QuanText: Protecting Dataset-Level Secrets in Textual Data Sharing Shuaiqi Wang∗ , Zinan Lin† , and Giulia Fanti∗ ∗ Carnegie Mellon University
† Microsoft Research
arXiv:2609.17995v1 [cs.LG] 16 Sep 2026
{shuaiqiw,gfanti}@andrew.cmu.edu
Abstract—Natural-language datasets support many downstream applications and research studies. However, released text can reveal sensitive global properties of the data source, such as the proportion of records associated with a particular gender, diagnosis, or political stance. Existing work has largely focused on property inference attacks that recover such global properties, while defenses for protecting these dataset-level secrets remain limited. Differential privacy, though effective for protecting individual records, provides only weak protection for aggregate properties. In this work, we propose Randomized Quantization for Text (QuanText), a training-free and large-language-modelagnostic data release mechanism that protects global secrets in textual datasets while preserving data utility. Given a function of the dataset that represents the secret in question (e.g. proportion of diabetics) and attributes over which the data holder wants to retain utility (e.g., topic and sentiment), QuanText distorts the distribution of the secret quantity and the distributions of correlated attributes by (i) constructing a set of candidate release distributions over attributes (both secret and non-secret), (ii) randomly selecting a distribution that is sufficiently close to the (private) empirical distribution, and (iii) rewriting each private text sample to match the chosen attribute distribution using attribute-related snippets from the original text. QuanText is inspired by the Statistic Maximal Leakage (SML) framework, which bounds leakage about a secret function of a data distribution. We show that under ideal conditions, QuanText theoretically satisfies an SML guarantee. Since these ideal conditions may not hold in practice, experiments on real-world datasets demonstrate that QuanText achieves a better empirical privacy–utility tradeoff than competing data generation baselines. The code for QuanText is available at https://github.com/wsqwsq/QuanText. Index Terms—Dataset-level privacy, data sharing, Statistic Maximal Leakage, Randomized Quantization.
I. I NTRODUCTION Natural-language datasets are important for both practical applications and academic research [1], [2]. However, their release also raises significant privacy concerns. Beyond the leakage of sensitive information from individual samples [3], [4], a released dataset may reveal sensitive global properties [5]–[7], such as the proportions of samples associated with certain attribute categories. For example, in medical records or patient–doctor dialogues [8], even after individual identifiers have been removed, the released corpus may expose the fraction of female patients or the prevalence of specific diagnostic categories, revealing sensitive population-level demographic or health information. Similarly, in social-media datasets [9], released text may reveal politically sensitive aggregate information, such as the proportion of posts supporting a controversial topic. Protecting such dataset-level properties
can be important for textual data sharing, while the released data should still preserve realistic semantics to remain useful (Fig. 1). Original data
Data holder
Released data
Attacker
Patient-doctor dialogues
I want to hide the fraction of patients with disease 𝑮
What data release mechanism should we use?
Guess the fraction of patients with disease 𝑮
Fig. 1: Textual data sharing can reveal sensitive global properties, such as the proportion of patients with a certain disease. We aim to design a data release mechanism that protects such global secrets while preserving the utility of released text. Several studies have proposed property inference attacks that infer global properties of released data or of the generative models used in the release process [5], [6], [10], [11]. However, comparatively few works focus on defenses that protect such sensitive global properties [10]. Prior studies have shown that differential privacy (DP), while effective for protecting individual samples, can be insufficient for protecting aggregate properties [12]–[15]. Intuitively, DP perturbs individual samples independently, but because the added noise is typically zero-mean, its effects largely cancel out in aggregate, leaving the proportions of the sensitive attribute categories close to their original values. [10] proposes a simple defense that distorts the secret values in released data in the vision setting. However, this approach remains insufficient when other attributes in the dataset are correlated with the secret, since attackers can exploit these correlations to recover the sensitive global property. Designing defenses in textual settings is similarly challenging: first, a single attribute may be expressed across multiple parts of a text; second, textual attributes are often highly correlated, allowing attackers to recover the global secret from seemingly non-sensitive words, phrases, or semantic cues. To this end, we propose Randomized Quantization for Text (QuanText), a training-free and large-language-model-agnostic data release mechanism that protects global secret proportions of a dataset while limiting leakage through correlated attributes and preserving the utility of released data. At a high level, QuanText proceeds in three stages. (i) First, QuanText efficiently constructs a set of candidate release distributions over
