Secret-Protected Evolution for Differentially Private Synthetic Text Generation
Authors: Tianze Wang
Zhaoyu Chen
Jian Du
Yingtai Xiao
Linjun Zhang
Qiang Yan
Venue: ICLR 2026 Poster (2026)
Keywords: synthetic data
differential privacy
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Text data has become extremely valuable on large language models (LLMs) and even lead to general artificial intelligence (AGI).
A lot of high-quality text in the real world is private and cannot be freely used due to privacy concerns. Therefore, differentially private (DP) synthetic text generation has been proposed, aiming to produce high-utility synthetic data while protecting sensitive information.
However, existing DP synthetic text generation imposes uniform guarantees that often overprotect non-sensitive content, resulting in substantial utility loss and computational overhead. Therefore, we propose Secret-Protected Evolution (SecPE), a novel framework that extends private evolution with secret-aware protection. 
Theoretically, we show that SecPE satisfies $(\vp, \vr)$-secret protection, constituting a relaxation of Gaussian DP that enables tighter utility–privacy trade-offs, while also substantially reducing computational complexity relative to baseline methods.
Empirically, across the OpenReview, PubMed, and Yelp benchmarks, SecPE consistently achieves lower Fréchet Inception Distance (FID) and higher downstream task accuracy than GDP-based Aug-PE baselines, while requiring less noise to attain the same level of protection. 
Our results highlight that secret-aware guarantees can unlock more practical and effective privacy-preserving synthetic text generation.

Published as a conference paper at ICLR 2026
SECRET-PROTECTED EVOLUTION FOR DIFFEREN- TIALLY PRIVATE SYNTHETIC TEXT GENERATION
Tianze Wang Minggl?;ZZin ZZaoyu : Du' Yingtai Xiao Linjun Zhang?, Qiang Yan'
'TiTTok, 'Department of Statistics, Rutgers University
ABSTRACT
Text data has become extremely valuable large language models (LLMs) and even lead to general artificial intelligence (AGI). A lot of high-quality text in the real world is private and cannot be freely used due to privacy concerns. Therefore. differentially private (DP) synthetic text generation has been proposed, aiming to produce high-utility synthetic data while protecting sensitive information. How- ever, existing DP synthetic text generation imposes uniform guarantees that often overprotect non-sensitive content, resulting in substantial utility loss and compu- propose Secret-Protected Evolution (SecPE),
tational overhead. Therefore, a novel framework that extends private evolution with secret-aware protection. Theoretically, show that SecPE satisfies (p, r-eerrett protection, constituting a relaxation of Gaussian DP that enables tighter utility-prvvacy trade-offs, while also substantially reducing computational complexity relative to baseline methods. Empirically, across the OpenReview, PubMed, and Yelp benchmarks, SecPE con- sistently achieves lower Fréchet Inception Distance (FID) and higher downstream task accuracy than GDP-based Aug-PE baselines, while requiring less noise to attain the same level of protection. Our results highlight that secret-aware guar- antees can unlock more practical and effective privacy-preservy synthetic text generation.
INTRODUCTION
Text data has grown immensely valuable for large language models (LLMs), enabling these mod- els to achieve revolutionary breakthroughs natural language understanding and generation while delivering robust performance across
unddersttnnddrrdndnnngnn tasks iincluding classification, con-
textual autocompletion, and social recommendation (Chen et al. 2019 Mukherjee al. 2020: Voy-
tovich & Greenberg 2022 Harte et al. 2023). However, training and adaptation typically rely on
large volumes of private user text data, raising serious privacy risks including memorization and
leakage of sensitive content (Carlini et al. 2019 2021 Lukas al.
2023 Wang et al. 2024).
To address privacy leakage, Differential Privacy (DP) (Dwork et al. 2006) has become the gold stan- dard, offering rigorous mathematical framework for mitigating information disclosure. Therefore, synthetic text based on DP can be safely shared and used for downstream tasks. A classical approach train DP generator (Abad al. 2016) and then sample DP synthetic data (uue et al.) 2023 Yu et al., 2024 Tan et al. 2025). Despite its conceptual simplicity, such generators are computationally intensive, require hundreds of high-quality private data achieve strong performance, and cannot directly leverage closed-source, state-of-the-art LLMs. More recently. Private Evolution (PE) (Lin) al. 2025) has emerged as an alternative: rather than privately training model, one repeatedly queries powerful foundation model to generate candidates, evaluates them against private data via DP voting, and resamples around the winners (Xie al., 2024 Zou al. (025).
PE leverages strong off-the-shelf models and shifts the privacy cost to selection and aggregation. However, it still requires a substantial volume of private samples, and its pairwise similarity com- putations and iterative data processing make the pipeline highly inefficient. This inefficiency poses a critical challenge in practice and motivates the need for more scalable solutions. In addition, the
"indicates equal contributions. This work was done when Tianze Wang was an intern at TikTok. indicates corresponding author. E-mail: jia @tiktok.com

---

Published as a conference paper at ICLR 2026
Protected Evolution
Secret Clustering
Privayy Budget
Greerate
Text Data
Private Data
Varistions
Synthetic Data illigh Quality)
Clussering
Seleet
Public Data
Centers
Downstream Model
Figure The overall SecPE. The framework consists of two modules: (1) Secret Clustering: clustering is applied to public data and updated with noisy private data to form representative centers for voting; (2) Protected Evolution: each iteration, candidate synthetic data consist of high-quality samples from the previous iteration together with their L.M-ggeerrted variations, and new high- quality samples are selected based on similarity to the noisy representatives.
reliance canonical DP assumes that every record is equally sensitive, even though sensitive infor- mation may be sparse (Shi et al. 2022) and vary across users and attributes (c.g.. medical records movic ratings). Furthermore, secrets may repeat across records, and single user may contribute
multiple records; under user-level DP, this further degrades utility (Levy et al. 2021 Chua et al, 2024
Charles al. 2024), increasing the noise required by uniform guarantees.
Recent work argues for secret protection, which provides guarantees tailored to specific secrets rather than membership (Ganesh et al.. 2025). With predefined secrets, public data can be used without protection. For example, once the secrets are predefined, the corresponding sensitive infor- mation can be detected, allowing the remaining non-secret data be freely used for clustering and summarization. This design enables the method to operate more efficiently, as the privacy budget reserved exclusively for secret-related adjustments rather than being uniformly applied the en- tire dataset. In the formulation, protection is calibrated at the adversary's 's prior for secrets and then directly bounding the reconstruction success probability, a similar concept as |Hayes al.. (2023). Conceptually, this relaxes Gaussian DP (GDP) (Dong et al., 2019) by requiring protection only at a specific point (Pj, r3) on the trade-off curve, rather than over the entire curve. This relaxation weakens the privacy constraint but yields higher utility and more practical reconstruction protection. This perspective suggests re-thinking PE around secret-aware aware selection and aggregation rather than uniform DP noise.
In this paper, we introduce the Secret-Protected Evolution (SecPE) framework. As illustrated in Figure I1, SecPE consists of two key components: (1) Secret Clustering, which detects sensitive attributes and forms representative centers by updating public clusters with noisy private data; and (2) Protected Evolution, which iteratively samples variations from high-quality synthetic data, eval- uates them against the noisy representatives, and selects the best candidates. This design preserves the practicality of PE while shifting protection toward secrets rather than uniform DP.
Our contributions are summarized as follows: (1) we propose a private synthetic data generation framework that emphasizes secret protection rather than canonical DP, thereby improving utility by reducing the noise typically required under DP; (2) we develop a secret-protected clustering method that substantially reduces runtime complexity compared the PE approach, enabling scala- bility to larger datasets while maintaining competitive performance; and (3) through experiments on RvenR, PubMed, and Yelp, we empirically demonstrate that SeePE achieves higher efficiency, lower Fréchet Inception Distance (FID) (Heusel al. 2018). and better downstream accuracy than μ-GDP based PE basclines under the same reconstruction guarantees.
RELATED WORK
Differential Privacy (DP). We begin by reviewing (c, 6DD and Gaussian Differential Privacy (GDP), the latter providing clean bridge to secret-protection analysis.
2

