SHIP: Structured and Hierarchical Insight with Privacy

Kai Chen; Guisi Ni; Albert Cheu; Kassem Fawaz; Yuzheng Hu; Ryan McKenna; Peter Kairouz

cs.CLOct 15, 2026

SHIP: Structured and Hierarchical Insight with Privacy

Authors: Kai Chen, Guisi Ni, Albert Cheu, Kassem Fawaz, Yuzheng Hu, Ryan McKenna, Peter Kairouz

Organizations: University of Virginia · Google Research

Abstract

Extracting insights from textual data while protecting user privacy is increasingly important. Existing methods produce private insights in diverse forms for different analytical purposes, making their utility difficult to assess and compare. In this work, we formulate differentially private (DP) insights as reusable representations for answering analytical queries, providing a common basis for utility assessment. Answering these queries, however, requires fine-grained details and cross-attribute statistics that existing representations may omit. To capture this information, we introduce Structured and Hierarchical Insight with Privacy (SHIP), which automatically maps queries to attributes, builds a hierarchical hybrid taxonomy, and releases a DP synthetic table for further analysis. We also develop an evaluation protocol based primarily on QA performance and structured fidelity. Our experiments demonstrate SHIP's strong performance on both measures relative to existing private insight baselines, while identifying queries that remain challenging for structured representations.

Figures & tables

Method	DP	Depth	Breadth	Open-Set	Workload
Clio	✗	✓	✗	✓	✗
Urania	✓	✓	✗	✓	✗
Chatterji et al.	✗	✗	✓	✗	✗
Flat-Open	✓	✗	✗	✓	✗
Flat-Close	✓	✗	✓	✗	✗
SHIP (Ours)	✓	✓	✓	✓	✓

Table 1: Taxonomy of insight extraction paradigms across five core capabilities: Clio ( Tamkin et al., 2024 ) , Urania ( Liu et al., 2025 ) , Chatterji et al. (2025) , Flat-Open ( Cheu et al., 2025 ) , Flat-Close ( Hu et al., 2025 ) , and SHIP.

Figure 1: An illustration of SHIP’s taxonomy building step. The hierarchical taxonomy originates from the top-level attribute set, integrating with open-set categories (blue) with complementary close-set categories (green) for multi-level categorization.

$\varepsilon\quad\;\;$	Algorithm	WildChat						SynChat
		Single-Attr		Multi-Attr		Overall		Single-Attr		Multi-Attr		Overall
		Avg Score	Acc	Avg Score	Acc	Avg Score	Acc	Avg Score	Acc	Avg Score	Acc	Avg Score	Acc
1.0	Urania	1.27	6.0	1.24	6.0	1.26	6.0	1.27	6.7	1.10	0.0	1.18	3.3
	Flat-Close	2.43	32.7	2.59	37.3	2.51	35.0	1.81	20.0	1.70	17.3	1.76	18.7
	Flat-Open	3.01	46.0	3.13	44.7	3.07	45.3	2.27	30.7	1.88	21.3	2.07	26.0
	SHIP (Ours)	4.05	72.7	3.56	53.3	3.80	63.0	3.54	59.3	4.41	83.3	3.97	71.3

Table 2: Deterministic query-answering evaluation across single- and multi-attribute questions on WildChat and SynChat under varying privacy budgets

\varepsilon

. We report average score (1-5 scale

\uparrow

) and accuracy (

\text{Score}\geq 4

\%\uparrow

Figure 2: Precision, Recall, and

F_{1}

in open-ended query-answering evaluation across WildChat (top row) and SynChat (bottom row) under privacy budgets

\varepsilon\in\{1,5,10\}

. Dotted background curves denote iso-

F_{1}

contours.

