{"id":"6b4755fa-4480-46d4-aa13-aa027681e81a","arxiv_id":"2608.09164","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"CIDER is a new dataset and benchmark showing that in-context personalization improves LLM prediction of individual privacy disclosure boundaries, but only one tested model improves both error types across all variants.","lead":"This paper introduces CIDER, a dataset of 14,850 human privacy judgments from 169 people across 60 scenarios, with each person rating nine ways of sharing sensitive information. It then tests whether LLMs can predict a person's disclosure choices from their past choices, finding that in-context personalization helps but often trades false positives against false negatives.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline 11.41 pp personalization gain is confounded: the no-history baseline uses a different system prompt and reasoning format, so the improvement is not cleanly attributable to history alone.","rationale":"The paper is a substantial dataset contribution and the empirical evaluation is internally consistent; the reader's CONDITIONAL verdict is appropriate. However, I do not think the reader's weakest assumption, the GPT-o3 variant generation quality, is the single most load-bearing issue for the central claim. The central claim is that in-context personalization improves prediction by up to 11.41 pp, and that number is computed against a no-history baseline whose prompt is structurally different from the personalized conditions in both system-prompt content and required reasoning format. This is a classic ICL evaluation confound: the treatment includes not only historical boundaries but also an instruction to infer preferences and a two-step reasoning scaffold. The paper's own small-model result under H, where Llama 3.1 8B drops below the no-history baseline, could be explained by this prompt mismatch rather than by an inability to use history. The prompt-sensitivity analysis in B.5 varies only HC wording, so it does not address the baseline mismatch. A matched k=0 condition is straightforward to run and would settle whether the reported gains are real. If the matched baseline moves substantially, the headline numbers and the model-family comparisons would need revision; if not, the original attribution stands. The variant-generation concern remains important for the variant-level FP/FN conclusions, and the lack of confidence intervals remains a reporting issue, but the unmatched baseline is more directly load-bearing for the paper's headline quantitative claim. Since the appropriate verdict is still CONDITIONAL pending this check, I leave the reader's verdict unchanged.","tokens_in":32783,"tokens_out":5548,"duration_ms":57187,"concrete_test":"Run every model on a matched no-history condition: reuse the HC/HL/H system and user prompts verbatim but with an empty <History> section (or 'No history available'), keeping the two-step reasoning instruction, JSON output, and target scenario identical. Compare matched no-history accuracy to the current no-history baseline for all 12 models at k=1, 4, 5, 6. If, for example, Claude Sonnet 4.6's matched baseline rises from 60.57% to above roughly 68%, the headline 11.41 pp personalization gain is largely prompt framing; if it stays within about 1 pp, the original attribution to history holds.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline result (Claude Sonnet 4.6, 71.98% HC k=6 vs 60.57% no-history, 11.41 pp gain; Abstract and Table 1) is computed against a baseline that differs from the personalized conditions in more than the presence of history. The HC/HL/H prompts (Appendix A.2, Figures 5-7) open with 'Your task is to infer a user's information disclosure preferences from their historical answers...', instruct the model to first infer preferences and then predict, and require exactly two reasoning sentences. The no-history prompt (Figure 8) instead says 'Your task is to predict the user's answer...', requires one-sentence reasoning, and omits the <History> section entirely. Thus the comparison conflates the effect of six historical boundaries with the effect of a different task framing: the personalized system prompt explicitly primes preference inference and imposes a two-step decomposition. For small models this matters: Llama 3.1 8B gets 54.34% no-history but 51.88% under H at k=6, which the paper interprets as history failing to help, but the H condition's prompt may itself induce pattern overfitting. Prompt-sensitivity tests (B.5) only reword the HC prompt; they never test a history-matched baseline. Without a k=0 version of the same personalized prompt, the 11.41 pp gain and the claim that 'in-context personalization improves prediction' are not cleanly attributable to the historical disclosure boundaries.