The release that protects everything and therefore tells no one anything
A product team wants to know why users abandon conversations with a company chatbot. A fairness auditor wants to know whether that same chatbot treats different groups of users equally. Both requests concern the same corpus of conversations. Under the privacy methods most organizations currently deploy, both teams receive the identical privatized dataset — and the fairness auditor, who legitimately needs to know each user’s characteristics, receives a dataset in which those characteristics have been scrubbed away.
This is not a bug in any particular tool. It is the design of the field. Differentially private synthetic text generation, the dominant approach for releasing useful text without exposing the people in it, applies the same guarantee to every attribute of every record regardless of who receives the data. Anonymization systems rewrite records to hide a predefined list of attributes that is fixed for all recipients. Both assume that what must be protected is a property of the data alone.
A team at the University of Washington Tacoma and Zillow argues, in a paper posted to arXiv, that this assumption is the source of the loss. [1] An attribute that is harmless to one audience can be sensitive to another, and each audience typically needs only some attributes preserved. Treating privacy as a single dial set once for all comers means the dial must be set for the most cautious recipient — and everyone else pays for that caution in insight they never get.
Three steps that separate what is sensitive from what is merely present
The framework the authors propose is called Ext-Classify-Priv, and its structure follows its name. The first step, Ext, extracts the information types present in a corpus — a schema of attributes such as age, topic, income, or relationship status, each with a finite set of possible values. This runs once per corpus, not once per release.
The second step is where the audience enters. Each recipient comes with what the authors call a release context: the recipient itself plus the use case. Classify takes that context and the attribute names — only the names, never the records — and asks a language model to sort the attributes into two sets: those this audience may learn, and those it may not. The same corpus yields different splits for different recipients. In the paper’s illustration, an advertiser has nine attributes protected while a public re-post of the same data has only three.
The third step protects only the private set. The authors build two mechanisms for this. One, SDG-CI, generates synthetic text with a formal privacy guarantee that covers the private attributes but not the public ones. The other, ANON-CI, rewrites each real record, providing an empirical rather than formal guarantee.
The normative question — who is allowed to learn what — is delegated to contextual integrity, Helen Nissenbaum’s framework holding that whether an information flow is appropriate depends on its context: who sends the information, who receives it, for what purpose, and the norms under which it was originally shared. Applied to a data release, contextual integrity identifies which attributes may flow to a given audience. It does not say how to stop the others from flowing, or how much protection a release provides. The authors are explicit about this division of labor: contextual integrity decides what to protect for each audience; the privatization mechanism decides how.
The gain, measured on three corpora
The empirical case rests on three datasets. The first is a synthetic Reddit corpus of question-and-answer pairs with human-annotated personal attributes of the answer writers, released to three audiences with different needs: an ML vendor, a community re-post, and an advertiser. The second is bioRxiv, a public preprint corpus. The third is a proprietary set of 1,000 conversations between homebuyers and real estate agents, held by Zillow.
On the Reddit data, audience-specific releases were more faithful than a single audience-agnostic release for every audience. The size of the gain tracked how much the audience was permitted to see. Measured by MAUVE, a distributional similarity score between synthetic and real text, SDG-CI at a privacy budget of epsilon equal to 1 improved over the MAPLE baseline by 0.196 for the re-post audience, which was allowed eight public attributes; by 0.129 for the ML vendor, allowed six; and by 0.050 for the advertiser, allowed two. [1]
That gradient is the finding, not a footnote — a reading of the results offered here, not a claim the authors state in those words. For audiences close to the original context — a community where users already disclose personal details, or an internal team auditing its own systems — conditioning on the audience produces substantially more useful data from the same corpus. For audiences that should learn almost nothing, such as advertisers building behavioral profiles, the classifier marks nearly every attribute private and the method behaves much like the audience-agnostic baseline. The authors’ conclusion is that for such audiences an audience-agnostic release costs the data owner little, while for audiences near the original context — common in real deployments — the conditioning pays.
On bioRxiv, the synthetic generation method raised MAUVE from 0.097 to 0.420 at epsilon equal to 1. [1] On the real estate conversations, the anonymization method raised MAUVE from 0.698 to 0.959 over the best baseline. The authors note that their epsilon covers only the private attributes and so is not directly comparable to the record-level epsilon of the baselines — matching it shows how much fidelity is gained by not protecting public attributes, which is precisely the setting the method is designed for.
Why the budget is spent where it is spent
The mechanism behind the gain is a bookkeeping decision about where privacy budget goes. Differential privacy works by adding calibrated noise; every statistic that is released draws down a finite budget, and noise spent on a statistic that did not need protecting is noise wasted. Standard synthetic generation spends budget on every attribute of every record. SDG-CI spends it only on the attributes classified as private for the recipient.
