Decoupled Learning and Selection in Slate Recommendation for Privacy and Stability Under Noisy Scores

Sam Urmian; Qinyi Liu; Mohammad Khalil

cs.LGSep 24, 2026

Decoupled Learning and Selection in Slate Recommendation for Privacy and Stability Under Noisy Scores

Authors: Sam Urmian, Qinyi Liu, Mohammad Khalil

Organizations: University of Bergen Centre for the Science of Learning & Technology (SLATE) · City University of Macau School of Education

Abstract

We formalize slate recommendation as a randomized score learner followed by deterministic selection. First, an appropriately scoped differential-privacy guarantee passes through selection and its audit trace by post-processing. End-to-end privacy holds only when selector inputs are public or independent, previous private outputs, or separately privacy-accounted; fixing raw state or candidate information instead yields only a conditional guarantee. Second, we derive a logged margin certificate: bounded score-induced objective movement below half the smallest greedy decision margin guarantees that the ordered slate is unchanged. Controlled fixed-margin tests show near-linear exponent scaling, with an empirical slope of $-0.220$ (95% CI $[-0.231,-0.210]$ ) against the independent-noise reference $-1/4$ . Real-anchor experiments on OULAD, MovieLens-25M, and Amazon Musical Instruments show that greater anchor weight reduces score-noise-induced ranking churn. OULAD and EdNet certificate checks validate the implementation of the logged inequality, while closed-loop simulations show bounded target drift and setting-dependent downstream utility. The contribution is therefore a privacy-scope contract and a certifiable score-to-slate stability mechanism, not a universal utility claim.

Figures & tables

Quantity	Plain meaning
$\Gamma$ or $\Gamma_{t}$	The smallest logged decision margin: how clearly the chosen item beat the closest runner-up.
$M$ or $M_{t}$	The largest score-induced movement in the selector objective.
$M<\Gamma/2$	A certificate that the ordered slate is unchanged.
$\gamma$	The gap between anchor top- $K$ items and the remaining candidates.
$w$	Anchor weight; larger $w$ gives the noisy adaptive score less influence.

Table 1 . Reading the stability quantities.

Claim being tested	Diagnostic	Strongest result
Top- $K$ exponent	Fixed-margin calibration under independent and low-rank correlated score noise	Independent noise: slope $-0.220$ (95% CI $[-0.231,-0.210]$ ) vs. reference $-0.250$ ( $R^{2}=0.998$ ). Correlated noise: slope $-0.506$ vs. reference $-0.500$ ( $R^{2}=0.997$ ).
Anchoring reduces raw ranking churn	Real-anchor sweeps on OULAD, MovieLens-25M, and Amazon Musical Instruments	Anchor weight $w=0.75$ cuts Flip@ $K$ by 53–81% across the three corpora and tested noise scales; rating-threshold sensitivity preserves the effect.
Pairwise noise condition	Injected-noise tails and descriptive 200-seed learner-update diagnostic	Normalized cross-boundary score differences stay below the sub-Gaussian envelope; shared seeds, pools, and scores make the repeated pair draws descriptive rather than independent observations.
Score-to-slate bridge	Ex post certificate-implementation checks on OULAD and EdNet	Anchor gaps and greedy margins are positive in all 640 logged pools. With candidates, state, bonuses, and novelty fixed, the realized $M_{t}$ check has zero instrumentation violations across 16,000 trials.
Target-value drift	Realized-window SCPO check and soft-window event logging	SCPO uses the exact realized-window envelope; for soft-window MMR, the fixed-window event holds on more than 98% of logged round pairs.
Downstream stress test	Nominal OULAD update configurations and explicit EdNet score-noise injection	The interpretable noise-injection result gives clean/noisy Kendall- $\tau$ of 0.928–0.993 anchored vs. 0.748–0.904 unanchored; utility changes remain mixed.

Table 2 . Main evidence map. Each row links one claim to the diagnostic that tests it most directly; downstream utility is reported separately because it also depends on simulator dynamics and optimization.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

	OULAD	EdNet
# Users	23,351	296,701
# Items	188	11,555
# Interactions	173,739	23,384,480
Density (‰)	39.58	6.82
Avg. interactions per user	7.44	78.8

Appendix

Table 3. Corpus summary. Density (‰) is interactions per thousand possible user–item pairs. Splits are user-stratified at random seed 42.

