{"id":"9570f4a1-8a47-45e3-9534-6055a2f3420b","arxiv_id":"2411.11521","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A local small language model can predict when a differentially private sanitized prompt will still yield useful LLM output, saving up to 20% of wasted API calls, and an exact-nearest-neighbor implementation of the dX-privacy mechanism mostly returns the original token.","lead":"This paper proposes a privacy middleware that runs a small language model locally to predict whether an online LLM will produce useful output on a sanitized prompt, and skips the LLM call when it will not. In tests on summarization and translation, the architecture avoids wasting resources on up to 20% of prompts; the paper also reproduces a widely cited text sanitization method and finds its published results may rely on an unacknowledged approximate nearest neighbor search.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline 20% savings confounds prompt correction with utility prediction: Table 3b's best row compares an ABCD regressor on corrected prompts to an epsilon-only baseline on uncorrected prompts, so the gain may come from correction, not the assessor.","rationale":"The paper's strongest empirical claim is that the utility assessor saves up to 20% of previously wasted prompts. The Table 3b best row is the only place this number appears, and its design does not hold the prompt-processing pipeline fixed when comparing feature sets. The corrected-prompts variant changes the input to the LLM, which changes the outcome independently of prediction, so the reported improvement conflates the regressor's contribution with the effect of the SLM rewriting step. This is a concrete experimental-design concern, not a disagreement with the consensus view of DP text sanitization, and it directly affects the central claim. The released code makes the control run straightforward, so the concern is testable. I partially agree with the reader's weakest assumption: the corrected-prompts variant is indeed the fragile point, but the more decisive issue is not only that correction may leak privacy; it is that the comparison does not isolate the utility assessor's contribution. The privacy question is also complicated by DP post-processing: if correction uses only the sanitized prompt, the composed mechanism remains dX-private, though the middleware's send/no-send decision still weakens guarantees as Section 7.2 admits. The baseline confound does not depend on that subtlety. The reader's CONDITIONAL verdict remains appropriate: the paper's architecture is plausible and the non-corrected rows show real gains, but the headline number needs a matched baseline before the central claim is fully supported.","tokens_in":22600,"tokens_out":7808,"duration_ms":85966,"concrete_test":"Using the released code, rerun Table 3b's Llama-embedding/Gemini configuration with Corrected Prompts = Yes for all rows, and compare: (i) epsilon-only regressor on uncorrected prompts (reported 25% Wasted), (ii) epsilon-only regressor on corrected prompts, and (iii) ABCD regressor on corrected prompts (reported 5%). If (ii) is already close to (iii) or much below 25%, the savings are due mostly to prompt correction rather than to the assessor's features; if (ii) remains near 25%, the confound is minor.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 5.3's headline saving is confounded. In Table 3b, the best row (Llama embedding, Gemini LLM, Llama3.2-1B, Corrected Prompts = Yes) drops Wasted $ from 25% (baseline, feature A only) to 5% (features ABCD), and the paper credits this to the utility assessor. But the baseline row uses uncorrected sanitized prompts, while the corrected row first rewrites the sanitized prompt with the SLM and then runs both the SLM and the LLM on the corrected text. Two interventions change at once: the prompt text and the feature set. If the SLM correction alone makes sanitized prompts more coherent and closer to the original, the LLM target similarity rises and Wasted $ falls even with an epsilon-only predictor. The paper reports no epsilon-only control on corrected prompts, so the 20-point improvement cannot be attributed to the ABCD features. Non-corrected rows in the same table (e.g., Opus-MT: 25% to 14%) show a much smaller gain, suggesting correction accounts for a large share of the headline effect.