cs.LGMar 12, 2026

STAMP: Selective Task-Aware Mechanism for Text Privacy

Authors: Fengwei Tian, Payel Bhattacharjee, Heidi Hanson, Geoffrey D. Rubin, Joseph Y. Lo, Ravi Tandon

Organizations: University of Arizona · Oak Ridge National Laboratory · Duke University

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

We present STAMP (Selective Task-Aware Mechanism for Text Privacy), a new framework for task-aware text privatization that achieves an improved privacy-utility trade-off. STAMP selectively allocates privacy budgets across tokens by jointly considering (i) each token's importance to the downstream task (as measured via a task- or query-specific representation), and (ii) its privacy sensitivity (e.g., names, dates, identifiers). This token-level partitioning enables fine-grained, group-wise control over the level of noise applied to different parts of the input, balancing privacy protection with task relevance. To privatize individual token embeddings, we introduce the polar mechanism, which perturbs only the direction of embeddings on the unit sphere while preserving their magnitude. Decoding is performed via cosine nearest-neighbor search, aligning the perturbation geometry with the decoding geometry. Unlike isotropic noise mechanisms, the polar mechanism maintains semantic neighborhoods in the embedding space and better preserves downstream utility. Experimental evaluations on SQuAD, Yelp, and AG News datasets demonstrate that STAMP, when combined with the normalized polar mechanism, consistently achieves superior privacy-utility trade-offs across varying per-token privacy budgets.

Figures & tables

Figure 1: Overview of the STAMP framework : Tokens are categorized according to their task and privacy relevance, and then perturbed using adaptively assigned privacy budgets via the polar mechanism. Figure (a) (left) illustrates the overall token perturbation pipeline with group-wise privacy budget allocation; (b) (right) details the grouping and budget assignment process based on task and privacy importance.
Figure 2: Prompt-based question answering example (in the baseline context, red bold text indicates privacy-sensitive tokens; blue bold text denotes task-relevant text): Uniform perturbation treats all tokens equally, wasting privacy on uninformative words and under-protecting sensitive but predictive ones. STAMP addresses this by stratifying tokens by privacy sensitivity and task relevance, and by aligning the privatization geometry with the decoding geometry.
Figure 3: STAMP privatization pipeline. Embeddings are decomposed into radial and angular components, perturbed under metric LDP, and decoded by angular proximity into privatized tokens suitable for downstream tasks.
Figure 4: Directional privatization using the Polar mechanism, which perturbs the angle of the normalized embedding vector while normalizing its magnitude.
Group Privacy Budgets {G1,G2,G3,G4}\{G_{1},G_{2},G_{3},G_{4}\}SQuAD (Cosine similarity)Non-Private BaselineYelp (Acc %)Non-Private BaselineAG News (Acc %)Non-Private Baseline
Polar (vMF)LaplacePolar (vMF)LaplacePolar (vMF)Laplace
{150, 50, 450, 350}0.3930.3250.8390.3600.2200.5800.5400.5600.920
{200, 100, 500, 400}0.4700.3340.8390.3800.1400.5800.6400.5800.920
{250, 150, 550, 450}0.5870.3350.8390.4800.1800.5800.6800.5600.920
{300, 200, 600, 500}0.6540.3410.8390.5600.2000.5800.7600.5200.920
{350, 250, 650, 550}0.8330.3430.8390.5600.1400.5800.8000.5200.920
Table 1: Polar vs. Laplace vs. Baseline at matched protocol (cosine decoding for all), embedding dimension at d=768d{=}768 . Rows are privacy points; columns group mechanisms by dataset. SQuAD (Cosine) cells show cosine similarity. Yelp/AG News cells show accuracy.
Figure 5: The parameter τ\tau serves as the critical decision boundary that classifies tokens as task-relevant or irrelevant based on their cosine similarity to the task representation. A sweep of τ\tau reveals that downstream utility (measured by cosine similarity between original and privatized contexts) stabilizes around τ=0.5\tau=0.5 , indicating a robust operating point that preserves task-critical signals without over-perturbing the context.
Figure 6: STAMP vs. Uniform (single angular budget) under the Polar mechanism across three tasks: SQuAD (QA), Yelp (sentiment), and AG News (topic classification). Curves show task performance versus the base angular budget ϵ0\epsilon_{0} ; both frameworks use normalized polar mechanism and cosine decoding. STAMP variants (e.g., private-only, private-low, heuristic) retain higher utility by concentrating noise on sensitive, low-importance spans, while Uniform converges as noise vanishes at large ϵ0\epsilon_{0} .
Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Qualitative comparison on a Yelp review (Sentiment Analysis) at a matched average privacy budget of ϵˉ≈540\bar{\epsilon}\approx 540 . The privatized outputs shown (middle/bottom) are subsequently coherence-repaired via a constrained rewrite that preserves meaning and forbids adding external facts or inventing names/entities. Even after repair, the Uniform & Laplace baseline (bottom) collapses semantic structure and remains largely unintelligible. In contrast, STAMP & Polar (middle) preserves syntactic form and salient sentiment cues (e.g., “underwhelmed” and the explicit rating “three stars”), enabling correct sentiment inference despite local perturbations.
Figure 8: Qualitative comparison on an AG News article (Topic: Sci/Tech) at a matched average privacy budget of ϵˉ≈490\bar{\epsilon}\approx 490 . The privatized outputs shown (middle/bottom) are subsequently coherence-repaired under the same constrained rewrite setting. Uniform & Laplace (bottom) yields near-complete information loss, producing a sequence of weakly related or unrelated tokens even after repair. STAMP & Polar (middle) successfully retains domain-specific terminology critical for topic classification (e.g., “Peptides”, “chemistry researcher”, “protein”), demonstrating stronger utility preservation under privacy.
Figure 9: Qualitative comparison on a Yelp review (Sentiment Analysis) at a matched average privacy budget of ϵˉ≈540\bar{\epsilon}\approx 540 . The privatized outputs shown (middle/bottom) are subsequently coherence-repaired using the same constrained rewrite rule set. The Uniform & Laplace baseline (bottom) results in total semantic collapse, outputting a nonsensical sequence of tokens. Conversely, STAMP & Polar (middle) maintains narrative structure and key contextual anchors (e.g., “video games”, “ticket projects”, “packed”), enabling the downstream classifier to correctly interpret the review’s positive sentiment.
Figure 10: Qualitative comparison on an AG News article (Topic: Business) at a matched average privacy budget of ϵˉ≈540\bar{\epsilon}\approx 540 . The privatized outputs shown (middle/bottom) are subsequently coherence-repaired via the same constrained rewrite process. The Uniform & Laplace baseline (bottom) results in complete obfuscation, producing a string of unrelated tokens. Meanwhile, STAMP & Polar (middle) preserves key legal/employment terminology—including “law strengthened job protections”, “active duty”, and “(USERRA)”—supporting correct topic classification under privacy constraints.
More in this topic

