generation from released keywords, but is not an exact reproduction.Its fixed vocabulary and representation are built from public or disjoint auxiliary data; its comparison evaluates the release structure under a matched fixed-vocabulary protocol.Source: J Our URANIA-Style Public-Keyword… · p. 54, §J.1 · p. 54, §J.9 · pp. 56–57

J.2 Text representation; J.3 Differentially private clustering

  • The baseline uses public-or-auxiliary TF–IDF–SVD representations and Gaussian noisy Lloyd clustering rather than URANIA's original representation and clustering implementations.Its representation is fixed before the protected target is processed, and the released centers are obtained through private noisy statistics.Source: §J.2 · p. 54, §J.3 · pp. 54–55

J.4 Noisy cluster-size filtering; J.5 Per-record public-keyword indicators; J.6 Differentially private keyword histogram release

  • Records contribute at most five public keywords, and each preserved cluster releases at most t keywords selected by positive noisy histogram counts.The cluster-size decision uses noisy sizes and a threshold fixed independently of target records.Source: §J.5 · p. 55, §J.4 · p. 55, §J.6 · p. 56

J.7 Cluster-level and aggregate verbalization; J.8 Privacy accounting and release boundary; J.9 Relationship to the original URANIA system

  • The decoder receives selected public keywords and noisy sizes, while the released baseline objects and final summary satisfy record-level add/drop DP under the stated fixed-public-input and bounded-contribution conditions.The implementation also differs from the original in keyword selection, verbalization, and omitted hierarchy-construction and visualization stages.Source: §J.7 · p. 56, §J.8 · p. 56, §J.9 · p. 57

K Additional Experimental Results: CFPB Complaint

The CFPB appendix reports additional ablations of plan and summary measures, plus a controlled probe-atom experiment; it also introduces additional Amazon review results.

K Additional Experimental Results: CFPB Complaint

  • CFPB ablations vary dictionary size, privacy budget, assignment sparsity, and released plan size across Overlap@L, preserved mass, and support-mass loss.The support-mass-loss plots define lower values as less non-private semantic mass lost by the released atom set.Source: Figure 7 · p. 58, Figure 8 · p. 59, Figure 9 · p. 60
  • The CFPB probe experiment plots plan-admission and summary-mention rates against injected probe support, with a separate plot showing the probe's offline non-private rank and top-L cutoff.The admission and mention panels compare privacy budgets and release mechanisms at K = 3 and L = 10.Source: Figure 14 · p. 64, Figure 15 · p. 65
  • CFPB supplementary tables provide generated-summary examples, release-conditioned verbalization evaluations, and text-similarity comparisons with non-private-plan summaries.The evaluation tables score verbalization quality; the similarity table compares generated texts rather than underlying semantic sketches.Source: Table 10 · p. 66, Table 7 · p. 66, Table 8 · p. 66

L Additional Experimental Results: Amazon Reviews

L.1 Record-level results

The Amazon appendix describes record-level and user-level ablations of plan utility, retained semantic mass, support loss, and summary similarity, with separate controlled probe experiments.

L.1 Record-level results

  • Record-level Amazon ablations plot Overlap@L, preserved mass, and support-mass loss across privacy budgets, assignment sparsity, and plan sizes.Additional plots show heatmaps over K and L and compare summary keyphrase Jaccard and TF–IDF cosine similarity with non-private-plan references.Source: Figure 16 · p. 67, Figure 17 · p. 68, Figure 18 · p. 69
  • The record-level Amazon probe figures track plan admission and summary mention as injected probe support varies, while holding K = 3 and L = 10.The experiment uses a public dictionary of 47 atoms including the probe.Source: Figure 22 · p. 72

L.2 User-level results

  • User-level Amazon plots vary privacy budget and contribution bound B across plan utility, retained mass, support loss, and summary-text similarity measures.The figures also include a support-loss heatmap over K and L and a probe experiment configured with B = 2.Source: Figure 23 · p. 73, Figure 24 · p. 74, Figure 25 · p. 75
  • User-level summary comparisons use keyphrase Jaccard and TF–IDF cosine similarity against non-private-plan references, alongside release-conditioned verbalization tables and generated-summary examples.The summary evaluation tables score verbalization quality, while the similarity table compares generated text rather than semantic sketches.Source: Figure 29 · p. 79, Figure 31 · p. 81, Table 11 · p. 84

M Additional Experimental Results: Yelp Reviews

M.1 Record-level results

The Yelp appendix reports record-level and user-level ablations over plan measures, semantic-mass retention and loss, and generated-summary similarity, alongside controlled probe tests and summary evaluations.

M.1 Record-level results

M.2 User-level results

  • User-level Yelp ablations vary dictionary size, privacy budget, and contribution bound B across Overlap@L, preserved mass, support-mass loss, and summary-text similarity.The user-level figures include a support-loss heatmap and a controlled probe experiment configured with B = 2.Source: Figure 47 · p. 91, Figure 48 · p. 91, Figure 49 · p. 92
  • Yelp summary comparisons use keyphrase Jaccard and TF–IDF cosine similarity against non-private-plan references, with release-conditioned verbalization evaluations and generated-summary examples.The similarity table compares generated texts rather than underlying semantic sketches.Source: Figure 56 · p. 95, Figure 59 · p. 97, Table 15 · p. 100

M.1 Record-level results; M.2 User-level results

  • The user-level controlled probe figures track plan-admission and summary-mention rates as probe support varies, while the record-level probe figure uses the same outcomes.Source: Figure 46 · p. 90, Figure 63 · p. 99
Loading 2609.16283v1…