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces CIDER, a dataset of 14,850 human disclosure-acceptability ratings from 169 users, organized into 1,650 contextual disclosure boundaries over 60 interpersonal information-sharing scenarios. Each boundary is a 9-bit vector over variants that factorially combine three granularity levels and three identifiability levels. The authors formulate a task in which an LLM must predict a user's boundary for a new scenario from k historical boundaries (k∈{1,4,5,6}), under three history conditions (HC, full semantic context; HL, structural labels only; H, bare decisions) and a no-history baseline. They evaluate 12 models, reporting accuracy, variant-level FP/FN shifts, error analyses, and comparisons against group- and norm-level baselines. The headline finding is that in-context personalization improves prediction by up to 11.41 pp (Claude Sonnet 4.6, HC k=6), while model-scale and variant-level analyses reveal heterogeneous FP/FN trade-offs. The dataset, prompts, and study artifacts are released.","tokens_in":33140,"tokens_out":7486,"duration_ms":71259,"significance":"If the comparative results withstand scrutiny, CIDER fills a real gap: it provides personalized, contextually situated disclosure boundaries rather than aggregate privacy norms, and it ships a reusable elicitation protocol plus an evaluation suite. The study design has notable strengths: real-user data with attention checks, manipulation checks (GEE effects of granularity/identifiability, monotonicity, inter-user agreement) that support the boundary structure, an explicit error taxonomy, and detailed prompt and appendix documentation. The central causal claim about history is, however, currently supported by an uncontrolled comparison, and several supporting claims lack uncertainty quantification; both are addressable within the scope of a revision.","major_comments":[{"comment":"The no-history baseline and the personalized conditions differ in more than the presence of history. The HC/HL/H system prompts (Figures 5–7) instruct the model to infer the user's information disclosure preferences and to produce exactly two reasoning sentences, whereas the no-history prompt (Figure 8) asks it to 'predict the user's answer' with one sentence of reasoning. Consequently, the 11.41 pp gain attributed to in-context personalization (Abstract, Table 1) and the FP/FN comparisons against baseline (Section 4.2.2, Table 6) conflate the effect of history with a different task framing and reasoning format. Please add a k=0 control that uses the same personalized system prompt (e.g., an empty <History> section, or an explicit instruction to infer preferences without history) and the same two-sentence reasoning requirement, and recompute all headline and variant-level comparisons against this control. This is necessary to make the attribution claim 'in-context personalization improves prediction' clean.","section":"§4.1, Appendix A.2 (Figs. 5–8), Table 1"},{"comment":"Table 1 and Section 4.2.1 report only point estimates, with no confidence intervals or significance tests, for all main comparisons. Claims such as 'GPT-5.4 improving by 1.38 pp from k=4 to k=6' and 'Qwen3.5-9B decreases by 0.23 pp under HC' are within the range one would expect from user-level variance across 169 users. Please report user-cluster bootstrap confidence intervals for at least the headline comparisons (HC k=6 vs no-history, HC vs HL, and k=4 vs k=6 for the models used in the scaling discussion), and indicate which differences are not statistically distinguishable.","section":"Table 1, §4.2.1"},{"comment":"The validity of the variant-level analyses rests on the assumption that the nine variants in each scenario vary essentially only in granularity and identifiability. Section 3.1 and Appendix D.4.2 validate this with a single author's review of 15 scenarios (scores 0.96 and 0.97) plus a two-author pass for correctness, but they do not measure inter-rater reliability or control for confounds such as tone, naturalness, or perceived sensitivity. Because Section 4.2.2 and the 'structural heuristics' claims interpret model behavior at the variant level, please add an independent, blind rating study (or at least a second annotator with agreement statistics) for the intended dimensions and for plausibility/naturalness, or temper these conclusions accordingly.","section":"§3.1, Appendix D.4.2, §4.2.2"}],"minor_comments":[{"comment":"The footnote for Llama 3.1 8B and Appendix B.1 describe prediction failures, but the main text does not fully explain how these failures are handled when