$\varepsilon$	Algorithm	CFPB		ChatDoctor		WildChat
$\varepsilon$	Algorithm	1-way Div $\downarrow$	2-way Div $\downarrow$	1-way Div $\downarrow$	2-way Div $\downarrow$	1-way Div $\downarrow$	2-way Div $\downarrow$
1.0	Flat-Close	0.2215	0.3469	0.1142	0.1917	0.1696	0.2966
	Flat-Open	0.1581	0.2529	0.1178	0.1831	0.1581	0.2585
	Hie-Close	0.1465	0.2182	0.0745	0.1139	0.1564	0.2353
	Hie-Open	0.1314	0.1980	0.0900	0.1396	0.1324	0.2155
	SHIP (Ours)	0.1313	0.1896	0.0762	0.1129	0.1201	0.1942

Table 3: Distribution fidelity (Sinkhorn divergence

\downarrow

) across datasets under varying privacy budgets

\varepsilon

Figure 3: Distribution of the number of topics per session in SynChat_topic, obtained from real dataset and SHIP (

\varepsilon=10

). “Allocated” is SHIP’s per-record category assignment, “synthetic” refers to the output of its DP tabular synthesizer.

Dataset	Records	Mid-Tokens	95%-Tokens	Open-ended Workload
WildChat	838k	1,061	4,463	{What are the users’ primary task intents and topic domains, what specific constraints or output formatting requirements are requested, and what types of solutions or response strategies do the assistants provide to resolve the requests?}
ChatDoctor	112k	252	531	{What are the users’ primary symptoms and chief complaints, and for those symptoms, what diagnostic tests or examinations do the doctors suggest, and what are the doctors’ diagnosis conclusions?}
CFPB	10k	192	885	{What are the primary problems or grievances encountered by the users, and what specific inquiries, requests, or corrective actions do the users seek to resolve the issues?}
SynChat	10k	217	636	[Same as WildChat]
SynChat_topic	10k	532	879	{Which topics come up in each conversation session? For sessions covering several topics, what are the most common complete paths from the first topic to the last, and how often does each occur?}

Table 4: The summary of four investigated datasets. Mid-tokens refer to the median number of tokens, and 95%-tokens mean the 95% percentile of token numbers. The token size statistics are calculated using Sentence-T5-base .

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Category	Query Content
Single-Attribute Yes/No	Query: Across all user interactions, do direct information retrieval and text transformation tasks collectively constitute more than 65% of all primary user intents? Answer: Yes.
Single-Attribute Comparison	Query: Across user conversation intents, do users more frequently ask the assistant to modify, summarize, or transform existing text, or to generate original creative writing pieces? Answer: Transforming and modifying existing text.
Single-Attribute Ask for Number	Query: Within user requests aimed at modifying and transforming existing text, what proportion specifically request content summarization into condensed formats such as bullet point extractions, executive summaries, or single-sentence abstracts? Answer: 0.3994 (39.94%).
Multi-Attribute Yes/No	Query: Among user requests focused on software coding tasks (such as code generation, bug fixing, performance optimization, and unit testing), does the computer programming topic domain account for more than 35% of all conversations? Answer: Yes.
Multi-Attribute Comparison	Query: When users engage with topics in computer programming, do their requests more frequently involve text transformation tasks (such as summarization, translation, paraphrasing, and proofreading) or creative writing tasks (such as narrative fiction, poetry, scriptwriting, and roleplay)? Answer: Text transformation tasks.
Multi-Attribute Ask for Number	Query: In discussions focused on the mathematics domain (covering geometry, calculus, number theory, and probability and statistics), what proportion of assistant responses adopt a clarification-seeking strategy (such as disambiguation, slot filling, preference elicitation, or intent confirmation)? Answer: 0.2003 (20.03%).

Appendix

Table 5: Several examples of deterministic queries on SynChat with standard answers. We present one example for each query category (single- or multi-attributes

\times

query type).

