Venue: NAACL 2025

# CluSanT: Differentially Private and Semantically Coherent Text Sanitization

Ahmed Musa Awon

University of Victoria

its.ahmed.musa@gmail.com&Yun Lu

University of Victoria

yunlu@uvic.ca &Shera Potka

University of Victoria

spotka@uvic.ca &Alex Thomo

University of Victoria

thomo@uvic.ca

###### Abstract

We introduce CluSanT, a novel text sanitization framework based on Metric Local Differential Privacy (MLDP). Our framework consists of three components: token clustering, cluster embedding, and token sanitization. For the first, CluSanT employs Large Language Models (LLMs) to create a set of potential substitute tokens which we meaningfully cluster. Then, we develop a parameterized cluster embedding that balances the trade-off between privacy and utility. Lastly, we propose a MLDP algorithm which sanitizes/substitutes sensitive tokens in a text with the help of our embedding. Notably, our MLDP-based framework can be tuned with parameters such that (1) existing state-of-the-art (SOTA) token sanitization algorithms can be described--and improved--under our framework with extremal values of our parameters, and (2) by varying our parameters, we enable a whole spectrum of privacy-utility tradeoffs. Our experiments demonstrate CluSanT's balance between privacy and semantic coherence, highlighting its capability as a valuable framework for privacy-preserving text sanitization.

## 1 Introduction

The advent of digital technology has led to an exponential increase in the generation and processing of textual data, elevating the importance of privacy within the realm of Natural Language Processing (NLP) Carlini et al. (2021); Jegorova et al. (2022). Differential Privacy (DP) Dwork (2006), known for its strong mathematical privacy guarantees, presents a viable solution to these challenges. However, applying DP in NLP is fraught with difficulties due to the complex nature of textual data Song and Raghunathan (2020).

Existing implementations of DP in NLP typically degrade semantic integrity and readability for humans, posing significant challenges for applications requiring high-quality, coherent text processing. This underscores the need for advanced methods capable of finely balancing privacy with utility Lyu et al. (2020); Anil et al. (2021); Dupuy et al. (2022); Li et al. (2018); Mireshghallah et al. (2021). Current state-of-the-art (SOTA) techniques, such as SanText Yue et al. (2021) and CusText Chen et al. (2023), illustrate these challenges. SanText, while focused on maximizing privacy, may significantly diminish the utility of sanitized text. Conversely, CusText can preserve better text utility but can only achieve privacy in a limited manner.

SanText achieves _metric local DP (MLDP)_ text sanitization by probabilistically replacing individual sensitive tokens (e.g., 'Paris') with alternative ones (e.g., 'Lyon'). Replacements are selected with probability proportional to their semantic distance to the original, in a manner similar to the _exponential mechanism_McSherry and Talwar (2007) in DP literature. While for smaller number of tokens this achieves meaningful replacements, applying this broadly can increase the likelihood of selecting less desirable ones. For instance, while 'Lyon' should be one of the top replacements for 'Paris,' the combined probability of a large number of low-utility city names can outweigh 'Lyon,' leading to poor choices. In response, CusText proposed to first cluster tokens based on their similarity. It then performs replacements by selecting only tokens from the relevant cluster, via the exponential mechanism. Though improving utility, this approach also limits CuTest's privacy guarantees to within each cluster.

_How can we reconcile this conflict between privacy and utility in the SOTA?_ We answer this question by introducing CluSanT,1 a novel framework for text sanitization consisting of three components: (1) token clustering, (2) cluster embedding, and (3) token sanitization. CluSanT allows its users to tune their desired privacy/utility tradeoff by controlling the likelihood to choose a sanitized token from a more optimal cluster. Independent of the frame

work, we also propose several improvements and evaluation metrics that we experimentally show augment the SOTA. Notably, while CluSanT's token sanitization algorithm is based on various parameters, it achieves MLDP guarantees (Thm. 5) for any valid parameters, allowing for flexible plug-and-play. We outline our general approach through the following main technical challenges.

### Technical Challenges

We summarize challenges in the SOTA, along with our proposed solutions:

* **SanText:** There is a high probability density over less desirable tokens. **Our Strategy:** Given tokens clustered in a semantically meaningful manner, CluSanT's token sanitization mechanism selects the optimal cluster with high probability, then performs replacements within the smaller, relevant cluster of tokens. This enhances the likelihood of selecting semantically appropriate replacements, thereby improving utility.
* **CusText:** CusText's approach _cannot_ achieve standard MLDP (Theorem 4). **Our Strategy:** We introduce a mechanism that privately (with MLDP) selects a cluster based on a cluster embedding. Parametrizing the cluster embedding allows one to tune the probability of selecting the optimal cluster, adapting to various application scenarios.
* **General Coherence:** Previous approaches, including SanText and CusText, have not adequately addressed issues related to grammatical or logical coherence within the text. **Our Strategy:** Addressing this is crucial because SOTA and our framework produce human-readable text, unlike other works that generate text representations for downstream ML tasks (Feysietan et al., 2019, 2020; Lyu et al., 2020a, b). Our experiments evaluate semantic similarity and coherence in sanitized texts through various metrics, including those developed with the assistance of Large Language Models (LLMs).

### Summary of Contributions

#### General Framework for Text Sanitization with Parametrizable Privacy.

We introduce CluSanT, a framework for MLDP text sanitization, which can be parametrized by: (1) a clustering of tokens of interest and (2) \(k\) : amplification factor which controls cluster embedding. Our framework's flexibility allows its users to choose from a whole _spectrum_ of MLDP algorithms to adapt to various text sanitization needs. We demonstrate how SanText and CusText (SOTA) are special (extremal) cases within this spectrum of the CluSanT framework.

#### Improved Sensitive Token Set, Utility Metrics, and Extensive Experiments.

Independent of our MLDP framework, we made improvements that can also be applied to the SOTA. In particular, we augment the set of sensitive tokens, improve embeddings for multi-word tokens, and utilize more direct metrics and datasets to assess semantic similarity and coherence of sanitized text, providing an accurate reflection of text quality and usability. We apply these improvements to extensively demonstrate the effect of different CluSanT parametrizations on the tradeoff between utility and privacy, through utility improvement over the base case (CluSanT parametrized to emulate SanText). We show that under many parametrizations we can closely match CusText in performance, while still maintaining MLDP guarantees.

## 2 Related Works

The most direct strategy for sanitizing text is directly masking sensitive elements (Pilan et al., 2022; Microsoft, 2023), which can reduce text utility. Instead, differential privacy can replace quasi-identifiers with semantically similar terms. The SOTA are SanText (Yue et al., 2021) and Custext (Chen et al., 2023), which we detail in Sec. 3.

The most recent work in this line (Tong et al., 2023) proposed RanText, an exponential mechanism-based approach for token replacement, with the goal to produce perturbed prompts for LLMs. However, their stated privacy (Theorem 2) is limited to tokens in specific adjacency lists (similar to how CusText's privacy is limited to each clustering), rather than standard MLDP2. Another work (Carvalho et al., 2023) attempts to choose replacement words within a radius of the original word; however, as radii generally do not partition the set of words, this method appears incompatible with clustering-based algorithms like CusText. We moreover were not able to find the code of the algorithm. Consequently, we choose not to exper 

imentally compare with these works at this time.

One improvement we made in our experiments are the datasets used. Instead of an ad-hoc method of identifying sensitive words, we use the TAB benchmark of (Pilan et al., 2022), a corpus of 1,268 English-language court cases from the European Court of Human Rights (ECHR), with the sensitive data manually-annotated in each document.

Several works add DP noise to text representations (Fejisetan et al., 2019, 2020; Lyu et al., 2020, 2020) or use adversarial training (Xie et al., 2017; Coavoux et al., 2018; Elazar and Goldberg, 2018; Li et al., 2018) to create these representations. These methods produce non-human-readable outputs for ML pipelines, addressing different problems. Other works specific to downstream tasks include e.g., training a learning algorithm (Igamberiev and Habernal, 2023; Habernal, 2021). Like SOTA, we produce sanitized text for general use rather than private representations.