the specified attribute types the data holder wants to retain utility on. For example, a user with a dataset of tweets may wish to preserve the distributions of topics and sentiments, both of which may be correlated with the target secret: the proportion of tweets favoring a particular political stance. Since directly releasing the private data (or even the distribution of these attributes) may leak the secret through their correlations, QuanText instead builds alternative candidate distributions with different secret and correlated-attribute marginal distributions. In our example, each candidate distribution specifies a joint distribution over topics and sentiments. To construct these candidates, QuanText uses an auxiliary public dataset: it applies the Chow–Liu algorithm [16] to approximate the joint distribution of attributes as a product distribution of simpler marginal and conditional distributions. (ii) Second, given the private dataset, QuanText determines the released joint distribution by randomly selecting from the subset of candidate distributions closest to the private empirical distribution. (iii) Third, QuanText constructs a released dataset that follows the selected attribute distribution. For each private sample, an attribute combination is assigned according to the release distribution, and a large language model rewrites the sample using the assigned attributes together with the corresponding attribute-relevant snippets extracted from the original text. For example, suppose a private tweet has the attributes (topic = climate change, sentiment = positive) and is assigned a synthetic attribute combination (topic = climate change, sentiment = negative). QuanText extracts relevant snippets from the original tweet, such as “global warming” and “clean energy”, and uses them to generate a new tweet that expresses the assigned topic and sentiment. Under idealized conditions, we prove that QuanText satisfies a privacy guarantee based on the Statistic Maximal Leakage (SML) framework [7]. SML bounds the leakage of a specified global-level secret under the worst-case data prior and against arbitrary attack strategies, including those that exploit correlated attributes. Since SML is robust to post-processing [7], a dataset released under a Π−SML guarantee can be used for downstream tasks like model training without degrading privacy. Our theoretical analysis accounts for correlation between textual content and style, such as word choice within individual text samples or text length. We quantify content–style dependence by a worst-case conditional probability ratio l, and prove that the SML is bounded by the mechanism-dependent quantization term plus log l, so weak dependence between content and style causes only limited additional privacy loss. Since the correlation parameter is difficult to estimate in practice, we compare the empirical privacy and utility performance of QuanText to several common data release baselines. Our results show that QuanText achieves a better empirical privacy–utility trade-off than competing data generation baselines on known property inference attacks. Our contributions are summarized as follows. • Mechanism Design: We propose QuanText, a modelagnostic, training-free data release mechanism that pro-
tects sensitive global secret proportions of a dataset while limiting leakage through correlated attributes and preserving data utility. • Privacy Analysis: We analyze the idealized privacy guarantee of QuanText via Statistic Maximal Leakage (SML), which is robust to arbitrary attack strategies and further processing of the released data. We provide an SML guarantee whose additive degradation is controlled by the strength of content–style correlation. • Empirical Evaluation: We evaluate the privacy and utility performance of QuanText on real-world datasets. Compared with existing data generation baselines, QuanText achieves a better privacy–utility trade-off. II. R ELATED W ORK Attribute Inference Attacks. Attribute inference attacks aim to recover a missing or sensitive attribute of an individual sample from its observed features, thus concern sample-level privacy [17]–[21]. Existing studies typically assume access to a trained classifier. Our setting is fundamentally different. We study dataset or distribution-level privacy, where the sensitive information is a global property of the private dataset, such as the proportion of samples with a particular attribute. Property Inference Attacks. Property inference attacks, also called distribution inference attacks, aim to infer aggregate properties of a private training dataset or distribution, such as demographic or class-label proportions, rather than attributes of individual records. Most prior work [12]–[14], [22]–[26] targets discriminative classifiers, including fully connected neural networks [23], convolutional neural networks [24], and classifiers in federated learning [14]. This line of work also shows that differential privacy (DP), while designed to protect individual records, provides only weak protection for aggregate statistics [12]–[14]. [15] similarly finds DP may leave attribute correlations vulnerable in classifier-based settings. A smaller body of work studies property inference for generative models or their synthetic outputs [5], [6], [10], [11]. For Generative Adversarial Networks [5] and diffusion models [10], attackers typically observe generated samples and estimate the target property empirically, assuming the generative distribution reflects the private training distribution. [11] studies the narrower task of property existence inference, which tests whether a target property appears in the training data, i.e., whether its proportion is nonzero, rather than estimating general proportions. More recently, [6] studies property inference attacks against large language models in both black-box settings, where attackers label generated samples to estimate the secret, and gray-box settings, where attackers use model weights and auxiliary data to train shadow models that map model features to the secret. Our setting is closest to property inference from generated data; however, while prior work primarily studies attacks, our work focuses on defense. Defenses Against Property Inference Attacks. Existing defenses against property inference attacks mainly target classifiers, using techniques such as property unlearning and adversarial training [26]–[28]. These heuristic methods are
