A Collocation-based Method for Addressing Challenges in Word-level Metric Differential Privacy (2024)

Abstract: Applications of Differential Privacy (DP) in NLP must distinguish between the syntactic level on which a proposed mechanism operates, often taking the form of word-level or document-level privatization. Recently, several word-level Metric Differential Privacy approaches have been proposed, which rely on this generalized DP notion for operating in word embedding spaces. These approaches, however, often fail to produce semantically coherent textual outputs, and their application at the sentenceor document-level is only possible by a basic composition of word perturbations. In this work, we strive to address these challenges by operating between the word and sentence levels, namely with collocations. By perturbing n-grams rather than single words, we devise a method where composed privatized outputs have higher semantic coherence and variable length. This is accomplished by constructing an embedding model based on frequently occurring word groups, in which unigram words co-exist with biand trigram collocations. We evaluate our method in utility and privacy tests, which make a clear case for tokenization strategies beyond the word level.

heading: 1 Introduction
text: The study of Differential Privacy (DP) in Natural Language Processing has brought about a number of innovative approaches, ranging from text rewriting to private fine-tuning of language models (Hu et al., 2024). At the core of these approaches is the goal of providing a level of quantifiable privacy protection when text is shared or used for some downstream purpose. Among other advantages, leveraging DP allows for flexibility in choice of privacy level, governed by the privacy budget, or ε.
An early form of DP in NLP comes with the notion of word-level Metric Differential Privacy (MLDP), the goal of which is to allow for privacypreserving analysis on text documents by per-
forming word-level perturbations (Feyisetan et al., 2020). In essence, a word is obfuscated by adding random noise to its embedding, perturbing to a (possibly different) word, and then releasing this “privatized” word (Klymenko et al., 2022). Metric DP is ensured via the implementation of mechanisms which add calibrated noise to text representations. While other recent advances in DP NLP have shifted towards more complex language models, the simplicity and atomicity of word-level MLDP methods make a case for its further study.
Although these works show promising results in balancing privacy and utility in the MLDP setting, a number of challenges have also been highlighted (Klymenko et al., 2022). Firstly, the design of mechanisms raises challenges when the underlying spaces, e.g., word embeddings, are both vast (large vocabularies) and complex (high dimensional) (Feyisetan et al., 2021). Moreover, applying DP at the word level and composing these results for private text generation often results in texts with grammatical errors (Mattern et al., 2022). Beyond this, composed word-level MLDP will always lead to privatized documents with the same length as the input documents, diminishing privacy protections.
In this work, we aim to address these challenges by building upon the promise of MLDP mechanisms, but rather than rely on word-level perturbations, we extend these mechanisms to operate on the collocation-level, or more generally, the n-gram level. By specifically focusing on collocations, we hope to improve output text coherence, introduce generated length variability, and boost utility while also performing fewer overall perturbations, thus saving privacy budget. In particular, we are guided by the following research question:
Can collocations be leveraged to improve the function of word-level Metric Differential Privacy mechanisms, and what is the effect on privacy and utility?
39
We answer this question by designing a new approach for MDLP perturbations which leverages collocation embedding models in conjunction with two proposed collocation extraction algorithms. In our conducted utility and privacy tests, we show that this simple, yet meaningful augmentation leads to improved utility and comparable privacy under a number of privatization strategies. Concretely, the contributions of our work are as follows:
1. To the best of the authors’ knowledge, we are the first work to explore the use of collocations in the DP NLP space, most notably through the use of joint n-gram embedding models.
2. We demonstrate the effectiveness of using collocation-based embedding models as a basis for MLDP mechanisms, rather than previous word-level approaches.
3. We provide a blueprint for further improving MLDP mechanisms through the opensourcing of our collocation extraction algorithms and embedding models, found at https://github.com/sjmeis/CLMLDP.