computing per-user accuracy; dropping failed scenarios can change the user-macro denominator and make this model's numbers less comparable.","section":"Table 1, Appendix B.1"},{"comment":"The use of GPT-o3 to generate variants while OpenAI models are evaluated later is a distributional overlap that the paper does not acknowledge; a sentence of transparency would be useful.","section":"§3.1"},{"comment":"The norm-level baseline defined as all 'No' is a strong modeling choice; consider using a norm-derived boundary (e.g., from PrivacyLens norm ratings) or explicitly justify why all-No is the appropriate norm baseline.","section":"Appendix C.4"},{"comment":"The abstract and Section 4.2.1 state that personalization 'generally improves' accuracy while several small models underperform the no-history baseline under H; consider adding a qualifier such as 'under HC/HL' to avoid overstating the general claim.","section":"Abstract, §4.2.1"}],"recommendation":"major_revision","confidential_remarks":"This is a solid dataset contribution, and the evaluation is unusually transparent. My main concern is the headline attribution; I would not trust the 11.41 pp figure until the same-prompt k=0 control is run. Please also request confidence intervals for the key comparisons and an independent variant-quality check. The paper fits COLM's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The dataset is the real contribution here, and it holds up. CIDER gives you 1,650 contextual disclosure boundaries from 169 users, each a 3x3 grid over granularity and identifiability. That is genuinely new: prior work mostly has aggregate norms or rule-based personalization, not individual-level boundaries at this granularity. The variant generation was checked with partial-credit scores (0.96 and 0.97), the manipulation checks (GEE, monotonicity, inter-user agreement) support the boundary construct, and the data and code are public. Credit where due: this is a usable benchmark with careful construction.\n\nThe soft spots are real, though. The headline claim of up to 11.41 pp gain from in-context personalization is based on comparing personalized prompts (HC/HL/H) against a no-history baseline that is not the same prompt with history removed. The no-history version asks for one-sentence reasoning and gives no <History> section; the personalized versions explicitly instruct the model to infer preferences and use two-sentence reasoning. That conflates the effect of history with the effect of task framing. The stress-test note is right. The prompt sensitivity tests in B.5 only reword the HC prompt; they never test a k=0 version of the same personalized prompt. Without that control, the 11.41 pp number and the claim that history helps are not cleanly attributable to the history itself.\n\nThe k-scaling analysis (k=1 to k=6 under the same prompt) is a cleaner comparison, and the finding that larger models benefit more from longer history is on firmer ground. But Table 1 reports point estimates without confidence intervals or significance tests. With 169 users, a 2-3 pp gap could be noise. The paper should add at least bootstrap CIs. Also, Llama 3.1 8B failed on some prediction tasks; the appendix gives counts, but the paper never states whether accuracy is computed on the shared subset or how failures were handled. That needs to be explicit.\n\nThe GPT-o3 variant generation versus OpenAI model evaluation is a mild distributional overlap, not a circularity. I would not weight that heavily.\n\nWho should read this: privacy and HCI people working on personalized alignment, and anyone building LLM benchmarks where in-context history is the intervention. The dataset is worth citing and worth a serious referee. The empirical section needs revision: add the k=0 control prompt, report uncertainty, clarify failure handling. That is a normal revision, not a rejection.\n\nSend it to peer review.","headline":"CIDER is a valuable per-user disclosure dataset, but the headline personalization gain is confounded by a mismatched no-history baseline prompt.","tokens_in":33564,"tokens_out":2303,"would_cite":true,"duration_ms":22547,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Six past choices lift LLM disclosure prediction by 11 points","keywords":["privacy preference alignment","contextual disclosure boundaries","granularity and identifiability","in-context personalization","LLM evaluation dataset","false positive-negative trade-off","contextual integrity","human annotation"],"falsifier":"Have independent raters blind-rate the variants from all 60 scenarios on the granularity and identifiability scales without seeing the intended labels; if a nontrivial share of variants is mis-assigned, such