STAMP: Selective Task-Aware Mechanism for Text Privacy

2026-03-12

AI Summary

This work addresses the challenge of balancing utility and privacy in text privacy preservation, where uniform noise addition often leads to suboptimal trade-offs. To this end, we propose STAMP, a novel framework that first jointly evaluates each token’s importance to downstream tasks and its privacy sensitivity, enabling task-aware, fine-grained privacy budget allocation. We further introduce a polar-coordinate perturbation mechanism that preserves the norm of embeddings while perturbing only their direction on the unit hypersphere, aligning privacy noise with the geometry of decoding. By integrating task-specific representations, sensitivity analysis, and cosine-based nearest-neighbor decoding, STAMP consistently outperforms existing methods across SQuAD, Yelp, and AG News benchmarks, achieving superior privacy-utility trade-offs under varying privacy budgets.

Technology Category

• Machine Learning: Privacy
• Natural Language Processing: Safety and Robustness
• Search and Optimization: Learning to Search

Application Category

• Security and Privacy: Privacy-enhancing technologies
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

We present STAMP (Selective Task-Aware Mechanism for Text Privacy), a new framework for task-aware text privatization that achieves an improved privacy-utility trade-off. STAMP selectively allocates privacy budgets across tokens by jointly considering (i) each token's importance to the downstream task (as measured via a task- or query-specific representation), and (ii) its privacy sensitivity (e.g., names, dates, identifiers). This token-level partitioning enables fine-grained, group-wise control over the level of noise applied to different parts of the input, balancing privacy protection with task relevance. To privatize individual token embeddings, we introduce the polar mechanism, which perturbs only the direction of embeddings on the unit sphere while preserving their magnitude. Decoding is performed via cosine nearest-neighbor search, aligning the perturbation geometry with the decoding geometry. Unlike isotropic noise mechanisms, the polar mechanism maintains semantic neighborhoods in the embedding space and better preserves downstream utility. Experimental evaluations on SQuAD, Yelp, and AG News datasets demonstrate that STAMP, when combined with the normalized polar mechanism, consistently achieves superior privacy-utility trade-offs across varying per-token privacy budgets.

Problem

• text privacy
• privacy-utility trade-off
• task-aware privatization
• differential privacy
• token-level privacy

Innovation

• task-aware privacy
• token-level privacy budgeting
• polar mechanism
• differential privacy
• embedding perturbation