heading: 2 Foundations

heading: 2.1 Differential Privacy
text: Differential Privacy (DP) (Dwork, 2006) provides mathematical privacy guarantees for individual’s data when their data undergoes algorithmic processing. Intuitively, it provides plausible deniability on the result about the source of input to an algorithm. An algorithm (or a mechanism) that is DP yields similar results irrespective of the inclusion of a single data record in the input dataset. These types of datasets that differ only in a single record are called adjacent or neighboring datasets.
Consider two adjacent datasets D and D′ differing only in a single record. A randomized mechanism M : Xm → O that takes a dataset D ∈ Xm and results in some output O ∈ O is called a (ε, δ)DP iff for all adjacent datasets D,D′ and ∀O ⊆ O, the following holds with ε ≥ 0 and δ ∈ [0, 1]:
P[M(D) ∈ O] ≤ eε · P[M(D′) ∈ O] + δ
The notion of adjacency of datasets defines the element protected by DP. If adjacent datasets D and D′ differ in one record, a DP mechanism provides plausible deniability about the inclusion or exclusion of a single record in the dataset. When the data records are collected at a central location
and then a DP mechanism is to be applied, the adjacency notion can be defined as aforementioned and it is called Global DP. However, if the data collector is not trusted and the DP mechanism is applied locally before the collection of data, the notion of adjacency is defined as any two data records; this is called Local DP (Duchi et al., 2013).
For natural language, the unstructured nature of data brings additional challenges regarding the notion of adjacent datasets (Klymenko et al., 2022). We consider a text consisting of n-gram tokens, and define the notion of adjacency as any two tokens following Feyisetan et al. (2020). Hence, an adversary cannot determine with high probability the source token of the privatized token.

heading: 2.2 Metric Differential Privacy (MDP)
text: For two finite sets X and Z and a distance metric d : X × X → R+ defined for the set X , a randomized mechanism M : X → Z satisfies metric differential privacy or εdX -privacy iff ∀x, x′ ∈ X and ∀z ∈ Z , this condition is satisfied with ε > 0:
P[M(x) = z] P[M(x′) = z] ≤ e εd(x,x′) (1)
Metric DP is a relaxation of DP where instead of considering the worst-case guarantees, the privacy guarantees scale according to the distance between adjacent datasets (Chatzikokolakis et al., 2013). This allows for greater utility and flexibility alongside a mathematical guarantee.

heading: 2.3 MDP for a Sentence
text: We assume a vocabulary set consisting of all the tokens in V , with the tokens as points in the embedding space. The embedding function Φ : V → Rd gives the position of the tokens in the space. Additionally, we assume that the space V is equipped with a distance metric dV : V×V → R+ that gives us the distance between two tokens w and w′ as
dV(w,w ′) = ||Φ(w)− Φ(w′)||2 (2)
If a mechanism M satisfies MDP for two tokens for ε > 0, it satisfies Equation 1 ∀w,w′ ∈ V , and thus, we have the following inequality:
P[M(w) = x] P[M(w′) = x] ≤ e ε·dV (w,w′) (3)
This guarantee can be extended to the whole sentence consisting of n tokens, i.e., s = w1 · w2 · · ·wn. Following Feyisetan et al. (2020), a token-level mechanism can be applied to each token independently and a privatized sentence can
be generated by concatenating these privatized tokens, i.e., z = x1 · x2 · · ·xn. If the distance function that takes sentences of the same token length D : Vn × Vn → R+ is defined as D =∑n
i=1 dV(wi, xi), the privacy guarantees of applying mechanism M to the sentence can be derived as follows:
P[M(s) = z] P[M(s′) = z] =
n∏
i=1
P[M(wi) = x] P[M(w′i) = x]
≤ n∏
i=1
exp ( ε · dV(wi, w′i) )
= exp ( ε · n∑
i=1
dV(wi, w ′ i)
)
= exp ( ε · D(s, s′) )
It should be noted that while we use the term “sentence” here, the above can be generalized to text “documents”.