Raw Dialogue	Algorithm & Categorization
user : Can you proofread this calculus passage and fix the punctuation errors, while also organizing your final explanations using a markdown table? Here is the draft: The derivative in differential calculus measures the rate of change. It derives from the Latin word differentia meaning difference. ai : Here is the corrected text with proper punctuation, followed by a breakdown of the etymological origin presented as a markdown table: The derivative, in differential calculus, measures the rate of change. It derives from the Latin word differentia , meaning difference. \| Term \| Language of Origin \| Etymological Meaning \| \| :— \| :— \| :— \| \| Derivative \| Latin (derivativus) \| To draw off, lead down, or derive from a source \| \| Differential \| Latin (differentia) \| A variance, distinction, or difference between quantities \| user : That table is very clear, thank you. Could you double-check if any extra punctuation marks are missing around the word differentia? ai : The punctuation is correct as written. To be thorough, the term differential calculus itself originates from the Latin differentia , where the root relates to the infinitesimal differences studied in calculus.	Ground Truth • Intent: text transformation > proofreading > punctuation correction • Topic: mathematics > calculus > differential calculus • Constraint: output_format > tabular_format > markdown_table • Strategy: direct_information > factual_definition > etymological_origin
	SHIP • Intent: text editing > proofreading & correction > punctuation correction • Topic: stem > mathematics in stem > mathematical calculus • Constraint: formatting and structure > tabular formatting > markdown table • Strategy: direct answer > correction > linguistic correction
	Flat-Close • Intent: text processing • Topic: stem • Constraint: formatting and structure • Strategy: structured presentation
	Flat-Open • Intent: text editing • Topic: stem • Constraint: formatting • Strategy: step-by-step explanation
	Urania • Cluster: Technical Mathematics, Precise Translation, and Backend Development • Keywords: mathematical definition, literal translation, ... • Description: User queries spanning advanced mathematics, precise linguistic translation, and backend development. Users seek rigorous mathematical definitions in differential geometry and calculus, literal translations under length constraints, and ...

Appendix

Table 6: Case study from SynChat (

\varepsilon=10

) illustrating categorization across algorithms. SHIP discovers hierarchical paths across all four orthogonal dimensions, whereas Flat-Close and Flat-Open use 1-level labels, and Urania outputs an unstructured text cluster descriptor.

Query & Ground Truth	SHIP (Ours)	Flat-Close	Flat-Open	Urania
Query: Across the entire dataset, when users specify constraints on their requests, do they more frequently demand specific output formatting requirements or enforce explicit length limits? Answer: Output formatting	Formatting rules Score: 5/5 ✓	Formatting rules Score: 5/5 ✓	Formatting rules Score: 5/5 ✓	Formatting rules Score: 5/5 ✓
Query: Within web development conversations in computer programming, what proportion of user requests specify tabular presentation formats in their output constraints? Answer: 16.07%	15.91% Score: 5/5 ✓	“I don’t know” Score: 1/5 $\times$	“I don’t know” Score: 1/5 $\times$	“I don’t know” Score: 1/5 $\times$
Query: Across user requests with a primary intent of software coding, what proportion specify output format constraints? Answer: 41.77%	43.15% Score: 5/5 ✓	39.80% Score: 5/5 ✓	21.40% Score: 2/5 $\times$	62.80% Score: 2/5 $\times$
Query: Within web development topic discussions under computer programming, what proportion of queries concentrate on frontend component development and UI construction? Answer: 6.73%	“I don’t know” Score: 1/5 $\times$	“I don’t know” Score: 1/5 $\times$	“I don’t know” Score: 1/5 $\times$	“I don’t know” Score: 1/5 $\times$

Appendix

Table 7: Case studies of deterministic query evaluation on SynChat (

\varepsilon=10

) across different structural paradigms. We provide representative examples: (1) Macro Shallow Query : Top-level distributions are accurately captured by all methods. (2) Hierarchical Query : Fine-grained subcategories are correctly resolved by SHIP via hierarchical taxonomy, whereas flat baselines collapse and fail. (3) Cross-Attribute Joint Query : Tabular representations with orthogonal attribute axes (SHIP and Flat-Close ) accurately evaluate bivariate cross-tabulations, whereas 1D semantic clustering ( Urania ) entangles dimensions and fails. (4) Highly Detailed Query : Excessively fine-grained joint conditions lead to failure across all methods.