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a middleware architecture that uses a small language model (SLM) to predict, before a prompt is sent to a costly online LLM, whether a dX-privacy-sanitized prompt will yield useful output. The prediction is based on features such as the privacy parameter epsilon and semantic similarities between the original prompt, the sanitized prompt, and the SLM-generated summaries/translations. The authors evaluate the architecture on summarization and translation tasks, report savings of up to 20% of previously wasted prompts, and reproduce an issue in Feyisetan et al.'s dX-privacy mechanism: an exact nearest-neighbor search outputs the input token about 99% of the time for moderate epsilon, whereas the previously reported results are reproducible only with approximate nearest-neighbor search.","tokens_in":22856,"tokens_out":6154,"duration_ms":61064,"significance":"If the prediction claim holds, the paper offers a practical and low-cost way to navigate the privacy-utility trade-off for LLM prompts, an important problem in privacy-preserving LLM use. The regression target is the LLM's actual output similarity, not a quantity derived from the input features, so the prediction task is genuine and not circular. The reproducible-code release and the careful replication of Feyisetan et al. are concrete strengths, and the nearest-neighbor finding is a valuable cautionary result for text-sanitization research. However, the headline 'up to 20%' savings claim is confounded by the corrected-prompts variant, so the current evidence supports the feature-based prediction claim only in a weaker, configuration-dependent form.","major_comments":[{"comment":"The headline 20% improvement conflates prompt correction with feature-based prediction. In the best configuration (Llama embedding, Gemini LLM, Llama3.2-1B, Corrected Prompts = Yes, features ABCD), the baseline row uses uncorrected sanitized prompts with feature A only, so two interventions change simultaneously: the prompt text is corrected and the feature set is expanded. No epsilon-only control on corrected prompts is reported, so the drop in Wasted $ from 25% to 5% cannot be attributed to the ABCD features. The non-corrected rows in the same table show a much smaller gain (e.g., 25% to 14% for T5/Opus-MT), suggesting that prompt correction accounts for a substantial share of the headline effect. The claim in Section 5.3 that the best improvement saves 20% of previously wasted computational and monetary resources is therefore not supported as stated. Please report an epsilon-only baseline on corrected prompts or otherwise separate the correction effect from the feature effect (e.g., compare ABCD on uncorrected and corrected prompts against the corresponding prompt-type baseline).","section":"Section 5.3, Table 3b"},{"comment":"The corrected-prompts variant may undo the dX-privacy noise, but the paper never analyzes this possibility. In this variant, the SLM first rewrites the sanitized prompt for coherence and grammar, and then both the SLM and the LLM operate on the corrected text. If correction replaces sanitized tokens with their original or semantically nearest forms, the privacy guarantee that motivated sanitization is weakened. Section 7.2 only considers the quality-threshold decision rule and assumes the provider cannot infer which tokens were changed; it does not address the fact that the corrected prompts have been rewritten before being sent. Please provide evidence that correction preserves the dX-privacy properties (e.g., token-level overlap between corrected and original prompts versus sanitized and original prompts), or restrict the headline savings claim to the non-corrected variant.","section":"Section 5.3 (Corrected Prompts variant) and Section 7.2"}],"minor_comments":[{"comment":"The decision rule that operationalizes the 'send or don't send' choice is never specified; the reported Wasted $ metric uses a fixed 0.1 similarity margin, and the savings will depend on this threshold. Please state the intended threshold or report sensitivity to it.","section":"Section 5.3"},{"comment":"The paper states that other regressors were tested and the best one was selected, but the hyperparameters of the Histogram-based Gradient Boosting Regression Tree and the model-selection procedure are not described. The code release helps, but a sentence with the key settings would improve reproducibility.","section":"Section 5.3"},{"comment":"The finding about Feyisetan et al. is presented as a definite result in the abstract ('show that a potential performance-driven implementation choice... not being explicitly acknowledged'), while Section 4.2 correctly frames it as a 'potential' reliance based on the AWS repository. Please align the abstract and body wording, or provide more direct evidence about the original authors' implementation.","section":"Section 4.2"},{"comment":"There are minor language issues, such as 'a approximate nearest neighbor search' in the introduction and the informal 'mv_normal' in Algorithm 1; a final proofread would improve clarity.