{"id":"5a6b10b9-8c06-4c7b-b2d9-9e023c6d9df0","arxiv_id":"2411.13784","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"low","formal_verification":"none","parameter_count":2,"one_line_summary":"Word-level dX-privacy using multidimensional Laplace noise plus nearest neighbor search almost never emits semantically similar words; the paper derives why and patches the mechanism with a rank-based post-processing step.","lead":"A popular method for anonymizing text by adding high-dimensional noise to word embeddings tends to either leave a word unchanged or replace it with a very different word, almost never a related one. The paper explains this failure geometrically and offers a post-processing fix that restores useful output.","discovery_kind":"first_principles","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The universality claim ('any word embedding model') is extrapolated from GloVe, Word2Vec, and fastText; transformer-based embeddings could have different local distance profiles that invalidate the explanation.","rationale":"The reader's weakest assumption identifies the same load-bearing concern: the paper's universal 'any embedding model' claim is supported only by static embedding models. My read of the formal sections confirms that the theorem statements and the noisy dot product derivation are essentially sound; the weakness is in the empirical generalization from GloVe/Word2Vec/fastText to all high-dimensional word embeddings. This directly affects the central claim, because if transformer-based embeddings have local distance profiles where z_{x1,x2} is comparable to z_{w,x1}, the mechanism could plausibly output semantically close neighbors, and the 'curse of dimensionality' explanation would fail to generalize. The proposed concrete test settles this by recomputing the load-bearing quantities for a transformer model and checking the actual output distribution. Since the reader already conditions the verdict on addressing this and related issues, my stress-test does not move the verdict; it reinforces the condition.","tokens_in":29497,"tokens_out":4773,"duration_ms":87814,"concrete_test":"Using the released code, compute z_{w,x1}, z_{x1,x2}, and z_{x1,x101} from Eqs. (18) and (19) over 5,000 random vocabulary words for a transformer-based embedding model (e.g., BERT or RoBERTa token embeddings, either static layer outputs or CLS-vector aggregations, with dimensions matched to the existing pipeline). Then simulate the word-by-word mechanism at several epsilon values (e.g., 1, 5, 10, 50) and plot the proportions of original, close-neighbor, and distant-neighbor outputs. If z_{x1,x2}/z_{w,x1} is no longer tiny or if close neighbors appear with non-negligible frequency, the universal claim must be restricted to static embeddings; if the ratio remains tiny and the output distribution is still bimodal, the claim is empirically supported for transformer-based embeddings as well.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central explanation, summarized in Section 6.2 and Table 2, rests on the empirical premise that for high-dimensional word embeddings the quantity z_{w,x1} (Eq. 18) is much larger than z_{x1,x2} or z_{x1,x101} (Eq. 19). The abstract states this as holding for 'any word embedding model,' but the evidence covers only GloVe (two vocabularies, four dimensions), Word2Vec, and fastText. These are all static, non-contextual embedding families with broadly similar training objectives and Euclidean geometry. No transformer-based or contextual embedding is tested. The formal theorems (Theorems 1–3 and Eqs. 18–21) are correct for a fixed embedding set, but they do not by themselves imply the local-distance inequality; that inequality is an empirical input to the argument. If transformer embeddings have different local geometry -- e.g., smaller absolute nearest-neighbor distances relative to consecutive-neighbor gaps, or stronger anisotropy that makes Euclidean nearest-neighbor distances more informative -- the observed bimodal 'original word or completely dissimilar word' behavior could be a property of static embeddings rather than a universal curse of dimensionality. Since the paper claims the latter and uses the claim to motivate both the analysis and the proposed fix, this missing case is load-bearing. The absence of error bars on Table 2 and the per-vocabulary tuning of the constant c in Section 7 are secondary concerns; they do not affect the core geometric claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies the word-level multidimensional Laplace mechanism for d_X-privacy applied to text. It