$\varepsilon\quad\;\;$	Algorithm	WildChat			SynChat
$\varepsilon\quad\;\;$	Algorithm	Recall	Precision	$F_{1}$	Recall	Precision	$F_{1}$
1.0	Urania	$5.6_{\pm 4.3}$	$67.6_{\pm 20.7}$	$9.3_{\pm 6.4}$	$17.7_{\pm 21.7}$	$65.3_{\pm 19.1}$	$22.9_{\pm 22.4}$
	Flat-Close	$76.2_{\pm 10.4}$	$70.0_{\pm 17.3}$	$71.3_{\pm 10.0}$	$42.3_{\pm 14.6}$	$53.7_{\pm 5.3}$	$45.9_{\pm 8.7}$
	Flat-Open	$76.4_{\pm 9.0}$	$68.9_{\pm 17.7}$	$71.1_{\pm 12.7}$	$41.6_{\pm 13.8}$	$65.1_{\pm 16.8}$	$49.3_{\pm 13.1}$
	SHIP (Ours)	$\textbf{86.3}_{\pm 5.1}$	$\textbf{80.8}_{\pm 8.5}$	$\textbf{83.2}_{\pm 4.5}$	$\textbf{66.2}_{\pm 12.9}$	$\textbf{69.2}_{\pm 14.3}$	$\textbf{67.0}_{\pm 11.7}$
5.0	Urania	$18.4_{\pm 21.0}$	$63.3_{\pm 17.2}$	$22.6_{\pm 23.3}$	$19.9_{\pm 12.8}$	$\textbf{81.3}_{\pm 6.6}$	$29.5_{\pm 16.9}$

Appendix

Table 8: Open-ended query-answering evaluation across analytical conclusion statements on WildChat and SynChat under varying privacy budgets

\varepsilon

. We report Recall (

\text{Score}\geq 4

\%\uparrow

), Precision (

\text{Score}\geq 4

\%\uparrow

), and primary

F_{1}

score (

\text{Score}\geq 4

\%\uparrow

), together with their standard deviations.

Generated Report (Compacted)

Extracted Statement Examples

SHIP: ## Executive Summary Empirical investigation reveals a structured ecosystem of user inquiries, cognitive intents, domain distributions, and assistant strategies ... ## Macro Domain Breakdown * User Intent: Anchored in Information Seeking (

\approx 43\%

), followed by Text Editing (

\approx 22\%

), Creative Writing (

\approx 18\%

), and Coding (

\approx 15\%

) ... ## In-Depth Single- & Multi-Attribute Analysis * Intent-Domain Synergy: STEM-driven information seeking represents the single largest cross-attribute intersection in the dataset ... ## Strategic Takeaways 1. Technical Specialization: STEM (

\approx 68\%

) and Information Seeking (

\approx 43\%

) mandate rigorous factual verification and step-by-step derivations ...

• Information seeking accounts for roughly 43% of all conversational interactions. • STEM disciplines command roughly 68% of all inquiries. • Within computer science topics, software engineering and database administration dominate the volumetric load. • In mathematics, geometry and calculus inquiries drive detailed analytical requests. • STEM-driven information seeking represents the single largest intersection in the dataset. • Technical coding tasks frequently incorporate rigorous formatting constraints, such as requiring code blocks or diff patches, alongside computational constraints. … (69 total decomposed statements)

Flat-Close: ## Executive Summary Investigation into chat conversations reveals dialogues spanning cognitive goals, thematic domains, and operational constraints ... ## Macro Domain Breakdown * User Intent: Information seeking and content generation represent the dominant volume drivers, accounting for nearly half of all prompts ... ## In-Depth Single- & Multi-Attribute Analysis * Cross-Tabulation: Coding prompts within STEM almost universally trigger executable code delivery with step-by-step debugging explanations ... ## Strategic Takeaways 1. Programmable Interfaces: High prevalence of formatting constraints indicates users view chat assistants as programmable tools ...

