PaperlayerView exact revision on arXiv

Source-linked AI summary

QuanText: Protecting Dataset-Level Secrets in Textual Data Sharing

Shuaiqi Wang, Zinan Lin, Giulia Fanti

arXiv:2609.17995v2cs.LGcs.CR

TL;DR

Text releases can reveal sensitive global properties, yet defenses for dataset-level secrets remain limited and correlated attributes complicate protection. QuanText selects a nearby randomized release distribution and rewrites samples to match it. Under idealized conditions it has an SML guarantee, and real-world evaluations report a better empirical privacy–utility trade-off than competing data-generation baselines.

  • Problem

    Textual datasets can reveal sensitive global proportions, while defenses for dataset-level secrets are limited and correlated attributes can expose secrets despite individual-level protection.

    Source: §I · p. 1

  • Method

    QuanText constructs candidate distributions over secret and utility-relevant attributes, randomly selects one close to the private empirical distribution, and rewrites samples using attribute-related snippets.

    Source: §I · p. 1, §IV · p. 3, A. QuanText Algorithm · p. 4

  • Results

    QuanText achieves a better empirical privacy–utility trade-off than competing data-generation baselines on known property-inference attacks.

    Source: §I · p. 2

  • Takeaways & Limitations

    QuanText is training-free and large-language-model-agnostic, and its idealized SML guarantee has additive degradation controlled by content–style correlation.

    Source: §I · p. 2

Abstract

from arXiv · show

Natural-language datasets support many downstream applications and research studies, but releasing text can reveal sensitive global properties of the underlying data source, such as the proportion of records associated with a particular gender, diagnosis, or political stance. Existing work has largely focused on property inference attacks that recover such global properties, while defenses for protecting these dataset-level secrets remain limited. Differential privacy, although effective for protecting individual records, provides only weak protection for aggregate properties. We propose Randomized Quantization for Text (QuanText), a training-free and large-language-model-agnostic data release mechanism that protects global secrets in textual datasets while preserving data utility. Given a dataset-level secret, such as the proportion of records with a particular diagnosis, and attributes whose utility should be preserved, such as topic and sentiment, QuanText perturbs both the secret distribution and the distributions of correlated attributes. It does so by constructing candidate release distributions over secret and non-secret attributes, randomly selecting a candidate sufficiently close to the private empirical distribution, and rewriting each private text sample to match the selected distribution using attribute-related snippets from the original text. QuanText is inspired by the Statistic Maximal Leakage (SML) framework, which bounds leakage about a secret function of a data distribution. Under idealized conditions, we show that QuanText satisfies an SML guarantee. Since these conditions may not hold exactly in practice, we also evaluate QuanText empirically on real-world datasets. Our results show that QuanText achieves a better empirical privacy-utility trade-off than competing data generation baselines.

I. INTRODUCTION

Textual data releases can expose sensitive dataset-wide proportions, while defenses for these secrets remain limited and correlated attributes make protection difficult. QuanText perturbs candidate attribute distributions and rewrites samples; its idealized SML analysis and real-world evaluations report privacy protection alongside preserved utility.

I. INTRODUCTION

  • Released text can reveal sensitive global proportions, including disease prevalence or political stance, even when individual identifiers are removed.The challenge is that textual attributes may span multiple text parts and correlate with seemingly non-sensitive words, phrases, or semantic cues.Source: §I · p. 1

II. RELATED WORK

  • Prior work has emphasized property-inference attacks, while defenses remain comparatively scarce; differential privacy can protect individuals yet provide weak aggregate-property protection.A vision-setting defense that distorts secret values can remain vulnerable when other attributes correlate with the secret.Source: §I · p. 1, §II · pp. 2–3