Lastly, (Mattern et al., 2022) argues that sanitization via replacing individual tokens within a text limits syntax variability, and can lead to e.g., grammar errors. They instead propose paraphrasing via GPT-2. However, we believe our line of works will continue to be useful, since (1) token-based sanitization, such as CluSanT, do not appear to conflict with, and may even complement paraphrasing, and (2) certain contexts require specific syntax, e.g., legal documents (Vogel, 2009) in our experiments. Moreover, one may mitigate certain grammar issues through clustering to separate grammatically dissimilar tokens (e.g., by putting 'Britain' and 'British' in different clusters).

## 3 Preliminaries

Following SOTA, we privatize text by randomising each token (e.g., 'Paris', 'United States') deemed 'sensitive', in a way that preserves metric local differential privacy (MLDP) (Alvim et al., 2018). We call a _token sanitization mechanism_ a (randomised) algorithm which takes as input a token and outputs a token which we call the _santitized_ token. Below, we define LDP. Informally, a mechanism \(M\) is LDP if from its output (sanitized token) \(y\), one cannot tell if the original input (token) was \(x\) or \(x^{\prime}\).

**Definition 1**.: _(Local Differential Privacy (LDP) (Duchi et al., 2013)) \(M:X\to Y\) satisfies \(\epsilon\)-LDP if \(\forall x,x^{\prime}\in X,y\in Y\), \(\frac{\Pr[M(x)=y]}{\Pr[M(x^{\prime})=y]}\leq e^{\epsilon}\)._

**Metric LDP** (Alvim et al., 2018) is a variant/extension of LDP for better utility, by tuning privacy with respect to a distance metric. Here, one can more easily distinguish whether \(y\) is the output of \(M(x)\) or \(M(x^{\prime})\)--if \(x,x^{\prime}\) are far apart. Specifically, a mechanism \(M\) satisfies MLDP for a given privacy parameter \(\epsilon\geq 0\) and distance metric \(d:X\times X\rightarrow\mathbb{R}_{\geq 0}\), if the following condition holds for all \(x,x^{\prime}\in X,y\in Y\): \(\frac{\Pr[M(x)=y]}{\Pr[M(x^{\prime})=y]}\leq e^{\epsilon d(x,x^{\prime})}\).

Lastly, the exponential mechanism has been applied extensively in previous work on token sanitization (e.g., SanText, cusText, RanText). Informally, it selects a sanitized token with probability proportional to its closeness to the original token (with closeness defined via utility function \(u\)).

**Definition 2**.: _[Exponential Mechanism (McSherry and Talwar, 2007)] Let I be a finite set denoting the input space, and O be a finite set denoting the output space. Let \(u(x,y)\) be a utility function3 defined for any \(x\in I\) and \(y\in O\), and let \(\Delta u\geq 0,\epsilon_{E}\geq 0\). The exponential mechanism, parametrized by \(I,O,u,\Delta u\), runs the following: \(M_{E}(x)\) (with \(x\in I\)): Randomly select \(y\in O\), where_

Footnote 3: Note \(u\) is called a _utility function_ by convention, but the ‘utility’ of a sanitized text may be defined on completely different metrics; see Experiments Sec. 5.

Two useful facts from (McSherry and Talwar, 2007; Yue et al., 2021) are as follows.

**Theorem 1**.: _For the exponential mechanism \(M_{E}\), the following hold:_

1. _Fix any_ \(x,x^{\prime}\in I\) _and_ \(y\in O\)_. Then_ \(\frac{\Pr(M_{E}(x)=y)}{\Pr(M_{E}(x^{\prime})=y)}\leq\exp\left(\frac{\epsilon_ {E}|u(x,y)-u(x^{\prime},y)|}{\Delta u}\right)\)__
2. _If we set the parameter_ \(\Delta u=\max\left(|u(x,y)-u(x^{\prime},y)|\right)\) _(called_ sensitivity _of_ \(u\)) then_ \(M_{E}\) _is_ \(\epsilon\)_-LDP. If we set parameter_ \(\Delta u=1\) _and let_ \(u(x,y)=-d(x,y)\) _for a metric_ \(d\)_, then_ \(M_{E}\) _is_ \(\epsilon\)_-MLDP._

### Notation

For ease of reading, we standardize the notation used to describe SOTA.

* \(X\): the set of all tokens within texts of interest. Each token is represented by a real vector \(\mathbb{R}^{\ell}\) for some constant \(\ell\) (this mapping from token to vector is called a _token embedding_).
* \(X^{\prime}\): a set of sensitive tokens. We usually name sensitive tokens as \(x,x^{\prime}\). \(X^{\prime}\) may be a sub- or super-set of \(X\). For experiments, we use an initial set of sensitive tokens from \(X\) as seeds, which we 

then expand several-fold with additional tokens of a similar nature. For instance, if 'British' is a seed token, we may add 'French' and 'German', even if they were not initially in \(X\).
* \(y\in Y\): output of the token sanitization mechanism. Previous work differ in set \(Y\); in the interest of fairness and ease of presentation, we set \(Y=X^{\prime}\) in all experiments.
* \(u\): utility function; \(\Delta u\): sensitivity of \(u\) (Exponential Mechanism Def. 2)
* \(M:X^{\prime}\to Y\): token sanitization mechanism

SanText Yue et al. (2019)In SanText, the token sanitization mechanism \(M:X^{\prime}\to X^{\prime}\) is based on the exponential mechanism (Def. 2), with a modification that the utility function sensitivity \(\Delta u\) is replaced by the constant \(1\) (see Thm. 1). The utility function is defined as \(u(x,x^{\prime})=-d(x,x^{\prime})\), where \(d(x,x^{\prime})\) is a metric distance (e.g., Euclidean) between the real-vector embeddings of tokens \(x,x^{\prime}\). We formalize this mechanism in the Appendix. SanText achieves the following privacy guarantee.

**Theorem 2** (Privacy of SanText).: _The token sanitization mechanism \(M\) of SanText, satisfies \(\epsilon\)-MLDP._

We note that SanText+ is a variation introduced in the same paper Yue et al. (2021). However, SanText+ sanitizes non-sensitive tokens as well as sensitive ones; thus, for fairness in utility comparisons (as sanitizing more tokens lowers the text utility), we focus on SanText.

CusText Chen et al. (2023)CuSext improves the utility of SanText by first partitioning all tokens in the lexicon \(X\) into disjoint sets called _clusters_ based on token similarity. Then, given a fixed set of clusters, CusText performs exponential mechanism (Def. 2) within each cluster.

Since CusText only ever replaces \(x\) with tokens in the cluster containing \(x\), CusText's privacy applies only within each cluster.

**Theorem 3** (Privacy of CusText).: _Let \(C\) be a cluster. Let \(M_{C}:C\to C\) be the mechanism \(M\) defined above, but with domain and range restricted to cluster \(C\). Then \(M_{C}\) satisfies \(\epsilon\)-LDP._

However, CusText's mechanism \(M\) does not in general satisfy (metric) LDP, when there is more than one cluster. Intuitively, if tokens \(x,x^{\prime}\) are in different clusters, \(M(x)\) and \(M(x^{\prime})\) have disjoint supports and thus are easily distinguishable.

**Theorem 4** (Proof in Appendix).: _For any clustering with at least two clusters, the mechanism \(M\) defined in CusText cannot satisfy \(\epsilon\)-(metric) LDP for any \(\epsilon\in\mathbb{R}\)._

## 4 CluSanT: Cluster Exponential Mechanism with MLDP Guarantees

CluSanT first clusters tokens based on their similarity. It then sanitizes sensitive tokens by first selecting a cluster, then selecting the replacement token from within that cluster. This approach makes contextually relevant replacements, improving the utility of sanitized text over SanText while still maintaining MLDP. CluSanT's privacy guarantees hold for any clustering, allowing for flexible integration of different clustering methods.