Setting	Standard	Strong	Locked
Approx. $\varepsilon$ ( $T=20$ )	$\approx 0.36$	$\approx 0.16$	$\approx 0.07$
Approx. $\varepsilon$ ( $T=50$ )	$\approx 0.58$	$\approx 0.26$	$\approx 0.11$
Clipping norm $C$	1.0	1.0	1.0
Noise multiplier $\sigma$	1.2	2.0	3.0
Sampling rate $q$	0.020	0.015	0.010
$\delta$	$10^{-5}$	$10^{-5}$	$10^{-5}$

Appendix

Table 4. Nominal privacy configurations recorded by the experimental harness. The accountant labels use the stated

(q,\sigma,\delta,T)

values, but the released artifact does not establish the sampler, population denominator, or protected-unit gradient aggregation needed to verify them as DP guarantees.

Family	Primary object usually analyzed	Usually outside the primary analysis	Relation to this paper
DP recommendation ( McSherry and Mironov, 2009 ; Abadi et al., 2016 ; Dwork and Roth, 2014 )	Privacy of the learned model or training algorithm	Deterministic post-layer, audit trace, and score-to-slate stability	Private regime lifts learner DP through a deterministic selector only under admissible/accounted side inputs
Re-ranking / slate construction ( Carbonell and Goldstein, 1998 ; Kunaver and Požrl, 2017 ; Steck, 2018 ; Singh and Joachims, 2018 ; Geyik et al., 2019 )	Deterministic slate objective for diversity, calibration, fairness, or novelty	Learner privacy and explicit scorer-noise model	This paper treats the selector as a bounded surface and studies how it composes with learner privacy and score stability
Contextual & private bandits ( Li et al., 2010 ; Chu and Li, 2011 ; Abbasi-Yadkori et al., 2011 ; Shariff and Sheffet, 2018 ; Mishra and Thakurta, 2015 )	Exploration/regret, sometimes with privacy built into the bandit	Replayable deterministic selection layer and shaped/diverse slate assembly	Proposition 10 recovers LinUCB only in the reduced exploration-only regime
Safe / constrained RL for recs ( Ie et al., 2019 ; Achiam et al., 2017 )	Constraint satisfaction inside a learned policy	Privacy composition and deterministic audit replay	Lemma 4 gives a selector-side drift bound under window enforcement without retraining the learner
Off-policy learning / evaluation ( Swaminathan and Joachims, 2015 )	Estimating or optimizing policy value from logged data	Structural privacy/audit/stability guarantees of the deployed post-layer	Complementary: such estimators could train $\mathcal{L}$ before the deterministic selector is applied
Governance / responsible AI ( Slade and Prinsloo, 2013 ; Drachsler and Greller, 2016 ; Mitchell et al., 2019 )	Documentation, review, and process artifacts	Formal algorithmic replay and privacy accounting	The audit trace is a formal decision artifact that governance processes could inspect

Appendix

Table 5. Analytic object emphasized by related families. The entries describe what each family usually studies, not whether the family is deficient.

Quantity	Mean	Median	Positive rate	Near-zero rate
$\gamma$	0.08462	0.05775	1.000	0.000
$\Gamma_{t}$	0.0008477	0.0007332	1.000	0.000

Appendix

Table 12 . OULAD positive-margin gate for the selector-margin certificate. The raw anchor gap

\gamma

and greedy selector margin

\Gamma_{t}

are positive in all logged records, but

\Gamma_{t}

is small, so certificate usefulness depends on small perturbation envelopes.

$\sigma_{\mathrm{pert}}$	Certified	Same order	Same set	Median $M_{t}/\Gamma_{t}$
5e-05	0.9962	1	1	0.1343
0.0001	0.9844	1	1	0.2698
0.0002	0.4306	0.9975	0.9988	0.537
0.0005	0.01188	0.9125	0.9975	1.347
0.001	0	0.6569	0.9875	2.725

Appendix

Table 13 . OULAD selector-margin perturbation check. Certified means

M_{t}<\Gamma_{t}/2

under the fixed-bonus envelope. Certified violations are zero across all 8,000 perturbation trials.