heading: 2.4 The Theory of Collocations
text: In linguistics, collocations are defined as groupings of words that often appear together in language. More specifically, collocations are word groups (“multi-word expressions”) existing in the space between idioms and free word groups (McKeown and Radev, 2000), where the meaning of idioms cannot be understood by their individual words. Intuitively, collocations can be defined as groupings of words that appear in predictable patterns (good morning), without being as rigid as idioms (sleep like a baby) (McKeown and Radev, 2000).
An important concept is the Contextual Theory of Meaning of John Rupert Firth (Léon, 2005; Manning and Schutze, 1999), famously summarized by “a word is characterized by the company it keeps”. The meaning of a given collocation only takes form when viewing the group as a whole, and not by examining the meaning of each word individually.
Looking to the notion of differentially private text rewriting via the composition of word-level replacements, one may imagine that the theory of collocations sheds light on the potential pitfalls of isolated word substitutions. As highlighted by Mattern et al. (2022), word-level DP disregards context, which results in semantically disjoint replacements as well as frequent grammatical incongruities. In this light, we posit that collocations may improve both of these challenges, as collocations represent groups of words with bundled meaning, and within a collocation, proper grammar must be upheld.

heading: 3 Related Work

heading: 3.1 Word-level MLDP
text: While Fernandes et al. (2019) proposed an early implementation of metric DP, (Feyisetan et al., 2020) were the first to design a word-level MLDP mechanism for static word embeddings. Ensuing works aim to improve word-level methods through various means, including differing metrics (Xu et al., 2020), nearest neighbor mapping (Xu et al., 2021b; Meisenbacher et al., 2024a), or noise mechanism (Xu et al., 2021a; Carvalho et al., 2023). Other works focus on the selection of words to privatize (Yue et al., 2021; Chen et al., 2022).
We aim to build upon this body of work, while also addressing the known challenges of semantic coherence, grammatical correctness, and output text length variability. In particular, we tackle these challenges in the word-level MLDP setting by leveraging collocations and n-gram embeddings.

heading: 3.2 Collocation Extraction and Evaluation
text: Several computational approaches for automatic collocation extraction have been explored. Pecina (2005) surveys an extensive list of early collocation extraction methods, and later explores the combination of different metrics (Pecina and Schlesinger, 2006). Other works improve on classic association measures (Bouma, 2010; Brezina et al., 2015), and more recent work has focused on evaluating endto-end solutions (Bhalla and Klimcikova, 2019; Espinosa Anke et al., 2021). More on the theoretical underpinnings and our motivation for the use of collocations can be found in Section 4.

heading: 3.3 N-gram Embeddings
text: Extending static embedding models beyond the word level often takes the form of n-gram embeddings or phrase embeddings (Poliak et al., 2017; Yin and Schütze, 2014). Works have explored different methods of embedding n-grams, notably the use of Pointwise Mutual Information (PMI) (Zhao et al., 2017) or BERT-based models for more contextual phrase embeddings (Wang et al., 2021).
In a study of n-gram embeddings, Gupta et al. (2019) find that the joint training process improves the quality of single-word embeddings. In other works, it is shown that n-gram embeddings can improve a variety of NLP tasks Bai et al. (2018); Zhang et al. (2014); Yin and Schütze (2015).
With these works as motivation, we investigate whether n-gram embeddings can serve to improve
DP text privatization approaches previously relying on word embeddings. In particular, we explore the usefulness of embedding collocations as the underlying embedding model of MLDP mechanisms.

heading: 4 A Collocation-based MLDP Method
text: In this section, we describe our proposed method, which differs from word-level MLDP methods in that it sets the underlying metric space to that of a jointly trained model of unigrams, bigram collocations, and trigram collocations. We outline a method to extract collocations, the training of the abovementioned embedding model, and the augmentation of existing MLDP mechanisms.

