Pith. sign in

REVIEW 2 major objections 4 minor 1 cited by

Preempting Text Sanitization Utility in Resource-Constrained Privacy-Preserving LLM Interactions

T0 review · 2 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A middleware using a small language model predicts whether a privacy-sanitized prompt will still be useful to a paid LLM, and saves up to 20% of prompts that would have been wasted.

desk verdict A genuinely useful utility-assessor architecture with a valuable ANN/ENN replication, but the headline 20% savings is confounded with an unanalyzed prompt-correction step. read the letter →

arxiv 2411.11521 v3 pith:32EZY6WL submitted 2024-11-18 cs.CR cs.LG

Robin Carpentier , Benjamin Zi Hao Zhao , Hassan Jameel Asghar , Dali Kaafar This is my paper · ORCID
classification cs.CRcs.LG
keywords differentialprivacytextsanitizationlargelanguagemodelsmallutilitypredictionresourceefficiencydX-privacyprompt
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to solve a practical cost problem: when a company sanitizes a prompt for privacy before sending it to a paid online LLM, the sanitization can destroy the prompt's usefulness, and the user cannot tell in advance. The authors propose a middleware "utility assessor" that runs a small local language model (≤1B parameters) on both the original and the sanitized prompt, extracts cheap numerical features (epsilon value and semantic similarities between prompts and the small model's outputs), and regresses those features to predict how well the big LLM will perform on the sanitized prompt. If the prediction is poor, the prompt is never sent and the small model's own answer is used, saving the wasted fee. In experiments on summarization and translation, the best configuration raises prediction accuracy enough to save up to 20% of prompts that would otherwise have been wasted. The paper also reports a reproduction finding: an exact implementation of the much-cited dX-privacy text sanitization mechanism returns the original token about 99% of the time for epsilon≥25, so the published results likely depended on an unacknowledged approximate nearest neighbor search.

What carries the argument

The load-bearing object is the dX-privacy token-level sanitization mechanism (Algorithm 1): sample a noise direction from a multivariate normal, scale it by a gamma magnitude $1/\varepsilon$, add it to the token embedding $\phi(x)$, then map the noisy point back to a token by nearest neighbor search; a fix by a later reference adds a final rank-based exponential sampling step so output tokens stay close to the input. The utility assessor wraps this mechanism with a second mechanism: a regression pipeline whose features are (A) the privacy parameter $\varepsilon$, (B) semantic similarity between original and sanitized prompt, (C) similarity between original prompt and SLM output on it, and (D) similarity between original prompt and SLM output on the sanitized prompt, trained to predict (E) similarity between original prompt and LLM output on the sanitized prompt. The predictor's role is to act as a gate: only sanitized prompts predicted to clear a quality threshold are sent to the LLM. The paper's secondary discovery, the exact-versus-approximate nearest neighbor discrepancy, identifies line 5 of Algorithm 1 as the critical implementation step whose choice flips the mechanism between identity and perturbation.

What would settle it

Run the prompt-correction step on a set of dX-private sanitized prompts and measure how often corrected tokens coincide with the original tokens or their nearest embedding neighbors; if the correction restores original tokens at a high rate, the privacy guarantee claimed for the corrected-prompt pipeline does not hold.

Watch

Extended reading notes

Core claim

The central claim is that performance of an LLM on a dX-private sanitized prompt is predictable from features computable entirely on the user's side, and this prediction can gate whether the prompt is sent. Concretely, with the sanitized prompt $p_\varepsilon$, the original prompt $p$, the small model's outputs $r^{SLM}$ on $p$ and $r^{SLM}_\varepsilon$ on $p_\varepsilon$, and a task-specific semantic-similarity metric as quality estimator, a histogram-based gradient boosting regressor predicts the target similarity between $p$ and the LLM's output $r^{LLM}_\varepsilon$. Across two tasks, five small models, two LLMs, and two token embedding models for sanitization, the full feature set outperforms a baseline that uses only $\varepsilon$; the best summarized result reduces failed predictions by 53% compared with the baseline, with "wasted" prompts (overly optimistic predictions) falling from 25% to 5% in the best translation configuration, which also uses the small model to first correct the grammar and coherence of the sanitized prompt. The paper also claims that the dX-privacy mechanism of the cited text sanitization work, when implemented exactly as defined with an exact nearest neighbor search on line 5, outputs the input token more than 99% of the time for $\varepsilon \ge 25$, making the published mechanism effectively identity for those settings; the approximate-nearest-neighbor implementation explains the discrepancy, a choice the original paper never acknowledges.

