Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Inspecting the Representation Manifold of Differentially-Private Text

Stefan Arnold

TL;DR

The paper investigates how differential privacy (DP) rewriting of text reshapes the geometry of neural representations, using intrinsic dimensionality (ID) as a geometric proxy. It contrasts word-level DP (MADLIB) with sentence-level paraphrasing approaches (DP-PARAPHRASE, DP-PROMPT, DP-MLM) across privacy budgets $\varepsilon$, finding that word-level perturbation greatly inflates the representation manifold while sentence-level paraphrasing better preserves human-like geometry. Among sentence-level methods, masked paraphrasing (DP-MLM) yields the most stable geometry, with causal paraphrasing showing varying robustness depending on privacy regime and DP-PROMPT sometimes underperforming due to error propagation. The results provide guidance on DP mechanism selection for privacy-preserving NLP, highlighting the trade-offs between privacy, representational fidelity, and potential linguistic quality limitations.

Abstract

Differential Privacy (DP) for text has recently taken the form of text paraphrasing using language models and temperature sampling to better balance privacy and utility. However, the geometric distortion of DP regarding the structure and complexity in the representation space remains unexplored. By estimating the intrinsic dimension of paraphrased text across varying privacy budgets, we find that word-level methods severely raise the representation manifold, while sentence-level methods produce paraphrases whose manifolds are topologically more consistent with human-written paraphrases. Among sentence-level methods, masked paraphrasing, compared to causal paraphrasing, demonstrates superior preservation of structural complexity, suggesting that autoregressive generation propagates distortions from unnatural word choices that cascade and inflate the representation space.

Inspecting the Representation Manifold of Differentially-Private Text

TL;DR

The paper investigates how differential privacy (DP) rewriting of text reshapes the geometry of neural representations, using intrinsic dimensionality (ID) as a geometric proxy. It contrasts word-level DP (MADLIB) with sentence-level paraphrasing approaches (DP-PARAPHRASE, DP-PROMPT, DP-MLM) across privacy budgets , finding that word-level perturbation greatly inflates the representation manifold while sentence-level paraphrasing better preserves human-like geometry. Among sentence-level methods, masked paraphrasing (DP-MLM) yields the most stable geometry, with causal paraphrasing showing varying robustness depending on privacy regime and DP-PROMPT sometimes underperforming due to error propagation. The results provide guidance on DP mechanism selection for privacy-preserving NLP, highlighting the trade-offs between privacy, representational fidelity, and potential linguistic quality limitations.

Abstract

Differential Privacy (DP) for text has recently taken the form of text paraphrasing using language models and temperature sampling to better balance privacy and utility. However, the geometric distortion of DP regarding the structure and complexity in the representation space remains unexplored. By estimating the intrinsic dimension of paraphrased text across varying privacy budgets, we find that word-level methods severely raise the representation manifold, while sentence-level methods produce paraphrases whose manifolds are topologically more consistent with human-written paraphrases. Among sentence-level methods, masked paraphrasing, compared to causal paraphrasing, demonstrates superior preservation of structural complexity, suggesting that autoregressive generation propagates distortions from unnatural word choices that cascade and inflate the representation space.

Paper Structure

This paper contains 16 sections, 1 figure, 2 tables.

Table of Contents

  1. Introduction
  2. Contribution.
  3. Background
  4. Differential Privacy
  5. Word-level DP.
  6. Sentence-level DP.
  7. Intrinsic Dimensionality
  8. Methodology
  9. Selection of Privacy Mechanisms
  10. Estimation of Intrinsic Dimension
  11. Findings
  12. Word-Level Perturbation.
  13. Sentence-Level Perturbation.
  14. Error Propagation
  15. Conclusion
  16. ...and 1 more sections

Figures (1)

  • Figure 1: Shift in the estimated number of intrinsic dimensions, with a horizontal line representing a lower bound derived from human-authored paraphrases.