In this section, we present two of the components in our CluSanT framework: cluster embedding (Sec. 4.1) and token sanitization (Sec. 4.2). The method of obtaining a token clustering is independent of this section and will be detailed in our experiments (see Sec. 5). Through parameterizing our clustering, and cluster embedding with a parameter \(k\), we obtain a spectrum of token sanitization mechanisms that range from SanText at one extreme and CusText at the other extreme (see Sec. 4.1.1). For now, we assume we already have a set of token clusters \(\{C\}\).

Notation:

* Mapping \(f\) between token \(x\) and its vector representation in \(\mathbb{R}^{\ell}\) is called a _token embedding_.
* Mapping \(f^{\prime}\) between clusters and real vectors is called a _cluster embedding_.
* \(\{C\}\): A clustering, a set of subsets \(C\) (_clusters_) partitioning \(X^{\prime}\cup Y\) (or \(X^{\prime}\) if \(Y=X^{\prime}\)). \(C_{x}\) is the (unique) cluster containing token \(x\).
* \(d_{c}:\mathbb{R}^{\ell}\times\mathbb{R}^{\ell}\rightarrow\mathbb{R}\): Any distance function that is a metric. We extend this to measure the distance between clusters, i.e., \(d_{c}(C,C^{\prime})=d_{c}\left(f^{\prime}(C),~{}f^{\prime}(C^{\prime})\right)\) for clusters \(C,C^{\prime}\).
* \(d:\mathbb{R}^{\ell}\times\mathbb{R}^{\ell}\rightarrow\mathbb{R}\): Any distance measure (which is not assumed to be a metric, and may be different from \(d_{c}\)) between two tokens.

### Cluster Embedding

We first define a cluster embedding given a token embedding and a clustering. Recall, a token embedding \(f\) is a mapping from a token to a real vector. A cluster embedding \(f^{\prime}\), on the other hand, maps a cluster to a real vector. Our cluster embedding is parameterized by \(k\geq 1\) 

Our cluster embedding \(f^{\prime}\) (Fig. 1) is parametrized by a standard token embedding \(f\), a clustering, and \(k\), which intuitively tunes how 'pushed apart' the clusters are from each other in the embedding. Looking ahead, our privacy Thm. 5 holds when the distance between clusters \(d_{c}(C_{x},C_{x^{\prime}})\) can be increased by tuning \(k\) (the choice of \(d_{c}\) being a Lp-norm satisfies this).

Specifically, our cluster embedding \(f^{\prime}\) embeds both tokens and clusters. It defines cluster embeddings by 'pushing' cluster apart by a factor of \(k\) (Step 1). Meanwhile, it maintains the original (according to \(f\)) difference between the embeddings of tokens from within the same cluster. This is done in Step 2(b), by adding the vector difference (\(f(x)-C_{x}\)) to the new cluster centroid, \(k\cdot C_{x}\).

**How is cluster embedding used?** Looking ahead, our sanitization mechanism: it first selects a cluster, then selects a token from within this cluster. By parametrizing \(f^{\prime}\) with a larger \(k\) and a distance \(d_{c}\) that grows with \(k\)4, we select more optimal clusters with higher probability.

Footnote 4: Such as e.g., Euclidean used in SOTA.

Effect of parameter \(k\)Since \(k\) only affects cluster selection (\(f^{\prime}\)), we ensure that words within the same cluster remain 'indistinguishable' from each other, regardless of their embedding--we apply a standard LDP mechanism when selecting a token from within a cluster. Conversely, tokens from different clusters may be more distinguishable, depending on \(k\). The larger \(k\) is, the more probability of choosing a better cluster, but the more distinguishable the clusters are (while still preserving MLDP). We formally describe the effect of \(k\) on privacy leakage in App. D. Utility gains from larger \(k\) depend on evaluation metric; we give examples in our experiments (Sec. 5).

Defining a cluster-based embedding follows the spirit of [3] and [7]'s concept of geo-indistinguishability, where a radius naturally defines a cluster of close/indistinguishable geo-points within the radius. In our case, CuSanT forms clusters of words based on their (semantic/syntactic) similarity using word embeddings, where we leave the definition of 'similarity' up to user interpretation.

#### 4.1.1 Describing SanText and CusText in Terms of CluSanT

CluSanT can be parametrized, via the clustering, parameter \(k\), and distances, to achieve a spectrum of \(\epsilon\)-MLDP token sanitization mechanisms. We show that SanText and CusText are instantiations of CluSanT, situated at extremal ends of this parametrization.

**Fact 1**.: _SanText and CusText are equivalent to Cluster for specific choices of parameters._

**SanText.** SanText's algorithm is the same as ClausSnT (Fig. 2) parametrized by \(k=1\), \(d_{c}\) being Euclidean (same metric as SanText), and each cluster containing exactly one token (i.e., #clusters is equal to #tokens). Note this means that Step 1 is equivalent to SanText, and since each cluster has only one token, then Step 2 always chooses the same token (regardless of distance \(d\)), making this algorithm equivalent to SanText (recall, SanText does not consider token clustering).

**CusText.** CluSanT can be parametrized to _asymptotically_ approach the behaviour of CusText, which always chooses a token from an 'optimal' cluster. We first define the clustering and distance \(d\) to be the same as CusText's, setting \(d_{c}\) as Euclidean, and letting \(k\rightarrow\infty\). When \(k\rightarrow\infty\), \(d_{c}\) between \(f^{\prime}\) embeddings of different clusters is infinitely large, and Step 1 of Fig. 2 will with overwhelming probability

Figure 1: Cluster embedding with parameter \(k\)



choose the cluster \(C_{x}\) of the original token \(x\).

### Token Sanitization Mechanism for Metric LDP Guarantees

The main observation behind CluSanT's tokenizer mechanism is the following: CuSText achieves good utility since it ensures that a token \(x\) is replaced only by another (possibly the same) token \(x^{\prime}\in C_{x}\), the cluster which \(x\) is in. However, by Thm. 4 we showed that this approach is impossible to achieve MLDP. Instead, CluSanT achieves privacy (and still good utility) by giving a _small_ probability of selecting 'less good' clusters.

Our mechanism is in Fig. 2. Intuitively, Step 1 (cluster selection) is MLDP following the exponential mechanism-style approach of SanText. Then, Step 2 (selecting within a cluster) achieves guarantees similar to CusText. Parametrizing Steps 1 and 2 via the clustering, cluster embedding (\(k\)), and distances \(d,d_{c}\), gives us a spectrum of \(\epsilon\)-MLDP mechanisms that include SanText and CusText.

**Theorem 5**.: _Consider \(d,d_{c}\), \(f\), \(f^{\prime}\) (with parameter \(k\)), and the clustering are chosen s.t.:_

* \(d_{c}\) _is a metric._
* _For all_ \(x,x^{\prime}\) _(using embedding_ \(f^{\prime}\) _for d_\(c\)_, and_ \(f^{\prime}\) _for d_\(\cdot\)_): (1)_ \(d_{c}(x,x^{\prime})\geq 1\) _or_ \(d_{c}(x,x^{\prime})\geq d(x,x^{\prime})\)_, and (2) if_ \(C_{x}\neq C_{x^{\prime}}\)_,_ \(d_{c}(C_{x},C_{x^{\prime}})+1\leq 2\cdot d_{c}(x,x^{\prime})\)_._ 5__ Footnote 5: We refer to App. C for more details on satisfying these assumptions. In short, (1) can be satisfied with appropriate choices of distances and embeddings. (2) can be satisfied by choosing \(d_{c}\) based on any Lp-norm.