The authors modify an existing tabular synthesizer, AIM, to model the private attributes conditioned on the public ones. Because the guarantee is defined relative to a simulator that is given the public attributes, statistics depending only on public values require no noise at all. The workload of marginals the mechanism selects from is restricted to those containing at least one private attribute, and marginals over public attributes alone are dropped entirely. Public attributes are copied from real records; private attributes are sampled one at a time, each conditioned on the public values and the private values already drawn.
A second stage recovers how the text sounds. Prompting a language model directly with a synthetic row of attributes omits the tone, phrasing, and structure of real records. The authors keep MAPLE’s Private Evolution stage, in which the language model is prompted with synthetic rows to generate candidate texts, and each private record votes for its nearest candidate in embedding space — with Gaussian noise added to the vote histogram. The language model never sees private text; the text enters only through the noisy votes. Because each record votes with its full text, this stage protects everything in the text beyond the public attributes, including content the schema does not capture.
The privacy claim is stated as Feature-DP, a variant in which the guarantee is relative to the public part of a record. The authors prove that SDG-CI satisfies it, with the budget split between the two stages and accounted in zCDP, a Rényi-divergence formulation of differential privacy from which the standard epsilon-delta guarantee follows by conversion.
The human in the loop is not decoration
Classify relies on a language model, and a language model can mislabel a sensitive attribute as public. The authors treat its output as a proposal requiring verification, not a verdict. For the proprietary real estate data, a legal and domain expert reviewed the split for three audiences.
The review is reported in detail, and the detail is the point. For an external audience — a loan officer — the expert agreed on seven of ten attributes. The three disagreements ran in the cautious direction: attributes the language model had marked private, the expert judged public, namely transaction stage, journey stage, and next step. For internal audiences — a product quality team and an internal audit team — agreement reached nine of ten, with the single disagreement on word count, which the expert deemed public in nature. The expert also asked that coarsened versions be used for buying amount and desired location: metro or zip code rather than a specific location, a price band rather than a specific amount.
That last request points at a structural limitation the authors do not hide. Public attributes are released exactly, for every record. They can therefore identify an individual on their own, independent of the sensitive attributes the mechanism protects. Feature-DP does not prevent inference from public attributes, so a public attribute correlated with a private one partly reveals it, and a sensitive attribute mislabeled as public is released unprotected. The guarantee constrains attribute inference, not membership inference — whether a given person’s record is in the training data at all. Deployments where mere presence in the dataset is sensitive require standard differential privacy rather than Feature-DP.
One release, one audience, one run
The guarantee holds for a single release to its intended audience. If audiences share their releases or collude, they learn the attributes that were public for any of them, and repeated releases from the same corpus accumulate privacy loss on the attributes that remain private. The privacy unit is one text, so individuals who contribute several texts receive weaker protection. ANON-CI provides only an empirical guarantee, and all results come from a single run.
There is a further admission about the schema itself. The guarantee is conditional on the schema — its attribute names, value lists, and coarsening maps — and on the mapping from synthetic bins back to specific values. In the experiments both are derived from the private data without differential privacy, so which attributes and which specific values occur in the dataset as a whole is not protected. The authors recommend deriving the schema with DP or from a dataset description, and verifying it by hand before use. They also note that DP extraction of information from text is not a solved problem, and that even state-of-the-art solutions work well only at high privacy budgets.
Where the practice still lags the promise
The framework’s central move is almost administrative: ask who is receiving the data before deciding what to hide. The machinery that follows — conditional tabular synthesis, noisy voting over embeddings, a rewriting loop that checks both privacy and utility — is engineering in service of that question. What the paper indicates is that asking it produces measurably more faithful data, for every audience tested, from the same corpus.
What it also demonstrates is how much of the pipeline still rests on judgment that no theorem covers. A language model proposes the split; a legal expert corrects it, and the corrections matter. The schema is assumed fixed and public even though in the experiments it was built from the private data. The public attributes are released exactly and can re-identify on their own. The guarantee is per release, per text, per audience, and dissolves under collusion or repetition.
The gap between what the method promises and what a deployment can honestly claim is, in this reading, not a flaw in the argument but its most useful contribution. The authors close by advising practitioners to choose the method and the attribute split according to the sensitivity of the data and the trust placed in each audience — which is to say, the hard part remains a human decision about context, made before any noise is added. The system can now be told who is asking. Knowing what to answer still requires someone who understands why they are asking.