---

Published as a conference paper at ICLR 2026
Definition 2.1 8))))) A randomized algorithm M is (e, diifferenntl private if, for any two neighboring datasets and D' that differ in exactly one datapoint, and for all S C Range(M), holds that Pr(M(D) S] < et Pr[M(D')) E S] +
Within the DP framework, an adversary aims to decide whether a specific record is present in a dataset. This naturally leads to binary hypothesis test between two neighboring datasets D D'. Following Dong et al. (2019), privacy can be characterized via the rypothesis-tssting view through a trade-off function. Formally, let P and Q denote the output distributions of randomized mechanism M on and D', respectively. For any rejection rule testing Ho : P in favor of H₃ : Q, the trade-off function T(r.)) [0, 1] + [0, 1] is defined as:
T(. (a) = inf : as Sa)
a E [0, 1]:
where 0g E()) and 8g = E(() are type I and type II errors, respectively. Evidently, larger values of the trade-off function indicate a harder hypothesis testing problem (hence more private). Definition 2.2 (GDP). A randomized algorithm M satisfies p-Gaussian Differential Privacy if for every pair of neighboring datasets D' with output distributions (P. P).
T().))(a)) 2 Ga(a)= == ④( (1 a) - -p), a E [].
(2)
where (a) is the benchmark trade-off curve for testing (Q,0) 1) against M(1, 1), and μ-GDP asserts that distinguishing M(D) from MMD') no easier than the Gaussian benchmark.
DP has its limitations: strong protection often entails utility loss, and its guarantees are typically uniform across all users and records, neglecting that not all secrets are equally sensitive. As a result, DP can be overly conservative for secret protection.
DP Synthetic Text Generation. The goal of generating DP synthetic texts is to mimic private data while protecting private information from leakage. An intuitive way is to train a language model with DP-SGD (Abadi et al.) (2016) as generator to guarantee DP for private data. While DP-Generator Yue et 20033 Yu al. 2024 Tan al. (025)) is effective, it is computationally intensive and requires a large amount of high-quality private data to achieve strong performance. Furthermore, it cannot benefit from state-of-the-art LLMs,, these models (e.g., GPT, Claude, Gemini, etc.) are closed-source, which limits its potential. To handle the above issues, Private Evolution (PE) (Xie al. (024) proposed for DP text synthesis, which only requires API access to foundation models and iteratively updates randomly initialized samples. Then, (Zou et al. 2025) and (Hou et al., 2025) further extend PE to data-deficient and data-isolated scenarios. However, standard DP provides uniform protection across all data, which can lead to excessive utility loss and computational overhead, especially when only a small portion of data is truly sensitive.
METHOD
To reduce the amount of noise added and thereby improve utility, adopt secret protection in place of differential privacy. The formal definition of secret protection is provided in Section Building this definition, introduce Secret-Protected Evolution (SecPE) in Section 3.2 In particular, Section 3.2. derives the noise scale required to achieve secret protection. Given this noise scale, Section 3.2.2 presents private clustering method that satisfies the definition of secret protection, while significantly reducing computational complexity compared to Private Evolution. Finally, Section 3.2.3 summarizes the SeePE pipeline and establishes the privacy guarantee of the SecPE algorithm.
3.1
3.1 SECRET PROTECTION
The notion of secrets can be subjective, as it is determined by individuals' subjective will. On one hand, secrets may be proprietary business information that an organization seeks to protect (e.g., data containing trading details from an investment firm). On the other hand, secrets may comprise user information that company wishes to leverage for model training. In general, secrets refer to sensitive content that warrants protection and the focus is not on membership privacy, but on safeguarding the secrets themselves against reconstruction. Ganesh et al. (225) introduces framework that provides privacy guarantees calibrated to the sensitivity of each secret, in contrast to DP, which enforces uniform and often overly conservative level of protection.
3

---

Published as a conference paper at ICLR 2026
be training dataset and S {si..... Sm } be a set of secrets. For each secret 8y, let (x; be an indicator function that equals if xa contains secret 8j, and let (2,, æ4)) be indicator that equals if and only if x; and x differ only in the presence of secret 85. We say that two datasets and D' are neighbors with respect to secret 5j (denoted D jj D') if, for all i E [n], either Fy
Definition 3.1 (Neighboring Datasets). Let D
Tj (2;, = 1.
Together, E and T3 specify which samples or datasets are considered neighbors under the secret- protection setting.
Definition 3.2 (Secret Protection). Let D) = (z1, Inn be a training dataset, where each sample may contain secrets from S {s1.-..: 8m). For a secret 8, E S, let ny denote a prior distribution over datasets {D),... 1Df, such that Pr(D)) Σ Py, where and DJ differ exclusively in the presence of 8j. A randomized mechanism A is said to satisfy (p, -secret protection if, for any reconstruction attack B, the following holds:
Pr [B(A(D)) =s mzg Vj.
Dy
Here, p and are vectors, and n, encodes the adversary's 's prior knowledge about the secret sy. The guarantee bounds, for each secret, the posterior reconstruction probability given a specified prior success probability.
This notion closely parallels the reconstruction robusiness of Balle et al. (2022), where sharp bounds are obtained via the blow-up function. Accordingly, we interpret (p. r) -secret protection through
the lens of j-GDP, since the trade-off function is tightly connected to blow-up function. We align the neighboring relation so that D2 differ only by a single element: and 8j & x' Dj-
specifically, 8j E x D
Lemma 3.3. Any H-GDP mechanism AA provides (p, -secret protection, where
Tj 1 -0- P3) 14).
Proof. Let P and Q2 denote the distributions of A(D) and A(D,). respectively, By μ-GDP, we have
(Ps)))(s)) 2 Gn(p,) = 4 4( '11 P.) 14)
+1 ((P,),)))) 2 (00-1(1111)1 (1- pj) 11)
(5)
- (P) < (( (1 pj) - 11) -rj
where (a) SuPE:Q(E) P(E) is the blow-up function. By Theorem 2 of (Hayes et al. 2023). this directly
inf i. P(E) is the trade-off function and (a)
implies (p. secrett protection.
We use GDP to interpret secret protection because the posterior obtained from the trade-off curve yields tight single-point bound at the specified prior. Note that the converse does not hold in general: (p. r)-scrett protection constrains the adversary's success at a single prior Pý, whereas f-- GDP requires the entire trade-off curve T(P.q) to lie above Gy.. This highlights that (p, -secrtt protection constitutes relaxation of the classical DP definition.
3.2
SECRET-PROTECTED EVOLUTION
In this section, we propose Prctee-Protected Evolution (SecPE), a framework that incorporates secrer protection into the evolution paradigm introduced in prior work. Whereas traditional PE (Lin et al.) Xie et al. 2024 Yu al. 2024) operate under canonical DP guarantees, SecPE shifts the focus secret protection, aligning with the discussion in the previous subsection.
2025
Traditional PE draws random samples from foundation model and iteratively refines candidates through DP voting similarity to the private data. A key drawback of this approach is the high computational cost from redundant similarity evaluations. Moreover, the voting distribution is typi- cally unbalanced, with small subset of synthetic samples accumulating the majority of votes while the rest are selected almost uniformly (see Figure 4). This imbalance reveals inefficiencies in the selection procedure and motivates more structured clustering- design.
4

---

Published as a conference paper at ICLR 2026
To address these issues, Algorithm replaces direct voting with cluster representatives. At high level, the SecPE pipeline consists of two stages: (1) Secret Clustering, where public data are clus- tered and updated with noisy private contributions to form representative anchors; and (2) Protected Evolution, where noisy representatives replace individual private samples in the voting process. This design preserves the practicality of PE while explicitly tailoring protection secrets.
Specifically, for M private examples and a target of Nayn synthetic samples, the naive PE voting scheme requires (M similarity computations. In contrast, SeePE leverages Secret Clustering with K anchors, reducing the complexity to O(K Nayn), where typically K < M. This yields substantial runtime savings in practice, further validated in Table
3.2.1 NOISE FOR SECRET PROTECTION
Following Ganesh et al. (2025).
, we assign a weight W; to each private example via linear program:
max W) 2:E Dprs
subject
Σ
W/ S + Φ- pj) - 5 (1-rr) A mj we [0, 1] Vi. (6)
2, Paiua
where Dpri.j == E Pari 8j E Iq is subset Dpri such that each data in Dpri,j contains secret sj. The objective encourages including as many examples as possible; We then construct form training subset. Here, f μ in Equation sampling probabilities p. max, w, Σ. w.
acts as a natural capacity constraint, permitting more samples to be selected when 8; is less sensitive (i.e., larger 77)) However, secret protection only requires upper bound on the blow-up function. In practice, fj may be chosen heuristically. A detailed procedure is outlined in Algorithm
Algorithm Procedure SECRETNOISE
1: Input: Dataset D secrets Saec secret budget (p,r).
2: Output: noise parameter a, sampling probabilities p
3: {wi} < solution to linear program
using the chosen f7 values.
4: V + 1/ max; Whi Pi & V.
Ev we
5: For each 8j Spoce Pj -n, Bern(pt), Qj NN
6: σj + min(o: : B(ry,,,)))) (p,) S Sryh, o + max, 0j
3.2.2 SECRET CLUSTERING
In the PE procedure, a small number of synthetic samples receive the majority of votes, illustrated in Figure This phenomenon indicates that selection occurs in group-like clusters rather than being uniformly spread, which motivates replacing pointwise voting with representative voting via clus- tering. Predefined secrets allow us to first detect and cluster using only public data, and then apply a controlled shift informed by secret-containing data. In this way, the representative centers sum- marize the global structure of the dataset without directly exposing sensitive information. Synthetic data can then be selected based on proximity to these representative centers, climinating the need to repeatedly process the entire dataset, procedure that is especially costly for large-scale datasets.
the number clusters K. In practice, we recommend scaling K with both the size of the original data and the target number of synthetic samples: (1) large enough to support diverse voting, and (2) small enough to limit noise amplification. Empirically, performance largely insensitive the exact choice of K (see Section 4.2
noteworthy hyperparameter