reports and analyzes a systematic utility failure: the mechanism, after nearest-neighbor post-processing, almost always returns either the original word or a semantically distant word, and rarely returns nearby semantic neighbors. The authors derive the distribution of the dot product between the Laplace noise vector and a word embedding, showing that its angular component follows a beta distribution with variance 1/n, that it is sub-Gaussian with parameter 1/sqrt(n), and that the overall dot product is concentrated within O(sqrt(n)/epsilon). They then use this distribution to explain the bimodal behavior through inequalities involving the distance from a word to its nearest neighbor versus the relative distances between consecutive neighbors. Finally, they propose a rank-based post-processing fix with a temperature parameter c and compare it with the original mechanism and with the exponential mechanism of Yue et al.","tokens_in":29775,"tokens_out":7435,"duration_ms":71618,"significance":"If the central claim holds, the paper identifies a practically important and previously under-explained failure mode of a widely used d_X-privacy mechanism for text, and it contributes a clean probabilistic characterization of high-dimensional Laplace noise (the noisy dot product distribution, its moments, and tail bounds). The formal derivations in Sections 4 and 5 appear sound: the beta density, Var[K]=1/n, Var[Z]=(n+1)/epsilon^2, and the sub-Gaussian tail bound all check out, and the paper includes several machine-checkable proofs and released code. The proposed fix is simple and respects post-processing immunity. The main weakness is the gap between the universal wording of the empirical claim ('any word embedding model') and the evidence, which covers only static, non-contextual embedding families. The formal theorems apply to a fixed embedding set; the local-distance inequality that drives the explanation is an empirical premise, and that premise is not yet established for transformer-based or contextual embeddings.","major_comments":[{"comment":"The abstract and introduction claim that the nearest-neighbor distance of a word in 'any word embedding model' is much larger than the relative difference in distances to its consecutive neighbors, but the evidence in Table 2 and Figures 2 and 6 covers only GloVe (two vocabularies, several dimensions), Word2Vec, and fastText. These are all static, non-contextual embedding families with broadly similar training objectives and Euclidean geometry. Theorems 1--8 are proved for a fixed embedding set and do not by themselves imply the local-distance inequality; that inequality is an empirical input to the central explanation. If contextual or transformer-based embeddings have different local distance profiles, the observed bimodal behavior could be a property of the tested static embeddings rather than a universal curse of dimensionality. Since the paper uses the universal claim to motivate both the analysis and the proposed fix, this missing case is load-bearing. Please either add analogous measurements (e.g., z_{w,x1}, z_{x1,x2}, z_{x1,x101} and plots of F_Z) for one or more contextual embedding models, or explicitly qualify the claim to the class of embeddings for which the inequality has been verified.","section":"Abstract, Section 1, Section 6.2, Table 2"},{"comment":"The empirical support for the central geometric claim lacks error reporting. The quantities z_{w,x1}, z_{x1,x2}, and z_{x1,x101} in Table 2 are averages over 5,000 randomly sampled words, but no standard errors, confidence intervals, or per-word distributions are reported. The same is true for the proportions in Figures 2, 6, and 8. Because the entire explanation rests on the gap between z_{w,x1} and z_{x1,x2}, the reader cannot tell whether this gap is systematic across words or driven by a minority of outliers. In addition, for the proposed fix in Section 7, the temperature c is selected per vocabulary by 'trying different values and choosing the one that gives the best result,' but the selection procedure and whether the evaluation words are independent of the selection are not specified. Please report the spread of the z quantities, add error bars or confidence bands to the proportion plots, and clarify how c is chosen for the reported fix.","section":"Section 6.2, Table 2, Figures 2, 6, 8"},{"comment":"The statement of Theorem 8 says 'for all c1,c2 in R, where c2 > 1,' but the proof requires c1 >= 0. Specifically, the step Pr[Z <= c1 c2 sqrt(n)/epsilon] >= Pr[K <= c1/sqrt(n)] Pr[R <= c2 n/epsilon] uses the implication K <= c1/sqrt(n) and