model-dependent and require modifying the training procedure. In contrast, we consider a model-agnostic, training-free defense at the data-release stage. [10] perturbs the sensitive property in generated data, but changing the secret alone is insufficient: an attacker can still recover it from other attributes correlated with it. Our work addresses this limitation by protecting fine-grained dataset-level proportions while limiting leakage through correlated attributes. III. P ROBLEM F ORMULATION The data holder has a private textual dataset D = {x1 , . . . , xn } of size n, where each sample xi ∈ X is a text string from universe X . The data holder aims to release a dataset D′ via a data generation mechanism D′ = M(D) while protecting a count query G(D) measuring the proportion of samples associated with a particular attribute category. That is, suppose there exists an oracle g : X → {0, 1}, that outputs 1 if and only if the sample x has a certain property (e.g., “has diabetes”), and 0 otherwise. Then 1 X g(x). G(D) ≜ n x∈D
For brevity, we will use the shorthand G to denote G(D). The data holder specifies a set of m attribute types of interest, m denoted by {ϕi }i=1 (e.g., ϕ1 = sentiment, ϕ2 = stance), over which utility should be retained; these attribute types may be correlated with the secret G. A core assumption of this work is that the secret G can be recovered by knowing the values of all attributes {ϕi }m i=1 ; we model leakage about the secret from non-attribute content in §IV-B. Each attribute type ϕi , such as sentiment, takes values from i ψai predefined set of categories with size ψi , denoted by vj j=1 , such as positive, negative, and neutral. Following [6], the dataset holder may get access to a public auxiliary dataset Daux from a similar domain. After observing the released dataset, the attacker aims to infer the original secret G. We assume that the attacker knows the data generation mechanism and is computationally unbounded. a) Privacy Constraint: Theoretically, we measure the privacy of a data release mechanism M in the Statistic Maximal Leakage (SML) framework [7], which provides privacy guarantees under any data prior and against arbitrary attack strategies. Let P denote the prior distribution of data, A be the attack method, G and Ĝ be the random variables representing the original and attacker-guessed secret values, and G be the set of all possible secret values. SML is defined as P Ĝ = G ΠM,g = sup log . (1) supg∈G PG (g) P,A SML takes the worst-case leakage over all possible data priors and attack methods. Intuitively, SML measures the gain in the attacker’s probability of correctly guessing the secret given the released dataset D′ . A smaller value of ΠM,g indicates stronger protection; in particular, if ΠM,g ≤ η, any attack success probability after release is at most αeη , where α
is the success probability using prior knowledge alone. SML also satisfies post-processing and adaptive composition [7], making the privacy guarantee robust to further processing of the released output and sequential applications of data release mechanisms. IV. R ANDOMIZED Q UANTIZATION FOR T EXT We design Randomized Quantization for Text (QuanText) as a data release mechanism that limits leakage about the secret quantity G while preserving the utility of the attribute types m of interest, {ϕi }i=1 . a) Straw Man Solution: A straw-man design that simply removes samples containing the sensitive property (e.g., “has diabetes”) is insufficient, because an attacker may still infer the secret from the distributions of correlated attributes (e.g., age), which may remain largely unchanged. To mitigate this risk, QuanText perturbs both the distribution of the sensitive property and the distributions of attributes correlated with it. b) Overview: Our core assumption is that the secret G is revealed exactly by knowing the attribute values of all samples in the private dataset. Hence, our approach is to rewrite samples in the dataset so that their attribute values, in aggregate, do not reveal the secret G. QuanText extracts attributes values from each text sample in D, obtaining an empirical joint distribution P̂ over these attribute values. It also constructs a set of alternative joint distributions over attribute values. To do so, it models the underlying joint attribute distribution with a tree-structured probabilistic graphical model using the Chow-Liu algorithm [16]. Given a set of candidate distributions (or a quantization of the attribute distribution space), QuanText selects uniformly at random from the set of candidate distributions that are closest in total variation distance to the empirical attribute distribution; the size of this subset can be varied to tune privacy guarantees. Once we draw an alternative attribute distribution P̃, we use an LLM to rewrite each sample in D, mapping its attribute values to a synthetic combination of attribute values drawn from P̃. To minimize the changes to the dataset, we use the Hungarian algorithm to find a low-cost matching between samples’ true attributes to a list of synthetic attributes; here, cost is defined as the number of differing attribute values. A. QuanText Algorithm We illustrate the pipeline of QuanText in Fig. 2 and present the full algorithm in Alg. 1. 1) Approximate the joint distribution over the attribute types P (ϕ1 , ϕ2 , . . . , ϕm ), as P (ϕ1 ) · Qm of interest, i=2 P ϕi |ϕπ(i) using the Chow–Liu algorithm [16] on an auxiliary public dataset Daux (Line 1). Here, ϕπ(i) denotes the parent of ϕi in the Chow–Liu tree, and ϕ1 is the root node. 2) Construct γ candidate release distributions per distribu tion component, namely P (ϕ1 ) and P ϕi |ϕπ(i) for all i ∈ {2, 3, . . . , m} (Line 1). We defer the construction algorithm to §A.