Load-bearing premise

The headline 20% savings come from a configuration where the small model first rewrites the sanitized prompt to fix grammar and coherence, and the paper never checks whether that rewriting undoes the privacy protection by putting the original sensitive tokens back.

Editorial extensions

If this is right

  • If the utility assessor generalizes beyond the tested two tasks, companies with pay-per-use LLM APIs can place a cheap local gate in front of sanitized prompts, cutting wasted API calls by up to 20% in the best configuration and roughly 10% on average.
  • The reproduction result implies that published utility numbers for dX-privacy text sanitization may not be reproducible from the stated algorithm alone; any evaluation of such mechanisms must specify whether nearest neighbor search is exact or approximate.
  • The finding that $\varepsilon$ alone is a poor predictor of sanitized-prompt utility (the same $\varepsilon$ can give near-zero or near-perfect utility depending on the prompt) motivates feature-based prediction rather than relying on the privacy parameter.
  • The architecture requires a reference-free quality metric, so it applies to summarization and translation now, and to other tasks only when such a metric exists, which the paper argues includes text classification and open-ended text continuation.
  • Since poor prompts are filtered out, the provider learns that received prompts passed a quality threshold; the paper argues this weakens but does not practically break the DP guarantee for long prompts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the small model's grammar/coherence correction step is observed to restore original or near-original tokens at a high rate, the headline 20% savings may be achieved at the cost of silently weakening the privacy guarantee; this is testable by token-level comparisons of corrected versus uncorrected sanitized prompts.
  • The same regression-gate idea could be extended to other sanitization methods that output text, such as DP-based rewriting, which the paper explicitly mentions; one could also retrain the regressor online per company to adapt to domain vocabulary.
  • The exact-versus-approximate nearest neighbor finding suggests a broader reproducibility hazard: performance-driven implementation choices that alter the effective mechanism are easy to omit in papers that describe privacy mechanisms abstractly; routine reporting of implementation-level search algorithms would help.
  • For real deployments, the quality threshold in the utility assessor creates a selection bias that an adversary could exploit with repeated queries; the paper does not quantify this, and the practical impact depends on prompt length and embedding geometry.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes a middleware architecture that uses a small language model (SLM) to predict, before a prompt is sent to a costly online LLM, whether a dX-privacy-sanitized prompt will yield useful output. The prediction is based on features such as the privacy parameter epsilon and semantic similarities between the original prompt, the sanitized prompt, and the SLM-generated summaries/translations. The authors evaluate the architecture on summarization and translation tasks, report savings of up to 20% of previously wasted prompts, and reproduce an issue in Feyisetan et al.'s dX-privacy mechanism: an exact nearest-neighbor search outputs the input token about 99% of the time for moderate epsilon, whereas the previously reported results are reproducible only with approximate nearest-neighbor search.

Significance. If the prediction claim holds, the paper offers a practical and low-cost way to navigate the privacy-utility trade-off for LLM prompts, an important problem in privacy-preserving LLM use. The regression target is the LLM's actual output similarity, not a quantity derived from the input features, so the prediction task is genuine and not circular. The reproducible-code release and the careful replication of Feyisetan et al. are concrete strengths, and the nearest-neighbor finding is a valuable cautionary result for text-sanitization research. However, the headline 'up to 20%' savings claim is confounded by the corrected-prompts variant, so the current evidence supports the feature-based prediction claim only in a weaker, configuration-dependent form.