---

Published as a conference paper at ICLR 2026
Algorithm 2 Procedure SECRETCLUSTERING
1: Input: Dataset Pri U D pub, secrets Spec. text embedding model V clipping radius R.
2: Input: Public clusters {[EK, ((()), [=) = KMEANS D pub. K)
3: Input: (a, p) SECRETNOISE pri Secr, P.r).
4: Output: Noisy cluster centers and cluster sizes {(ē), f&) ]a)] 1kml
5: Epri < , ( (Dpri)); Initialize e₁ = Ck. =
6: for Epri,s E Epr do
7: Sample ~ BBennolli(ps)..
8: if
then
9: Assign Epri, to its nearest public center: &o arg minje d(epri, e,))
10: Update cluster statistics: ek + eg + Epel, my +- my
11: end if
12:
end for
13:
ni nk + mg +((,0 Ōk +
ca na+me
28 my
NN(00
Theorem 1 (Secret Clustering). Let {C A {(e,, nx)) denole the set of public cluster centers with corresponding cluster sizes. Every private vector clipped as epri, Clip ( epri min(1, 1, R/| slppe..,l. and then assigned to its nearest anchor; Let denote the number of private points assigned anchor Ek. For every cluster k, we release the perturbed statistics:
é₁- 12k Cb + EiEo, Epris
Ekr
E
28
.N((0002a))
n&k + m&
me
ng + my 1J.
Te ((0,
where a is chosen by Algorithm 7 with == Then Algorithm satisfies (p, r-secret protection.
3.2.3 SECPE PIPELINE
Following Xie et 2024). Algorithm instantiates SecPE with two interacting components each round: (i) Secret Clustering via Algorithm 2 to build noisy representatives and voting weights; and (ii) Protected Evolution that alternates selection with LLM-driven variation. Specifically, the procedure begins with an initialization step (line 4 in Algorithm 3 that prompts a foundation model to generate random samples. At each iteration, the top Naya candidates from the previous round selected based their similarity to the pecret-protected clustering centers. These survivors, together with their --g-ennerated variations, form the candidate pool for the next round. A detailed convergence analysis deferred to Appendix C.2
Algorithm SecPE Pipeline
1: Input: Dataset Dpri U Dpub. secrets Seece text embedding model ///
2: Input: Number of synthetic samples Naya. variation number L.
3: Output: Synthetic text dataset Sgy
4: Initialize Sn <- RANDOM(N. (Nay T.)
5: for t E 10,1, T - 1} do
6: E E E, + E, min(1, R/[ Histogram, + [O......) 0
7:
[(ēx, nz kk) <- SECRETCLLUSTERING(( pub, Dpc)
8:
for k {L....,K} K} do
9:
i + arg mim EE, d(ēx, e₁) Histogram + fg
Histogram 11: end for
12: St+1
Jayn +- Top Nayn samples according to Histogram,,
13:
S < [VARIATION ( T.), 5t41
14:
end for
Theorem (Privacy Guarantee for Algorithm 3}. Let Algorithm 3 run for iterations with noise multiplier as specified in Algorithm Then satisfies (p, r-secret protection.

---

Published as a conference paper at ICLR 2026
Table Hyperparameter settings for SecPE and Aug-PE across datasets.
Dataset
Nayn
Cluster K
L
Iterations
Temperature
Max tokens
OpenReview
2000
15, 20, 15
6
10
1.2
448
PubMed
2000
2000, 3000, 4000
6
5
1.2
448
Yelp
5000
400, 600, 800
6
5
1.2
64
Table 2: LLM generation time and histogram computation time (scconds) for one epoch.
OpenRevicw
PubMed
Yclp
Time (sec)
LLM
Histogram
LLM
Histogram
LLM
Histogram
Aug-PE SecPE
1698.7
126.9
828.5 830.8
32.2 0.5
347.1 347.6
30126.4
1693.1
1.5
2.3
Theorem provides a theoretical guarantee for Algorithm 31 The proof follows directly from The- orem 2.4 of Doroshenko al. 2022), since the pair of distributions M( Pyci.j Beru(pi), o²)
and (00 2²) form dominating pair in each round.
Remark 3.4. When cosine similarity is used as the distance metric, it suffices to apply K K-menns to fz-normalized embeddings, which effectively transforms the clustering into cosine-based grouping- In this case, we set the sensitivity bound R = when calibrating the noise scale.
EXPERIMENTS
4.1 SETUP
In this section, we empirically evaluate SecPE on text synthesis and privacy protection. We first consider a random word task to illustrate SecPE's ability to generate high-fidelity synthetic text under secret constraints. Then Personally Identifiable Information (PII) task that assesses protection of truly sensitive content, where PII is detected with Ai4Priacy In both tasks, SecPE delivers better utility at lower runtime: secret protection injects less noise than μ-GDP the same reconstruction budget, and representative voting with clustering cuts computation while preserving fidelity.
Datasets. We evaluate on three widely applied open-source datasets: (1) OpenReview (Xie et al,, 2024] ICLR 2023 paper reviews labeled by research area and recommendation rating; (2) PubMed Yuu et al. 2023): medical paper abstracts; and (3) Yelp (Inc. Yelp 2015): user reviews of businesses labeled by business category and rating.
Baselines. Given that secref protection is a new concept, we construct baseline by instantiat- ing the most popular Aug-PE under μ-GDP, with μ set via Equation 4 and add Gaussian noise calibrated to the voting sensitivity following Xie et al. (2024). We use SecPE to denote SecPE with K clusters. Our comparison covers three aspects: (i) Computational efficiency: GPU hours for response generation and computation time for counting histogram are reported. (ii) Downstream performance: we fine-tune RoBERTa-baad (Liu et al. 2019) on synthetic data to classify Yelp rat- ings/categories and OpenReview recommendations/ aaras. For PubMed, pert-base-uncased (BERT) Ture et al. (2019) is fine-tuned to report next-word prediction accuracy; (iii) Real-synthetic similar- iry: compute FID text embeddings and provide comparison of text-length distributions;
Implementation details. As text generators, we use GPT-2 (Radford et al.
2019). Qwen-2.5-1. 2.5-1.5B
(Qwen et al. 2025) for main experiments. Llama-3.1-88 Dubey et al. (2024). 4. Owen-2.5-7B (Qwen et al.) 2025). applied for ablation study.
(Jiang et al. 2023 and 4PT-4o-Mimi (OpenAl 2024
We use privacy budget, we fix the prior vector p 1-10 and set the budget via the ratio r c with c e {2, 10, 50, oo), where heterogeneous, secret-specific budgets to achieve better effectiveness, we adopt a uniform budget to enable fair comparison with the μ-GDP Aug-PE. baseline, where μ Φ-1(1 p) (1-((1r))
(Reimers & Gurevych 2019) the embedding model V. For the
denotes the non-private setting. Although
could carefully tailor
7