heading: 4.1 Extracting Collocations
text: The first challenge of dealing with collocations is the reliable extraction of meaningful multi-word expressions that uphold the definition of a collocation. Several methods have been proposed by the literature, ranging from simple frequencybased approaches, methods looking at syntactic co-occurrences, to hypothesis testing methods or association measures such as mutual information (Evert, 2009; Manning and Schutze, 1999).
In this work, we focus on the extraction of bigram and trigram collocations via the use of Pointwise Mutual Information (PMI) (Church and Hanks, 1990). Essentially, PMI indicates how much one point (word) tells us about another. In other words, if the presence of one word decreases the uncertainty of the presence of another word, these two words have a high PMI. In the case of bigrams, two words x and y have a PMI as follows:
PMI(x, y) = log2 P (x|y) P (x) = log2 P (y|x) P (y) (4)
Given a corpus of N words, we can empirically measure the bigram PMI of xy as defined in Equation 4 by the following:
PMI(x, y) = log2 N · c(xy) c(x) · c(y) (5)
Note that in Equation 5, the order of the unigrams matters, and c denotes the raw frequency count of a given unigram or bigram. For trigram collocations, a simple modification can be made:
PMI(x, y, z) = log2 N2 · c(xyz)
c(x) · c(y) · c(z) (6)

heading: 4.1.1 Empirical Collocations
text: For the extraction of empirical collocations (Evert, 2009), i.e., those that can be derived via empirical means, we measure the PMI of bigrams and trigrams from a selected random sample of 2.5 million texts of the publicly available large-scale text corpus C4 (Colossal Cleaned Common Crawl) (Raffel et al., 2020). After counting the frequency of all unigrams, bigrams, and trigrams, we calculate the bigram and trigram PMI values using Equations 5 and 6, respectively. We filter the results for all values with a PMI score of 2.0 or higher and not containing any English connector words (e.g., a, an, the, and, or, etc.)1. This process results in a set of 3.02 million bigrams and 1.31 million trigrams2.

heading: 4.1.2 Collocation-level Tokenization
text: We design an extraction algorithm that will tokenize a given input text into its unigram, bigram, and trigram counterparts based upon the empirically derived PMI scores of the collocations. To do this, we define two scoring methods (pseudocode found in Appendix Algorithms 1 and 2):
• Greedy Sequential Tokenization (GST): a text is tokenized greedily by processing the tokens in order, with trigrams being prioritized. This is described in Algorithm 1.
• Max Score Tokenization (MST): a text is tokenized in a way that maximizes the overall PMI score of the resulting tokenized text. This is described in Algorithm 2.
1As defined by the Python GENSIM package. 2Can be found in the data folder of our code repository.
Algorithm 1 Greedy Sequential Tokenization (GST)
Require: scored bigrams B, scored trigrams T , input text tkns← word_tokenize(text) bigram_cands← get_bigrams(tkns).intersect(B) trigram_cands← get_trigrams(tkns).intersect(T ) n← length(tkns) output← [] for idx ∈ 1...n do
cand← trigram_cands.find(tkns[idx : idx+ 2]) if !cand then
cand← bigram_cands.find(tkns[idx : idx+ 1]) end if if !cand then
output.append(text[idx]) ▷ unigram else
output.append(cand) end if bigram_cands.delete(cand) trigram_cands.delete(cand) if cand ∈ B then ▷ advance to next unmatched word
idx += 2 else
idx += 3 end if
end for return output
Algorithm 2 Max Score Tokenization (MST)
Require: scored bigrams B, scored trigrams T , input text unigrams← word_tokenize(text) bigram_cands← get_bigrams(text).intersect(B) trigram_cands← get_trigrams(text).intersect(T ) cands ← sorted(unigrams + bigram_cands + trigram_cands) n← length(cands) matched← [] output← [] for idx ∈ 1...n do
if all(cands.tokens !∈ matched) then output.append(cand[idx]) matched.add(cands.tokens)
end if end for return output
GST and MST output a list of “tokens”, which can be either unigrams, bigram collocations, or trigram collocations. In its application, we tokenize documents at the sentence-level, so as not to detect collocations across sentence boundaries. Note that this method can be extended to an arbitrary n-gram level. As a result, there are collocation tokens less than or equal to the number of word tokens.

heading: 4.2 A Collocation Embedding Space
text: We train an embedding model in which unigram words, bigram collocations, and trigram collocations co-exist in a single embedding space. In particular, we train a 300-dimension WORD2VEC model (Mikolov et al., 2013) using the GENSIM
package (Řehůřek and Sojka, 2010). To train the model, we leverage a large subset of the C4 Corpus, namely 250 million text samples, or roughly 500GB. As inputs to the GENSIM trainer, we give the text samples as tokenized by our two algorithms, namely GST and MST, thus resulting in two trained embedding models. The models were trained on a six-core Intel Xeon CPU, with the entire training process (extraction + embedding) taking roughly 90 hours per model. These models are made available in our code repository.