_Then, \(M(x)\) in Fig. 2 achieves \(\epsilon\)-metric LDP for metric \(d_{c}\), and embedding \(f^{\prime}\)._

Proof.: Fix any \(x,x^{\prime}\in X^{\prime},y\in Y\). If \(x=x^{\prime}\) then \(\Pr(M(x)=y)=1=e^{0}\) so the MLDP inequality trivially holds. Thus, consider \(x\neq x^{\prime}\).

We have \(\Pr(M(x)=y)\) equal to \(\Pr(M_{1}(x)=C_{y})\Pr(M_{2}(x)=y|M_{1}(x)=C_{y})\) where (1) \(M_{1}(x)=C_{y}\) is the event that Step 1 of \(M\) chooses \(C_{y}\), and (2) \(M_{2}(x)=y|M_{1}(x)=C_{y}\) is the event that Step 2 of \(M^{\prime}\) chooses token \(y\), given Step 1 chooses \(C_{y}\).

Conditioned on Step 1 choosing cluster \(C_{y}\), Step 2 runs exponential mechanism with (both LDP and MLDP) privacy \(\epsilon/2\). Thus, \(\frac{\Pr(M_{2}(x)=y|M_{1}(x)=C_{y})}{\Pr(M_{2}(x^{\prime})=y|M_{1}(x)=C_{y})}\leq \min\left(e^{\epsilon/2},e^{\epsilon d(x,x^{\prime})/2}\right).\) Moreover, by Thm 1,

\[\begin{split}&\frac{\Pr(M_{1}(x)=C_{y})}{\Pr(M_{1}(x^{\prime})=C_{ y})}\leq\exp\left(\frac{\epsilon}{2}|d_{c}(C_{x},C_{y})-d_{c}(C_{x^{\prime}},C_{y})| \right)\\ \end{split}\]

Thus, \(\frac{\Pr(M(x)=y)}{\Pr(M(x^{\prime})=y)}\\ \leq e^{\frac{\epsilon}{2}|d_{c}(C_{x},C_{y})-d_{c}(C_{x^{\prime }},C_{y})|}e^{\frac{\epsilon}{2}\min(1,d(x,x^{\prime}))}\) Now consider the following two cases:

1. \(C_{x}=C_{x^{\prime}}\): Then, \(|d_{c}(C_{x},C_{y})-d_{c}(C_{x^{\prime}},C_{y})|=0\) and \(e^{\frac{\epsilon}{2}\min(1,d(x,x^{\prime}))}\leq e^{\epsilon\cdot d_{c}(x,x^{ \prime})}\) by theorem assumption (1) on \(d_{c}\).
2. \(C_{x}\neq C_{x^{\prime}}\): Since \(d_{c}\) is a metric, \(|d_{c}(C_{x},C_{y})-d_{c}(C_{x^{\prime}},C_{y})|\leq d_{c}(C_{x},C_{x^{\prime}})\). Moreover, by assumption, for \(C_{x}\neq C_{x}^{\prime}\), \(d_{c}(C_{x},C_{x^{\prime}})+1\leq 2\cdot d_{c}(x,x^{\prime})\). Thus, \[e^{\frac{\epsilon}{2}(|d_{c}(C_{x},C_{y})-d_{c}(C_{x^{\prime}},C_{y})|+1)} \leq e^{\frac{\epsilon}{2}(2\cdot d_{c}(x,x^{\prime}))}\] \[=e^{\epsilon\cdot d_{c}(x,x^{\prime})}\]

## 5 Experiments

Previous work (Feysietan et al., 2020; Yue et al., 2021; Chen et al., 2023) evaluated the quality

Figure 2: CluSanT’s \(\epsilon\)-MLDP Sanitization Mechanism



of sanitized text based on the performance of downstream tasks (e.g., sentiment analysis) on sanitized text. In this work, we evaluate the quality of sanitized text using more direct metrics that capture the semantic integrity and linguistic naturalness of sanitized text.

Metrics and DatasetWe evaluate sanitized text primarily with _semantic similarity_ and _perplexity_, and four additional metrics assessing common sense, coherence, cohesiveness, and grammar quality, using GPT-4o. In App. E we show (1) example sanitized texts, evaluated using cosine similarity, and (2) evaluations of a sanitized text validation set based on the SST2 [39] dataset used in SanText and CusText.

Cosine/Semantic similarityis measured using embedding vectors from the all-MiniLM-L6-v2 (sentence embedder) model6. We compute cosine similarity, a fundamental component of many downstream text mining tasks such as sentiment classification [50], between embeddings of original and sanitized texts to assess semantic preservation.

Footnote 6: [https://docs.trychroma.com/guides/embeddings](https://docs.trychroma.com/guides/embeddings)

_Perplexity_ measures the naturalness of the sanitized text by how well it aligns with typical language patterns, with lower perplexity indicating more natural text (higher probability). We evaluate the perplexity of sanitized texts with GPT-2.

_GPT-4o_ is used to evaluate grammar, common sense, coherence, and cohesiveness. LLMs' capabilities in assessing these metrics has been shown to match or surpass human evaluators in accuracy and consistency [78, 79] in various NLP evaluations (e.g., RAG).

We use the TAB dataset [20], which includes 1,268 annotated English-language court cases from the European Court of Human Rights. This dataset offers a robust framework for evaluating general-purpose text anonymization, with high-quality annotations and diverse content. More experiment setup details are in App. E.

Experimental MethodologyIn our experiments 7, we use a simple CuS Text clustering method [34]: given a set of tokens \(X\) to cluster, it randomly picks a token \(x\), creates a cluster \(C_{x}\), and inserts into \(C_{x}\) the top \(h-1\) tokens similar to \(x\) from \(X\), simultaneously removing them from \(X\). This process is repeated until \(X\) is empty, resulting in each cluster containing exactly \(h\) tokens. While this simple clustering method can be improved, the choice of clustering method is orthogonal to our work. By varying \(h\), we can control the size and number of clusters. In our study, we test with 40, 180, 360, and 720 clusters.

Footnote 7: For code and more details on our experiments please see [https://github.com/AwonSomeSource/CluSanT.git](https://github.com/AwonSomeSource/CluSanT.git).

Augmented Token SetWe improve previous approaches like SanText and CusText by augmenting the set of sensitive words and phrases, making it more realistic and contextual. We consider the set \(X^{\prime}\) as all sensitive words or phrases from the TAB dataset, supplemented with 100 words/phrases of similar nature for each using GPT-4o. For example, for "Sinn Fein headquarters," we obtained phrases of similar nature like "Labour Party headquarters," "Conservative Party headquarters," etc., rather than only similar terms like "Irish" which, while similar in vector embedding space, are not of the same nature. This approach extends the set of sensitive tokens to include additional, realistic phrases not originally in a text collection but still sensitive. In contrast, SanText and CusText recognizing the limitations of a restricted set of sensitive tokens, attempt to mitigate this by allowing replacements with non-sensitive words. However, this method often leads to replacements that do not always make sense. For example, replacing "Sinn Fein headquarters" with a non-sensitive word, such as "Irish" can render the text nonsensical.

Multi-word EmbeddingsSanText and CusText rely on single-word embeddings like GloVe [20], which cannot directly handle multi-word phrases such as "Sinn Fein headquarters." Our approach, on the other hand, employs the all-MiniLM-L6-v2 sentence embedder, designed to handle phrases and provide more accurate contextual representations. Our experiments ensure fairness for SanText and CusText by using the same set \(X^{\prime}\) of words/phrases for replacement and the same token embedder, all-MiniLM-L6-v2. Finally, we use Euclidean distance for all methods.

Numerical ResultsWe show partial experimental results, in Figures 3, 4, 5, 6 and full results in Figures 7, 8, 9, 10, 11, 12 in the Appendix. Figures show improvements achieved by CluSanT in terms of semantic similarity, perplexity, common sense, coherence, cohesiveness, and grammar over SanText. For all metrics except perplexity, higher scores are better, while for perplexity, lower scores 

are preferred. We abbreviate CluSanT by CST and CusText by CT. We consider CT as a special version of \(\text{CluSanT}\) where \(k=\infty\).