---

Published as a conference paper at ICLR 2026
Table 3: Performance comparison downstream tasks within random words on PubMed.
r/p = 2
r/p 10
r/p =
50
r/p = 00
LLM
Method
BERT_ .m
BERT.s
BERT_ .m
BERT_s
BERT_m _m
BERT_s
BERT .m
BERT, .s
AugPE
22.15
24.93
23.13
26.14
24.39
26.96
27.28
29.70
GPT2
SecPE2o00
26.74
29.18
27.09
29,42
26.82
29.38
26.82
29.19
SecPEsoun
27.15
29.54
27.32
29.75
26,69
29.12
27.09
29.52
SecPEçono
27.02
29.57
26.86
29.34
27.23
29.43
27.01
29,41
AugPE
20.37
22.65
21.01
23.09
21.18
23.52
23.68
25.87
Qwen-2.5-1.5B
SecPE2000
23.17
25.37
22.26
24.40
22.93
24.96
22.50
24.63
SecPFo000
22.31
24.48
22.24
24.55
22.65
24.92
22.84
24,91
SecPE1000
22.17
24.41
22.63
24.99
22.84
24.91
22.29
24.40
For numerical stability, we approximate Mixture of Gaussian with a single Gaussian in both settings. Additional training and hyperparameter details are provided in Table For each dataset, the hyper- parameters are kept fixed across all methods. For generating LLMs' responses, the prompts are the same as (Xie et al. 2024).
4.2 PERFORMANCE COMPARISON ON RANDOM WORDS
In this task, all vocabulary items in each dataset by frequency and designate words near the 20% quantile as secrets; a sample treated as secret-containing it includes any designated word.
Runtime comparison. Table 2 reports runtime NVIDIA A100 (80GB) GPU. A key advan- tage of SecPE lies in its efficiency: Secrel Clustering drastically reduces per-iteration histogram construction and selection time, accelerating the overall pipeline. Among Experiments, our method reduces this component by at least a factor of 60x; on Yelp (1.9M records), the reduction reaches roughly 10,000x. terms of LLM sampling, SecPE achieves runtime comparable Aug-PE, as both methods query the same model for the same number of variations.
Memory and GPU Utilization. Clustering before the PE step yields substantial resource savings. Concretely, in the Yelp experiment, we reduce memory usage by about 25.1 GB, since we no longer need to store embeddings for the entire dataset at once. GPU utilization also improves markedly: the original PE pipeline uses only about 3.2% of GPU capacity, whereas our approach reaches approximately 38.6%, indicating much more efficient hardware usage.
Downstream Task. Experimental results comparing SecPE with Aug-PE on downstream tasks are reported in Tables and 5 For each privacy budget and model, we highlight the highest classi- fication accuracy bold. On PubMed, as r/p decreases from to 2, the BERT-small next-word prediction accuracy on Aug-PE (GPT-2) synthetic text drops from 29.70 - 24.93, whereas only a marginal change from 29.19 29.15 for SecPEgo00- The results show that, with the same num- ber of training epochs, SecPE consistently achieves higher accuracy under private settings, and this advantage becomes
pronounced the privacy requirement tightens (i.e., smaller r r/p). In the non- non-private case (r/p- = oo), performance is slightly lower but broadly comparable, likely be- cause clustering abstracts away fine-grained details and can occasionally induce mis-sclections. We further observe non-systematic fluctuations in downstream accuracy when varying K, attributable randomness in both the SecPE procedure and the downstream fine-tuning: overall, however, the method remains robust and not sensitive to the choice of K.
Real-synthetic similarity. The left two panels of Figure align with the tabular results: as r/p decreases, SecPE achieves lower FID (i.e., greater similanity to the original data) than Aug-PE, whereas in the non-private setting it yields higher FID. Moreover, FID varies little across all tested K, further indicating that the choice of K does not materially affect performance. In the right two panels of Figure 2 we compare the empirical sequence-length distributions synthetic data with those of the original corpus. As SeePE and Aug-PE rely on the same generative LLM, their length distributions are very similar.
Ablation of LLM. We evaluate SecPEg00 Yelp under r/p {10, oo) using more advanced API- accessible LLMs. As shown in Table these models achieve accuracy comparable to, or exceeding GPT-2 and Qwwn-2.5-1.51B indicating that approach benefits from high-quality synthetic text
8

---

Published as a conference paper at ICLR 2026
Table 4: Performance comparison of downstream tasks within random words on OpenReview.
r/p
2
r/p = 10
r/p = 50
r/p
oc
LLM
Method
Area
Rating
Area
Rating
Area
Rating
Area
Rating
Aug-PE
29.06
25.70
27.94
27.12
32.48
27.88
41.06
28.70
SecPE1s
30.77
30.26
31.88
30.70
30.34
28.27
39.02
28.38
GPT2
SecPEzo
28.98
31.38
32.67
28.23
30.30
29.56
38.74
30.49
SecPE2s
30.34
29.24
34.81
30.66
32.48
30.31
38.60
30.49
Aug-PE
32.70
25.55
32.23
25.80
36.49
28.52
40.20
28.09
SecPE1s
38.34
27.73
38.67
26.02
36,09
30.95
36.03
32.03
Qwen-2.5-1.5B
SecPEgo
37.17
26,94
36,95
26.44
35.85
29.52
39.63
28.30
SecPHas
38.92
27.66
37.03
27.82
40.24
28.81
40.24
28.86
Table 5: Performance comparison of downstream tasks within random words on Yelp.
r/p
r/p
10
r/p
50
r/p
LLM
Method
Category
Rating
Category
Rating
Category
Rating
Category
Rating
Aug-PH 71.53
47.02
71.62
54.72
72.60
64.02
73.54
65.28
SecPE400
61.44 .444
72.90
58.92
72.18
64.30
72.50
61.28
GPT2
SecPEs00
96
60.38
73.82
58.36
73.61
65.08
72,96
62.22
SecPEs00
72.74
62.46
74.28
63.70
73.12
63.82
73.58
62.48
Aug-PE 72.70
55.84
72.14
53.52
71.93
55.54
72.14
59.02
SecPE.00
73.97
55,80
72.00
$7.80
73.28
$7.70
73.84
58.78
Qwen-2.5-1.5B
SecPE
72.22
56.04
73.24
57.80
73.66
58.53
73.00
58.61
SecPEs00
74.12
58.64
72.60
58.66
72.54
60.93
73.14
57.06
produced by stronger LLMs. Within the same family, stronger variants tend to perform better. For example, at r r/p - = 10 (category, clasini-lassiification accuracy, GPT-4o-mini (74.84, 62.96) outperforms GPT2 (73.82, 58.36 36) and Qwen-2.5-7B (74.56, 63.06) outperforms Qwen-2.5-115BB (73.12, 62.08). However, the 7B Mistral (72.52, 58 10) does not outperform smaller LLM in our setting, suggesting that appropriate model selection, rather than parameter count alone, is crucial.
Table 6: Stronger LLM generators yield improved downstream accuracy on Yelp.
r/p 10
r/p Rating
LLM
Category
Rating
Category
GPT2
73.82
58.36
72.96
62.22
Qwen-2.5-1.5B
73.24
$7.80
73.00
$8.61
Mistral-7B- -istral77B-Instruct--.333
72.52
58.10
73.38
61.28
Llama-3.1-40 1-88
74.14
61.92
73.82
62.99
Qwen-2.5-7B
74.56
63.06
74.24
63.34
GPT-4o-Mini
74.84
62.96
75.10
63.28
Ablation on the Number of Clusters (K). Table 7 presents an ablation study over different choices of the number of clusters K, where SecPE is trained for 20 epochs. The results show that per- formance is largely insensitive to the exact choice of K, as long as K is not too small, since an insufficient number of clusters fails to capture the overall data structure.
Table 7: Performance comparison downstream tasks under different K with r/p 10.
LLM
Label
K-50
K-100
K-200
K-1200
K K-1600
Category
62.50
63.88
70.94
73.76
73.92 66.16
73.56
GPT2
Rating
61.84
64.46
64.72
67.34
67.18

---

Published as a conference paper at ICLR 2026
GPT-2
Qwen-2.5-1.58
GPT-2
Qwen-2.5-14
Original
Original
1.75
1.90
1.50
SocPBake Baice
SocPEaso
1.2
1.25
1.02
1.00
39
30
23
20
10
10
0.25
20 30
10 50
1000
2000
5000
1000
2000
2000
17p
r/
Sequence Length
Sequence Length
Figure 2: Results on PubMed. (Left) FID relative the original data for SeePE and Aug-PE PE under r/p E (2, 10, 50, }o} using GPT-2 and Qwen-2.5-1.5B. (Right) Synthetic sequence-length distribu- tions for the non-private SecPE3000 and Aug-PE generated by GPT-2 and Qwen-2.5-1.5hh compared with the original data.
4.3 PERFORMANCE COMPARISON ON PERSONALLY IDENTIFIABLE INFORMATION (PII)
On the Yelp dataset, we detect 36 PII categories (e.g., age, email, gender) using A14Privacy and Pre- sidio and treat each category as a secret, yielding a dense secret-containing corpus. In this setting, the improvements word task. Crucially, the efficacy of our approach is intrinsically bottlenecked by the precision and recall of these underlying detection tools; since SecPE operates the identified secrets, deploying more advanced and accurate PII detectors would naturally translate to more pronounced perfor- mance gains. Furthermore, it worth noting that our comparison fixes the number of epochs across methods and therefore does not leverage SecPE's faster iteration speed.
Aug-PE (see Table () are modest and less pronounced than in the random-
Table 8: Performance comparison of downstream tasks within PII Yelp.
LLM
Method
r/p-
r/p = 10
r/p = 50
r/p =
0c
Category
Rating
Category
Rating
Category
Rating
Category
Rating
Aug-PE
73.50
62.36
73.60
65.89
74.10
63.44
73.54
65.28
A14Privacy
SecPLsno
73.65
63,45
75.05
61.22
74.34
62.45
72.96
62.22
Presidio
Aug-PE
71.72
55.80
72.54
63.34
74.15
66.92
75.14
67.04
SecPEs00
73.88
64.80
74.38
66.58
75.40
66.66
75.34
65.50
CONCLUSION
We introduced SecPE, secret-aware evolution framework for privacy-preserving text synthesis. By calibrating protection at the level secrets rather than enforcing uniform DP across all records, SecPE provides formal (p, -scret guarantees and relaxes Gaussian DP to the operative prior point, thereby achieving tighter utility-privacy trade-offs. Empirically, across diverse datasets, SecPE im- proves fidelity and downstream accuracy over GDP Aug-PE baselines under private settings, while also substantially accelerating the pipeline. Ablation studies further show that stronger LLMs con- sistently yield higher-quality synthetic text, highlighting the critical role of model selection. Overall, our results suggest that secret-aware mechanisms offer more practical and effective approach to text generation than DP, particularly in settings where sensitive content sparse in type yet repeated across records and thus highly consequential.
10