heading: 4.3 Augmenting MLDP Mechanisms
text: With the two collocation embedding models, we can now make a simple augmentation to existing word-level MLDP mechanisms. As these mechanisms typically operate on strictly word (unigram) spaces, we first swap out these models with our trained embedding models. Then, inputs to the mechanisms are tokenized by our collocation extraction algorithms, rather than word tokenization.
The returned tokens can be of word length 1-3. However, the MLDP privacy guarantees are not affected, as the embedding space consists of these variable word-length tokens. Hence, the mechanisms can operate as usual, with the outputs being perturbed uni-, bi-, or trigrams. Mathematically, the privacy guarantees for any tokens w,w′ in our embedding space remain as defined in Section 2.3.

heading: 5 Experimental Setup and Results
text: In our experiments to test our collocation-based method, we focus on evaluating the effect that can be observed by using collocations rather than pure words. In particular, we perform a two-part evaluation: utility experiments and privacy experiments.

heading: 5.1 Mechanism Selection
text: We center our evaluation around the fundamental MLDP mechanism proposed by Feyisetan et al. (2020), often referred to as MADLIB (Algorithm 3), which typically operates on word embeddings in Euclidean space by adding calibrated multivariate noise. Our goal is to experiment using this mechanism across a range of ε values, with the hopes of generalizing to mechanisms that build on top of MADLIB. Specifically, we choose the values ε ∈ {0.1, 0.5, 1, 5, 10, 15, 25, 50}.

heading: 5.2 Utility Experiments
text: Our utility experiments follow the example set by several previous DP NLP works (Mattern et al.,
Algorithm 3 MADLIB (Feyisetan et al., 2020)
Require: String x = w1w2 . . . wn, privacy parameter ϵ > 0, word setW , embedding function φ Ensure: Privatized string x̂ for i ∈ {1, . . . , n} do
Compute embedding φi = φ(wi) Perturb embedding to obtain φ̂i = φi +N with noise density pN (z) ∝ exp(−ϵ∥z∥) Obtain perturbed word ŵi = argminu∈W |φ(u)− φ̂i| Insert ŵi in ith position of x̂
end for return x̂
2022; Utpala et al., 2023; Igamberdiev and Habernal, 2023), that is to evaluate how well DP generated text can preserve the original utility of the dataset. In particular, texts that are generated by a mechanism are compared against a non-privatized baseline, and the utility (loss) is measured.
To ensure a greater practical relevance, we perform utility experiments for our chosen mechanism at a document level, where privatized documents are achieved via the composition of token-level perturbations. For this, we set a dataset specific privacy budget, where our “base” ε values introduced above are scaled by the average word length of each dataset. Thus, each text is perturbed with an overall budget of ε ∗ avg_word_len(dataset). This ensures that all texts, regardless of length, are offered the same privacy guarantee.
We note here that in this budget calculation, our goal is to provide an equal guarantee for each document to be privatized. However, we do not take into account the effect of the distance function in the Metric DP guarantee; thus, the document level budget is calculated according to pure DP composition, namely with basic composition of ε values.
We evaluate five privatization strategies, which are described below and illustrated in Figure 1:
1. Non-private: no DP is applied to a given text. 2. Word-level (S1): a text is tokenized by word,
and the document budget is distributed evenly to each word to be perturbed. For embeddings, we use WORD2VEC-GOOGLE-NEWS3003. Since this model contains three billion tokens, we filter the vocabulary down to that of the DEBERTA-V3-BASE (see next section). In S1, stopwords are not privatized.
3. Collocation-level, word-level guarantee (S2): a text is tokenized using our GST collocation extraction algorithm, but each resulting
3https://code.google.com/archive/p/word2vec/
token is given the same budget as in the wordlevel scenario (see Figure 1).
4. Collocation-level (GST) (S3): a text is tokenized by GST, and the document budget is distributed evenly to all resulting collocations.
5. Collocation-level (MST) (S4): same as above, but with the MST algorithm.
Thus, for each given input text, we receive five resulting outputs: the original (baseline) text and four privatized variants. These serve as the basis for our utility (and privacy) experiments.