major comments (2)
  1. [Section 5.3, Table 3b] The headline 20% improvement conflates prompt correction with feature-based prediction. In the best configuration (Llama embedding, Gemini LLM, Llama3.2-1B, Corrected Prompts = Yes, features ABCD), the baseline row uses uncorrected sanitized prompts with feature A only, so two interventions change simultaneously: the prompt text is corrected and the feature set is expanded. No epsilon-only control on corrected prompts is reported, so the drop in Wasted $ from 25% to 5% cannot be attributed to the ABCD features. The non-corrected rows in the same table show a much smaller gain (e.g., 25% to 14% for T5/Opus-MT), suggesting that prompt correction accounts for a substantial share of the headline effect. The claim in Section 5.3 that the best improvement saves 20% of previously wasted computational and monetary resources is therefore not supported as stated. Please report an epsilon-only baseline on corrected prompts or otherwise separate the correction effect from the feature effect (e.g., compare ABCD on uncorrected and corrected prompts against the corresponding prompt-type baseline).
  2. [Section 5.3 (Corrected Prompts variant) and Section 7.2] The corrected-prompts variant may undo the dX-privacy noise, but the paper never analyzes this possibility. In this variant, the SLM first rewrites the sanitized prompt for coherence and grammar, and then both the SLM and the LLM operate on the corrected text. If correction replaces sanitized tokens with their original or semantically nearest forms, the privacy guarantee that motivated sanitization is weakened. Section 7.2 only considers the quality-threshold decision rule and assumes the provider cannot infer which tokens were changed; it does not address the fact that the corrected prompts have been rewritten before being sent. Please provide evidence that correction preserves the dX-privacy properties (e.g., token-level overlap between corrected and original prompts versus sanitized and original prompts), or restrict the headline savings claim to the non-corrected variant.
minor comments (4)
  1. [Section 5.3] The decision rule that operationalizes the 'send or don't send' choice is never specified; the reported Wasted $ metric uses a fixed 0.1 similarity margin, and the savings will depend on this threshold. Please state the intended threshold or report sensitivity to it.
  2. [Section 5.3] The paper states that other regressors were tested and the best one was selected, but the hyperparameters of the Histogram-based Gradient Boosting Regression Tree and the model-selection procedure are not described. The code release helps, but a sentence with the key settings would improve reproducibility.
  3. [Section 4.2] The finding about Feyisetan et al. is presented as a definite result in the abstract ('show that a potential performance-driven implementation choice... not being explicitly acknowledged'), while Section 4.2 correctly frames it as a 'potential' reliance based on the AWS repository. Please align the abstract and body wording, or provide more direct evidence about the original authors' implementation.
  4. [Throughout] There are minor language issues, such as 'a approximate nearest neighbor search' in the introduction and the informal 'mv_normal' in Algorithm 1; a final proofread would improve clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the utility regression predicts an out-of-sample LLM target from independent SLM features, and the self-cited dX-privacy fix is fully specified in Algorithm 1.

full rationale

The central claim is that features A-D (epsilon, prompt-prompt similarity, SLM output similarities on original and sanitized prompts) predict target E, the actual LLM output similarity on the sanitized prompt. E is measured from the LLM's own output and is not a transformation of any input feature; the regressor is evaluated on a held-out 20% split, so the 'up to 20%' savings figure is an out-of-sample prediction rather than a fitted value or renamed input. The sanitization mechanism does include a fix from Asghar et al. [3], a same-group citation, but Algorithm 1 specifies the fix completely (lines 6-7), and the utility-assessor experiments do not invoke [3] as evidence for the prediction; the reproduction experiments are compared against Feyisetan et al.'s external published results. The comparison in Table 3b between the epsilon-only baseline on uncorrected prompts and the ABCD regressor on corrected prompts is a confound and a privacy concern (correction may undo sanitization), but it is not circularity: the target is still the LLM's actual similarity, not derived by construction from the features. No equation in the paper reduces the claimed prediction to its inputs, and no fitted parameter is renamed as a prediction. Score 0.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the validity of the reference-free similarity metric, the alignment of SLM and LLM performance curves, the behavioral assumptions in Section 7.2, and the unexamined privacy preservation of the SLM correction step. The hand-chosen numeric quantities are the 0.1 threshold for defining wasted and failed predictions and the post hoc epsilon ranges used to train the regressor. No new physical or mathematical entities are posited.

