BR-MoE: Budgeted Semantic Release for Privacy-Preserving Traffic Analytics

Abdolazim Rezaei

cs.CROct 19, 2026

BR-MoE: Budgeted Semantic Release for Privacy-Preserving Traffic Analytics

Authors: Abdolazim Rezaei

Organizations: Department of Computer Science, Texas A&M University–Corpus Christi, Corpus Christi, TX 78412, USA

Abstract

Traffic cameras support useful analysis, but their outputs can reveal private information. Replacing images with text reduces direct visual exposure. It does not place a formal bound on disclosure. The published reinforcement learning and mixture-of-experts framework refines scene descriptions through relevance, coverage, and brevity rewards. It does not account for repeated releases under a fixed privacy budget. This paper proposes budgeted semantic release as an extension of that framework. Four scene experts first process isolated video chunks. Their outputs are mapped to a fixed, bounded semantic schema. A reinforcement learning controller selects which expert summaries to release and how much privacy budget to spend. The controller uses public task requests and previous private releases. A separate privacy filter enforces the total budget. Calibrated noise is added before the summaries are converted to text. Under explicit chunk isolation and bounded-event assumptions, the complete release transcript satisfies an event-level differential privacy bound. The design also supports reuse of previous summaries without new disclosure. An evaluation protocol covers traffic utility, privacy attacks, release freshness, and computational cost. Illustrative tables show the intended reporting format. They do not establish empirical gains. The proposed contribution is a task-aware release interface with auditable privacy accounting for repeated traffic descriptions.

Figures & tables

Work	Main output or objective	Privacy scope	Relation to this study
RL-MoE [ 3 ]	Refined scene descriptions	Empirical privacy evaluation	Source architecture; lacks a release accountant.
VTPM [ 7 ]	Pedestrian activity reports	Identity-related information removal	Relevant semantic-report baseline.
DP-Cap [ 5 ]	Learned visual representations	Training image–caption records	Does not sanitize new inference inputs.
SPTI [ 9 ]	Synthetic images via text	Entries in a private dataset	Batch synthesis; not a live-caption benchmark.
Privid [ 12 ]	Aggregate video query answers	Bounded-duration events	Foundation for isolated chunk processing.
GeoPrivd [ 13 ]	Geospatial traffic query answers	Trajectory-level influence control	Closely related analytics system; different release objective.

Table 1: Literature-based position of the proposed extension. Different privacy units are not interchangeable.

Panel of Figure 1 — Figure 1: Proposed BR-MoE architecture. Blue solid arrows carry data. Dashed arrows carry control signals. All fresh private information reaches the output through the noise mechanism. The controller receives only public inputs and prior private releases. The offline trainer uses public or synthetic episodes and is frozen before deployment.

Expert	Components	$d_{m}$	$C_{m}$
Traffic	Moving; stopped vehicles	2	20
Pedestrian	Walking; waiting pedestrians	2	6
Signs	Stop; speed-limit; other sign; no sign	4	1
Environment	Clear; rain; fog; other weather	4	1

Table 2: Proposed semantic schema and starting caps. Values are design choices, not tuned settings.

Source	Intended role	Labels needed	Split and scope control
CityFlow [ 25 ]	Main fixed-camera traffic stream; vehicle attack audit	Occupancy and motion; existing vehicle identities where available	Sequence and identity separation; report camera coverage.
BDD100K [ 26 ]	Perception and domain-shift evaluation	Pedestrian states and coarse signs; available scene labels	Keep official sequence separation; use actual clip lengths.
MINT-V2X [ 18 ]	Public simulation for controller stress tests	Task targets derived from documented simulation fields	Split complete runs or contiguous periods; no visual-privacy claim.
New annotated subset	Joint four-expert evaluation	All twelve schema components and task labels	Publish selected sequences and annotations; no invented sample size.

Table 3: Planned data use. Subset sizes, annotation counts, and split manifests remain to be established.