R <= c2 n/epsilon to conclude R K <= c1 c2 sqrt(n)/epsilon, which is valid only when c1 is nonnegative. The proof also appears to use the decomposition (c1/sqrt(n))(c2 n/epsilon), which should be stated explicitly rather than left implicit in the displayed equation. Please correct the domain of c1 and the displayed algebra.","section":"Theorem 8"}],"minor_comments":[{"comment":"The statement of Theorem 2 has 'cos theta_{w-x, y+x}' in the first term, while the proof and Eq. (22) use 'cos theta_{w-x, y-x}'. The statement should be corrected to y - x.","section":"Theorem 2"},{"comment":"The last displayed equality of the proof of Theorem 6 writes 'e^{-sigma^2 lambda^2/2}'; the exponent should be positive, e^{+sigma^2 lambda^2/2}, to match the definition of a sub-Gaussian bound.","section":"Theorem 6 proof"},{"comment":"The proof of Theorem 1 says 'in the second last step, we have used Theorem 3' for the elementary identity <x,y> = ||x|| ||y|| cos theta. That identity is not Theorem 3; it should be referenced to the displayed 'elementary fact' in Section 3 or renumbered.","section":"Theorem 1 proof"},{"comment":"The caption of Figure 2 identifies the right panel as 'Word2Vec,' while the text immediately above the figure says the pattern is shown for 'the GloVe-Wiki and fastText embedding models.' Please make the caption consistent with the text and with Figure 8.","section":"Figure 2 caption"},{"comment":"The comparison of the proposed fix with the exponential mechanism of Yue et al. is illustrative but not quantitative. It would strengthen the paper to report a utility metric (e.g., average semantic similarity of outputs to the original word, or downstream task accuracy) in addition to the proportion curves.","section":"Section 7"},{"comment":"There are several typographical errors, including 'santize'/'santized' in Sections 1 and 8, 'Glove' in Figure 2, and 'c+2' in the paragraph after Theorem 8. These should be corrected in revision.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern about the universality claim is real and matches my reading: the formal probabilistic analysis is sound, but the paper's central explanatory step depends on an empirical local-distance inequality that has only been demonstrated for static embeddings. The missing transformer-based evaluation and the lack of error bars are the main obstacles to acceptance. If the authors add the missing empirical evidence or carefully narrow the claim, the paper would be a solid contribution to PETS."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this paper earns its place. It identifies why the standard word-level multidimensional Laplace mechanism for dX-privacy behaves so oddly—almost always outputting the original word or a completely dissimilar word, and almost never a semantically close neighbor—and shows the cause is the post-processing nearest-neighbor search, not the noise distribution. The new analytic results, the angular component of the noisy dot product (beta density, Var[K]=1/n), the moment formula, sub-Gaussianity, and the tail bounds, are mostly correct; Var[Z]=(n+1)/ε^2 and the probabilistic interpretation in Section 6 are clean. The empirical contrast between z_{w,x1} and z_{x1,x2} explains the bimodal output convincingly.\n\nCredit where due: the pathology is reproduced across GloVe, Word2Vec, and fastText, the paper makes clear this is not a few isolated outliers but the norm for high-dimensional embeddings, and the code is released. The proposed fix is honest—a post-processing reranking step that does not change the privacy guarantee—and the authors explicitly flag that the temperature c is fitted per vocabulary.\n\nSoft spots, in proportion. The abstract's 'any word embedding model' is stronger than the evidence: all tested embeddings are static, non-contextual models with similar Euclidean geometry. Transformer-based or contextual embeddings could have a different local distance profile, and the crucial inequality is an empirical input, not a consequence of the theorems. That is the main load-bearing gap, but it is fixable by testing contextual embeddings or by narrowing the claim. Smaller issues: Table 2 and Figures 2, 6, and 8 lack error bars even though the values come from sampling; Theorem 8 states c1∈R but the proof needs c1>0 for the tail bound to be meaningful; and the fix's c is a free parameter, so the utility improvement is only as robust as that per-vocabulary tuning. None of these undermine the core diagnosis.