free parameters (2)
  • Similarity threshold for wasted/failed predictions = 0.1
    The paper counts a prediction as wasted or failed when the predicted similarity differs from the target by more than 0.1 (Section 5.3). This threshold is hand-chosen and directly defines the headline savings metric, but it is not varied or justified.
  • Epsilon ranges for regression training = 1-1000 (summarization, Llama embedding), 1-100 (summarization, Bart embedding), 1-2000 (translation, Llama embedding)…
    The ranges were selected post hoc based on the observed utility curves in Figure 4, where epsilon has little effect outside these ranges. This data-driven choice affects the regression results and the reported savings.
assumptions (5)
  • domain assumption Semantic similarity between a prompt and a generated output, computed with all-mpnet-base-v2 or paraphrase-multilingual-mpnet-base-v2, is a valid reference-free utility measure for summarization and translation.
    All regression features and the target are cosine similarities between the original prompt and model outputs (Section 4.1, Quality Estimator). If this proxy does not track actual task quality, the measured savings do not reflect real utility.
  • domain assumption The SLM's performance trends across sanitization levels are sufficiently aligned with the LLM's that SLM-derived features can predict LLM utility.
    The architecture (Section 3.2) and the regression (Section 5.3) rely on similar-shaped performance curves, shown empirically in Figure 4 for the tested models but assumed to generalize to other tasks and models.
  • domain assumption User prompts are long enough and each prompt is sent only once, so the provider cannot average multiple sanitized versions or exploit the quality-threshold decision to reverse the sanitization.
    Section 7.2 states this assumption explicitly and argues the resulting privacy leak is small in practice for long prompts, but no formal bound is given.
  • ad hoc to paper In the Corrected Prompts variant, the SLM's grammar and coherence correction does not undo the dX-privacy sanitization or restore sensitive tokens.
    Section 5.3 introduces the correction step as part of the best-performing configuration, but the paper provides no analysis of whether correction reverts the noise added by Algorithm 1. If correction restores original content, the 20% savings headline is achieved at the cost of privacy protection.
  • standard math The dX-privacy mechanism in Algorithm 1, with the Asghar et al. fix, samples replacement tokens according to exp(-epsilon * rank) and preserves the stated DP guarantee.
    The paper relies on the correctness of this mechanism as background (Section 2.3). The formal study is cited as Asghar et al., authored by members of the present team.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Preempting Text Sanitization Utility in Resource-Constrained Privacy-Preserving LLM Interactions." pith.science (2026). https://pith.science/paper/32EZY6WL

@misc{pith2026241111521,
  author       = {Pith},
  title        = {Pith review of: Preempting Text Sanitization Utility in Resource-Constrained Privacy-Preserving LLM Interactions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/32EZY6WL}},
  note         = {Machine review of arXiv:2411.11521}
}
read the original abstract

Interactions with online Large Language Models raise privacy issues where providers can gather sensitive information about users and their companies from the prompts. While textual prompts can be sanitized using Differential Privacy, we show that it is difficult to anticipate the performance of an LLM on such sanitized prompt. Poor performance has clear monetary consequences for LLM services charging on a pay-per-use model as well as great amount of computing resources wasted. To this end, we propose a middleware architecture leveraging a Small Language Model to predict the utility of a given sanitized prompt before it is sent to the LLM. We experimented on a summarization task and a translation task to show that our architecture helps prevent such resource waste for up to 20% of the prompts. During our study, we also reproduced experiments from one of the most cited paper on text sanitization using DP and show that a potential performance-driven implementation choice dramatically changes the output while not being explicitly acknowledged in the paper.

Figures

Figures reproduced from arXiv: 2411.11521 by the authors.

Figure 1
Figure 1. Utility Assessor Architecture. 𝑝 represents the orig￾inal prompt. 𝑝𝜀 denotes the sanitized version of the prompt. 𝑟 𝑆𝐿𝑀 and 𝑟 𝑆𝐿𝑀 𝜀 designate the SLM’s result on the original and sanitized prompts, respectively. 𝑟 𝐿𝐿𝑀 𝜀 identifies the LLM’s result on the sanitized prompt. 3.2 Utility Assessor Architecture We propose a solution architecture where a user benefits from a trusted middleware including an SLM to assess th… view at source ↗
Figure 2
Figure 2. Average empirical frequency of the input word [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Llama-3-8B summarization performance on sanitized prompts measured as the similarity between the original prompt [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Models summarization performance on sanitized prompts, compared with the percentage of tokens changed and the [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. $d_X$-Privacy for Text and the Curse of Dimensionality

    cs.CR 2024-11 conditional novelty 7.0 of 10

    Word-level dX-privacy using multidimensional Laplace noise plus nearest neighbor search almost never emits semantically similar words; the paper derives why and patches the mechanism with a rank-based post-processing step.