Parameter	Starting value
Chunk duration; fixed frame sampling	2 s; 2 frames/s
Main window; report cadence	60 s; 60 s
Benchmark episode	10 min; 10 report slots
Protected changed chunks $K$	2; test 5 and 10
Episode budget $\varepsilon_{\star}$	4; test 2 and 8
Release amount $e_{t}$	0, 0.1, 0.2, 0.4, 0.8

Table 4: Proposed starting configuration. All choices require validation and complete implementation logging.

Method	Vehicle MAE $\downarrow$	Ped. MAE $\downarrow$	Sign macro-F1 $\uparrow$	Event AUC $\downarrow$	Coverage (%) $\uparrow$	P95 time (s) $\downarrow$
Original-image release reference	0.80	0.35	0.91	0.90	100	1.2
RL-MoE, re-run protocol	1.40	0.70	0.85	0.79	100	4.8
RL-MoE + field removal	1.70	0.90	0.82	0.72	100	4.9
Uniform-DP	7.20	2.80	0.44	0.55	100	3.1
Task-DP	6.10	2.40	0.51	0.56	100	3.2
Periodic-DP + reuse	5.80	2.20	0.55	0.57	90	3.0

Table 5: Illustrative main-comparison values; replace every performance cell with measurements. Private rows use the planned

K=2

, ten-minute horizon, and

\varepsilon_{\star}=4

Variant	Utility $\uparrow$	Age (s) $\downarrow$	Valid
BR-MoE (proposed)	0.61	42	Yes
Fixed task schedule	0.57	0	Yes
No reuse (return missing)	0.49	0	Yes
No task conditioning	0.53	48	Yes
Raw-feature gate (unsafe)	0.68	30	No

Table 6: Illustrative ablation values at the planned total budget of 4. “Valid” means the stated design retains the proof assumptions; it is not an implementation certification.

$K$	$\varepsilon_{\star}$	Utility $\uparrow$	Event AUC $\downarrow$	Coverage (%) $\uparrow$
2	2	0.48	0.53	65
2	4	0.61	0.56	80
2	8	0.69	0.61	95
5	4	0.43	0.54	72
10	4	0.30	0.52	60

Table 7: Illustrative budget and event-bound sensitivity for BR-MoE. All performance cells must be replaced.

Allocation	$K$	$\Delta_{tm}$	$\varepsilon_{tm}$	$b_{tm}$
Uniform four experts	2	0.8	0.1	8.0
Pedestrian only	2	0.8	0.4	2.0
Uniform four experts	5	2.0	0.1	20.0
Pedestrian only	5	2.0	0.4	5.0

Table 8: Analytical noise scales for the pedestrian vector.

J_{t}=30

C_{m}=6

, and

e_{t}=0.4

. These are formula-derived values.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 433 papers

Mar 14, 2026

REAEDP: Entropy-Calibrated Differentially Private Data Release with Formal Guarantees and Attack-Based Evaluation

Sensitive data release is vulnerable to output-side privacy threats such as membership inference, attribute inference, and record linkage. This creates a practical need for release mechanisms that provide formal privacy guarantees while preserving utility in measurable ways. We propose REAEDP, a differential privacy framework that combines entropy-calibrated histogram release, a synthetic-data release mechanism, and attack-based evaluation. On the theory side, we derive an explicit sensitivity bound for Shannon entropy, together with an extension to Rényi entropy, for adjacent histogram datasets, enabling calibrated differentially private release of histogram statistics. We further study a synthetic-data mechanism

\mathcal{F}

with a privacy-test structure and show that it satisfies a formal differential privacy guarantee under the stated parameter conditions. On multiple public tabular datasets, the empirical entropy change remains below the theoretical bound in the tested regime, standard Laplace and Gaussian baselines exhibit comparable trends, and both membership-inference and linkage-style attack performance move toward random-guess behavior as the privacy parameter decreases. These results support REAEDP as a practically usable privacy-preserving release pipeline in the tested settings. Source code: https://github.com/mabo1215/REAEDP.git

Bo Ma, Jinsong Wu, Wei Qi Yan

School of Mathematics and Computer Engineering, Auckland University of Technology, Auckland 1024 New Zealand · Resideo Technologies, Inc., Austin, TX 78759, USA · Department of Artificial Intelligence, Guilin University of Electronic Technology, Gui Lin, China +1