We plotted the number of clusters on the vertical axis and the centroid pushing factor \(k\) of \(\text{CluSanT}\) on the horizontal axis, creating heatmaps for each \(\epsilon\) value considered: 0.5, 1, 2, 4, 8, 16. Due to space constraints, we only show results for \(\epsilon=1\) and \(\epsilon=8\) here and include the rest in the Appendix.

For all \(\epsilon\) values, as \(k\) increases (moving right in the maps), the semantic similarity improvement (over SanText) increases. Additionally, as the number of clusters increases (moving down), semantic similarity improvement also increases.

The most significant improvement of \(\text{CluSanT}\) over SanText is observed for \(\epsilon=8\) and 720 clusters. Generally, the more clusters used, the greater the improvement over SanText. For \(\epsilon=16\), the improvement in semantic similarity for \(\text{CluSanT}\) over SanText is not as pronounced as for \(\epsilon=8\). This is because, while the semantic similarity of sanitized text to the original text for \(\text{CluSanT}\) approaches 1 for this \(\epsilon\) (the highest value possible, being a cosine similarity), the semantic similarity for SanText also increases for larger \(\epsilon\) values, resulting in a slightly reduced improvement margin.

Similar trends are observed for perplexity, common sense, and coherence, as well as for grammar and cohesiveness (detailed in Appendix). As the number of clusters and \(k\) increase, \(\text{CluSanT}\)'s performance improves significantly over SanText, approaching that of CusText. While CusText shows better performance across metrics, it is only marginally better than \(\text{CluSanT}\). However, this comes at the cost of weaker privacy guarantees. We note that these metrics represent general trends; as LLM judgments can be noisy, smaller \(k\) values may occasionally yield better results.

## 6 Conclusion

We introduced \(\text{CluSanT}\), a novel framework for text sanitization that achieves metric local differential privacy (MLDP). \(\text{CluSanT}\) comprises token clustering and token sanitization, leveraging Large Language Models to generate substitute tokens, which are then clustered, and sanitized using a MLDP algorithm. Our MLDP framework encompasses a range of privacy-utility tradeoffs via tuneable parameters between state-of-the-art algorithms SanText and CusText, allowing users to achieve strong privacy or high utility as required. Our framework achieves MLDP guarantees regardless of the clustering, allowing for plug-and-play (and future optimization) of this component in our framework. In summary, \(\text{CluSanT}\) advances the area of privacy-preserving text processing, offering a robust, tuneable solution for handling sensitive text.

Figure 4: Peplexity improvement over SanText (%); the lower, the better

Figure 5: Common sense improv. over SanText (%)

Figure 3: Semantic similarity improvement over SanText (%). \(\text{CluSanT}\) abbreviated by CST, CusText by CT. Horizontal axis varies parameter \(k\) of \(\text{CluSanT}\). Vertical axis varies the number of clusters. Same axes apply for the other heatmaps as well. Unless otherwise mentioned, the higher, the better.

Figure 6: Coherence improvement over SanText (%)





## Limitations

* We inherit some limitations of SanText/CusText. In particular, sanitizing a text by sanitizing individual tokens can lead to mistakes. For example, when a token has two different meanings in different contexts, the token sanitization may not know which meaning it should take. While we use a sentence embedder that generates different embeddings for 'London, Ontario' and 'London, England,' it is not helpful for distinguishing 'Jordan' as a country from the name 'Jordan.' To achieve this, the embedder would need to consider the meaning of the entire passage. However, accomplishing this is challenging and requires further work. We believe our framework can be improved in follow-up studies by considering token context in our clustering and text sanitization.
* While we improved the sensitive token set and multi-word embedding in our framework, we tested only one clustering method (that of CuStext's) and primarily used Euclidean distances. One direction to enrich our framework is by parametrizing it with other clustering methods and distance metrics. Whereas ClusterSant presents a general framework and privacy theorem for an arbitrary clustering, building an optimal clustering methods appears to be a highly non-trivial task which we defer to future work.
* Our privacy theorem for the CluSanT framework makes some assumptions on the relationship between the distances and the parameter \(k\) chosen (though they can be satisfied by common choices of distances, see App. C) A meaningful research direction can be to weaken such assumptions.

## References

* Alvim et al. (2018) Mario Alvim, Konstantinos Chatzikokolakis, Catuscia Palamidessi, and Anna Pazii. 2018. Local differential privacy on metric spaces: optimizing the trade-off with utility. In _2018 IEEE 31st Computer Security Foundations Symposium (CSF)_, pages 262-267. IEEE.
* Andres et al. (2013) Miguel E Andres, Nicolas E Bordenabe, Konstantinos Chatzikokolakis, and Catuscia Palamidessi. 2013. Geo-indistinguishability: Differential privacy for location-based systems. In _Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security_, pages 901-914.
* Anil et al. (2021) Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. 2021. Large-scale differentially private bert. _arXiv preprint arXiv:2108.01624_.
* Carlini et al. (2021) Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In _30th USENIX Security Symposium (USENIX Security 21)_, pages 2633-2650.
* Carvalho et al. (2023) Ricardo Silva Carvalho, Theodore Vasiloudis, Oliuwaseyi Feyisetan, and Ke Wang. 2023. Tem: High utility metric differential privacy on text. In _Proceedings of the 2023 SIAM International Conference on Data Mining (SDM)_, pages 883-890. SIAM.
* Chatzikokolakis et al. (2013) Konstantinos Chatzikokolakis, Miguel E Andres, Nicolas Emilio Bordenabe, and Catuscia Palamidessi. 2013. Broadening the scope of differential privacy using metrics. In _Privacy Enhancing Technologies: 13th International Symposium, PETS 2013, Bloomington, IN, USA, July 10-12, 2013. Proceedings__13_, pages 82-102. Springer.
* Chen et al. (2023) Sai Chen, Fengran Mo, Yanhao Wang, Cen Chen, Jian-Yun Nie, Chengyu Wang, and Jamie Cui. 2023. A customized text sanitization mechanism with differential privacy. In _Findings of the Association for Computational Linguistics: ACL 2023_, pages 5747-5758.
* Chiang and Lee (2023) Cheng-Han Chiang and Hung-yi Lee. 2023. Can large language models be an alternative to human evaluations? _arXiv preprint arXiv:2305.01937_.
* Coavoux et al. (2018) Maximin Coavoux, Shashi Narayan, and Shay B Cohen. 2018. Privacy-preserving neural representations of text. _arXiv preprint arXiv:1808.09408_.
* Duchi et al. (2013) John C Duchi, Michael I Jordan, and Martin J Wainwright. 2013. Local privacy and statistical minimax rates. In _2013 IEEE 54th Annual Symposium on Foundations of Computer Science_, pages 429-438. IEEE.
* Dupuy et al. (2022) Christophe Dupuy, Radhika Arava, Rahul Gupta, and Anna Rumshisky. 2022. An efficient dp-sgd mechanism for large scale nlu models. In _ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_, pages 4118-4122. IEEE.
* Dwork (2006) Cynthia Dwork. 2006. Differential privacy. In _International colloquium on automata, languages, and programming_, pages 1-12. Springer.
* Elazar and Goldberg (2018) Yanai Elazar and Yoav Goldberg. 2018. Adversarial removal of demographic attributes from text data. _arXiv preprint arXiv:1808.06640_