heading: 5.3 Training and Evaluation
text: Datasets To measure utility, we choose four datasets from the GLUE benchmark (Wang et al., 2018), a standard benchmark representing a variety of language understanding tasks. Specifically, we utilize the COLA, MRPC, RTE, and SST2 datasets. ForSST2, we use a 10k random sample.
We first perturb each dataset according to the strategies outlined above. Note that we privatize both the train and validation sets, as this presents the strictest test of utility preservation in which all data is perturbed. For datasets with two sentences (RTE, MRPC), we only perturb the first sentence.
Model Training The preservation of utility is measured by fine-tuning a language model on all dataset variants (i.e., baseline or perturbed), and measuring the effect on utility. For this, we finetune all datasets on a DEBERTA-V3-BASE model with input size of 256, for one epoch and otherwise default HuggingFace Trainer parameters. All training is performed on one NVIDIA A6000 GPU. For stability in the results, we run each training procedure three times on different random shuffles of the data, reporting the average metrics of all runs.
Metrics We report the (micro) F1 score of all trained models on the validation sets. This metric aims to capture the effect of privatization on the ability for a model with good utility to be trained.
In addition, we report the cosine similarity (CS) between each (original, private) dataset pair. This metric can be used to measure the degree to which semantic similarity is preserved in perturbation (Meisenbacher et al., 2024b). For this, we utilize the SENTENCE-TRANSFORMERS/ALL-MINILML6-V2 model (Reimers and Gurevych, 2019).
We also use perplexity to measure the semantic coherence privatized texts. As perplexity aims to
measure the ability of a language model to predict a given text, a better (lower) perplexity would imply a text is more “natural” or “predictable”. Although this metric has been used in recent DP NLP works (Yue et al., 2023; Singh et al., 2024), its use directly on privatized texts has not been explored widely with the exception of Weggenmann et al. (2022). We report average perplexity (AP) of all sequences in a dataset, using GPT-2 (Radford et al., 2019).

heading: 5.4 Privacy Experiments
text: Our privacy experiments take the form of empirical privacy measurement, where we use two tasks as proxies for privacy preservation, which also allow for measures of relative gain (discussed below):
1. Yelp Reviews (Zhang et al., 2015): we utilize the same dataset used by Utpala et al. (2023), which contains a subset of reviews authored by 10 frequent reviewers. From this, we model an authorship identification task. We take a random subset of 10k rows.
2. Trustpilot Reviews (Hovy et al., 2015): each review includes the gender of the original reviewer (M/F). This creates an gender identification task, for which we use a 10k sample.
As with the utility experiments, all texts in the two datasets are privatized according to the five perturbation strategies. The resulting datasets are then divided into a 90-10 train-validation split4.
Evaluation Both datasets are labeled for sentiment (positive/negative), allowing for a binary classification task, which is carried out in a similar manner as the utility experiments. Macro F1 is reported, as the labels are positive-biased.
Next, empirical privacy is measured. To do this, an adversarial classifier is trained to predict the sensitive attribute (author ID or gender) given the corresponding text. We use the same DEBERTA-V3BASE fine-tuning process for the creation of this classifier. For evaluation, we follow two adversarial archetypes as proposed in the recent literature (Mattern et al., 2022; Utpala et al., 2023): the static and adaptive attackers. The static attacker is only able to train on the non-privatized train split and must evaluate on privatized validation splits. The adaptive attacker, a much more capable adversary, is able to train on the privatized train splits.
4A random seed of 42 is used throughout this work.
For adversarial performance, we report macro F1 scores. Using both the utility and privacy measurements, we calculate the relative gain (RG) of privatization (Mattern et al., 2022), namely whether the gains in privacy outweigh potential losses in utility. This metric is given by the following formula, where Pp, Up, Po, Uo are the measured privacy (P) and utility (U) scores of the privatized (p) or original (o) data: RG = (Up/Uo)− (Pp/Po).