Differentially Private Synthetic Data Generation Differential Privacy Synthetic Data Evaluation

Ask PDF

Sep 14, 2026

Differentially Private Semantic Plans for Aggregate Insight Generation

URANIA provides end-to-end differential privacy (DP) for summaries of data-dependent clusters. However, its cluster--keyword release does not directly provide collection-wide aggregates for semantic concepts defined independently of the protected corpus. Records may express several concepts, records expressing the same concept may be assigned to different clusters, and cluster identities need not correspond across analyses. Consequently, cluster-level statistics do not directly provide comparable measurements of predefined concepts across collections or repeated analyses. We introduce DP-SPIN, a trusted-curator framework for aggregate measurement and summarization over semantic concepts fixed independently of the protected target records. Each record is mapped to a bounded sparse nonnegative vector over these concepts, whose sum forms a semantic sketch. A differentially private mechanism releases a semantic plan containing admitted concepts and noisy masses; normalized semantic-support values and support bins are obtained by post-processing. For user-level privacy, each user's aggregate contribution is clipped to a fixed bound. The language model receives only the plan and fixed decoding instructions, while a public verifier checks concept mentions, reported values, comparisons, and rank claims against the released plan. The final summary is differentially private by post-processing. We establish record- and user-level DP guarantees under add/drop and replacement adjacency. We evaluate DP-SPIN under record-level privacy on CFPB complaint narratives, Amazon All Beauty reviews, and Yelp restaurant reviews, and under user-level privacy on Amazon and Yelp. We compare DP-SPIN with non-private plan and summary references, DP keyword and category histogram baselines, and a URANIA-style baseline with a fixed public keyword vocabulary.

Behrooz Razeghi

School of Engineering and Applied Sciences, Harvard University

Privacy-Preserving Language Models Privacy-Preserving ML Differential Privacy

Ask PDF

Jul 27, 2026

ScoreShield: Differentially Private Release of Similarity Scores

A growing number of applications, such as biometrics and retrieval-augmented generation (RAG), rely on cosine similarity scores computed between vector embeddings of text, images, or audio. These systems return similarity scores through their APIs for ranking and verification. However, such releases can leak information about individual records and enable membership inference attacks. While differential privacy (DP) provides a principled metric for quantifying attack risks, naïve application of DP mechanisms---such as adding i.i.d. Gaussian noise to vector entries---leads to excessive distortion (i.e., low utility) at a given privacy constraint that scales poorly with the number of released scores. We propose ScoreShield, a perturb-then-project mechanism that adds Gaussian noise calibrated to global sensitivity of the chosen score release regime and then projects the result onto the feasibility set of valid cosine objects. ScoreShield satisfies

(\varepsilon,δ)

-DP for releasing similarity score vectors and Gram matrices. We provide utility guarantees for the exact Frobenius metric projection used in the risk analysis, and prove convergence to feasibility for the practical averaged alternating-projection solver used for large-scale Gram releases. For full pairwise cosine Gram release under record-level replacement adjacency, the exact-projection bound improves the

n

-dependence of squared Frobenius risk from

Θ(n^3)

for the naïve Gaussian baseline to

\mathcal{O}(n^2)

for fixed privacy parameters, with sharper local bounds at low-rank Grams. We evaluate the mechanism across RAG, face recognition, semantic retrieval, image similarity, and recommender-system tasks.

Behrooz Razeghi, Parsa Rahimi

School of Engineering and Applied Sciences, Harvard University · School of Engineering, École Polytechnique Fédérale de Lausanne (EPFL)

Privacy-Preserving ML Differential Privacy

Ask PDF

Abstract

Privacy-Preserving ML

Explore similar work

REAEDP: Entropy-Calibrated Differentially Private Data Release with Formal Guarantees and Attack-Based Evaluation

Differentially Private Semantic Plans for Aggregate Insight Generation

ScoreShield: Differentially Private Release of Similarity Scores