• Information seeking and content generation represent the most dominant volume drivers, accounting for nearly half of all user prompts. • Technical and professional domains (STEM and productivity) dominate the thematic distribution across topical domains. • Formatting and structure constraints, such as markdown tables and JSON schemas, represent a major constraint category. • When users initiate programming tasks within the STEM domain, assistants almost universally respond with executable code blocks and step-by-step explanations. • Creative or professional writing within business or humanities simultaneously invokes tone/style and length constraints in roughly two-thirds of cases. … (59 total decomposed statements)

Appendix

Table 9: Compacted analytical reports generated by SHIP and Flat-Close (

\varepsilon=10.0

) on SynChat and representative extracted atomic statements (Round 1 of evaluation). We showcase representative statements demonstrating macro distributions, fine-grained leaf details, and cross-attribute interactions.

Generated Report (Compacted)

Extracted Statement Examples

Flat-Open: ## Executive Summary Dialogues are anchored in information seeking and creative writing, with STEM serving as the thematic backbone capturing over two-thirds of allocations ... ## Single-Attribute Distribution Breakdown * User Intent: Information Seeking accounts for

\approx 30.3\%

, followed by Creative Writing (

\approx 17.1\%

), Reasoning (

\approx 11.0\%

), and Code Generation (

\approx 10.6\%

) ... ## Multi-Attribute Relationships & Cross-Tabulations * Intent-Domain Dynamics: Within Code Generation and Debugging, the STEM domain captures over

85\%

of instances ... ## Strategic Takeaways 1. Ecosystem Specialization: Rigorous technical problem-solving (STEM + Code Generation) coexists with extensive creative workflows ...

• Information seeking represents the single largest intent category, accounting for approximately 30.3% of all interactions. • STEM topics dominate the entire conversation corpus, accounting for approximately 68.8% of all topic assignments. • Formatting constraints govern approximately 43.1% of all interactions where user constraints are specified. • Within code generation and debugging, the STEM domain captures over 85% of instances. • Humanities topics capture roughly 20% to 22% of creative and editing workflows. … (67 total decomposed statements)

Urania: ## Executive Summary The dataset demonstrates an orientation toward complex problem-solving where technical computing, formal sciences, and creative tasks intersect ... ## Macro Domain Breakdown * Root Cluster 94 ( $\approx 29.4\%$ ): Software Engineering, Mathematics, Linguistics, and Creative Writing (merges poetry, Python scripts, and transliteration) ... ## Granular Topic & Keyword Analysis * Mathematical Reasoning: Prominence of ‘euclidean geometry‘ (

\approx 243.5

) and ‘differential calculus‘ (

\approx 176.5

), coupled with ‘markdown table‘ (

\approx 151.5

) ... ## Strategic Takeaways 1. Multi-Constraint Integration: Users rarely separate technical computation from presentation formatting; math queries demand code and markdown tables ...

• Software engineering, mathematics, linguistics, and creative writing represent the largest single macro-domain at approximately 29.4% of total volume. • Advanced mathematics, technical computing, and structured formatting account for approximately 26.5% of all interactions. • Mathematical inquiries in Root Cluster 1 focus on Euclidean and analytic geometry, differential calculus, and the Riemann zeta function. • Enterprise data architecture topics in Root Cluster 63 include PostgreSQL database migration, schema design, and query optimization. • Key thematic drivers in technical workflow clusters include version control, git reset, backend API development, and web state management. … (47 total decomposed statements)

Appendix

Table 10: Compacted analytical reports generated by Flat-Open and Urania (

\varepsilon=10.0

) on SynChat and representative extracted atomic statements (Round 1 of evaluation). We showcase representative statements illustrating open extracted distributions, entangled macro clusters, and keyword-level granular topics.