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
For the theoretical analysis of this work, we provide detailed explanations in Section 3.2 The assumptions and complete proofs of the theorems are presented in Appendix [ The datasets, models and hyperparameters used in the experiments are described in Section and additional experimental settings reported in Appendix B All datasets used are publicly available, and their usage are explicitly referenced in the paper.
ETHICS STATEMENT
This work adheres to the ICLR Code Ethics, with no involvement of human subjects or animal experimentation. All datasets employed were sourced in compliance with relevant usage guide- lines to ensure privacy protection. We ensured the avoidance of biases or discriminatory outcomes throughout the research process, utilized no personally identifiable information, and conducted no experiments posing privacy or security risks. Furthermore, we are committed to upholding trans- parency and integrity in the research. The proposed method facilitates privacy protection, and we aim to further standardize the use of private data.
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318 318, 2016.
Borja Balle, Giovanni Cherubin, and Jamie Hayes, Reconstructing training data with informed adversaries, 2022.
abs org
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks, 2019. URL https://
arxiv. org/ abs /assss/a/ /1002.182...00 08232
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson. Alina Oprea, and Colin Raffel. Extracting training data from large language models, 2021. URL https://arxx http///axxvvvoooo
abs /2t//0112 2..12..41 07805
Zachary Charles, Arun Ganesh, Ryan McKenna, H. Brendan McMahan, Nicole Mitchell, Krishna Pillutla, and Keith Rush. Fine-tuning large language models with user-level differential privacy, 2024. URL htthh:tt///rrrtt attpo//////..i..o/aabbaa////
orgg/bs / 2407 17..070700 07737
Mia Xu Chen, Benjamin N. Lee, Gagan Bansal, Yuan Cao, Shuyuan Zhang, Justin Lu, Jackie Tsay, Yinan Wang, Andrew M. Dai, Zhifeng Chen, Timothy Sohn, and Yonghui Wu. Gmail smart compose: Real-time assisted writing. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery Data Mining, KDD '19, pp. 2287-2295, New York, NY, USA, 2019. Association for Computing Machinery. ISBN 9781450362016. 3292500.3330723, Utthtttss:/
doi: 10.1145/ 110.1111//3000 1ttp:/...114/322250000 3330723
Christopher A. Choquette-Chov Arun Ganesh, Thomas Steinke, and Abhradeep Thakurta. Pri- vacy amplification for matrix mechanisms, 2024. URL 15526
Lynn Chua, Badih Ghazi, Yangsibo Huang, Pritish Kamath, Ravi Kumar, Daogao Liu, Pasin Manu- rangsi, Amer Sinha, and Chiyuan Zhang. Mind the privacy unit! user-level differential privacy for language model fine-tuning, 2024.
abs http//bb///44... 2206 14322
Jinshuo Dong, Aaron Roth, and Weijie J. Su. Gaussian differential privacy, 2019. URL
https
//arxiv. wwtpxii.rrggaba///e 905 02383
Vadym Doroshenko, Badih Ghazi, Pritish Kamath, Ravi Kumar, and Pasin Manurangsi. Connect the dots: Tighter discrete approximations of privacy loss distributions, 2022. URL hetps:
04380
11

---

Published as a conference paper at ICLR 2026
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang. Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXhv:240.217783, 2024.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Proceedings of the Third Conference on Theory of Cryptography, TCC'06, pp. 265-284, Berlin, Heidelberg, 2006. Springer- Verlag. ISBN 3540327312. doi: 10. 1007/11681877 14.
Arun Ganesh, Brendan McMahan, Milad Nasr, Thomas Steinke, and Abhradeep Thakurta. Hush! protecting secrets during model training: An indistinguishabiiity approach, 2025. URL https:
//axxv..or//ab// 00201
Jesse Harte, Wouter Zorgdrager, Panos Louridas, Asterios Katsifodimos, Dietmar Jannach, and Mar- ios Fragkoulis. Leveraging large language models for sequential recommendationn. In Proceed- ings of the 17th ACM Conference on Recommender Systems, RecSys '23, pp. 1096-1102, ACM, September 2023. doi: 10.1 10.1145756049153331066999
URL http: dei org/ 1145/
0804915.3610633
Jamie Hayes, Saeed Mahloujifar, and Borja Balle. Bounding training data reconstruction in dp-sgd, 2023. hRLL/ttts////xxv..oom
07225
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium, 2018. URL
https:
/ttpas///aavvv..oo www.wiwwwwwaaaaaaaaaaaaaaaaa abs wttp://rrgbbbb/////r/o 08500
Charlie Hou, Mei- Yu Wang, Yige Zhu, Daniel Lazar, and Giulia Fanti. Private federated learning using preference-optimizeed synthetic
synhheii data. Forty-second International Conference on Machine Learning. 2025. URt/https: htt.tppp:///peeeeeeeee..eeeee wow.eee//ooommmmeee 2uaU222222
Inc. Yelp. Yelp Open Dataset, 2015. URL UBLL
Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chap- lot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William Sayed. Mistral 7b, 2023. URL https:
flaxxiv.rrg/bbbe /tt.g//bb//31...... 06825
Daniel Levy, Ziteng Sun, Kareem Amin, Satyen Kale, Alex Kulesza, Mehryar Mohri, and Ananda Theertha Suresh. Learning with user-level privacy, 2021. URL httpss://arxiv.
org/ htg//bb//ae 2102. 11845
Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, Harsha Nori, and Sergey Yekhanin. Differentially private synthetic data via foundation model apis 1: Images, 2025. URL httpp::/arxiv.
orq/abs/ 2305. 15560
Yinhan Liu, Myle Out, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach, 2019. URL
Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella- Béguelin. Analyzing leakage of personally identifiable information in language models, 2023.
URL
20533
Sankha Subhra Mukherjee, Jiawei Yu, Yida Won, Mary McClay, Lu Wang, A John Rush, and Joydeep Sarkar. Natural language processing- quantification of the mental state of psychiatric patients. Computational Psychiatry, 4:76-106, 2020. URL https://api.
semanticscholas htt.://l......rooooooooaaa222200
OpenAI. Hello gpt-4o, 2024. URL htt.h:::p://ppeaii.com 1ttp:///hoologgoo4o001000
12