Reference graph

Works this paper leans on

61 extracted references · 19 canonical work pages · cited by 1 Pith paper

  1. [1]

    Alibaba-NLP. 2024. gte-large-en-v1.5. https://huggingface.co/Alibaba-NLP/gte- large-en-v1.5

    work page 2024

  2. [2]

    Andrés, Nicolás E

    Miguel E. Andrés, Nicolás E. Bordenabe, Konstantinos Chatzikokolakis, and Catuscia Palamidessi. 2013. Geo-Indistinguishability: Differential Privacy for Location-Based Systems. In Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (Ccs ’13) . 901–914. doi:10.1145/2508859. 2516735

    doi:10.1145/2508859 2013

  3. [3]

    Hassan Jameel Asghar, Robin Carpentier, Benjamin Zi Hao Zhao, and Dali Kaafar

    work page

  4. [4]

    Borja Balle, Gilles Barthe, Marco Gaboardi, Justin Hsu, and Tetsuya Sato. 2020. Hypothesis testing interpretations and renyi differential privacy. In International Conference on Artificial Intelligence and Statistics. PMLR, 2496–2506. doi:10.48550/ arXiv.1905.09982

    arXiv doi:10.48550/arxiv.1905.09982 2020

  5. [5]

    Piotr Bojanowski, Edouard Grave, Armand Joulin, and Tomas Mikolov. 2017. En- riching Word Vectors with Subword Information. Transactions of the Association for Computational Linguistics 5 (2017), 135–146. doi:10.1162/tacl_a_00051

    doi:10.1162/tacl_a_00051 2017

  6. [6]

    Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks. In 28th USENIX Security Symposium (USENIX Security 19) . 267–284. doi:10.48550/arXiv.1802.08232

    arXiv doi:10.48550/arxiv.1802.08232 2019

  7. [7]

    Andrés, Nicolás Emilio Bordenabe, and Catuscia Palamidessi

    Konstantinos Chatzikokolakis, Miguel E. Andrés, Nicolás Emilio Bordenabe, and Catuscia Palamidessi. 2013. Broadening the Scope of Differential Privacy Using Metrics. In Privacy Enhancing Technologies. Springer Berlin Heidelberg, 82–102. doi:10.1007/978-3-642-39077-7_5

    doi:10.1007/978-3-642-39077-7_5 2013

  8. [8]

    Yu Chen, Tingxin Li, Huiming Liu, and Yang Yu. 2023. Hide and Seek (HaS): A Lightweight Framework for Prompt Privacy Protection. arXiv:2309.03057

    arXiv 2023

Show all 61 references
  1. [9]

    Chun Jie Chong, Chenxi Hou, Zhihao Yao, and Seyed Mohammadjavad Seyed Talebi. 2024. Casper: Prompt Sanitization for Protecting User Privacy in Web- Based Large Language Models. arXiv:2408.07004

    2024

  2. [10]

    Cyberhaven. 2023. ChatGPT at Work . Technical Report. https: //web.archive.org/web/20240612123905/https://info.cyberhaven.com/hubfs/ Webflow_Resources/EB_ChatGPTatworkreport_052423.pdf

    2023

  3. [11]

    Cynthia Dwork and Aaron Roth. 2014. The Algorithmic Foundations of Differ- ential Privacy. In Foundations and Trends in Theoretical Computer Science . Now Publishers. doi:10.1561/0400000042

    2014 doi

  4. [12]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language understanding. arXiv:1810.04805

    2019 arXiv

  5. [13]

    Cynthia Dwork. 2008. Differential privacy: A survey of results. In International conference on theory and applications of models of computation . Springer, 1–19. doi:10.1007/978-3-540-79228-4_1

    2008 doi

  6. [14]

    Alexander Fabbri, Irene Li, Tianwei She, Suyi Li, and Dragomir Radev. 2019. Multi- News: A Large-Scale Multi-Document Summarization Dataset and Abstractive Hierarchical Model. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics. 1074–1084...