Raw Dialogue (Compressed)

Algorithm & Categorization

user: I am looking at an H-NMR spectrum for an unknown organic compound with the molecular formula C4H8O2. There is a triplet at 1.2 ppm, a quartet at 4.1 ppm, a singlet at 2.0 ppm … Can you help me piece this together? … user: On a completely different matter, we are heading into trial preparations for a breach of contract case, and opposing counsel just served a massive batch of unorganized emails. What is the best way to handle this electronic discovery dump? … user: This legal wrangling is tedious … Let’s talk about something entirely different. What are the key turning points in the early political career of Alexander Hamilton?

Ground Truth • Topic path (level-1 categories only): chemistry

\rightarrow

litigation

\rightarrow

history SHIP • Topic path (level-1 categories only): chemistry

\rightarrow

law

\rightarrow

history

user: I have a monolithic function in my Python backend …How should I break this down to follow the single responsibility principle? … user: While sorting out those backend services, I also need to record our petty cash expenditures and reconcile the February bank statement. … user: Speaking of discrepancies, my Diels-Alder reaction keeps yielding the wrong stereoisomer. How can I control endo and exo selectivity? … user: That chemistry problem is getting too complicated. Instead, I need to draft a request to the judge to throw out the plaintiff’s complaint. … user: This legal drafting is overwhelming …drop this entire line of questioning. How do modern historians analyze the biases in 19th-century colonial archives?

Ground Truth • Topic path (level-1 categories only): programming

\rightarrow

finance

\rightarrow

chemistry

\rightarrow

litigation

\rightarrow

history SHIP • Topic path (level-1 categories only): programming

Appendix

Table 11: Case study from SynChat_topic (

\varepsilon=10

). The conversation moves through several unrelated domains. The second column includes the real categorizations and those by SHIP; “

\rightarrow

” denotes a topic switch.

$\varepsilon$	Level	Open-Set	Close-Set	Other & None
$1.0$	L0	13.5 (83.9%)	4.5 (2.5%)	1.8 (13.7%)
	L1	35.8 (80.2%)	43.0 (8.3%)	23.0 (11.5%)
	L2	29.8 (46.7%)	152.0 (37.6%)	74.0 (15.7%)
$5.0$	L0	16.3 (86.5%)	4.3 (1.0%)	1.8 (12.5%)
	L1	52.8 (89.3%)	37.3 (5.8%)	24.8 (5.0%)
	L2	55.0 (55.5%)	137.5 (32.1%)	93.0 (12.3%)

Appendix

Table 12: Average category counts and allocated records across attributes on WildChat.

$\varepsilon\quad\;\;$	Comparison	WildChat		SynChat		CFPB		ChatDoctor
$\varepsilon\quad\;\;$	Comparison	Score	$\text{Score}_{w}$	Score	$\text{Score}_{w}$	Score	$\text{Score}_{w}$	Score	$\text{Score}_{w}$
1.0	SHIP vs. Urania	$4.570$	$4.714$	$4.786$	$4.781$	$4.208$	$4.236$	$4.541$	$4.689$
	SHIP vs. Flat-Close	$3.912$	$3.754$	$4.158$	$4.155$	$4.122$	$4.182$	$3.435$	$3.757$
	SHIP vs. Flat-Open	$3.793$	$3.768$	$4.136$	$4.159$	$3.893$	$4.083$	$3.645$	$3.851$
5.0	SHIP vs. Urania	$4.478$	$4.687$	$4.819$	$4.772$	$4.481$	$4.427$	$4.463$	$4.603$
	SHIP vs. Flat-Close	$4.004$	$3.944$	$4.418$	$4.413$	$4.315$	$4.378$	$3.499$	$3.839$

Appendix

Table 13: Record-level pairwise preference evaluation of SHIP against each baseline across four datasets under varying privacy budgets

\varepsilon

. Each cell is the average judge preference score on a 1-5 scale oriented toward SHIP:

5

strongly prefers SHIP,

3

is neutral, and

1

strongly prefers the baseline, so values above

3

favour SHIP (

\uparrow

). Score denotes the workload-unaware judgement and

\text{Score}_{w}

the workload-aware judgement.