Privacy-Utility Tradeoff

Privacy-utility tradeoffs study how to limit disclosure of sensitive information while preserving useful data, models, and services.

See all 71 papers

Explore similar work

CardsList
Feb 24, 2026

Adaptive Text Anonymization: Learning Privacy-Utility Trade-offs via Prompt Optimization

Anonymizing textual documents is a highly context-sensitive problem: the appropriate balance between privacy protection and utility preservation varies with the data domain, privacy objectives, and downstream application. However, existing anonymization methods rely on static, manually designed strategies that lack the flexibility to adjust to diverse requirements and often fail to generalize across domains. We introduce adaptive text anonymization, a new task formulation in which anonymization strategies are automatically adapted to specific privacy-utility requirements. We propose a framework for task-specific prompt optimization that automatically constructs anonymization instructions for language models, enabling adaptation to different privacy goals, domains, and downstream usage patterns. To evaluate our approach, we present a benchmark spanning five datasets with diverse domains, privacy constraints, and utility objectives. Across all evaluated settings, our framework consistently achieves a better privacy-utility trade-off than existing baselines, while remaining computationally efficient and effective on open-source language models, with performance comparable to larger closed-source models. Additionally, we show that our method can discover novel anonymization strategies that explore different points along the privacy-utility trade-off frontier.

Gabriel Loiseau, Damien Sileo, Damien Riquet +2

Hornetsecurity, Hem, France · Univ. Lille, Inria, CNRS, Centrale Lille, UMR 9189 - CRIStAL, F-59000 Lille, France

Privacy-Utility TradeoffPrompt OptimizationPrivacy-Preserving Language Models
AskPDF
Aug 30, 2026

PrivBench: A Holistic and Modular Benchmarking Platform for Evaluating Text-to-Text Privatization

Natural Language Processing methods have enabled novel solutions and advances in the field of privacy, particularly in the sub-domain of text-to-text privatization, where the goal is to transform a sensitive input text into a privatized output by ideally masking (in)directly identifiable or otherwise private information. The evaluation of text-to-text privatization, however, is not straightforward, and the extant literature has utilized a myriad of techniques and metrics to quantify the privacy-preserving capabilities of privatization methods. Seeking to unify the evaluation of text-to-text privatization, we introduce PrivBench, a holistic and modular benchmarking platform for researchers and practitioners working on text privatization. PrivBench is holistic in that it evaluates privatization on a series of defined desiderata, which are structured into modules. PrivBench is not only modular but also extensible, allowing for future updates and benchmark versions. PrivBench is user-centered and promotes competition via real-time evaluation and a live public leaderboard. The platform is free to use and openly accessible at https://privbench.com/.

Stephen Meisenbacher, Andreea-Elena Bodea, Ahmet Bilal Akın +3

Technical University of Munich, School of Computation, Information and Technology · Technical University of Munich, School of Social Sciences and Technology · Munich Center for Machine Learning, Munich, Germany +1

Privacy-Preserving ML
AskPDF
Sep 16, 2026

QuanText: Protecting Dataset-Level Secrets in Textual Data Sharing

Natural-language datasets support many downstream applications and research studies, but releasing text can reveal sensitive global properties of the underlying data source, such as the proportion of records associated with a particular gender, diagnosis, or political stance. Existing work has largely focused on property inference attacks that recover such global properties, while defenses for protecting these dataset-level secrets remain limited. Differential privacy, although effective for protecting individual records, provides only weak protection for aggregate properties. We propose Randomized Quantization for Text (QuanText), a training-free and large-language-model-agnostic data release mechanism that protects global secrets in textual datasets while preserving data utility. Given a dataset-level secret, such as the proportion of records with a particular diagnosis, and attributes whose utility should be preserved, such as topic and sentiment, QuanText perturbs both the secret distribution and the distributions of correlated attributes. It does so by constructing candidate release distributions over secret and non-secret attributes, randomly selecting a candidate sufficiently close to the private empirical distribution, and rewriting each private text sample to match the selected distribution using attribute-related snippets from the original text. QuanText is inspired by the Statistic Maximal Leakage (SML) framework, which bounds leakage about a secret function of a data distribution. Under idealized conditions, we show that QuanText satisfies an SML guarantee. Since these conditions may not hold exactly in practice, we also evaluate QuanText empirically on real-world datasets. Our results show that QuanText achieves a better empirical privacy-utility trade-off than competing data generation baselines.

Shuaiqi Wang, Zinan Lin, Giulia Fanti

Carnegie Mellon University · Microsoft Research

Privacy-Preserving ML
AskPDF