    2019 doi

  7. [15]

    Falcons.ai. 2023. Fine-Tuned T5 Small for Text Summarization. https:// huggingface.co/Falconsai/text_summarization

    2023

  8. [16]

    Natasha Fernandes, Mark Dras, and Annabelle McIver. 2019. Generalised Differ- ential Privacy for Text Document Processing. In Principles of Security and Trust . 123–148. doi:10.1007/978-3-030-17138-4_6

    2019 doi

  9. [17]

    Oluwaseyi Feyisetan, Borja Balle, Thomas Drake, and Tom Diethe. 2020. Privacy- and Utility-Preserving Textual Analysis via Calibrated Multivariate Perturbations. In Proceedings of the 13th International Conference on Web Search and Data Mining (WSDM ’20). 178–186. doi:10.1145/...

    2020

  10. [18]

    K Gordon. 2013. MRA Thought of the Day–Medical Record Redacting: A Bur- densome and Problematic Method for Protecting Patient Privacy. MRA Health Information Services (2013)

    2013

  11. [19]

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, and Alex Vaughan et al. 2024. The Llama 3 Herd of Models. arXiv:2407.21783

    2024 arXiv

  12. [20]

    Fadi Hassan, David Sánchez, and Josep Domingo-Ferrer. 2023. Utility-Preserving Privacy Protection of Textual Documents via Word Embeddings. IEEE Transac- tions on Knowledge and Data Engineering 35, 1 (2023), 1058–1071. doi:10.1109/ TKDE.2021.3076632

    2023

  13. [21]

    Matthew Honnibal, Ines Montani, Sofie Van Landeghem, and Adriane Boyd

  14. [22]

    Timour Igamberdiev and Ivan Habernal. 2023. DP-BART for Privatized Text Rewriting under Local Differential Privacy. In Findings of the Association for Computational Linguistics: ACL 2023. 13914–13934. doi:10.18653/v1/2023.findings- acl.874

    2023 doi

  15. [23]

    Lee, Kobbi Nissim, Sofya Raskhod- nikova, and Adam Smith

    Shiva Prasad Kasiviswanathan, Homin K. Lee, Kobbi Nissim, Sofya Raskhod- nikova, and Adam Smith. 2011. What Can We Learn Privately? SIAM J. Comput. 40, 3 (2011), 793–826. doi:10.1137/090756090

    2011 doi

  16. [24]

    Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Ves Stoyanov, and Luke Zettlemoyer. 2019. BART: De- noising Sequence-to-Sequence Pre-Training for Natural Language Generation, Translation, and Comprehension. arXiv:1910.13461

    2019 arXiv

  17. [25]

    Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Veselin Stoyanov, and Luke Zettlemoyer. 2020. BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehension. In Proceedings of the 58t...

    2020 doi

  18. [26]

    Peihua Mai, Ran Yan, Zhe Huang, Youjia Yang, and Yan Pang. 2023. Split-and- Denoise: Protect Large Language Model Inference with Local Differential Privacy. arXiv:2310.09130

    2023 arXiv

  19. [27]

    Justus Mattern, Benjamin Weggenmann, and Florian Kerschbaum. 2022. The Limits of Word Level Differential Privacy. InFindings of the Association for Compu- tational Linguistics: NAACL 2022. 867–881. doi:10.18653/v1/2022.findings-naacl.65

    2022 doi

  20. [28]

    Microsoft. [n. d.]. Presidio - Data Protection and De-identification SDK. https: //github.com/microsoft/presidio/

  21. [29]

    Tomás Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. 2013. Efficient Esti- mation of Word Representations in Vector Space. In1st International Conference on Learning Representations, ICLR . arXiv:1301.3224

    2013 arXiv

  22. [30]

    Redmiles

    Priyanka Nanayakkara, Mary Anne Smart, Rachel Cummings, Gabriel Kaptchuk, and Elissa M. Redmiles. 2023. What Are the Chances? Explaining the Epsilon Parameter in Differential Privacy. In 32nd USENIX Security Symposium (USENIX Security 23). 1613–1630. doi:10.48550/arXiv.2303.00738