I. INTRODUCTION

  • QuanText constructs alternative distributions over secret and utility-relevant attributes, randomly selects one close to the private empirical distribution, and rewrites samples using original-text snippets.The method is training-free and large-language-model-agnostic, and aims to limit leakage through correlated attributes while preserving utility.Source: §I · pp. 1–2
  • Under idealized conditions, QuanText satisfies an SML guarantee whose additive degradation is controlled by content–style correlation.The analysis models dependence with a worst-case conditional probability ratio l; the bound is the mechanism-dependent quantization term plus log l.Source: §I · p. 2
  • QuanText achieves a better empirical privacy–utility trade-off than competing data-generation baselines on known property-inference attacks.The evaluation is motivated in part by the difficulty of estimating the content–style correlation parameter in practice.Source: §I · p. 2

III. PROBLEM FORMULATION

The formulation treats the secret as a proportion of samples with specified attribute values in a private textual dataset. It measures protection against an attacker who knows the release mechanism, using SML's worst-case leakage across data priors and attacks.

III. PROBLEM FORMULATION

  • The private dataset contains n text strings, and the data holder releases a generated dataset while seeking to protect a count query over specified attribute categories.Attributes have predefined category values, such as positive, negative, and neutral sentiment.Source: §III · p. 3
  • The core assumption is that the secret proportion can be recovered from all attribute values, even when the secret directly depends on only a subset.The secret may remain correlated with attributes outside the subset evaluated by its defining oracle.Source: §III · p. 3
  • The attacker observes the released dataset, knows the generation mechanism, and is computationally unbounded.Source: §III · p. 3
  • SML measures worst-case leakage across data priors and attack methods; lower Π_M,g indicates stronger protection.SML also supports post-processing and adaptive composition, so further processing or sequential releases preserve the stated guarantee.Source: §III · p. 3

IV. RANDOMIZED QUANTIZATION FOR TEXT

QuanText perturbs the distribution of a sensitive property and correlated attributes, then rewrites private samples to match a randomly selected alternative attribute distribution. It builds that distribution from component-level candidates and uses attribute-related snippets to limit changes to the text.

IV. RANDOMIZED QUANTIZATION FOR TEXT

  • QuanText perturbs both the sensitive-property distribution and distributions of correlated attributes, since removing sensitive samples alone may leave inferable correlations intact.The straw-man example removes samples containing a property such as diabetes, but correlated attributes such as age may remain largely unchanged.Source: §IV · p. 3
  • QuanText extracts sample attributes, models their joint distribution with a Chow–Liu tree, and selects uniformly among the candidate distributions closest in total variation to the empirical distribution.The number of closest candidates considered can be varied to tune privacy guarantees.Source: §IV · p. 3

A. QuanText Algorithm

  • The algorithm estimates the joint attribute distribution using an auxiliary public dataset and constructs γ candidate release distributions for each distribution component.It computes component-level empirical distributions from the private dataset, then selects a release distribution from the top-k candidates nearest to each empirical component distribution.Source: A. QuanText Algorithm · pp. 3–4
  • QuanText combines selected component distributions into a released joint distribution, draws n target attribute combinations, and assigns them to private samples using the Hungarian algorithm.The assignment minimizes the number of differing attribute values between each sample’s true attributes and its target combination.Source: A. QuanText Algorithm · p. 4
  • For each assigned target, QuanText extracts relevant snippets from the original text and uses an LLM to rewrite the sample to match the target attributes.The snippets are drawn from the original sample and are relevant to its assigned target attribute combination.Source: A. QuanText Algorithm · p. 4

B. Idealized Privacy Guarantee

The idealized analysis bounds leakage about dataset-level secrets using Statistic Maximal Leakage (SML), while accounting for dependence between semantic content and writing style. The guarantee depends on candidate-selection parameters and the content–style dependence bound.