heading: 5.5 Results
text: The results of the utility experiments are given in Tables 1, 2, and 3, and are illustrated in Figure 2, whereas the privacy results are shown in Table 4.

heading: 6 Discussion
text: Utility Analysis An analysis of the results begins with the strong utility performance of collocationbased perturbation strategies across all tested datasets and ε values. This effect is especially
prominent in the SST2 and MRPC tasks. Interestingly, the RTE task presents a challenge for all tested strategies, implying that entailment tasks are more difficult with privatized texts. Nevertheless, the utility loss is dampened with collocation-based methods, particularly at ε ≥ 1 (Figure 2).
Another intriguing finding comes with the COLA results, where all strategies struggle to enable any sort of “true learning” until the ε = 10 threshold. Upon reflection, this particular task may represent the toughest of utility tasks, as the ability to determine the acceptability of a given text becomes extremely challenging post-perturbation. Nevertheless, as opposed to S1 (word-level) perturbation, which can never break the worst-case (majority voting) performance, both S2 and S3 are successful in doing this for higher ε values. One can attribute this to the fact that collocation-based perturbation will still preserve traces of semantic coherence, which is crucial for the COLA task.
Surprisingly, MST performs poorly in terms of utility as compared to GST. While the exact reason for this would require an in-depth study, we posit that two takeaways can be learned: (1) maximizing PMI might not necessarily be ideal in any case and especially for privatization, and (2) the use of PMI itself may introduce issues, due to the limitations of a frequency-based association measure.
Budget Distribution An important discussion arises out of the comparative performance demonstrated by S2 and S3/4. Despite being granted on average a (much) stricter privacy budget, S2 perturbations manage to show strong performance across all tasks, having the highest score in 5 experiment scenarios and otherwise competitive scores. In essence, texts perturbed via S2 hold tighter document-level privacy guarantees than S3/4, yet they are still able to preserve utility better on average than the pure word-level perturbations of S1.
Based on these findings, we hold that further work should be afforded to investigate best practices with budget allocation, including that beyond simple “uniform” allocation given a document budget. This becomes more interesting (and potentially complex) with collocations rather than words.
Beyond F1: Similarity and Perplexity The CS and AP metrics also tell an interesting story. On average, collocation-based perturbations always result in privatized texts with higher semantic similarity, even at lower ε values. The strength of collocations is particularly made clear at higher ε values, where the gap is quite large. In contrast, the perplexity metric is split based on ε value: at lower values, word-level perturbations (S1) achieve better scores, whereas at higher scores, S3 prevails. This
disparity is insightful, prompting the further study of metric-based evaluations in privacy-preserving NLP. Qualitatively, one can argue that collocationbased perturbations produce much more coherent and readable texts, as showcased in Appendix A.
The Effect on Privacy Analyzing the empirical privacy results also brings insights. As opposed to the disparity in perplexity measurement, a reverse trend can be observed with empirical privacy. At lower ε values, collocation-based perturbations achieve comparable or better privatization against adversaries, whereas this advantage begins to favor word-level approaches at higher privacy budgets. However, the strength of word-level approaches at higher budgets comes with the cost of severely limited utility, as shown by both tasks.
The relative gain results show that in none of the tested scenarios, a positive gain can be observed using word-level perturbations. This comes in contrast to strategies S2-4, which often show positive gains, and achieve the highest relative gain in all but one scenario. These results are promising in the way that MLDP mechanisms can be made practically feasible when leveraging collocations.
As a final analysis, we observe that collocation embedding models enable greater diversity in privatization outputs. Taking the vocabulary of DEBERTA-V3-BASE (128k tokens), we discover that while only 68,544 unigram tokens from our GST model exist in the vocabulary, 1,248,304 tokens from the model match the vocabulary, i.e., where every word exists in the vocabulary. This allows for a wider search space, thus presumably reducing cases where a token is perturbed to itself.
Replication on Other Mechanisms We replicate the SST2 utility experiments on two other MLDP mechanisms, the Mahalanobis Mechanism (Xu et al., 2020) and the Vickrey Mechanism (Xu et al., 2021b). These results are shown in Tables 5 and 6. The results mirror those described in this work, albeit with an interesting anomaly observed with the Vickrey Mechanism at lower ε values. We perform this extra analysis as a first step towards generalizing our results to all MLDP mechanisms, in order to investigate the advantages of multi-word rather than single word DP perturbations.