    2023 doi arXiv

  23. [31]

    Nomic.ai. 2024. modernbert-embed-base. https://huggingface.co/nomic-ai/ modernbert-embed-base

    2024

  24. [32]

    Morris, Brandon Duderstadt, and Andriy Mulyar

    Zach Nussbaum, John X. Morris, Brandon Duderstadt, and Andriy Mulyar

  25. [33]

    Annika Willoch Olstad. 2023. Generation and Selection of Replacement Choices for Text Sanitization. Master’s thesis. University of Oslo. https://www.duo.uio. no/handle/10852/103852

    2023

  26. [34]

    Anthi Papadopoulou, Pierre Lison, Mark Anderson, Lilja Øvrelid, and Ildikó Pilán. 2023. Neural Text Sanitization with Privacy Risk Indicators: An Empirical Analysis. arXiv:2310.14312

    2023 arXiv

  27. [35]

    arXiv:2402.01613

    Nomic Embed: Training a Reproducible Long Context Text Embedder. arXiv:2402.01613

    arXiv

  28. [36]

    Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. GloVe: Global Vectors for Word Representation. In Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP) . 1532–1543. doi:10. 3115/v1/D14-1162

    2014

  29. [37]

    Chen Qu, Weize Kong, Liu Yang, Mingyang Zhang, Michael Bendersky, and Marc Najork. 2021. Natural Language Understanding with Privacy-Preserving BERT. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management (CIKM ’21) . 1488–1497. doi:10.11...

    2021

  30. [38]

    Pedregosa, G

    F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cour- napeau, M. Brucher, M. Perrot, and E. Duchesnay. 2011. Scikit-learn: Machine Learning in Python. Journal of Machine ...

    2011

  31. [39]

    Guerreiro, Chrysoula Zerva, Ana C Farinha, Christine Maroti, José G

    Ricardo Rei, Marcos Treviso, Nuno M. Guerreiro, Chrysoula Zerva, Ana C Farinha, Christine Maroti, José G. C. de Souza, Taisiya Glushkova, Duarte Alves, Luisa Coheur, Alon Lavie, and André F. T. Martins. 2022. CometKiwi: IST-Unbabel 2022 Submission for the Quality Estimation Sh...

    2022

  32. [40]

    Nils Reimers and Iryna Gurevych. 2019. Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks. In Proceedings of the 2019 Conference on Em- pirical Methods in Natural Language Processing . Association for Computational Linguistics. doi:10.18653/v1/D19-1410 Conference’1...

    2019 doi

  33. [41]

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2020. Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer.Journal of Machine Learning Research 21, 140 (2020), 1–67. http...

    2020

  34. [42]

    Zhili Shen, Zihang Xi, Ying He, Wei Tong, Jingyu Hua, and Sheng Zhong. 2024. The Fire Thief Is Also the Keeper: Balancing Usability and Privacy in Prompts. arXiv:2406.14318

    2024 arXiv

  35. [43]

    Spotify. [n. d.]. Annoy (Approximate Nearest Neighbors Oh Yeah). https://github. com/spotify/annoy

  36. [44]

    Nils Reimers and Iryna Gurevych. 2020. Making Monolingual Sentence Em- beddings Multilingual using Knowledge Distillation. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing . Association for Computational Linguistics. doi:10.18653/v1/202...

    2020 doi

  37. [45]

    Jörg Tiedemann. 2020. The Tatoeba Translation Challenge – Realistic Data Sets for Low Resource and Multilingual MT. In Proceedings of the Fifth Conference on Machine Translation. 1174–1182. https://aclanthology.org/2020.wmt-1.139/

    2020

  38. [46]

    Jörg Tiedemann and Santhosh Thottingal. 2020. OPUS-MT – Building open translation services for the World. InProceedings of the 22nd Annual Conference of the European Association for Machine Translation . 479–480. https://aclanthology. org/2020.eamt-1.61/

    2020

  39. [47]

    Dai, Anja Hauth, and Katie Mil- lican et al

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M. Dai, Anja Hauth, and Katie Mil- lican et al. 2025. Gemini: A Family of Highly Capable Multimodal Models. arXiv:2312.11805

    2025 arXiv

  40. [48]

    Unbabel. 2023. wmt22-cometkiwi-da. https://huggingface.co/Unbabel/wmt22- cometkiwi-da

    2023

  41. [49]

    Benjamin Weggenmann, Valentin Rublack, Michael Andrejczuk, Justus Mattern, and Florian Kerschbaum. 2022. DP-VAE: Human-readable Text Anonymization for Online Reviews with Differentially Private Variational Autoencoders. In Proceedings of the ACM Web Conference 2022 (WWW ’22) ....