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The dX-privacy mechanism used in the evaluation includes a fix from Asghar et al. [3], which is a same-group paper (the authors are co-authors). This is not itself a problem, but the paper should be explicit that the sanitization pipeline is the authors' own extension of Feyisetan et al., not the original mechanism. The headline savings claim is likely to be the main point of contention; the non-corrected rows provide a fairer test of the architecture's core prediction contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague — the paper is worth your time, but read Table 3 carefully. The genuinely new piece is the utility assessor: a small local model that predicts whether a dX-privacy-sanitized prompt will produce a good LLM response before you pay for the API call. They release code, run five SLMs and two LLMs across summarization and translation, and show that features beyond epsilon—semantic similarities between original, sanitized, and SLM outputs—consistently improve regression accuracy. The non-corrected rows alone show meaningful gains (e.g., translation wasted spend drops from 25% to 13-14%). The regression target is the LLM's actual similarity on the sanitized prompt, so the prediction task is genuine rather than a fit of the answer. That core claim holds up.\n\nThe paper also contains a valuable negative result: replicating Feyisetan et al.'s dX-privacy mechanism with exact nearest neighbor returns the input token ~99% of the time for epsilon >= 25, whereas the original results are reproducible only with approximate nearest neighbor search. They handle this carefully, and the finding deserves attention from anyone building on that line.\n\nThe soft spots are real but not fatal. First, the headline 'up to 20% saved' comes from the 'Corrected Prompts = Yes' rows, where the SLM first rewrites the sanitized prompt for grammar/coherence and then both models run on the corrected text. The baseline for comparison uses uncorrected prompts. So two things change at once: the prompt text and the feature set. There is no epsilon-only control on corrected prompts, so the 20-point improvement cannot be attributed to the assessor features. A smaller but still good gain (e.g., 25% to 14%) appears without correction, so the architecture helps, but the headline overstates the specific contribution of the features.\n\nSecond, the correction step's privacy impact is unanalyzed. If the SLM correction replaces sanitized tokens with their original or semantically nearest forms, it could undo the dX-privacy perturbation. Section 7.2 discusses the middleware's effect on DP guarantees but only considers the quality-threshold decision, not the correction step. Given the whole point is privacy, this gap needs to be closed.\n\nThird, the regression results come from a single 80/20 split with no error bars or repeated evaluation. The differences between some rows are small enough that variance could matter. A repeated split or bootstrap would help.\n\nAlso note the sanitization mechanism is not Feyisetan et al. as published but the authors' own fix (Asghar et al.), which they disclose. That is fine, but it means the empirical results concern the modified mechanism.\n\nWho is this for: privacy/security researchers working on LLM prompt protection, and practitioners building middleware. It deserves a serious referee. My recommendation: send to peer review, but demand a revised version that separates the correction step from the feature set, analyzes correction's effect on privacy, and adds error bars.","headline":"A genuinely useful utility-assessor architecture with a valuable ANN/ENN replication, but the headline 20% savings is confounded with an unanalyzed prompt-correction step.","tokens_in":23386,"tokens_out":6046,"would_cite":true,"duration_ms":49434,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A middleware using a small language model predicts whether a privacy-sanitized prompt will still be useful to a paid LLM, and saves up to 20% of prompts that would have been wasted.","keywords":["differential privacy","text sanitization","large language model","small language model","utility prediction","resource efficiency","dX-privacy","prompt privacy"],"falsifier":"Run the prompt-correction step on a set of dX-private sanitized prompts and measure how often corrected tokens coincide with the original tokens or their nearest embedding neighbors; if the correction restores original tokens at a high rate, the privacy guarantee claimed for the corrected-prompt pipeline does not hold.","tokens_in":1938,"feed_emoji":"🛡️","tokens_out":1799,"duration_ms":60621,"temperature":0.7,"pith_summary":"This paper tries to solve a practical cost