\n\nWho this is for: anyone using word-level metric DP for text, and mechanism designers working on Mahalanobis or truncated exponential mechanisms that keep a nearest-neighbor post-processing step. It deserves a serious referee; the central claim is reproducible and the math is sound enough to build on. Send it to review.","headline":"A genuinely useful diagnosis of why word-level dX-privacy either returns the original word or a distant one, with mostly correct probability theory; the main overclaim is universality across all embedding models.","tokens_in":30331,"tokens_out":3232,"would_cite":true,"duration_ms":29726,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68P27","60E15"],"pacs":[],"model":"deepseek-v4-flash","headline":"Word-by-word $d_X$-privacy outputs the original word or an unrelated one, nearly never a close synonym, because nearest-neighbor rounding in high-dimensional embeddings isolates every word; a rank-based post-processing fix restores the…","keywords":["differential privacy","metric privacy","word embeddings","multidimensional Laplace mechanism","nearest neighbor search","curse of dimensionality","noisy dot product","text sanitization"],"falsifier":"Take a transformer-based contextual embedding model, pick a word with many synonyms, compute the ratio of its nearest-neighbor distance to the difference between its first and second neighbor distances, and run the word-by-word mechanism at a mid-range $\\epsilon$ (for example 10) over several thousand words, counting how often the first 100 nearest neighbors are output. If close neighbors appear at a rate comparable to distant neighbors, the universal claim fails. A lighter check: verify whether $F_Z(z_{\\mathbf{w},\\mathbf{x}_1})$ (the probability that the original word beats its nearest neighbor) still dominates $F_Z(z_{\\mathbf{x}_1,\\mathbf{x}_2})$ as strongly for such a model as it does for GloVe and Word2Vec.","tokens_in":29277,"feed_emoji":"🎲","tokens_out":11677,"duration_ms":97016,"temperature":0.7,"pith_summary":"The paper studies the standard word-by-word $d_X$-privacy mechanism for text: add multidimensional Laplace noise to a word embedding, then round to the nearest vocabulary word. It establishes that this mechanism almost never outputs semantically similar words — it returns either the original word or a far-off, unrelated one — and that this all-or-nothing behavior persists across all values of the privacy parameter $\\epsilon$ and across common embedding models. The authors show that the culprit is the nearest-neighbor post-processing step, not the noise itself: in high dimensions, every word behaves like an isolated outlier because the nearest-neighbor distance dwarfs the gaps between consecutive neighbors, while the noise vector is nearly orthogonal to every embedding. They derive the distribution, moments, and tail bounds of the noise-embedding dot product, and propose a rank-based post-processing fix that makes the mechanism output close neighbors at the expected rates. If right, this means a widely deployed privacy tool has a built-in utility failure whose cause is geometric, not statistical.","feed_headline":"Privacy noise flips: original word or a stranger, never a synonym","feed_subtitle":"Standard text-privacy noise skips close synonyms; a rank-based fix restores expected utility.","key_machinery":"The load-bearing object is the noisy dot product $Z = \\langle \\boldsymbol{\\eta}, \\mathbf{w} \\rangle = r\\|\\mathbf{w}\\|\\cos\\theta_{\\boldsymbol{\\eta},\\mathbf{w}}$, a product of an independent length component and angular component. The length $R$ follows the Gamma density $f_G(r) \\propto r^{n-1} e^{-\\epsilon r}$; the angular component $K = \\cos\\theta_{\\boldsymbol{\\eta},\\mathbf{w}}$ has density $f_B(k) = \\frac{1}{B((n-1)/2, 1/2)}(1-k^2)^{(n-1)/2 - 1}$ on $[-1,1]$ and is sub-Gaussian with parameter $1/\\sqrt{n}$, meaning the noise vector is nearly orthogonal to every word embedding when $n$ is large. Theorems 1 and 2 convert the question 'which vocabulary word is nearest to the perturbed embedding?' into threshold inequalities on $r\\cos\\theta$ with respect to the vectors $\\mathbf{x}-\\mathbf{w}$ and $\\mathbf{y}-\\mathbf{x}$; the whole argument then reduces to comparing the sizes of nearest-neighbor distances with the gaps between consecutive neighbors. Because in high dimensions $\\frac{1}{2}\\|\\mathbf{w}-\\mathbf{x}_1\\|$ (the threshold that lets the original word win) is large while $\\frac{\\|\\mathbf{w}-\\mathbf{x}_2\\|^2 - \\|\\mathbf{w}-\\mathbf{x}_1\\|^2}{2\\|\\mathbf{x}_1-\\mathbf{x}_2\\|}$ (the threshold that lets the nearest neighbor beat the second) is small relative to the concentrated mass of $Z$, the observed all-or-nothing