Attribute Types of Interest 𝜙! : Review star 𝜙" : Business category 𝜙# : Key words
Auxiliary Public Dataset
Private Dataset
ℙ(𝜙! ) : Candidate γ
Candidate 1
𝜙!
𝜙"
𝜙#
ℙ(𝜙! , 𝜙" , 𝜙# ) ≈ Chow-Liu ℙ(𝜙! )ℙ(𝜙" |𝜙! )ℙ(𝜙# |𝜙" ) Algorithm
ℙ(𝜙" |𝜙! = 2) :
Select with randomness
ℙ(𝜙# |𝜙" = 𝑅𝑒𝑠𝑡𝑎𝑢𝑟𝑎𝑛𝑡𝑠) :
(5, Restaurants, Italian restaurants) The gustoso was great, and the ravioli was delicious too. Both dishes were flavorful …
Private Sample
𝐴! : (3, Restaurants, Cafés)
Released Distribution
3 (𝜙" |𝜙! = 1) ℙ 3 (𝜙" |𝜙! = 2) ℙ
ℙ(𝜙" |𝜙! = 1) :
Step 2: Construct candidate release distributions
Step 1: Approximate the joint distribution
Target attribute combinations
3 (𝜙! ) : ℙ
3 (𝜙# |𝜙" = 𝑅𝑒𝑠𝑡𝑎𝑢𝑟𝑎𝑛𝑡𝑠) ℙ
Draw i.i.d. samples
𝐴$ : (5, Grocery, Eggs)
Steps 3 & 4: Select released distribution according to the private dataset, and draw target attribute combinations
Target attribute combinations 𝐴" … 𝐴# (4, Restaurants,
Attribute combination was great gustoso raviolis A+ …
Irish Pubs & Food)
Match
Extract
Attribute Related Snippets
Target attribute combination
was great A+ …
The pints were A+, and the brown bread was delicious…
Rewrite
Released Sample
Target Attribute Related Snippets
Step 5: Match target attribute combinations, and rewrite samples
Fig. 2: Illustration of QuanText on a customer review dataset, where the attribute types of interest are review star, business category, and key words. Step 1 approximates the joint attribute distribution with a Chow–Liu tree learned from an auxiliary public dataset. Step 2 constructs candidate release distributions for each distribution component. Steps 3 and 4 randomly select released distributions based on the private dataset and then sample target attribute combinations. Step 5 matches these target combinations to private samples, extracts snippets relevant to the assigned target attributes, and rewrites the samples accordingly to form the released dataset. 3) Compute the empirical distributions from the original private dataset: P̂ (ϕ1 ) and P̂ ϕi |ϕπ(i) for all i ∈ {2, 3, . . . , m} (Line 1). 4) Select release distributions for the distribution components, combine them into a released joint distribution, and construct target attribute combinations: • For each distribution component, determine the released distribution P̃ (ϕ1 ) or P̃ ϕi |ϕπ(i) , i ∈ {2, 3, . . . , m} by (a) identifying the top-k candidate distributions with the smallest total variation (TV) distances from the corresponding empirical private distribution (Line 1), and (b) selecting one of them uniformly at random (Line 1). • Form the released joint distribution (Line 1): Qm P̃ (ϕ1 , ϕ2 , . . . , ϕm ) = P̃ (ϕ1 ) · i=2 P̃ ϕi |ϕπ(i) . • Draw n target attribute combinations from the released joint distribution, where n is the number of private samples (Line 1). Each combination specifies one category value per attribute type of interest. 5) Rewrite samples to match the released distribution using attribute-related snippets from the original text: • Label the attribute combination of each private sample via an LLM (Line 1), and map the private samples to the target attribute combinations using the Hungarian algorithm (Line 1). • For each sample, extract snippets relevant to its mapped target attribute combination using an LLM (Line 1). • Rewrite each sample with an LLM according to