$\varepsilon$	Gemini		Sonnet
$\varepsilon$	Avg Score	Acc (%)	Avg Score	Acc (%)
1.0	3.97	71.3	4.00	71.0
5.0	4.04	72.0	3.99	71.7
10.0	3.82	67.0	3.81	68.0

Appendix

Table 14: Deterministic QA results with different QA agent models on SynChat.

Query: Among user conversation constraints specifying output formatting, do list format requests (such as bulleted lists, numbered lists, checklists, and description lists) exceed 45% of all output formatting constraints?
Code	STDOUT
Step 1: Identify the reference population and inspect its categories.
formatting_rows = df[ df[’user_constraints (level 1)’] == ’formatting’ ] print(f"Total formatting constraint rows: {len(formatting_rows)}") print( formatting_rows[’user_constraints (level 2)’] .value_counts(dropna=False) ) print( formatting_rows[’user_constraints (level 3)’] .value_counts(dropna=False) )	Total formatting constraint rows: 4677 user_constraints (level 2) bullet points: 241 numbered list formatting: 107 checklist formatting: 100 [other categories omitted] user_constraints (level 3) bulleted list: 349 numbered list structured output: 247 general bullet points: 178 checklist structured output: 100 markdown checklist: 91 numbering style constraint: 73 [other categories omitted]
Step 2: Combine matching categories across levels and calculate the proportion.
df_formatting = formatting_rows list_formatting_count = len(df_formatting[ df_formatting[’user_constraints (level 2)’].isin([ ’bullet points’, ’numbered list formatting’, ’checklist formatting’ ]) \| df_formatting[’user_constraints (level 3)’] .str.contains( ’bullet\|list\|checklist\|numbered’, case=False, na=False ) ]) print( f"List formatting constraints count: " f"{list_formatting_count} / " f"{len(formatting_rows)} = " f"{list_formatting_count/len(formatting_rows)*100:.2f}%" )	List formatting constraints count: 1144 / 4677 = 24.46%
Final answer: No. List format requests account for 1,144 out of 4,677 output formatting constraint rows in the released DP synthetic table (24.46%), which does not exceed 45%.

Appendix

Table 15: Example QA agent execution trace involving scope resolution and category aggregation across taxonomy levels. Resource loading and unrelated code and outputs are omitted.

Panel of Figure 4 — Figure 4: The prompts used for proposing categories for multiple attributes.

Panel of Figure 5 — Figure 5: The prompts used for re-classifying text based on complementary categories.

Panel of Figure 6 — Figure 6: The prompts used for generating complementary categories.

Panel of Figure 7 — Figure 7: The prompts used for de-duplicating proposed and survived categories.

Panel of Figure 8 — Figure 8: The prompts used for scoring the query answers or the statements.

Differentially Private Synthetic Data Generation

See all 21 papers

Sep 14, 2026

Differentially Private Semantic Plans for Aggregate Insight Generation

URANIA provides end-to-end differential privacy (DP) for summaries of data-dependent clusters. However, its cluster--keyword release does not directly provide collection-wide aggregates for semantic concepts defined independently of the protected corpus. Records may express several concepts, records expressing the same concept may be assigned to different clusters, and cluster identities need not correspond across analyses. Consequently, cluster-level statistics do not directly provide comparable measurements of predefined concepts across collections or repeated analyses. We introduce DP-SPIN, a trusted-curator framework for aggregate measurement and summarization over semantic concepts fixed independently of the protected target records. Each record is mapped to a bounded sparse nonnegative vector over these concepts, whose sum forms a semantic sketch. A differentially private mechanism releases a semantic plan containing admitted concepts and noisy masses; normalized semantic-support values and support bins are obtained by post-processing. For user-level privacy, each user's aggregate contribution is clipped to a fixed bound. The language model receives only the plan and fixed decoding instructions, while a public verifier checks concept mentions, reported values, comparisons, and rank claims against the released plan. The final summary is differentially private by post-processing. We establish record- and user-level DP guarantees under add/drop and replacement adjacency. We evaluate DP-SPIN under record-level privacy on CFPB complaint narratives, Amazon All Beauty reviews, and Yelp restaurant reviews, and under user-level privacy on Amazon and Yelp. We compare DP-SPIN with non-private plan and summary references, DP keyword and category histogram baselines, and a URANIA-style baseline with a fixed public keyword vocabulary.