---

Published as a conference paper at ICLR 2026
Qwen, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang, Le Yu, Mei Li, Mingfeng Xue, Pei Zhang, Qin Zhu, Rui Men, Runji Lin, Tianhao Li, Tianyi Tang, Tingyu Xia, Xingzhang Ren, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yu Wan, Yugiong Liu, Zeyu Cui, Zhenru Zhang, and Zihan Qiu. Qwen2.5 technical report, 2025. URL https: www.aaxiivvvooo org/ abs 22122412.2222 15115
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language Models are Unsupervised Multitask Learners. OpenAl blog, 18))9, 2019.
Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert- networks, 2019. URL sttttp://axxxv.oogg//aa
Weiyan Shi, Aiqi Cui, Evan Li, Ruoxi Jia, and Zhou Yu. Selective differential privacy for language modeling, 2022. URL
Bowen Tan, Zheng Xu, Eric Xing, Zhiting Hu, and Shanshan Wu. Synthesizing privacy preserving text data via finetuning *without* finetuning billion-scale LLMs. In Forty-second International Conference on Machine Learning, 2025. URL
net wwwp://ettfoommmm.//
FCm4 laCLi
Julia Turc, Ming-Wa Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Well-read students learn better: On the importance of pre-training compact models, 2019. URL httphtsss///axii.ooo abs/
1908. 08962
Leah Voytovich and Clayton Greenberg. Natural language processing: Practical applications in medicine and investigation of contextual autocomplete. In Victor E. Staartjes, Luca Regli, and Carlo Serra (eds.), Machine Learning Clinical Neuroscience, pp. 207-214 Cham, 2022. Springer International Publishing. ISBN -78-3-030-85292-4.
Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, Sang T. Truong, Simran Arora, Mantas Mazeika, Dan Hendrycks, Zinan Lin, Yu Cheng, Sanmi Koyejo, Dawn Song, and Bo Li. Decodingtrust: A comprehensive assessment of trustworthiness in gpt models, 2024. URL htttp::/aaxxi orgg/bs/ 2206 11698
Chulin Xie, Zinan Lin, Arturs Backurs, Sivakanth Gopi, Da Yu, Huseyin A Inan, Harsha Nori, Haotian Jiang, Huishuai Zhang, Yin Tat Lee, Bo Li, and Sergey Yekhanin. Differentially private synthetic data via foundation model apis 2: Text, 2024. URL https://axxv.or//////
0103.01740
Da Yu, Peter Kairouz, Sewoong Oh, and Zheng Xu. Privacy-preserving instructions for aligning large language models. In Forty-first International Conference on Machine Learning, 2024. URL
net/ forum? wtt.ummdddmuUiii200011
Xiang Yue, Huseyin Inan, Xuechen Li, Girish Kumar, Julia McAnallen, Hoda Shajari, Huan Sun, David Levitan, and Robert Sim. Synthetic text generation with differential privacy: A simple and practical recipe. Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 1321-1342, 2023.
Tianyuan Zou, Yang Liu, Peng Li, Yufei Xiong. Jianqing Zhang, Jingjing Liu, Xiaozhou Ye, Ouyang, and Ya-Qin Zhang. Contrastive private data synthesis via weighted multi-PLM fu- sion. In Forty-second International Conference on Machine Learning, 2025. URL https:
//openzeview.
13

---

Published as a conference paper at ICLR 2026
THE USE OF LARGE LANGUAGE MODELS (LLMS)
In this work, Large Language Models (LLMs) used solely as general-purpose assistive tools to help polish and improve the clarity of the writing. Authors take full responsibility for all content in the paper, including text that was refined using LLMs, and confirm that no part of the manuscript generated by LLMs constitutes plagiarism or scientific misconduct.
A LIMITATION
While clustering accelerates the pipeline, it abstracts away fine- sree-grrieed details, which can cause modest loss of utility in the non-private regime. Another open challenge is the formal definition of what constitutes secret and how to quantify its sensitivity. Future work will explore heterogeneous, secret-specific budgets and adaptive priors to further improve utility while maintaining protection. We also plan to extend SecPE image domains (with an appropriate formalization of "secrets" in that setting) and investigate secret-protected generators.
B SUPPLEMENTARY EXPERIMENTS
B. SIMULATION RESULT
To explicitly demonstrate how secret protection reduces the required noise relative to GDP, we con- sider toy setup with N 8000 records and 400 secrets. Each record contains each secret independently with probability Bernoulli(0.01). For a fair comparison, 1 in GDP is coupled to the (p, r) pair via μ + 1-1111111 p) Φ- rr) r)-
We report the noise ratio defined as O / (larger is better). In the left panel, we fix (N, (8000, 400) and vary the privacy budget r/p [2, 400]. In the right panel, fix r/p 10 and N = 8000, and vary the number of secrets yn E [100, 1000j. Across both settings, the noise required by rsecret protection is consistently smaller than that of μ-GDP.
4.05
ratio
noise ratio
4
4.00
3-
3.95
2
100
0.06
0.10
0.12
m/N
(a) Privacy budget
(b) Secret fraction
Figure 3: Noise ratio dCDP/ secre comparing (p, -s-erett protection with Gaussian DP. (a): N
8000, m 400, varying r/p. (b): N 8000, r/p 10, varying the number of secrets m.
B.2 VOTING DETAILS
Here we compare raw voting in Aug-PE with post-clustering votes SeePE. Figure shows the first three labels on Yelp. The synthetic samples receiving the highest vote mass are largely the same across both methods, indicating that the clustering preserves the key selections and is thus reasonable.
B.3 FID AND LENGTH
Figure presents the FID with respect to the OpenReview dataset for SecPE and Aug-PE under T/p E 10, 10, 50, oo), together with the synthetic sequence-lengte distributions the non-private SecPEgn compared against Aug-PE, using GPT-2 and Qwen-2.5-1.58 generators.
14

---

Published as a conference paper at ICLR 2026
2.5
Vating (raw)
Voting (raw)
3.0
Voting (raw)
(x100)
Vote (x10s)
2.0
(x110)
4.-
2.0-
1.0
1.0
0.0
0.0
Voting Iclustring)
Voting (clustring)
3.0-
Voting (clustring)
Voie Count (x=10
Vote (x104)
2.9
Vote Count (x109)
1.5-
2.0-
1.5
1.0
1.0
0.5
0.0
0.0
Figure 4: Voting distribution per label on Yelp. Top: raw votes from Aug-PE. Bottom: votes after clustering in SecPE.
GPT-2
Qwen-2.5-1.58
GPT-2
Owen-225-11.66
120
Aupit:
AugPt
2.5
Original Aug FE
Originl Aug PE
130
Sectt
SecPE
50
SecPEis
SecPEss
2.0
SccPEp
2.0
SecPEs
90
fe:
SwPfue
3.5-
66
30
Denstyy
1.0
1.0-
40
20
0.5
2000
3000
Sequence Length
Sequence Length
Figure 5: FID and sequence-length distributions on OpenReview.
Similarly, Figure 6 shows the FID with respect to the Yelp dataset for SecPE and Aug-PE under the same r/p settings, along with the sequence-length distributions of the non-private SecPEn00 compared against Aug-PE, PE, also using GPT-2 and Dw5n-225511.5B as generators.
50
GPT-2
50
Qwen-2.5-1.58
GPT-2
12
Qwen-2.5-1158
Augre
Aught
Driginal
Original
43
SecPEae
40
SexPE
Aug
Aug
30-
30-
Denoty
20
20
0.4
10
10
02-
400
600
800
200
400
600
800
r1p
Sequence Length
Sequence Length
Figure 6: FID and sequence-length distributions on Yelp.
B.4 APIS
Figure 7 shows the synthetic sequence-length distributions on Yelp for the non-private SecPE across different generator models. Among them, -istral-7B-Instruectt exhibits the largest devi- ation from the original distribution, which aligns with its inferior performance reported in table 6
B.5 SUPPLEMENTARY PII EXPERIMENT
We conducted an additional PII experiment on the Yelp dataset using a stronger PII detection tool from Microsoft, Presidio The new results in Table 9 show clear and substantial improvement,
15

---

Published as a conference paper at ICLR 2026
Original GPT 4o Mini
Original
Original
Orggnel
Limm33.1-89
Mittral 7B instructiw..3
Qwen2.5-77
Dersity (x10-3)
200
400
800
200
400
800
200
400
800
200
600
800
Sequence Length
Sequence Length
Sequence Length
Sequence Length
Figure 7: Synthetic sequence-length distributions across different generator models.
particularly under strong privacy settings (c.g., r/p 2 or r/p 10), confirming that SecPE remains effective when reliable secret detection available.
Table 9: Performance comparison of downstream tasks within PII on Yelp.
r/p
r/p =
r/p = 50
r/p =
LLM
Method
Category
Rating
Category
Rating
Category
Rating
Category
Rating
Aug-PE SecPFe00
71.72
55,80
72,54 74.38
63.34
74.15 75.40
66.92
75.14 75.34
67.04
GPT2
73.88
64.80
66.58
66.66
65.50
C ADDITIONAL THEORETICAL ANALYSIS
C.I FURTHER PROPERTIES AND RELATION TO DP
Theorem (Naive Composition). Suppose A1 D + R1 satisfy D x R, + R2 satisfy (p2, T2) protection. Define A: D - R, x R2 by
protection, A
A(D) (Ai(D), A2 (D),
Then A satisfies (p,r) secret protection such that, coordinate-wise,
max(p1, P2),
72-
Proof. From definition, fix any secret 8j. to ensure that both mechanisms Ar and A2 satisfy their respective (P1, r1) and (p2, r2) secrett protection guarantees, the prior distribution (D,....,Dy Dx) must satisfy:
(1) Pi,j, and x(1) S P2.j.
Vi E [K]
Therefore, to apply both guarantees simultaneously, we define the composed mechanism's 's prior bound as:
Pj max(P155 P2.),
so that any prior distribution satisfying (1) & Pj is valid for both mechanisms.
Let B : R₁ x R2 > [K] be any adversary attempting to identify the index from the output of A(D.). Define an intermediate adversary (y1) arg max, Pr(A, (D,) = vi) (a hypothetical adversary trying to recover i from only). By the assumption that Ai satisfies (pi, Pi, --seerett protection,
Pr A: [B((A = Ti.
Since A satisfies (p2, r2) -s)-ret protection, for each fixed yı, the success probability of identifying Hence:
i from A2(Ds, yn) is at most 72jj-
Pr [B(A2(Dr, vn). = (1))) + S r2. toom,
A
Thus, the total success probability any adversary satisfies:
Pr [B(A(D)) = < d Ai ioot,
Pr (D.) = i + Pr inm., A2
(D,, = Bi (v1) #
rij + r2.j
16