Quantity	Mean	Median	Positive rate	Near-zero rate
$\gamma$	0.01007	0.00706	1.000	0.000
$\Gamma_{t}$	0.0003949	0.0002794	1.000	0.000

Appendix

Table 14 . EdNet positive-margin gate for the selector-margin certificate. The raw anchor gap

\gamma

and greedy selector margin

\Gamma_{t}

are positive in all logged records.

$\sigma_{\mathrm{pert}}$	Certified	Same order	Same set	Median $M_{t}/\Gamma_{t}$
5e-05	0.5931	0.9519	0.9775	0.3442
0.0001	0.3944	0.8925	0.9587	0.682
0.0002	0.1856	0.8275	0.9375	1.387
0.0005	0.003125	0.6669	0.8962	3.452
0.001	0	0.4275	0.8225	7.198

Appendix

Table 15 . EdNet selector-margin perturbation check. Certified means

M_{t}<\Gamma_{t}/2

under the fixed-bonus envelope. Certified violations are zero across all perturbation trials.

Explore similar work

ScoreShield: Differentially Private Release of Similarity Scores
Jul 27, 2026Behrooz Razeghi, Parsa RahimiΔ)$-Differential Privacy Membership Inference Attacks
School of Engineering and Applied Sciences, Harvard University · School of Engineering, École Polytechnique Fédérale de Lausanne (EPFL)
Smooth Partial Lotteries for Stable Randomized Selection
May 19, 2026Alexander Goldberg, Giulia Fanti, Nihar B. ShahLotteries Submodular Functions
Carnegie Mellon University
Meta-Learning and Targeted Differential Privacy to Improve the Accuracy-Privacy Trade-off in Recommendations
Apr 29, 2026Peter Müllner, Dominik Kowald, Markus Schedl +1Privacy-Utility Trade-Offs Privacy
Know Center Research GmbH · Graz, Austria · Know Center Research GmbH & University of Graz +3

Jul 27, 2026, cs.IRJ/K move · Enter open · S save

ScoreShield: Differentially Private Release of Similarity Scores

Behrooz Razeghi, Parsa Rahimi

School of Engineering and Applied Sciences, Harvard University · School of Engineering, École Polytechnique Fédérale de Lausanne (EPFL)

Δ)$-Differential Privacy Membership Inference Attacks Cosine Similarity Similarity and Metrics Scores Release

Open paper AskPDF arXiv

A growing number of applications, such as biometrics and retrieval-augmented generation (RAG), rely on cosine similarity scores computed between vector embeddings of text, images, or audio. These systems return similarity scores through their APIs for ranking and verification. However, such releases can leak information about individual records and enable membership inference attacks. While differential privacy (DP) provides a principled metric for quantifying attack risks, naïve application of DP mechanisms---such as adding i.i.d. Gaussian noise to vector entries---leads to excessive distortion (i.e., low utility) at a given privacy constraint that scales poorly with the number of released scores. We propose \textsc{ScoreShield}, a perturb-then-project mechanism that adds Gaussian noise calibrated to global sensitivity of the chosen score release regime and then projects the result onto the feasibility set of valid cosine objects. \textsc{ScoreShield} satisfies

(\varepsilon,δ)

-DP for releasing similarity score vectors and Gram matrices. We provide utility guarantees for the exact Frobenius metric projection used in the risk analysis, and prove convergence to feasibility for the practical averaged alternating-projection solver used for large-scale Gram releases. For full pairwise cosine Gram release under record-level replacement adjacency, the exact-projection bound improves the

n

-dependence of squared Frobenius risk from

Θ(n^3)

for the naïve Gaussian baseline to

\mathcal{O}(n^2)

for fixed privacy parameters, with sharper local bounds at low-rank Grams. We evaluate the mechanism across RAG, face recognition, semantic retrieval, image similarity, and recommender-system tasks.

Abstract

Explore similar work

ScoreShield: Differentially Private Release of Similarity Scores

Smooth Partial Lotteries for Stable Randomized Selection

Meta-Learning and Targeted Differential Privacy to Improve the Accuracy-Privacy Trade-off in Recommendations