    2022

  42. [50]

    Meng Tong, Kejiang Chen, Jie Zhang, Yuang Qi, Weiming Zhang, Nenghai Yu, Tianwei Zhang, and Zhikun Zhang. 2024. InferDPT: Privacy-preserving Inference for Black-Box Large Language Model. arXiv:2310.12214

    2024

  43. [51]

    Wikimedia Foundation. 2025. Wikidata: A Free Knowledge Base. https://www. wikidata.org Accessed: 2025-06-04

    2025

  44. [52]

    Alexandra Wood, Micah Altman, Aaron Bembenek, Mark Bun, Marco Gaboardi, James Honaker, Kobbi Nissim, David R O’Brien, Thomas Steinke, and Salil Vadhan

  45. [53]

    Chi, Tatsunori Hashimoto, Oriol Vinyals, Percy Liang, Jeff Dean, and William Fedus

    Jason Wei, Yi Tay, Rishi Bommasani, Colin Raffel, Barret Zoph, Sebastian Borgeaud, Dani Yogatama, Maarten Bosma, Denny Zhou, Donald Metzler, Ed H. Chi, Tatsunori Hashimoto, Oriol Vinyals, Percy Liang, Jeff Dean, and William Fedus. 2022. Emergent Abilities of Large Language Mod...

    2022 doi arXiv

  46. [54]

    Xiang Yue, Minxin Du, Tianhao Wang, Yaliang Li, Huan Sun, and Sherman S. M. Chow. 2021. Differential Privacy for Text Analytics via Natural Text Sanitization. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021 . 3853–3866. doi:10.18653/v1/2021.findin...

    2021 doi

  47. [55]

    Xiaojin Zhang, Yahao Pang, Yan Kang, Wei Chen, Lixin Fan, Hai Jin, and Qiang Yang. 2025. No Free Lunch Theorem for Privacy-Preserving LLM Inference. Artificial Intelligence (2025), 104293. doi:10.1016/j.artint.2025.104293

    2025

  48. [56]

    Xin Zhang, Yanzhao Zhang, Dingkun Long, Wen Xie, Ziqi Dai, Jialong Tang, Huan Lin, Baosong Yang, Pengjun Xie, Fei Huang, Meishan Zhang, Wenjie Li, and Min Zhang. 2024. mGTE: Generalized Long-Context Text Representation and Reranking Models for Multilingual Text Retrieval. arXi...

    2024 arXiv

  49. [57]

    Nan Xu, Oluwaseyi Feyisetan, Abhinav Aggarwal, Zekun Xu, and Nathanael Teissier. 2021. Density-Aware Differentially Private Textual Perturbations Using Truncated Gumbel Noise. The International FLAIRS Conference Proceedings 34 (2021). doi:10.32473/flairs.v34i1.128463

    2021 doi

  50. [61]

    Ying Zhao and Jinjun Chen. 2022. A Survey on Differential Privacy for Unstruc- tured Data Content. Acm Computing Surveys 54, 10s (2022). doi:10.1145/3490237

    2022 doi

  51. [2018]

    Differential Privacy: A Primer for a Non-Technical Audience. Vand. J. Ent. & Tech. L. 21 (2018), 209. doi:10.2139/ssrn.3338027

    2018 doi

  52. [2020]

    spaCy: Industrial-strength Natural Language Processing in Python. (2020). doi:10.5281/zenodo.1212303

    2020 doi

  53. [2024]

    arXiv:2411.13784

    𝑑𝑋 -Privacy for Text and the Curse of Dimensionality. arXiv:2411.13784

    arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.