the mapped target attribute combination and the extracted snippets (Line 1). B. Idealized Privacy Guarantee To analyze the Statistic Maximal Leakage (SML) of QuanText, following prior work [29]–[31], we decompose textual data along two axes: content Y ∈ Y and style Z ∈ Z with Y ∪ Z = X . Content captures the semantic meaning of the text, including attribute-level information, whereas style refers to non-semantic surface properties, such as word choice, phrasing, and text length. Global-level secrets are functions of the private dataset and may be correlated with content; through content–style dependence, style may therefore also reveal information about the secret. We quantify the dependence of style on content using the worst-case conditional probability ratio, denoted by L (Y ; Z). L (Y ; Z) ≜
P (Z = z|Y = y1 ) . y1 ,y2 ∈Y;z∈Z P (Z = z|Y = y2 ) sup
(2)
Intuitively, L (Y ; Z) measures how much the content Y can change the likelihood of a particular style Z. When L (Y ; Z) = 1, the style is independent of the content. We show that L (Y ; Z) upper bounds the mutual information I (Y ; Z). Proposition IV.1. If L (Y ; Z) ≤ l, then I (Y ; Z) ≤ log l. We assume that LLM used in QuanText can generate samples that satisfy the requirements specified in the prompts. Assumption IV.2 (LLM Capability). LLM rewrite faithfully realizes the assigned attribute combination: for every private
Algorithm 1: Randomized Quantization for Text Input: Private dataset D = {x1 , . . . , xn }, auxiliary dataset Daux , attribute types of interest {ϕ1 , . . . , ϕm }, number of candidate distributions γ, selection size k, large language model f . Output: Released dataset D′ . 1
// Step 1: Chow-LiuQapproximation P (ϕ1 , . . . , ϕm ) ≈ P (ϕ1 ) · m i=2 P ϕi |ϕπ(i) ← C HOW L IU (Daux ).
// Step 2-4: Decide released distribution for n each distribution component P ∈ {P(ϕ1 )}∪ o π(i) P(ϕi | ϕπ(i) = vj ) : i = 2, . . . , m, j ∈ ψπ(i) do 3 Q ← C ANDIDATE C ONSTRUCTION(γ, P) [Alg. 2]. 4 Compute the empirical distribution P̂ from D. P 5 Qk ← arg min Q′ ⊆Q:|Q′ |=k q∈Q′ dTV (q, P̂). 6 P̃ ← U NIFORM(Qk ). 7 end Qm 8 P̃(ϕ1 , . . . , ϕm ) ← P̃(ϕ1 ) · i=2 P̃(ϕi | ϕπ(i) ). 9 Draw target attribute combinations 1 n i.i.d. ∼ P̃(ϕ1 , . . . , ϕm ). ãj , . . . , ãm j j=1 2
// Step 5: Match and rewrite samples for i ← 1 to n do 11 â1i , . . . , âm ← L ABEL ATTRIBUTESf (xi ). i 12 end r Pm r 13 Set Cij ← r=1 1 âi ̸= ãj for all i, j ∈ {1, . . . , n}. 14 σ ← H UNGARIAN (C), where σ(i) is the target combination assigned to xi . 15 for i ← 1 to n do 16 si ← E XTRACT S NIPPETSf (xi , ã1σ(i) , . . ., ãm σ(i) ). m ′ 1 17 xi ← R EWRITEf (xi , si , ãσ(i) , . . . , ãσ(i) ). 18 end
10
D′ ← {x′1 , . . . , x′n }. ′ 20 return D .