B. Idealized Privacy Guarantee

  • When L(Y; Z) = 1, style is independent of content, and L(Y; Z) upper-bounds the mutual information I(Y; Z) by log l.L(Y; Z) measures how much content can change the likelihood of a style value.Source: B. Idealized Privacy Guarantee · p. 4
  • QuanText’s SML bound applies to secrets defined as proportions of samples with particular attribute categories, given a bound on content–style dependence and the stated theorem assumptions.The analysis separates semantic content, which includes attribute information, from non-semantic style such as word choice, phrasing, and text length.Source: B. Idealized Privacy Guarantee · pp. 4–5
  • The bound gives stronger privacy when γ is smaller, k is larger, or Chow–Liu parent attributes have fewer categories; content–style correlation adds log l to the bound.Here γ is the number of candidates per conditional attribute, k is the selection size, and l bounds the dependence of style on content.Source: B. Idealized Privacy Guarantee · p. 5
  • SML is robust to post-processing, so a dataset released under a Π−SML guarantee can be used for downstream model training without degrading privacy.The theorem’s SML bound also has an operational interpretation in terms of attacker success probability.Source: B. Idealized Privacy Guarantee · p. 5

V. EXPERIMENTS

The paper evaluates QuanText’s privacy and utility on real-world datasets.

V. EXPERIMENTS

  • QuanText’s privacy and utility are evaluated on real-world datasets.The passage does not specify the datasets or report evaluation outcomes here.Source: §V · p. 5

A. Datasets

The experiments use Tweet Stance and ChatDoctor as private datasets, with task-specific attributes and dataset-level secrets. The Tweet figure plots attack MAE against aggregate utility across data-generation methods and privacy settings.

A. Datasets

  • Tweet Stance contains 4,870 labeled tweets; 3,000 are used as private data and 1,870 as auxiliary data for the Chow–Liu tree.The attributes are Target, Stance, and Sentiment; secrets include individual category proportions and Target–Stance combination proportions.Source: A. Datasets · p. 5
  • ChatDoctor experiments define female-ratio secrets at 0.3, 0.5, and 0.7 using three 600-dialogue samples, and diagnosis-proportion secrets using another 600 dialogues.The diagnosis categories are mental disorder, digestive disorder, and childbirth; gender or diagnosis is the sole attribute of interest in each setup.Source: A. Datasets · p. 5
  • Fig. 3 plots attack MAE against aggregate utility for different data-generation methods and privacy guarantees on Tweet.The figure caption identifies the comparison dimensions but does not report which method performs best.Source: Figure 3 · p. 6

B. QuanText and Data Generation Baselines

QuanText uses candidate dilution to control privacy strength, while the baselines are differentially private generation methods and naive data releases. The experiments vary the privacy budget for the DP baselines.

B. QuanText and Data Generation Baselines

  • Candidate dilution γk controls QuanText’s privacy performance, with smaller values corresponding to stronger privacy.The experiments consider γk values of 2, 3, 4, 6, 8, and 12; the theoretical relationship may not hold exactly in practice.Source: B. QuanText and Data Generation… · p. 6
  • The DP baselines are Private Evolution (PE) and DP fine-tuning (DP-FT), alongside raw data release and subsampling as naive baselines.PE uses a Random API and Variation API, while DP-FT generates synthetic data from a model fine-tuned with DP-SGD.Source: B. QuanText and Data Generation… · p. 6
  • Raw data release releases the private data directly, while subsampling releases a random half of the private dataset.Source: B. QuanText and Data Generation… · p. 6
  • The experiments use Llama3.1-8B-Instruct as the backend model and vary the PE and DP-FT privacy budget ϵ across 1, 2, 3, and 4.PE runs for 10 iterations and DP-FT for 15 epochs.Source: B. QuanText and Data Generation… · p. 6

C. Evaluation Metrics

The evaluation measures privacy with a labeling-based property inference attack and utility with semantic and statistical metrics. The attack estimates the sensitive-category proportion, while utility metrics compare generated and real data.