as a general variant rated as detailed or an unidentifiable variant that reveals the subject, the ordinal structure underpinning the variant-level false-positive and false-negative claims is violated. Alternatively, rerun the prediction task with human-written variants: if the FP-FN patterns persist, the conclusions reflect the structural dimensions rather than artifacts of generated wording.","tokens_in":32553,"feed_emoji":"🔒","tokens_out":5825,"duration_ms":51923,"temperature":0.7,"pith_summary":"CIDER is a new dataset that records how 169 real people would feel about sharing the same sensitive information at nine different levels of detail and identifiability, across 60 everyday scenarios. The paper uses these recorded contextual disclosure boundaries to ask whether an LLM can predict a given person's sharing decisions in a new situation from just six of their past decisions. The answer it argues for is yes, but unevenly: in-context personalization lifts accuracy by up to 11.41 percentage points, with the strongest models using scenario meaning while smaller models lean on crude structural rules about detail and identifiability. The paper also argues that accuracy alone hides a systematic imbalance, because most models trade false positives against false negatives, and only one model cut both error types on every variant. If right, CIDER gives the field a working benchmark for personalized privacy alignment rather than norm-level compliance alone.","feed_headline":"Six past choices lift LLM disclosure prediction by 11 points","feed_subtitle":"A 14,850-annotation dataset shows LLMs can learn personal sharing boundaries, but only one model cuts both error types.","key_machinery":"The load-bearing object is the contextual disclosure boundary: a user's nine binary accept-and-reject decisions on variants spanning a 3x3 grid of granularity (general, moderately detailed, very detailed) and identifiability (not, partially, fully identifiable), collected under a fixed scenario, communication role, and AI-mediation condition. A generation pipeline produces the nine variants for each scenario, and the boundary is read by models through three personalization conditions—full semantic context (HC), structural labels only (HL), and bare decisions without context or labels (H)—which isolate whether prediction gains come from semantic understanding or from structural heuristics. The boundary serves simultaneously as the dataset unit, the prediction target, and the instrument that exposes asymmetric error shifts across variants.","core_discovery":"The central claim is that an individual's privacy preference can be operationalized as a contextual disclosure boundary—a binary yes/no rating over nine variants ordered along granularity and identifiability—and that this boundary can be predicted from behavioral history without any parameter updates. On 1,650 such boundaries from 169 users, in-context personalization with six historical scenarios improves prediction accuracy by up to 11.41 percentage points over the no-history baseline, with the best models reaching about 72 percent accuracy. The paper further claims that larger reasoning models extract user-specific and context-specific semantics from history, whereas smaller models mostly apply structural heuristics keyed to the two disclosure dimensions, and that personalization's benefit is not error-balanced: across the nine variants only Claude Sonnet 4.6 reduced both false-positive and false-negative rates, while every other model increased at least one error type on some variant.","pith_inferences":["A testable extension is to treat the FP-FN imbalance as an explicit design objective: fine-tuning a small model on CIDER with an asymmetric loss that penalizes false positives more heavily would show whether the structural-heuristic floor is a capability ceiling or merely a prompt and training artifact.","The ordinal granularity-by-identifiability grid could be reused as a controllable probe for other alignment axes, such as emotional tone or recipient trust, letting future datasets measure how LLM disclosure behavior shifts along each dimension independently.","The paper's single-session snapshot invites a longitudinal extension: re-contacting the same users weeks later would test whether disclosure boundaries are stable enough to justify long-term personalization, and whether a model should update or override stale history.","Because human acceptance falls monotonically along both axes while inter-user variance is wide, one direct extension is to check whether models' per-variant error patterns correlate with users' self-reported need for privacy and attitudes toward AI."],"forward_implications":["If