19
sample x, LLM f , extracted snippets s, and target combination a, the rewritten sample x′ = R EWRITEf (x, s, a) satisfies b(x′ , a) = 1, where the oracle b outputs 1 if and only if a sample has property combination a. The following theorem characterizes the SML of QuanText. Theorem IV.3 (SML of QuanText). For any secret defined as the proportion of samples associated with particular attribute categories in the private dataset D, if L (Y ; Z) ≤ l, then under Thm. IV.2, the SML of QuanText satisfies γ 1+Pm i=2 ψπ(i) ΠM,g ≤ log + log l, (3) k where ϕπ(i) denotes the parent of ϕi in the constructed Chow– Liu tree, ψπ(i) is the number of values attribute ϕπ(i) can take, γ is the number of candidate distributions for each distribution component, and k is the selection size. (Proof in §B.) Thm. IV.3 shows that QuanText provides a stronger privacy guarantee, i.e., a smaller SML value, when the number of candidate distributions γ per conditional attribute is smaller, the number of nearest-neighbor distributions k is larger, or the parent attributes in the Chow–Liu tree have fewer
categories. This is consistent with the intuition that, when the mechanism selects from a larger fraction of the candidate distributions and each relevant attribute has fewer possible categories, the released distribution reveals less information for the attacker to use when inferring the secret. Furthermore, content–style correlation increases the privacy loss bound additively by log l. Since SML admits an operational interpretation, Thm. IV.3 directly bounds the attacker’s success probability. Proposition IV.4 (Best attack success rate). Let α denote the optimal attack success rate using prior knowledge alone. After observing the dataset released by QuanText, the optimal attack success rate satisfies γ 1+Pm i=2 ψπ(i) . P(Ĝ = G) ≤ α · k V. E XPERIMENTS We evaluate the privacy and utility of QuanText on realworld datasets. A. Datasets We use the Tweet Stance [9] and ChatDoctor [8] datasets, and treat them as the real private data to be released and protected. • Tweet Stance Dataset [9] This dataset contains 4,870 tweets annotated with three labels: Target (five political topics: climate change, atheism, legalization of abortion, Hillary Clinton, and Donald Trump), Stance (Favor, Against, Neither), and Sentiment (Positive, Negative, Neither). We subsample 3,000 tweets as the private dataset and use the remaining 1,870 samples as the auxiliary dataset for the Chow–Liu spanning tree. We consider Target, Stance, and Sentiment as the attributes of interest, yielding the Chow–Liu spanning tree {Target → Stance; Target → Sentiment}. We define the secrets as the proportions of tweets in a specific Target, Stance, or Sentiment category, and in a specific Target–Stance combination. All secrets are specified with a precision of 0.01%. • ChatDoctor Dataset [8] This dataset consists of patient– doctor dialogues. Following [6], we define two types of secrets: (1) the proportion of female samples and (2) the proportions of specific medical diagnoses. For (1), we subsample three datasets of 600 dialogues each with target female ratios 0.3, 0.5, and 0.7, taking gender as the only attribute of interest. For (2), we subsample 600 dialogues, define the secrets as the proportions of samples with mental disorder, digestive disorder, and childbirth, each to a precision of 0.01%, and take diagnosis as the only attribute of interest. In both cases, the single attribute of interest reduces the Chow–Liu tree to a single node. B. QuanText and Data Generation Baselines As shown in Thm. IV.3, for a given dataset, the SML of QuanText is determined by γk under Thm. IV.2. Intuitively, γk measures the degree of quantization among candidate distributions, coupled with how closely we stay in the neighborhood of
Stance = FAVOR
1.0 smaller candidate dilution
Aggregate Utility
0.8 0.6 0.4
Raw Data Subsampling Private Evolution DP Fine-tuning QuanText
0.2
0.025 0.050 0.075 0.100 0.125 0.150 0.175
Attack MAE
(a) Secret as the proportion of Target = Legalization of Abortion.
1.0
(b) Secret as the proportion of Stance = Favor
Sentiment = NEGATIVE
1.0 0.8
Aggregate Utility
0.8
Aggregate Utility
Stance, Target = FAVOR, Legalization of Abortion
0.6 0.4
Raw Data Subsampling Private Evolution DP Fine-tuning QuanText
0.2
(c) Secret as the proportion of Sentiment = Negative.
0.4
Raw Data Subsampling Private Evolution DP Fine-tuning QuanText
0.2 0.00
0.02 0.04 0.06 0.08 0.10 0.12 0.14 0.16 0.18
Attack MAE
0.6
0.02
0.04
Attack MAE
0.06
0.08
(d) Secret as the proportion of Stance = Favor & Target = Legalization of Abortion.
