STAMP: Selective Task-Aware Mechanism for Text Privacy

Fengwei Tian; Payel Bhattacharjee; Heidi Hanson; Geoffrey D. Rubin; Joseph Y. Lo; Ravi Tandon

cs.LGMar 12, 2026

STAMP: Selective Task-Aware Mechanism for Text Privacy

Authors: Fengwei Tian, Payel Bhattacharjee, Heidi Hanson, Geoffrey D. Rubin, Joseph Y. Lo, Ravi Tandon

Organizations: University of Arizona · Oak Ridge National Laboratory · Duke University

Abstract

We present STAMP (Selective Task-Aware Mechanism for Text Privacy), a new framework for task-aware text privatization that achieves an improved privacy-utility trade-off. STAMP selectively allocates privacy budgets across tokens by jointly considering (i) each token's importance to the downstream task (as measured via a task- or query-specific representation), and (ii) its privacy sensitivity (e.g., names, dates, identifiers). This token-level partitioning enables fine-grained, group-wise control over the level of noise applied to different parts of the input, balancing privacy protection with task relevance. To privatize individual token embeddings, we introduce the polar mechanism, which perturbs only the direction of embeddings on the unit sphere while preserving their magnitude. Decoding is performed via cosine nearest-neighbor search, aligning the perturbation geometry with the decoding geometry. Unlike isotropic noise mechanisms, the polar mechanism maintains semantic neighborhoods in the embedding space and better preserves downstream utility. Experimental evaluations on SQuAD, Yelp, and AG News datasets demonstrate that STAMP, when combined with the normalized polar mechanism, consistently achieves superior privacy-utility trade-offs across varying per-token privacy budgets.

Figures & tables

Figure 1: Overview of the STAMP framework : Tokens are categorized according to their task and privacy relevance, and then perturbed using adaptively assigned privacy budgets via the polar mechanism. Figure (a) (left) illustrates the overall token perturbation pipeline with group-wise privacy budget allocation; (b) (right) details the grouping and budget assignment process based on task and privacy importance.

Figure 2: Prompt-based question answering example (in the baseline context, red bold text indicates privacy-sensitive tokens; blue bold text denotes task-relevant text): Uniform perturbation treats all tokens equally, wasting privacy on uninformative words and under-protecting sensitive but predictive ones. STAMP addresses this by stratifying tokens by privacy sensitivity and task relevance, and by aligning the privatization geometry with the decoding geometry.

Figure 3: STAMP privatization pipeline. Embeddings are decomposed into radial and angular components, perturbed under metric LDP, and decoded by angular proximity into privatized tokens suitable for downstream tasks.

Figure 4: Directional privatization using the Polar mechanism, which perturbs the angle of the normalized embedding vector while normalizing its magnitude.

Group Privacy Budgets $\{G_{1},G_{2},G_{3},G_{4}\}$	SQuAD (Cosine similarity)		Non-Private Baseline	Yelp (Acc %)		Non-Private Baseline	AG News (Acc %)		Non-Private Baseline
Group Privacy Budgets $\{G_{1},G_{2},G_{3},G_{4}\}$	Polar (vMF)	Laplace	Non-Private Baseline	Polar (vMF)	Laplace	Non-Private Baseline	Polar (vMF)	Laplace	Non-Private Baseline
{150, 50, 450, 350}	0.393	0.325	0.839	0.360	0.220	0.580	0.540	0.560	0.920
{200, 100, 500, 400}	0.470	0.334	0.839	0.380	0.140	0.580	0.640	0.580	0.920
{250, 150, 550, 450}	0.587	0.335	0.839	0.480	0.180	0.580	0.680	0.560	0.920
{300, 200, 600, 500}	0.654	0.341	0.839	0.560	0.200	0.580	0.760	0.520	0.920
{350, 250, 650, 550}	0.833	0.343	0.839	0.560	0.140	0.580	0.800	0.520	0.920

Table 1: Polar vs. Laplace vs. Baseline at matched protocol (cosine decoding for all), embedding dimension at

d{=}768

. Rows are privacy points; columns group mechanisms by dataset. SQuAD (Cosine) cells show cosine similarity. Yelp/AG News cells show accuracy.

Figure 5: The parameter $\tau$ serves as the critical decision boundary that classifies tokens as task-relevant or irrelevant based on their cosine similarity to the task representation. A sweep of $\tau$ reveals that downstream utility (measured by cosine similarity between original and privatized contexts) stabilizes around $\tau=0.5$ , indicating a robust operating point that preserves task-critical signals without over-perturbing the context.

Figure 6: STAMP vs. Uniform (single angular budget) under the Polar mechanism across three tasks: SQuAD (QA), Yelp (sentiment), and AG News (topic classification). Curves show task performance versus the base angular budget $\epsilon_{0}$ ; both frameworks use normalized polar mechanism and cosine decoding. STAMP variants (e.g., private-only, private-low, heuristic) retain higher utility by concentrating noise on sensitive, low-importance spans, while Uniform converges as noise vanishes at large $\epsilon_{0}$ .