---

Published as a conference paper at ICLR 2026
Hence, the composed mechanism A satisfies (p. r) secret protection such that, coordinate-wist max(p1, P2), + P2-
Remark C.I. For every f > the following equivalence holds Dong et al. (2019) the mechanism p-GDP + (E,)(E))-DP for all 0,
where
8(E) 16 - eº a -----
_ 7
11
Setting = -1 - pÿ)
1b (1 - r links the (e, 6)-DP to (p., r2) -ecrett protection.
Consider the same setting Lemma 3.3 the neighboring datasets D1 D2 differ in exactly one element, specifically, 8, E d1 E D2 while 8y & 22 E D2. The following lemma establishes direct implication from (c, 6), to (p, r---rettt protection.
Lemma C.2. Any (t, 0)-DP mechanism A provides at least (p, r) --ecrel protection, where
rj 1 (ee 1/c) - 1-p Pj
+c. 8, Yc21
Proof. For any secret 8j, denote output distributions as:
Pi A(Di), P2:- :2:=A(1 A(D2)
and define the prior Pr(Dirain Dı] Pý. Pr(Durain D2) 1 P.. Let y A(Dimin) denote
output from A. By Bayes' rule, the posterior odds are:
Pr[Punin Dj y] Pr(y D D1) Pr D1) Pi(y) Pj
Pr[Duuin D2 yl Pr(y Dusin D2)
= D2ÿ) Pz(y) 1 1 Pj
Now partition the output space y' into two parts:
(v)
G E y::: log P2(y) Setty. U=
By the definition of ()-P), we have:
e (+() Pi(U) s P2(U))) + > {E))(( +
which implies (U) S 8/ (eett -e), P2(U) S 8/ (eett -f). For 2 1, let l In(n1 +
e--nee so that Pi (U), P2(U) c5. On the good region G, we have:
PrrDnn D1 y]
e _
Pý = PriDirin = D1 yl Sr²==
Pr(Drain D2 y]
1 1-p; Pj
1+ (e + 1/c)
I-Pa P5
Let denote the output distribution of A(Tarin), Pr(B(A(D.)) = a < / max (Pr[Dirain Dí v], Pr(Dumin D2 vl) dp(y)
We upper bound this by splitting the integral over and
J max(.) (.) du { max(.) du / max(.) (oxx(-))p du
<r*. + ((U) S r* c
Thus, A provides (Øi, r,) secret protection in expectation, where
rj 1+ (e + 1/c) 1 +c. 8, Ve 2 1.
For 0, letting - co, (e, DDP implies (p, secrett protection with
rj 1
I-2.
P3
17

---

Published as a conference paper at ICLR 2026
C.2 CONVERGENCE ANALYSIS
Definition C.3 (Per-round mis-selection rate). The per-round mis-selection rate is the worst-case (over private points) probability that the selection event fails at round t:
Pt
o sup Pr(-Sel((2) S.)
[0. 1].
Here the probability is over the algorithmic randomness at round é given St.
Claim C.A. Fix a point E D and some iteration Suppose 2' E S₁ is the closest point a,
V = VARIATION(=",, I.) {="}.
)- If 1|x - 2²11 2 then with probability at least (1 - pc) some
point in V will get noticeably closer to x: than 2", i.e.,
log L
min || =212 - EEV
||0 2" 112.
4d
Theorem 4. Assume that log L < d. With probability 2 - the non-private cluster-evolution algorithm outputs Soy with Wasserstein distance (D(Dpri Sam) S n after iterations. Vp [1, oo whenever
T
4
dllo((D/n) log(NNriv/7
(or more generally,
T E pt) >
Ad (d/r)
max, Pt.
log L
log
Proof. The proof of othertheorem C.4
C.4 and theorem follows directly from Theorem 1 in Lin et al. 2025). In the idealized (no mis-selection) case, T > 4 ddlog(D/n) + log Npnv//). Accounting for log
per-round mis-selections rate Pt weakens the contraction by a factor (1 - pt), which replaces T
with Ein m=m (1 pt),, or in the worst case, scales by 1/(1 max; Pr).
L
Theorem 5 (Secret Clustering). Let {C&] & {(ek, (()), denote the set of public cluster centers with corresponding cluster sizes. Every private vector is clipped as épri,i= Clip g( = Cpri,i min(1, R/ ppl., J. and then assigned to its nearest anchor; Let my denote the number of private points assigned to anchor ek. For every cluster k, we release the perturbed statistics:
ē = Thk Ck + Eiec, Epri,
+ Ek.
EK
2R
T& m
m2
i 72 + my + 7kk
17s ~ o2.
where a is chosen by Algorithm ! with T Then Algorithm 2 satisfies (p, (p,r))secue seccet protection.
Proof. Let Dsec denote the dataset containing the secret associated with secret 8, and let Pret
Dpri Donc. where
Diec := fx D Dpei 3 æ}. For any cluster k, suppose that is the number of private data containing that is as- signed to cluster k, then the distribution of ms P = A/(0, 02) for D'ri and Q == N/ 1(rgg min, d(é,, = k),
0²) for Dpui where
Σ D
aarg min d(e,, k)
Dawel:
and Deeel is distributed according to = Ex,eDin Bern(p.). Hence, invoking Lemma 4.5 of Choquette-Chie Choo et al. (2024), N (M, 0²) and (O) forms a dominating pair that bounds the blow-up function for P and Q. Similarly, for cluster center:
Ni. Ck Eiec. êpri,i ni + mmg
Liec, épri, ma
Ck
[isco (épri.i Ex)
Ek
+
m
Y& + m&
2R
2R
p
Ti + YT0k
Tkk
For each iteration, since the noise is calibrated to bound the blow-up function, Theorem 2 of (Hayes al. 2023) directly implies that the mechanism satisfies (p, rs-rret protection.
18