* G. Feyisetan, B. Balle, T. Drake, and T. Diethe (2020)Privacy-and utility-preserving textual analysis via calibrated multivariate perturbations. In Proceedings of the 13th international conference on web search and data mining, pp. 178-186. Cited by: SS4.
* O. Feyisetan, R. Socher, and C. D. Manning (2014)Glove: global vectors for word representation. In Proceedings of the 2014 conference on empirical methods in natural language processing (EMNLP), pp. 1532-1543. Cited by: SS4.
* I. Habernal (2021)When differential privacy meets nlp: the devil is in the detail. In ACL Anthology, Cited by: SS4.
* T. Igamberdiev and I. Habernal (2023)Dp-bart for privatized text rewriting under local differential privacy. In ACL Anthology, Cited by: SS4.
* M. Jegorova, C. Kaul, C. Mayor, A. Q.'Neil, A. Weir, R. Murray-Smith, and S. A Tsaftaris (2022)Survey: leakage and privacy at inference time. IEEE Transactions on Pattern Analysis and Machine Intelligence. External Links: Document Cited by: SS4.
* Y. Li, T. Baldwin, and T. Cohn (2018)Towards robust and privacy-preserving text representations. arXiv preprint arXiv:1805.06093. Cited by: SS4.
* L. Lyu, X. He, and Y. Li (2020a)Differentially private representation for nlp: formal guarantee and an empirical study on privacy and fairness. arXiv preprint arXiv:2010.01285. Cited by: SS4.
* L. Lyu, Y. Li, X. He, and T. Xiao (2020b)Towards differentially private text representations. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, pp. 1813-1816. Cited by: SS4.
* J. Mattern, B. Weggenmann, and F. Kerschbaum (2022)The limits of word level differential privacy. In ACL Anthology, Cited by: SS4.
* F. McSherry and K. Talwar (2007)Mechanism design via differential privacy. In 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS'07), pp. 94-103. Cited by: SS4.
* Microsoft (2023)Presidio: data protection and identification sdk. Note: Accessed: October 15, 2023 Cited by: SS4.
* F. Mireshghallah, H. A. Inan, Marcello Hassegawa, V. Ruhle, T. Berg-Kirkpatrick, and R. Sim (2021)Privacy regularization: joint privacy-utility optimization in language models. arXiv preprint arXiv:2103.07567. Cited by: SS4.
* J. Pennington, R. Socher, and C. D. Manning (2014)Glove: global vectors for word representation. In Proceedings of the 2014 conference on empirical methods in natural language processing (EMNLP), pp. 1532-1543. Cited by: SS4.
* I. Pilan, P. Lison, L. Ovrelid, A. Papadopoulou, D. Sanchez, and M. Batet (2022)The text anonymization benchmark (tab): a dedicated corpus and evaluation framework for test anonymization. Computational Linguistics48 (4), pp. 1053-1101. Cited by: SS4.
* R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Ng, and C. Potts (2020)SST-2. Cited by: SS4.
* C. Song and A. Raghunathan (2020)Information leakage in embedding models. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, pp. 377-390. Cited by: SS4.
* Tan Thongtan and Tanasanee Phienthrakul (2019)Sentiment classification using document embeddings trained with cosine similarity. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: Student Research Workshop, Florence, Italy, pp. 407-414. Cited by: SS4.
* Meng Tong, Kejiang Chen, Yuang Qi, Jie Zhang, Wiming Zhang, and Nenghai Yu (2023)Pivrinfer: privacy-preserving inference for black-box large language model. arXiv preprint arXiv:2310.12214. Cited by: SS4.
* Carl Vogel (2009)Law matters, syntax matters and semantics matters. Formal Linguistics and Law212, pp. 25. Cited by: SS4.
* Q. Xie, Z. Dai, Y. Du, E. Hovy, and G. Neubig (2017)Controllable invariance through adversarial feature learning. Advances in neural information processing systems30. Cited by: SS4.
* H. Yu, A. Gan, K. Zhang, S. Tong, Q. Liu, and Z. Liu (2024)Evaluation of retrieval-augmented generation: a survey. arXiv preprint arXiv:2405.07437. Cited by: SS4.
* X. Yue, M. Du, T. Wang, Y. Li, H. Sun, and S. S. Chow (2021)Differential privacy for text analytics via natural text sanitization. pp. 3853-3866. Cited by: SS4.

## Appendix A Differential Privacy Definition

**Definition 3**.: _(\(\epsilon\)-Differential Privacy (Dwork, 2006)) Given a privacy parameter \(\epsilon\geq 0\), for any two adjacent inputs \(x,x^{\prime}\in X\) and each potential output \(y\in Y\), a randomized mechanism \(M\) satisfies \(\epsilon\)-differential privacy (DP) if it ensures that_

\[\frac{\Pr[M(x)=y]}{\Pr[M(x^{\prime})=y]}\leq e^{\epsilon}.\] 

SanText and CusText

### SanText

Below, we detail the operational steps of the token sanitization mechanism \(M\) of SanText when processing an input token \(x\):

1. [label=0]
2. \(M\) is parameterized by the privacy parameter \(\epsilon\) and employs a metric \(d\) to measure distances between tokens.
3. The utility function \(u\) is defined such that \(u(x,x)=-d(x,x)\). Under this definition, \(M\) selects an output from \(Y\) based on the exponential mechanism (Def. 2) tailored for the specified \(\epsilon\), but with parameter \(\Delta u\) set as \(1\).

### CusText

We describe CusText's token sanitization algorithm \(M:X^{\prime}\to X\) for input token \(x\).

1. [label=0]
2. \(M\) is parametrized by the formed clusters, a distance \(d\), and the privacy parameter \(\epsilon\).
3. Let \(C\subseteq X\) be the cluster \(x\) belongs in.
4. Let utility \(u:C\times C\rightarrow\mathbb{R}\) be the negative of the normalised distance \(u(x,y)=-\frac{d(x,y)-d_{\min}}{d_{\max}-d_{\min}}\) (\(d_{\min}=\min_{x,y\in C}d(x,y)\) and \(d_{\max}=\max_{x,y\in C}d(x,y)\)), so that sensitivity \(\Delta u=1\).
5. Using the above utility function, replace \(x\) with some token in \(C\) via the exponential mechanism (Def. 2) for privacy \(\epsilon\).

We present the proof for Thm. 4 that CusText cannot achieve standard (M)LDP when there is more than one cluster.

Proof.: We prove first for LDP. Suppose for contradiction that there exists \(\epsilon\in\mathbb{R}\) such that \(M\) satisfies \(\epsilon\)-LDP. Then for all \(x,x^{\prime}\in X^{\prime},y\in X\), this inequality must hold:

\[\Pr(M(x)=y)\leq e^{\epsilon}\Pr(M(x^{\prime})=y)\]

Since there are at least two clusters, there must exist \(x,x^{\prime}\in X^{\prime}\) that belong in different clusters. Let \(y\) be a token in the cluster of \(x\), which means \(y\) is not in the cluster of \(x^{\prime}\). This means that \(\Pr(M(x)=y)>0\) and \(e^{\epsilon}\Pr(M(x^{\prime})=y)=e^{\epsilon}\cdot 0=0\). Thus the above inequality cannot hold, which is a contradiction, and thus there is no \(\epsilon\) for which \(M\) is \(\epsilon\)-LDP.

The proof for metric LDP follows since if \(M\) is \(\epsilon\)-metric LDP then \(M\) is \(\epsilon\cdot\Delta u\)-LDP. Since the lexicon is finite, \(\Delta u\) maximises over a finite set and is also finite. Thus, if \(M\) is \(\epsilon\)-metric LDP then it is \(\epsilon^{\prime}\)-LDP for some finite \(\epsilon^{\prime}\) (which we just proved is impossible). 

## Appendix C Setting Parameters Satisfying Theorem Assumptions

We discuss how to parameterize CluSanT in order to leverage our general privacy Theorem 5. We note that while we give specific examples of parameters below (e.g., \(d_{c}\) set as Euclidean), our theorem assumptions are stated more generally and may be satisfied via other instantiations.