six past boundaries can shift accuracy by more than 11 points, inference-time personalization becomes a viable route to privacy alignment without retraining or updating model parameters.","The gap between the semantic and structural conditions indicates that richer conversational context, not just more history, is what frontier models convert into user-specific predictions; smaller models plateau because they fall back on granularity and identifiability shortcuts.","The false-positive and false-negative asymmetry implies that aggregate accuracy overstates alignment, so privacy benchmarks should report both error directions per disclosure variant rather than a single score.","Because model-predicted individual boundaries tie or beat group-based and norm-based boundaries in most compared cases, the paper supports treating personalized preference modeling, not norm compliance, as the right target for privacy-aligned assistants.","The tension between frontier-model accuracy and small-model local deployment frames a concrete design trade-off: achieving both privacy and personalization requires improving contextual reasoning in on-device models."],"supporting_citations":[{"why":"Supplies the Contextual Integrity framework that grounds the scenario attributes and the norm-violating communication contexts.","marker":"(Nissenbaum, 2004)"},{"why":"Supplies Communication Privacy Management theory, which motivates modeling personal privacy boundaries as behavioral disclosure rules.","marker":"(Petronio, 2002)"},{"why":"Provides the PrivacyLens seed scenarios of norm-violating interpersonal communication that CIDER adapts and expands.","marker":"(Shao et al., 2024)"},{"why":"Provides prior evidence connecting disclosure detail to perceived privacy risk, grounding the granularity dimension.","marker":"(Bhatia & Breaux, 2018)"},{"why":"Defines identifiability through direct and quasi-identifiers, grounding the identifiability dimension.","marker":"(Sweeney, 2000)"},{"why":"Supplies the partial-credit ordinal scoring scheme used to evaluate whether generated variants preserve the intended granularity and identifiability levels.","marker":"(Wang et al., 2010)"},{"why":"Supplies the AC1 agreement measure used to validate the automatic labeling of scenario dimensions.","marker":"(Gwet, 2014)"},{"why":"Provides the Need for Privacy short scale used in the study to measure participants' privacy dispositions.","marker":"(Frener et al., 2024)"}],"fun_headline_variants":["Six past examples lift LLM privacy prediction by 11 points","In-context personalization: 6 samples boost accuracy 11%","Predicting disclosure boundaries: 14,850 human annotations","Only one LLM balances privacy prediction errors","LLMs need just six personal examples to predict sharing"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The nine generated variants must faithfully instantiate the intended three-by-three granularity and identifiability grid and preserve its ordinal structure; that quality rests on one author's review of 15 scenarios with partial-credit scores of 0.96 and 0.97 plus two authors' review of all variants, so if variants also differ in tone or naturalness the variant-level error analyses are not cleanly attributable to the two dimensions.","fun_headline_variants_meta":{"raw":{"variants":["Six past examples lift LLM privacy prediction by 11 points","In-context personalization: 6 samples boost accuracy 11%","Predicting disclosure boundaries: 14,850 human annotations","Only one LLM balances privacy prediction errors","LLMs need just six personal examples to predict sharing"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000266,"raw_usage":{"total_tokens":1640,"prompt_tokens":1001,"completion_tokens":639,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":617,"completion_tokens_details":{"reasoning_tokens":558}},"tokens_in":617,"tokens_out":639,"duration_ms":5891,"temperature":1.0,"reasoning_tokens":558,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:16:22.797590+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have independent raters blind-rate the variants from all 60 scenarios on the granularity and identifiability scales without seeing the intended labels; if a nontrivial share of variants is mis-assigned, such as a general variant rated as detailed or an unidentifiable variant that reveals the subject, the ordinal structure underpinning the variant-level false-positive and false-negative claims is violated. Alternatively, rerun the prediction task with human-written variants: if the FP-FN patterns persist, the conclusions reflect the structural dimensions rather than artifacts of generated wording.","supporting_citations":[],"review_version":2}