Behrooz Razeghi

School of Engineering and Applied Sciences, Harvard University

Privacy-Preserving Language Models Privacy-Preserving ML Differential Privacy

Ask PDF

Sep 16, 2026

QuanText: Protecting Dataset-Level Secrets in Textual Data Sharing

Natural-language datasets support many downstream applications and research studies, but releasing text can reveal sensitive global properties of the underlying data source, such as the proportion of records associated with a particular gender, diagnosis, or political stance. Existing work has largely focused on property inference attacks that recover such global properties, while defenses for protecting these dataset-level secrets remain limited. Differential privacy, although effective for protecting individual records, provides only weak protection for aggregate properties. We propose Randomized Quantization for Text (QuanText), a training-free and large-language-model-agnostic data release mechanism that protects global secrets in textual datasets while preserving data utility. Given a dataset-level secret, such as the proportion of records with a particular diagnosis, and attributes whose utility should be preserved, such as topic and sentiment, QuanText perturbs both the secret distribution and the distributions of correlated attributes. It does so by constructing candidate release distributions over secret and non-secret attributes, randomly selecting a candidate sufficiently close to the private empirical distribution, and rewriting each private text sample to match the selected distribution using attribute-related snippets from the original text. QuanText is inspired by the Statistic Maximal Leakage (SML) framework, which bounds leakage about a secret function of a data distribution. Under idealized conditions, we show that QuanText satisfies an SML guarantee. Since these conditions may not hold exactly in practice, we also evaluate QuanText empirically on real-world datasets. Our results show that QuanText achieves a better empirical privacy-utility trade-off than competing data generation baselines.

Shuaiqi Wang, Zinan Lin, Giulia Fanti

Carnegie Mellon University · Microsoft Research

Privacy-Preserving ML

Ask PDF

Feb 26, 2026

DPSQL+: A Differentially Private SQL Library with a Minimum Frequency Rule

SQL is the de facto interface for exploratory data analysis; however, releasing exact query results can expose sensitive information through membership or attribute inference attacks. Differential privacy (DP) provides rigorous privacy guarantees, but in practice, DP alone may not satisfy governance requirements such as the minimum frequency rule, which requires each released group (cell) to include contributions from at least

k

distinct individuals. In this paper, we present DPSQL+, a privacy-preserving SQL library that simultaneously enforces user-level

(\varepsilon,δ)

-DP and the minimum frequency rule. DPSQL+ adopts a modular architecture consisting of: (i) a Validator that statically restricts queries to a DP-safe subset of SQL; (ii) an Accountant that consistently tracks cumulative privacy loss across multiple queries; and (iii) a Backend that interfaces with various database engines, ensuring portability and extensibility. Experiments on the TPC-H benchmark demonstrate that DPSQL+ achieves practical accuracy across a wide range of analytical workloads -- from basic aggregates to quadratic statistics and join operations -- and allows substantially more queries under a fixed global privacy budget than prior libraries in our evaluation.

Tomoya Matsumoto, Shokichi Takakura, Shun Takagi +1

LY Corporation

Differential Privacy Relational Databases

Ask PDF

Abstract

Differentially Private Synthetic Data Generation

Explore similar work

Differentially Private Semantic Plans for Aggregate Insight Generation

QuanText: Protecting Dataset-Level Secrets in Textual Data Sharing

DPSQL+: A Differentially Private SQL Library with a Minimum Frequency Rule