C. Evaluation Metrics

  • Privacy is measured by the labeling-based attack’s Mean Absolute Error (MAE), with higher MAE indicating better protection of global secrets.For each sample, a language model labels whether it belongs to the sensitive category, and the attack estimates the category’s proportion.Source: C. Evaluation Metrics · pp. 6–7
  • The labeling-based attack uses Llama3.1-8B-Instruct, Mistral-7B-Instruct, and Qwen3-4B-Instruct as backend models.Source: C. Evaluation Metrics · p. 7
  • Utility is evaluated with KNN-Precision, KNN-Recall, Fréchet Inception Distance (FID), and Attribute Match (AM).KNN metrics capture semantic quality and coverage; FID measures embedding closeness, and AM compares predefined feature distributions using Wasserstein-2 distance for numerical features and Total Variation distance for categorical features.Source: C. Evaluation Metrics · p. 7
  • Overall utility averages the four metrics after rescaling each to [0, 1], with larger values indicating better performance.The authors note that averaging metrics with different underlying scales may not be ideal, though it is used in some benchmarks for visualization and interpretation.Source: C. Evaluation Metrics · p. 7

D. Results

QuanText outperforms PE and DP-FT on privacy and aggregate utility across the reported privacy budgets when γk ≤ 8. The ablations report improved privacy with smaller candidate dilution, stable performance across γ and k choices at fixed dilution, and similar method rankings across attack backends.

D. Results

  • For γk ≤ 8, QuanText consistently achieves higher attack MAE and aggregate utility than PE and DP-FT across ϵ ∈ {1, 2, 3, 4}.Raw Data Release and Subsampling have attack MAE near zero, while PE and DP-FT have consistently low MAE that varies only slightly across DP budgets.Source: D. Results · pp. 7–8
  • Reducing candidate dilution from 12 to 2 raises attack MAE from approximately 0.01 to 0.1 while aggregate utility falls from 0.85 to 0.77.The authors attribute the limited utility loss to adjusting selected-attribute proportions while reusing attribute-related snippets that preserve semantic quality and coverage.Source: D. Results · p. 8

1) Ablation Studies:

  • At fixed γk = 4, attack MAE and aggregate utility remain largely stable as γ and k vary proportionally on Tweet Stance.The sensitivity analysis runs each parameter setting three times and reports means and standard deviations.Source: 1) Ablation Studies · p. 8, Figure 5 · p. 8
  • Pairwise backend-model rankings have averaged Spearman correlations above 0.6, indicating that the relative protection of methods is largely preserved across attack models.Source: 1) Ablation Studies · pp. 8–9, Table I · p. 9

VI. CONCLUSION

  • The conclusion characterizes QuanText as training-free and model-agnostic, with an SML analysis that accounts for leakage through correlated textual attributes.Experiments on real-world datasets are reported to show a favorable privacy–utility trade-off and better privacy and utility than differentially private data-generation baselines.Source: §VI · p. 9

APPENDIX A CANDIDATE DISTRIBUTION CONSTRUCTION

The construction algorithm samples candidate distributions from a symmetric Dirichlet pool and selects a separated subset using a greedy farthest-point rule. Its stated time complexity is O(γ^2L).

APPENDIX A CANDIDATE DISTRIBUTION CONSTRUCTION

  • For each distribution component P, the algorithm draws L candidate distributions from a symmetric Dirichlet distribution with concentration parameter α.The default α = 1 gives the uniform Dirichlet distribution.Source: Appendix A · p. 10
  • It selects γ candidates using a greedy farthest-point rule, maximizing each new candidate’s minimum TV distance to those already selected.The output is a candidate distribution set Q of size γ.Source: Appendix A · p. 10
  • The stated time complexity of Algorithm 2 is O(γ^2L).Source: Appendix A · p. 10

APPENDIX B PROOF OF THM. IV.3

The proof treats QuanText’s first four steps as the release mechanism and invokes SML post-processing, relying on attribute-related snippets revealing no information about the secret.

APPENDIX B PROOF OF THM. IV.3

  • The proof defines M′ as the release mechanism consisting of QuanText’s first four steps.It uses this mechanism to prove Thm. IV.3.Source: Appendix B · p. 10
  • The proof considers both L(Y; Z) = 0 and L(Y; Z) ≤ l cases.It also identifies Θ and Θ′ as the private and released data distribution parameters, respectively.Source: Appendix B · pp. 10–11
  • The SML argument uses post-processing and the claim that attribute-related snippets reveal no information about the secret.The proof applies these facts to the SML of QuanText.Source: Appendix B · p. 10
Loading 2609.17995v2…