Assumption **(1)** can be satisfied by an appropriate setting of the embedding or distances \(d_{c},d\). For example, one can choose \(d_{c}\) as Euclidean, and setting \(k\) to be large enough so that \(d_{c}(x,x^{\prime})\geq d(x,x^{\prime})\) (for embedding \(f^{\prime}\) for \(d_{c}\) and embedding \(f\) for \(d\); recall \(k\) does not change \(f\)). Another way is to achieve \(d_{c}(x,x^{\prime})\geq 1\) for \(x\neq x^{\prime}\), by normalizing embeddings.

Fact **2**.: _Assumption **(2)** can be satisfied for \(d_{c}\) being any Lp-norm (e.g., Euclidean/L2-norm used in SanText), and a large enough \(k\)._

Proof.: Assume tokens below use embedding parameterised by \(k\). By triangle inequality (since \(d_{c}\) is a metric), we can write

\[d_{c}(x,x^{\prime})\geq d_{c}(C_{x},C_{x^{\prime}})-d_{c}(x,C_{x})-d_{c}(x^{ \prime},C_{x^{\prime}})\]

Now multiply both sides by 2:

\[2\cdot d_{c}(x,x^{\prime})\] \[\geq 2\cdot d_{c}(C_{x},C_{x^{\prime}})-2\cdot(d_{c}(x,C_{x})-d_{ c}(x^{\prime},C_{x^{\prime}}))\] \[=d_{c}(C_{x},C_{x^{\prime}})+[d_{c}(C_{x},C_{x^{\prime}})\] \[\quad-2\cdot(d_{c}(x,C_{x})-d_{c}(x^{\prime},C_{x^{\prime}}))]\]

To prove our inequality, we just need that the above is \(\geq d_{c}(C_{x},C_{x^{\prime}})+1\). We note that we already have the "\(d_{c}(C_{x},C_{x^{\prime}})\)" part of the sum, so we want

\[d_{c}(C_{x},C_{x^{\prime}})-2\cdot(d_{c}(x,C_{x})-d_{c}(x^{\prime},C_{x^{ \prime}}))\geq 1\]

For \(d_{c}(y,z)\) equal to the Lp-norm of \(y-z\), \(\lim_{k\rightarrow\infty}d_{c}(x,x^{\prime})\rightarrow\infty\), but \((d_{c}(x,C_{x})-d_{c}(x^{\prime},C_{x^{\prime}}))\) remains constant (since distance between \(x\) and \(C_{x}\) is unaffected by \(k\)). Thus, we can always find a \(k\) such that the above inequality holds.

 



**Intuition for the above proof**: Recall in ClusSanT we write the embedding of point \(x\) in terms of the cluster centroid \(k\cdot C_{x}\) when using embedding \(f\) parametrised by \(k\). So

\[x=k\cdot C_{x}+(C_{x}-x)\]

and

\[x^{\prime}=k\cdot C_{x^{\prime}}+(C_{x^{\prime}}-x^{\prime})\]

Importantly, the "distance to the centroid", \((C_{x}-x)\) or \((C_{x^{\prime}}-x^{\prime})\) remains constant regardless of \(k\). This is true for distances based on Lp-norm, like Euclidean used in the SOTA. So when \(k\) is large, this "\((C_{x}-x)\)" term becomes less significant, so approximately,

\[2\cdot d_{c}(x,x^{\prime})\] \[\approx 2\cdot d_{c}(k\cdot C_{x},k\cdot C_{x^{\prime}})\] \[=2\cdot d_{c}(f(C_{x}),f(C_{x^{\prime}}))\text{ for our embedding $ f$ parametrised by $k$}\]

for some large enough \(k\), the above is \(\geq d_{c}(f(C_{x}),f(C_{x^{\prime}}))+1\)

## Appendix D Effect of Parameter \(k\) on Privacy

We formally quantify the effect privacy leakage of ClusSanT based on \(k\), for the example where \(d_{c}\) is any Lp-norm (i.e., \(d_{c}(x,x^{\prime})=||x-x^{\prime}||_{p}\). Informally, \(k\) linearly degrades LDP guarantees.

**Fact 3**.: _Consider an instantiation \(M\) of ClubSanT that satisfies the assumptions of Thm. 5, and let \(d_{c}\) be any Lp-norm. Then this instantiation satisfies \(\epsilon\Delta\)-LDP, where \(\Delta=\max_{x,x^{\prime}}d_{c}(x,x^{\prime})+k\cdot\max_{C_{x},C_{x^{\prime}} }d_{c}(C_{x},C_{x^{\prime}})\) (using embedding \(f\))._

Proof.: \(M\) satisfies \(\epsilon\)-MLDP by Thm. 5, that is, \(\forall x,x^{\prime},y\) (We explicitly show the embedding here for clarity.):

\[\Pr(M(x)= y) \leq e^{<d_{c}(f^{\prime}(x),f^{\prime}(x^{\prime}))}\Pr(M(x^{ \prime})=y)\] \[=e^{||f^{\prime}(x)-f^{\prime}(x^{\prime})||_{p}}\Pr(M(x^{\prime })=y)\] \[\leq e^{\epsilon\max_{x,x^{\prime}}||f^{\prime}(x)-f^{\prime}(x^{ \prime})||_{p}}\Pr(M(x^{\prime})=y)\]

Here,

\[||f^{\prime}(x)-f^{\prime}(x^{\prime})||_{p}\] \[=||f(x)+k\cdot f(C_{x})-(f(x^{\prime})+k\cdot f(C_{x^{\prime}})) ||_{p}\] \[\leq||f(x)-f(x^{\prime})||_{p}+||k\cdot C_{x}-k\cdot C_{x^{\prime} }||_{p}\]

The first inequality above is due to \(d_{c}\) being a metric. Thus,

\[\max_{x,x^{\prime}}||f^{\prime}(x)-f^{\prime}(x^{\prime})||_{p}\] \[\leq\max_{x,x^{\prime}}d_{c}(f(x),f(x^{\prime}))+k\cdot\max_{C_{x },C_{x^{\prime}}}d_{c}(f(C_{x}),f(C_{x^{\prime}}))\]

## Appendix E Detailed Experimental Results

Here we give the detailed prompt for obtaining the extended set \(X^{\prime}\) of sensitive tokens using GPT-4o.

_If I give you a word or phrase, example "southern norland," can you give me 100 similar words/phrases of the same category?_

_For example:_

* _If it is a location, give me other locations that are similar in nature._
* _If it is an organization, give me other organizations that are similar._
* _If it is an object, give me other objects that are similar._

_The similarity should be in terms of the category and characteristics of the entity. The words you give should make sense if used as a replacement for the original word/phrase in a similar context._

_Format output as a list of words/phrases:_

\[[\text{word/phrase1, word/phrase2, ...}]\]

_Here the context that "search_phrase)" was used in: "[context]"._

For example, when the search phrase was 'sarpsborg city court (tingrett)' with its context in the TAB text, the output we received from GPT-4o was:

['oslo district court', 'bergen district court', 'trondeheim district court', 'stavanger district court', 'kristiansand district court', 'tromso district court', 'drammen district court', 'fedrikstad district court', 'skien district court', 'alesund district court', 'bods district court', 'hamar district court', 'moldle district court', 'haugesund district court', etc].

Now we give detailed experimental results on semantic similarity (Figure 7), perplexity (Figure 8), grammar (Figure 9), common sense (Figure 10), coherence (Figure 11), and cohesiveness (Figure 12). For perplexity we used GPT-2. To judge the grammar, common sense, coherence, and cohesiveness of sanitized text, we used GPT-4o, with the following prompt.