problem: when a company sanitizes a prompt for privacy before sending it to a paid online LLM, the sanitization can destroy the prompt's usefulness, and the user cannot tell in advance. The authors propose a middleware \"utility assessor\" that runs a small local language model (≤1B parameters) on both the original and the sanitized prompt, extracts cheap numerical features (epsilon value and semantic similarities between prompts and the small model's outputs), and regresses those features to predict how well the big LLM will perform on the sanitized prompt. If the prediction is poor, the prompt is never sent and the small model's own answer is used, saving the wasted fee. In experiments on summarization and translation, the best configuration raises prediction accuracy enough to save up to 20% of prompts that would otherwise have been wasted. The paper also reports a reproduction finding: an exact implementation of the much-cited dX-privacy text sanitization mechanism returns the original token about 99% of the time for epsilon≥25, so the published results likely depended on an unacknowledged approximate nearest neighbor search.","feed_headline":"Small model saves 20% of wasted privacy-sanitized calls","feed_subtitle":"A local small-language-model utility check decides before a pay-per-use LLM runs whether the sanitized prompt is worth sending.","key_machinery":"The load-bearing object is the dX-privacy token-level sanitization mechanism (Algorithm 1): sample a noise direction from a multivariate normal, scale it by a gamma magnitude $1/\\varepsilon$, add it to the token embedding $\\phi(x)$, then map the noisy point back to a token by nearest neighbor search; a fix by a later reference adds a final rank-based exponential sampling step so output tokens stay close to the input. The utility assessor wraps this mechanism with a second mechanism: a regression pipeline whose features are (A) the privacy parameter $\\varepsilon$, (B) semantic similarity between original and sanitized prompt, (C) similarity between original prompt and SLM output on it, and (D) similarity between original prompt and SLM output on the sanitized prompt, trained to predict (E) similarity between original prompt and LLM output on the sanitized prompt. The predictor's role is to act as a gate: only sanitized prompts predicted to clear a quality threshold are sent to the LLM. The paper's secondary discovery, the exact-versus-approximate nearest neighbor discrepancy, identifies line 5 of Algorithm 1 as the critical implementation step whose choice flips the mechanism between identity and perturbation.","core_discovery":"The central claim is that performance of an LLM on a dX-private sanitized prompt is predictable from features computable entirely on the user's side, and this prediction can gate whether the prompt is sent. Concretely, with the sanitized prompt $p_\\varepsilon$, the original prompt $p$, the small model's outputs $r^{SLM}$ on $p$ and $r^{SLM}_\\varepsilon$ on $p_\\varepsilon$, and a task-specific semantic-similarity metric as quality estimator, a histogram-based gradient boosting regressor predicts the target similarity between $p$ and the LLM's output $r^{LLM}_\\varepsilon$. Across two tasks, five small models, two LLMs, and two token embedding models for sanitization, the full feature set outperforms a baseline that uses only $\\varepsilon$; the best summarized result reduces failed predictions by 53% compared with the baseline, with \"wasted\" prompts (overly optimistic predictions) falling from 25% to 5% in the best translation configuration, which also uses the small model to first correct the grammar and coherence of the sanitized prompt. The paper also claims that the dX-privacy mechanism of the cited text sanitization work, when implemented exactly as defined with an exact nearest neighbor search on line 5, outputs the input token more than 99% of the time for $\\varepsilon \\ge 25$, making the published mechanism effectively identity for those settings; the approximate-nearest-neighbor implementation explains the discrepancy, a choice the original paper never acknowledges.","pith_inferences":["If the small model's grammar/coherence correction step is observed to restore original or near-original tokens at a high rate, the headline 20% savings may be achieved at the cost of silently weakening the privacy guarantee; this is testable by token-level comparisons of corrected versus uncorrected sanitized prompts.","The same regression-gate idea could be extended to other sanitization methods that output text, such as DP-based rewriting, which the paper explicitly mentions; one could also retrain the regressor online per company to adapt to domain vocabulary.","The