Reviews:
[{"review_id": "ImaG7BWHi0", "reviewer": "Reviewer_Gvyt", "summary": "The authors adapt private evolution to offer guarantees under the “secret-protection” framework, which is a recent DP relaxation proposed by (Ganesh et al., 2025). They introduce a clustering step with public data to improve efficiency of PE. They conduct experiments by instantiating the secret-protection framework by declaring random words as “secrets” and examples containing them to betray the secret, showing utility improvements over regular PE that provides uniform protection.", "questions": "- Secret protection is instantated by a (S,E,T) tuple (in the notation of Ganesh et al, 2025). In experiments, what is T?\n\n- Any intuitions about how the number of secrets and their choice affect the utility improvement of SecPE compared to PE? Is this entirely predicted by the computed noise and sampling parameters?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 4, "presentation": 2, "contribution": 2, "strengths": "- The topic is of high importance to the community. Secret protection is a promising DP relaxation that can potentially address many “type mismatches” between DP and the kind of sensitive data that companies own and want to extract value out of. Synthetic data via private evolution is one of the least resource- and expertise-intensive ways to get something out of your sensitive data. For these two reasons, finding a good design here will unlock a lot of useful practical applications.\n\n- The experiments demonstrating utility improvement of SecPE compared to PE, in the setting where the secret protection definition is instantiated by declaring PII or random words as “secrets” (with examples containing them considered to betray the secret), are well-executed and highly interesting.", "weaknesses": "- As secret protection is a relatively nascent privacy framework, I believe the authors could do more in terms of exposition in Section 3.1, as well as (1) give the specific instantiation of (S,E,T) (in the notation of (Ganesh et al., 2025)) that defines the neighboring relationship fundamental to applications of secret protection, and (2) describe how secret clustering relates to secret protection.\n\n  - Specifically, the authors give a relatively terse statement of the secret-protection definition. Lemma 3.2 proves GDP implies a particular instantiation of secret protection. Rather than focusing on this point, the main text would be better served to describe further the algorithmic changes to PE enabled by relaxation of the DP definition.\n\n- The core algorithmic tool for enabling the secret protection guarantee is from (Ganesh et al., 2025). Nothing particular PE under secret protection is introduced.\n\n- While authors report computational efficiency gains from SecPE, these gains feel misattributed. Reported speedup is in terms of improving pairwise similarity calculations. First, it is relatively unintuitive to me that the bottleneck is similarity computation, rather than iterative rewrites with a possibly expensive API model. Perhaps a FLOPs or memory analysis of the operation, compared to inference FLOPs and memory would shed some light here. Second, avoiding pairwise similarity computations seems orthogonal to SecPE, and there exist many simple and practical solutions to the problem for regular PE. For example:\n  - Using approximate nearest neighbours search over the index of synthetic examples (https://github.com/google-research/google-research/tree/master/scann).\n  - Clustering the synthetic data, and voting on clusters. Although not used in PE, this is employed in the highly-related work on private postprocessing (https://arxiv.org/abs/2402.13659), which can be viewed as half of one step of private evolution.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UTcQSRRciE", "reviewer": "Reviewer_ntT2", "summary": "This paper presents a novel Secret Protection Evolutionary framework (SecPE) for differentially private (DP) synthetic text generation. The work aims to address the issue of significant utility loss and high computational overhead associated with traditional DP methods in text generation. By introducing the concept of Secret-Protected Evolution\tas an alternative to uniform DP guarantees,  it achieves a better utility-privacy trade-off. In the theoretical part, the paper defines a (p, r)-secret protection criterion and establishes its connection to Gaussian DP. The experimental section validates the advantages of SecPE across several benchmark datasets (OpenReview, PubMed, Yelp), demonstrating reductions in Fréchet Inception Distance (FID), improved accuracy on downstream tasks, and decreased runtime.", "questions": "The manuscript employs the term \"operative point\" on multiple occasions without providing a formal definition.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1.This work proposes a (p,r)-secret protection framework and establishes its theoretical connection to Gaussian Differential Privacy (GDP), offering a new perspective for privacy-preserving research.\n2.The experimental design is comprehensive, and the validation is thorough.", "weaknesses": "1.The paper operates on the assumption that \"secrets\" can be predefined; however, in real-world scenarios, sensitive content is often dynamic and non-enumerable.\n2.The paper fails to analyze the impact of the cluster number K on the effectiveness (it only mentions \"insensitive\" but provides no ablation studies).\n3.The improvement on the PII task is relatively limited (Table 7), potentially due to high secret density diminishing the protection benefits. Further analysis on the impact of secret sparsity is required.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xENwbkrkz7", "reviewer": "Reviewer_Rcqb", "summary": "This paper proposes Secret-Protected Evolution (SecPE), a novel framework for generating synthetic text that addresses key limitations in existing privacy-preserving methods. The authors identify that standard Differential Privacy (DP), imposes a uniform privacy guarantee that over-protects non-sensitive data, leading to unnecessary utility loss. The paper provides a strong theoretical foundation, proving the pipeline satisfies (p, r)-secret protection. Empirically, evaluations on OpenReview, PubMed, and Yelp benchmarks show SecPE consistently outperforms a GDP-based baseline.", "questions": "(1) How can secrets be systematically defined and their priors quantified in real-world scenarios?\n\n(2) Could adaptive clustering mitigate the minor utility loss in non-private settings?\n\n(3) How does the framework compose over multiple data releases", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "Strengths include the novel and practical privacy formulation, some computational efficiency gains, comprehensive evaluation across multiple models and datasets", "weaknesses": "(1) The framework also relies on a clear definition of \"secrets\" and their prior probabilities (p), which is left somewhat ambiguous and could be a practical hurdle. \n\n(2) The presentation needs some improvement.   For example, the sentence on LIne 75-77 is not understandable.   The definitions needs some background knowledge, which is absent. \n\n(3) Finally, performance improvements are more modest when secrets are dense (as in a PII task), and the method's dependence on representative public data for clustering is not fully explored.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lw6Joz8Cej", "reviewer": "Reviewer_2rqM", "summary": "The paper proposes **Secret-Protected Evolution (SecPE)**, a novel framework for generating high-fidelity synthetic text under formal privacy constraints. Unlike traditional Differential Privacy (DP), which enforces uniform guarantees across all data points, SecPE introduces the concept of **Secret Protection**, focusing on safeguarding specific sensitive content (“secrets”) rather than entire records. The framework extends the Private Evolution (PE) paradigm and integrates a new **Secret Clustering** module, which leverages public data and limited noisy private updates to build secret-aware cluster centers for efficient selection. In the **Protected Evolution** phase, candidate synthetic texts are iteratively generated and selected based on similarity to these noisy representatives. Theoretical analysis shows that SecPE satisfies $(p, r)$-secret protection—a relaxation of Gaussian Differential Privacy (GDP)—and yields tighter utility–privacy trade-offs. Empirical results on **OpenReview**, **PubMed**, and **Yelp** datasets demonstrate that SecPE achieves lower FID, higher downstream accuracy, and significantly reduced computational cost compared to µ-GDP–based Aug-PE baselines.", "questions": "1. How sensitive is SecPE’s performance to the choice of secret prior probabilities \\(p_j\\)? Would a mis-specified prior significantly degrade the protection or utility?\n2. Could the authors discuss how SecPE scales when the number of secrets grows very large (e.g., thousands of potential sensitive attributes)?\n3. The authors mention that clustering abstracts away fine-grained details. Could this abstraction lead to mode collapse or reduced diversity in the generated synthetic data?\n4. In *user-level DP*, the protection unit is an **entire user’s data** (i.e., all records belonging to a user), whereas SecPE protects **individual secrets** regardless of user identity. Could SecPE be extended to user-level protection, or combined with it to achieve multi-granular privacy?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "### Strengths\n1. The paper introduces a **new privacy notion, (p, r)-secret protection**, that generalizes and relaxes Gaussian DP, offering a theoretically grounded yet more flexible privacy-utility balance.\n2. The proposed **SecPE algorithm** effectively combines secret-aware protection with the efficiency of K-means–based clustering, reducing computational complexity from $O(MN_{syn})$ to $O(KN_{syn})$.\n3. **Empirical results** on multiple datasets show consistent performance improvements, with SecPE achieving higher downstream accuracy and lower FID values compared to Aug-PE.\n4. The framework provides a **clear theoretical linkage** between secret protection and existing DP frameworks (DP, GDP), thereby establishing conceptual coherence.\n5. The experimental section is thorough, including analyses on efficiency, downstream accuracy, FID, and ablations over LLM size and clustering hyperparameters.\n\n### Quality\nThe paper is technically solid and theoretically well-founded. The connection between secret protection and Gaussian DP is clearly derived and mathematically consistent. The experimental evaluation is extensive and replicable. However, the lack of a real-world deployment or qualitative human evaluation of the generated text slightly limits the practical validation.\n\n## Clarity\nThe paper is **clearly written and well structured**, especially in the methodology section. Figures and algorithms (notably Algorithms 1–3) provide a good overview of the pipeline. However, some mathematical symbols (e.g., blow-up function and trade-off function) could be briefly explained when first introduced to enhance readability for non-privacy experts.\n\n### Significance\nSecPE represents a **notable conceptual advance** in privacy-preserving text generation, shifting from record-level to secret-level guarantees. Its relaxation of GDP could inspire a new line of research in secret-aware privacy mechanisms, potentially extending beyond text to multimodal settings. The method’s computational efficiency also makes it practical for real-world applications where DP-finetuning is infeasible.", "weaknesses": "### Weaknesses\n1. The paper would be strengthened by **a more comprehensive comparison with DP-finetuned LLMs**, which, while computationally costly, have been shown to perform competitively in private text synthesis.\n2. Although the paper reports improvements in synthetic quality, **SecPE’s performance on personally identifiable information (PII)** tasks shows only marginal gains. The method’s real-world effectiveness in dense secret scenarios therefore remains somewhat inconclusive.\n3. The definition of \"secret\" remains **qualitative and application-dependent**. The paper acknowledges this limitation but does not explore strategies for adaptive or data-driven secret detection beyond keyword-level identification.\n4. The **sensitivity of the algorithm to different clustering sizes (K)** and to varying prior parameters $(p, r)$ could be analyzed more rigorously, as these hyperparameters directly influence both privacy guarantees and utility.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)