_Could you please evaluate the following passage for its grammar, common sense, coherence, and cohesiveness? Score it

on a scale from 1 to 5, where 1 is the lowest (poor quality) and 5 is the highest (excellent quality). You should score based on these criteria:_

* **Grammar**_: Are the sentences structured correctly?_
* **Common sense**_: Does the content make logical sense in the real world?_
* **Coherence**_: Do the ideas flow logically from one sentence to another?_
* **Cohesiveness**_: Do all parts of the text come together in a unified whole?_
* _Please ONLY respond in JSON format with the four keys 'grammar', 'common sense', 'coherence', and 'cohesiveness', each with a score attached to them._

CluSanT's improvement over SanText generally increases with the number of clusters used. Increasing the number of clusters and parameter \(k\) significantly enhances CluSanT 's performance, approaching that of CusText. Although CusText performs better across metrics, it offers weaker privacy guarantees. Note that these metrics represent general trends, and due to noisy judgments from LLMs, smaller \(k\) values can sometimes yield better results.

In the following, we present an example of an original text from the court dataset collected by Pilan et al. (2022), along with the substitutions made by SanText, CluSanT with the number of clusters 100 and \(k=16,64\), and CusText. We also give the cosine similarities for each substitution and average similarities.

The original text is as follows:

The case originated in an application (no. 18308/02) against the Republic of Turkey lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms ("the Convention") by two Turkish nationals.

We do not show the whole original text because even though it is public, it still contains sensitive information.

**Comparison of Substitution Methods**

**SanText (\(\epsilon=4\))**

* _Aliaga Public Prosecutor_ \(\rightarrow\) _60,000 norwegian kroner (nok) (approximately 7,500 euros)_: 0.0633__
* _Aliaga Criminal Court_ \(\rightarrow\) _district court of oland_: 0.5709__
* _Court of Cassation_ \(\rightarrow\) _court of the township_: 0.5470__
* _Republic of Turkey_ \(\rightarrow\) _legal and services office_: 0.2239__
* _Turkish Government_ \(\rightarrow\) _pdki (democratic party of iranian kuridstan)_: 0.5242__Average Cosine Similarity: 0.2264__CluSanT (\(\epsilon=4\),clusters = 1000, \(k=16\))__
* _Aliaga Public Prosecutor_ \(\rightarrow\) _manisa high criminal court_: 0.5344__
* _Aliaga Criminal Court_ \(\rightarrow\) _urban planning court_: 0.5415__
* _Court of Cassation_ \(\rightarrow\) _court of the vicar-general_: 0.6089__
* _Republic of Turkey_ \(\rightarrow\) _supreme court of north macedonia_: 0.3797__
* _Turkish Government_ \(\rightarrow\) _halkn gucu (people's power)_: 0.6460__Average Cosine Similarity: 0.5718__CluSanT (\(\epsilon=4\),clusters = 1000, \(k=64\))__
* _Aliaga Public Prosecutor_ \(\rightarrow\) _bialya lead prosecutor_: 0.6840__
* _Aliaga Criminal Court_ \(\rightarrow\) _elblag regional court_: 0.6085__
* _Court of Cassation_ \(\rightarrow\) _court of the steward of the marshalsea_: 0.5849__
* _Republic of Turkey_ \(\rightarrow\) _republic of Slovenia_: 0.6537__
* _Turkish Government_ \(\rightarrow\) _balikesir, edremit_: 0.5269__Average Cosine Similarity: 0.6985__CuTest (\(\epsilon=4\),clusters = 1000, equivalent to \(k\rightarrow\infty\))__
* _Aliaga Public Prosecutor_ \(\rightarrow\) _turlah public prosecector_: 0.6318__ 

* _Aliaga Criminal Court_\(\rightarrow\) _storfors district court (storfors tingsrint)_: 0.5465
* _Court of Cassation_\(\rightarrow\) _court of the lord high admiral_: 0.5305
* _Republic of Turkey_\(\rightarrow\) _republic of Azerbaijan_: 0.7156
* _Turkish Government_\(\rightarrow\) _totoman empire_: 0.5591

Average Cosine Similarity: 0.6703

SanText produces some substitutions that are quite off, for instance, replacing "Aliaga Public Prosecutor" with "60,000 Norwegian kroner (NOK) (approximately 7,500 euros)", which is meaningless in this context.

CluSanT with \(k=16\) provides more contextually appropriate substitutions compared to SanText. However, improvements are seen with a higher \(k\) value. **CluSanT** with parameters \((\epsilon=4,{\rm clusters}=1000,k=64)\) provides the most contextually appropriate substitutions with the highest average cosine similarity, making it the best choice for preserving the meaning and context of the original text.

CuS Text also provides reasonable substitutions but occasionally diverges, such as replacing "Turkish Government" with "Ottoman Empire."

### SST2: Binary Classification for Sentiment Analysis

We further demonstrate how CluSanT can be used to improve the utility in downstream tasks through the SST2 dataset (Socher et al.) which has also been used to evaluate SanText, CuStext (though their experiments focused on sanitizing text for training). For this experiment (Table 1), we evaluated an already-trained model for the task Binary Classification for Sentiment Analysis on a validation set sanitized either through SanText, CuStext, or CluSanT (various \(k\) parameters). We see that with higher \(k\), we achieve significantly higher accuracy and lower loss than SanText and approaching that of CusText (while still achieving standard MLDP guarantees) 

Figure 8: Peplexity improvement over SanText (%); the lower, the better.

Figure 7: Semantic similarity improvement over SanText (%); the higher, the better. CluSanT abbr. by CST and CusText by CT. Horizontal axis varies parameter \(k\) of CluSanT. Vertical axis varies the number of clusters. Same axes apply for the other heatmaps as well.

 

Figure 10: Common Sense improvement over SanText (%); the higher, the better.

Figure 9: Grammar improvement over SanText (%); the higher, the better.

 

Figure 12: Cohesiveness improvement over SanText (%); the higher, the better.

Figure 11: Coherence improvement over SanText (%); the higher, the better.

 



\begin{table}
\begin{tabular}{|l|l|l|l|l|l|} \hline \(\epsilon\) & num clusters & Mechanism & \(k\) & Accuracy & Loss \\ \hline N/A & N/A & Unsanitized & N/A & 0.91954 & 0.263152 \\ \hline
1 & N/A & Santext & N/A & 0.678161 & 1.467184 \\
1 & 336 & CluSanT & 8 & 0.643678 & 1.762656 \\
1 & 336 & CluSanT & 16 & 0.666667 & 1.544436 \\
1 & 336 & CluSanT & 32 & 0.724138 & 1.129536 \\
1 & 336 & Custext & N/A & 0.804598 & 0.828578 \\ \hline
4 & N/A & Santext & N/A & 0.62069 & 1.799631 \\
4 & 336 & CluSanT & 1 & 0.666667 & 1.569011 \\
4 & 336 & CluSanT & 8 & 0.712644 & 1.466076 \\
4 & 336 & CluSanT & 16 & 0.735632 & 1.144738 \\
4 & 336 & CluSanT & 32 & 0.793103 & 1.056569 \\
4 & 336 & Custext & N/A & 0.724138 & 1.346923 \\ \hline
8 & N/A & Santext & N/A & 0.703561 & 1.394245 \\
8 & 336 & CluSanT & 1 & 0.678161 & 1.420536 \\
8 & 336 & CluSanT & 8 & 0.689655 & 1.5434 \\
8 & 336 & CluSanT & 16 & 0.770115 & 0.993965 \\
8 & 336 & CluSanT & 32 & 0.793103 & 0.860854 \\
8 & 336 & Custext & N/A & 0.827586 & 0.760091 \\ \hline
16 & N/A & Santext & N/A & 0.712644 & 1.474932 \\
16 & 336 & CluSanT & 1 & 0.804598 & 1.168481 \\
16 & 336 & CluSanT & 8 & 0.850575 & 0.564254 \\
16 & 336 & CluSanT & 16 & 0.885057 & 0.463717 \\
16 & 336 & CluSanT & 32 & 0.882357 & 0.463717 \\
16 & 336 & Custext & N/A & 0.873563 & 0.486622 \\ \hline  & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} \\ \end{tabular}
\end{table}
Table 1: SST2 Binary Classification for Text Sentiment Analysis (Socher et al.) on existing trained model when validation set is sanitized with various mechanisms.