exact-versus-approximate nearest neighbor finding suggests a broader reproducibility hazard: performance-driven implementation choices that alter the effective mechanism are easy to omit in papers that describe privacy mechanisms abstractly; routine reporting of implementation-level search algorithms would help.","For real deployments, the quality threshold in the utility assessor creates a selection bias that an adversary could exploit with repeated queries; the paper does not quantify this, and the practical impact depends on prompt length and embedding geometry."],"forward_implications":["If the utility assessor generalizes beyond the tested two tasks, companies with pay-per-use LLM APIs can place a cheap local gate in front of sanitized prompts, cutting wasted API calls by up to 20% in the best configuration and roughly 10% on average.","The reproduction result implies that published utility numbers for dX-privacy text sanitization may not be reproducible from the stated algorithm alone; any evaluation of such mechanisms must specify whether nearest neighbor search is exact or approximate.","The finding that $\\varepsilon$ alone is a poor predictor of sanitized-prompt utility (the same $\\varepsilon$ can give near-zero or near-perfect utility depending on the prompt) motivates feature-based prediction rather than relying on the privacy parameter.","The architecture requires a reference-free quality metric, so it applies to summarization and translation now, and to other tasks only when such a metric exists, which the paper argues includes text classification and open-ended text continuation.","Since poor prompts are filtered out, the provider learns that received prompts passed a quality threshold; the paper argues this weakens but does not practically break the DP guarantee for long prompts."],"supporting_citations":[{"why":"Defines the dX-privacy text sanitization mechanism via calibrated multivariate perturbations; the reproduced ENN-versus-ANN discrepancy concerns this algorithm.","marker":"[17]"},{"why":"Supplies the rank-based exponential sampling fix used in Algorithm 1 lines 6-7, the exact sanitization procedure evaluated in the paper.","marker":"[3]"},{"why":"Introduces the metric-based dX-privacy framework that underpins the formal privacy definition.","marker":"[7]"},{"why":"Provides the Multi-News dataset on which the summarization and translation experiments are run.","marker":"[14]"},{"why":"Supplies the all-mpnet-base-v2 sentence embedding model used for summarization quality features.","marker":"[40]"},{"why":"Supplies the paraphrase-multilingual-mpnet-base-v2 model used for translation quality features.","marker":"[41]"},{"why":"Provides the scikit-learn histogram-based gradient boosting regressor used for utility prediction.","marker":"[35]"}],"fun_headline_variants":["Small model predicts wasted sanitized prompts, saving 20% LLM calls","Cheap utility check before LLM call avoids 20% wasted prompts","Sanitized prompt utility predicted locally, sparing 20% of LLM calls","Exact nearest-neighbor sanitization outputs input 99% for high epsilon"],"cache_read_input_tokens":25472,"weakest_assumption_plain":"The headline 20% savings come from a configuration where the small model first rewrites the sanitized prompt to fix grammar and coherence, and the paper never checks whether that rewriting undoes the privacy protection by putting the original sensitive tokens back.","fun_headline_variants_meta":{"raw":{"variants":["Small model predicts wasted sanitized prompts, saving 20% LLM calls","Cheap utility check before LLM call avoids 20% wasted prompts","Sanitized prompt utility predicted locally, sparing 20% of LLM calls","Exact nearest-neighbor sanitization outputs input 99% for high epsilon"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001182,"raw_usage":{"total_tokens":4926,"prompt_tokens":1030,"completion_tokens":3896,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":646,"completion_tokens_details":{"reasoning_tokens":3813}},"tokens_in":646,"tokens_out":3896,"duration_ms":27426,"temperature":1.0,"reasoning_tokens":3813,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T18:25:24.850640+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the prompt-correction step on a set of dX-private sanitized prompts and measure how often corrected tokens coincide with the original tokens or their nearest embedding neighbors; if the correction restores original tokens at a high rate, the privacy guarantee claimed for the corrected-prompt pipeline does not hold.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the rank-based exponential sampling fix used in Algorithm 1 lines 6-7, the exact sanitization procedure evaluated in the paper."}],"review_version":1}