behavior follows.","core_discovery":"The paper's central claim is that the multidimensional Laplace mechanism for word-level $d_X$-privacy has a systematic utility failure caused by the nearest-neighbor rounding that follows the noise addition, not by the noise distribution itself. In high-dimensional embedding spaces the distance from a word to its nearest neighbor is much larger than the relative difference between its two consecutive neighbors' distances; since the noise vector is nearly orthogonal to every embedding, the perturbed point is almost always closest either to the original word or to a distant word, and the narrow band of semantically related neighbors is skipped. The authors derive the noisy dot product distribution $Z = R K$, where the length $R$ follows the Gamma density $f_G(r) \\propto r^{n-1} e^{-\\epsilon r}$ and the angular component $K = \\cos\\theta_{\\boldsymbol{\\eta},\\mathbf{w}}$ has density $f_B(k) \\propto (1-k^2)^{(n-1)/2 - 1}$ on $[-1,1]$; they prove $K$ is sub-Gaussian with variance $1/n$, so the noise is increasingly orthogonal to every word vector, and that the mass of $Z$ concentrates within $O(\\sqrt{n}/\\epsilon)$. Theorems 1 and 2 turn nearest-neighbor selection into threshold conditions on this dot product: the original word beats a neighbor when $r\\cos\\theta_{\\boldsymbol{\\eta},\\mathbf{x}-\\mathbf{w}} < \\frac{1}{2}\\|\\mathbf{w}-\\mathbf{x}\\|$, and a neighbor beats the next neighbor only under the analogous condition with $\\|\\mathbf{x}_1-\\mathbf{x}_2\\|$ in the denominator. The measured geometry of GloVe, Word2Vec, and fastText makes the first condition almost always true and the second almost never, which is exactly the observed pattern. A post-processing step that resamples among the ranks of the nearest neighbor, with probability proportional to $\\exp(-c\\epsilon\\, d_{NN}(\\mathbf{x}^*, \\mathbf{x}))$, is shown to restore the expected exponential decay of output frequency with semantic distance.","pith_inferences":["The paper's universal phrasing ('any word embedding model') is asserted but only measured on GloVe, Word2Vec, and fastText; a transformer-based contextual embedding model with a different local distance profile would be the decisive test of the universality claim.","The open problem the authors pose — a metric that flattens nearest-neighbor gaps while satisfying the metric axioms — points to data-dependent metrics that rescale distance by local density, in the spirit of elastic distinguishability, as a promising route to a $d_X$-private mechanism that outputs neighbors at the intended rates.","A corollary the authors do not draw: because the angular component $K$ has variance $1/n$ regardless of the embedding's distribution, any high-dimensional perturbation scheme that rounds to the nearest catalogued point inherits this orthogonality failure, so the effect should appear in other domains such as high-dimensional location or sensor data.","One testable extension: instead of a full nearest-neighbor search, one could first project the noisy embedding onto the subspace spanned by the original word's $k$ nearest neighbors; if the projection restores comparable thresholds, the failure could disappear without an extra tuning constant."],"forward_implications":["For a fixed word vocabulary and $\\epsilon$, the output distribution of the mechanism is effectively binary — original word or far-off word — so the privacy-utility tradeoff promised by $d_X$-privacy is not delivered in the word-by-word setting.","The same failure mode is predicted for any mechanism that adds Laplace-style noise in a high-dimensional space and then rounds to the nearest catalogued point, including geo-indistinguishability deployments on high-dimensional auxiliary data.","The proposed rank-based resampling fix is a post-processing step, so it inherits the original mechanism's $d_X$-privacy guarantee without modifying the noise; the only new cost is a per-vocabulary tuning constant $c$.","The concentration bound $O(\\sqrt{n}/\\epsilon)$ for the noisy dot product gives a practical rule of thumb: to see close neighbors appear, the privacy budget must scale with $\\sqrt{n}$ unless the embedding space is restructured.","Because every word is effectively an outlier in high dimensions, the isolated-point critique of $d_X$-privacy applies universally to text embeddings, not just to rare or unusual words."],"supporting_citations":[{"why":"Introduces the calibrated multivariate perturbation mechanism that the paper analyzes: word-by-word multidimensional Laplace noise followed by nearest-neighbor