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Qualitative comparison on a Yelp review (Sentiment Analysis) at a matched average privacy budget of $\bar{\epsilon}\approx 540$ . The privatized outputs shown (middle/bottom) are subsequently coherence-repaired via a constrained rewrite that preserves meaning and forbids adding external facts or inventing names/entities. Even after repair, the Uniform & Laplace baseline (bottom) collapses semantic structure and remains largely unintelligible. In contrast, STAMP & Polar (middle) preserves syntactic form and salient sentiment cues (e.g., “underwhelmed” and the explicit rating “three stars”), enabling correct sentiment inference despite local perturbations.

Figure 8: Qualitative comparison on an AG News article (Topic: Sci/Tech) at a matched average privacy budget of $\bar{\epsilon}\approx 490$ . The privatized outputs shown (middle/bottom) are subsequently coherence-repaired under the same constrained rewrite setting. Uniform & Laplace (bottom) yields near-complete information loss, producing a sequence of weakly related or unrelated tokens even after repair. STAMP & Polar (middle) successfully retains domain-specific terminology critical for topic classification (e.g., “Peptides”, “chemistry researcher”, “protein”), demonstrating stronger utility preservation under privacy.

Figure 9: Qualitative comparison on a Yelp review (Sentiment Analysis) at a matched average privacy budget of $\bar{\epsilon}\approx 540$ . The privatized outputs shown (middle/bottom) are subsequently coherence-repaired using the same constrained rewrite rule set. The Uniform & Laplace baseline (bottom) results in total semantic collapse, outputting a nonsensical sequence of tokens. Conversely, STAMP & Polar (middle) maintains narrative structure and key contextual anchors (e.g., “video games”, “ticket projects”, “packed”), enabling the downstream classifier to correctly interpret the review’s positive sentiment.

Figure 10: Qualitative comparison on an AG News article (Topic: Business) at a matched average privacy budget of $\bar{\epsilon}\approx 540$ . The privatized outputs shown (middle/bottom) are subsequently coherence-repaired via the same constrained rewrite process. The Uniform & Laplace baseline (bottom) results in complete obfuscation, producing a string of unrelated tokens. Meanwhile, STAMP & Polar (middle) preserves key legal/employment terminology—including “law strengthened job protections”, “active duty”, and “(USERRA)”—supporting correct topic classification under privacy constraints.

Privacy-Utility Tradeoff

Privacy-utility tradeoffs study how to limit disclosure of sensitive information while preserving useful data, models, and services.

See all 71 papers

Adaptive Text Anonymization: Learning Privacy-Utility Trade-offs via Prompt Optimization
Feb 24, 2026Gabriel Loiseau, Damien Sileo, Damien Riquet +2Privacy-Utility Tradeoff Prompt Optimization
Hornetsecurity, Hem, France · Univ. Lille, Inria, CNRS, Centrale Lille, UMR 9189 - CRIStAL, F-59000 Lille, France
PrivBench: A Holistic and Modular Benchmarking Platform for Evaluating Text-to-Text Privatization
Aug 30, 2026Stephen Meisenbacher, Andreea-Elena Bodea, Ahmet Bilal Akın +3Privacy-Preserving ML
Technical University of Munich, School of Computation, Information and Technology · Technical University of Munich, School of Social Sciences and Technology · Munich Center for Machine Learning, Munich, Germany +1
QuanText: Protecting Dataset-Level Secrets in Textual Data Sharing
Sep 16, 2026Shuaiqi Wang, Zinan Lin, Giulia FantiPrivacy-Preserving ML
Carnegie Mellon University · Microsoft Research

Feb 24, 2026J/K move · Enter open · S save

Adaptive Text Anonymization: Learning Privacy-Utility Trade-offs via Prompt Optimization

Gabriel Loiseau, Damien Sileo, Damien Riquet, Maxime Meyer+1

Hornetsecurity, Hem, France · Univ. Lille, Inria, CNRS, Centrale Lille, UMR 9189 - CRIStAL, F-59000 Lille, France

Privacy-Utility Tradeoff Prompt Optimization Privacy-Preserving Language Models

Open paper AskPDF arXiv

Anonymizing textual documents is a highly context-sensitive problem: the appropriate balance between privacy protection and utility preservation varies with the data domain, privacy objectives, and downstream application. However, existing anonymization methods rely on static, manually designed strategies that lack the flexibility to adjust to diverse requirements and often fail to generalize across domains. We introduce adaptive text anonymization, a new task formulation in which anonymization strategies are automatically adapted to specific privacy-utility requirements. We propose a framework for task-specific prompt optimization that automatically constructs anonymization instructions for language models, enabling adaptation to different privacy goals, domains, and downstream usage patterns. To evaluate our approach, we present a benchmark spanning five datasets with diverse domains, privacy constraints, and utility objectives. Across all evaluated settings, our framework consistently achieves a better privacy-utility trade-off than existing baselines, while remaining computationally efficient and effective on open-source language models, with performance comparable to larger closed-source models. Additionally, we show that our method can discover novel anonymization strategies that explore different points along the privacy-utility trade-off frontier.

Abstract

Privacy-Utility Tradeoff

Explore similar work

Adaptive Text Anonymization: Learning Privacy-Utility Trade-offs via Prompt Optimization

PrivBench: A Holistic and Modular Benchmarking Platform for Evaluating Text-to-Text Privatization

QuanText: Protecting Dataset-Level Secrets in Textual Data Sharing