heading: 7 Conclusion
text: In this work, we present an alternative to wordlevel Metric Differential Privacy, which differs in
the way that we tokenize and privatize sensitive input texts on the collocation level. We provide two collocation extraction algorithms and their corresponding trained embedding models, showing how word-level MLDP mechanisms can be simply augmented to operate on this higher syntactic level. In our evaluation, we demonstrate the merits of such augmentation, achieving a balance between improved utility, higher semantic coherence, and comparable privacy preservation.
The results provide researchers with two overarching insights. Using collocations, given the same overall budget for a document, we can achieve higher utility while still preserving privacy. At the same time, given the same per-token budget, perturbing collocations often outperforms word-byword privatization. Thus, we make the case that further studies in the field of DP NLP should consider investigating linguistic units outside of the standard word- or sentence-/document-level.
The main limitations of our study come with our reliance on one particular measure for collocation extraction, namely PMI. In addition, we focus on validating our method for the MADLIB mechanism, but do not perform extensive testing on more recent methods. Finally, we base our results on the selected datasets for utility and privacy, whereas this would be well-served to be more extensively tested. As such, we propose the following paths for future work: (1) a focus on collocations and their reliable extraction for DP applications, (2) further work on validating the merits of privatization between the word and sentence level, and (3) deeper investigations into the rigorous evaluation of DP text privatization, with an emphasis on metrics.

heading: Acknowledgments
text: The authors would like to thank the anonymous reviewers for their time and feedback and Alexandra Klymenko for her valuable contributions.
Limitations
The main limitations regarding our experimental setup include the use of only one metric for automatic collocation extraction. In addition, we do not clean or filter the outputs of the collocation extraction process, outside of our set threshold of PMI ≥ 2. The effect of performing extra cleaning steps, or by using entirely different collocation extraction methods, remains a point for future work.
Another point is the limited testing in terms of MLDP mechanisms. We decided to test extensively on one mechanism (MADLIB) rather than conduct more limited tests on a variety of mechanisms. Although we provide initial insights into the effect on other mechanisms, further testing is needed.
Finally, we acknowledge the distinction between measured results of empirical privacy versus true privacy preservation, and although the former is a good proxy for the latter, there is still work to be done regarding the nature of privacy in textual data.

heading: A Appendix
text: Collocation Examples Table 7 presents a sample of six randomly selected tokens from our GSTextracted collocation embedding model, as well as the five nearest neighbors in the space. Note that for any given token, a nearest neighbor need not be the same “length” token, i.e., a unigram’s nearest neighbor may include bigrams or trigrams.
Document-level Budgets As described in Section 5.2, to utilize our selected “base” ε values, we scale the privacy budget allotted to each tested dataset. In Table 8, we tabulate all document budgets, which are calculated by multiplying the average words per text by the base ε values.
Examples Table 9 shows selected privatization outputs from two datasets using MADLIB with the privatization strategies S1-4. For readability, we strip sentence punctuation marks, and we select five ε values for illustration. Some inappropriate words have been redacted.

heading: Future Work
text: The effect of performing extra cleaning steps, or by using entirely different collocation extraction methods, remains a point for future work. Another point is the limited testing in terms of MLDP mechanisms. We decided to test extensively on one mechanism (MADLIB) rather than conduct more limited tests on a variety of mechanisms. Although we provide initial insights into the effect on other mechanisms, further testing is needed. Finally, we acknowledge the distinction between measured results of empirical privacy versus true privacy preservation, and although the former is a good proxy for the latter, there is still work to be done regarding the nature of privacy in textual data