rounding.","marker":"[16]"},{"why":"Defines $d_X$-privacy (metric privacy), the privacy notion the mechanism is built to satisfy.","marker":"[11]"},{"why":"Reports the surprising observation that word-level sanitization outputs either the original word or far-off words; this paper explains and fixes it.","marker":"[8]"},{"why":"Provides the GloVe embeddings in several dimensions that are the primary experimental testbed for the phenomenon.","marker":"[29]"},{"why":"Provides the Word2Vec embeddings used as a second, independent testbed.","marker":"[24]"},{"why":"Provides the fastText embeddings used as an additional testbed for the claimed universality across embedding models.","marker":"[20]"},{"why":"Is the exponential-mechanism baseline (natural text sanitization) compared against the proposed fix; the paper shows it still suffers the same close-neighbor failure.","marker":"[35]"},{"why":"Supplies the Laplace mechanism and differential privacy background that the multidimensional mechanism generalizes.","marker":"[14]"},{"why":"Is the standard high-dimensional nearest-neighbor meaningfulness result that the paper distinguishes from its own geometric explanation.","marker":"[5]"}],"fun_headline_variants":["Text privacy noise: original word or a stranger, never similar","Why dX-privacy outputs exact words or gibberish","High-dimensional Laplace noise skips synonyms","Curse of dimensionality defeats word privacy noise","Rank-based resampling restores text privacy utility"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The universal explanation assumes that in every high-dimensional word embedding model, each word's nearest neighbor is much farther away than the gap between consecutive neighbors' distances; the paper only measures this for GloVe (two vocabularies), Word2Vec, and fastText, so if a model such as a transformer-based embedding has differently shaped local distance profiles, the mechanism could behave as expected there even though the noise analysis remains correct.","fun_headline_variants_meta":{"raw":{"variants":["Text privacy noise: original word or a stranger, never similar","Why dX-privacy outputs exact words or gibberish","High-dimensional Laplace noise skips synonyms","Curse of dimensionality defeats word privacy noise","Rank-based resampling restores text privacy utility"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000598,"raw_usage":{"total_tokens":2890,"prompt_tokens":1131,"completion_tokens":1759,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":747,"completion_tokens_details":{"reasoning_tokens":1685}},"tokens_in":747,"tokens_out":1759,"duration_ms":11892,"temperature":1.0,"reasoning_tokens":1685,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T15:53:39.974401+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a transformer-based contextual embedding model, pick a word with many synonyms, compute the ratio of its nearest-neighbor distance to the difference between its first and second neighbor distances, and run the word-by-word mechanism at a mid-range $\\epsilon$ (for example 10) over several thousand words, counting how often the first 100 nearest neighbors are output. If close neighbors appear at a rate comparable to distant neighbors, the universal claim fails. A lighter check: verify whether $F_Z(z_{\\mathbf{w},\\mathbf{x}_1})$ (the probability that the original word beats its nearest neighbor) still dominates $F_Z(z_{\\mathbf{x}_1,\\mathbf{x}_2})$ as strongly for such a model as it does for GloVe and Word2Vec.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces the calibrated multivariate perturbation mechanism that the paper analyzes: word-by-word multidimensional Laplace noise followed by nearest-neighbor rounding."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines $d_X$-privacy (metric privacy), the privacy notion the mechanism is built to satisfy."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Reports the surprising observation that word-level sanitization outputs either the original word or far-off words; this paper explains and fixes it."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the fastText embeddings used as an additional testbed for the claimed universality across embedding models."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Laplace mechanism and differential privacy background that the multidimensional mechanism generalizes."},{"cited_title":"nearest neighbor","cited_arxiv_id":null,"evidence_quote":"Is the standard high-dimensional nearest-neighbor meaningfulness result that the paper distinguishes from its own geometric explanation."}],"review_version":1}