Fig. 3: Attack MAE vs. aggregate utility under different data generation methods with varying privacy guarantees on Tweet. the true empirical attribute distribution. We refer to this ratio as candidate dilution. Although Thm. IV.2 may not hold exactly in practice, we vary the candidate dilution, i.e., γk , to control the privacy performance of QuanText in our experiments, where smaller candidate dilution corresponds to stronger privacy. Specifically, we consider γk ∈ {2, 3, 4, 6, 8, 12} and use Llama3.1-8B-Instruct as the backend model. As we do not know of any other defenses specifically against target property inference attacks in textual data release settings, we select Differentially Private (DP) synthetic data generation methods as our baselines, specifically, Private Evolution [32]–[34] and DP model fine-tuning [35]–[37]. We also include raw data release and subsampling as naive baselines. Raw Data Release: We release the private data directly. Subsampling: We randomly subsample and release half of the private dataset. • Private Evolution (PE) [32]–[34], [38]: PE is a trainingfree method for differentially private synthetic data generation using foundation models [32]–[34], [38]–[40]. Starting from samples generated by a Random API, PE iteratively constructs a DP noisy histogram from privateto-synthetic nearest-neighbor votes, samples from this histogram, and perturbs selected samples via a Variation API. We use Augmented Private Evolution (Aug-PE) [33], the text-generation variant of PE, modifying only
• •
•
the Random and Variation prompts. DP Fine-Tuning (DP-FT) [35]–[37]: DP-FT fine-tunes the language model for next-token prediction using differentially private stochastic gradient descent (DP-SGD) [41]. Synthetic data are then generated from the finetuned model according to a generation instruction.
We run PE for 10 iterations and DP-FT for 15 epochs. For both PE and DP-FT, we vary the privacy budget ϵ ∈ 1, 2, 3, 4, and use Llama3.1-8B-Instruct as the backend model. C. Evaluation Metrics Privacy: Although our theoretical arguments suggest that QuanText satisfies an SML guarantee in idealized settings, it is unclear how to estimate the correlation parameter l from Thm. IV.3. Hence, we evaluate an empirical privacy measure that can also be evaluated for the other baseline defenses we consider: we calculate the Mean Absolute Error (MAE) of the labeling-based property inference attack used in [5], [6], [10], described as follows. Higher MAE indicates better performance on protecting global secrets. •
Labeling-based Attack For each sample, the attack uses a large language model to decide whether the sample belongs to the sensitive attribute category. The property ratio is then computed as the number of samples in the sensitive category divided by the total number of samples.
Female Ratio = 0.3
1.0
0.8
Aggregate Utility
Aggregate Utility
0.8 0.6 0.4 0.2 0.0
Female Ratio = 0.5
1.0
Raw Data Subsampling Private Evolution DP Fine-tuning QuanText
0.01
0.02
Attack MAE
0.03
0.6 0.4 0.2 0.0
0.04
Raw Data Subsampling Private Evolution DP Fine-tuning QuanText
0.00
(a) Secret as Female Ratio = 0.3.
1.0
0.6
0.2 0.0 0.00
0.03
0.04
0.05
Diagnosis: Digestive Disorder
0.8
Aggregate Utility
Aggregate Utility
0.8
0.4
0.02
Attack MAE
(b) Secret as Female Ratio = 0.5.
Diagnosis: Childbirth
1.0
0.01
Raw Data Subsampling Private Evolution DP Fine-tuning QuanText
0.01
0.02
0.03
Attack MAE
0.04
0.4 0.2
Raw Data Subsampling Private Evolution DP Fine-tuning QuanText
0.0 0.000 0.005 0.010 0.015 0.020 0.025 0.030 0.035
0.05
(c) Secret as the proportion of Diagnosis = Childbirth.
0.6
Attack MAE
(d) Secret as the proportion of Diagnosis = Digestive Disorder.
Fig. 4: Attack MAE vs. aggregate utility under different data generation methods with varying privacy guarantees on ChatDoctor. In our experiments, we use Llama3.1-8B-Instruct, Mistral-7B-Instruct, and Qwen3-4B-Instruct as the backend models for the labeling-based attack. Although [6] proposes another property inference attack for text, it targets models trained on private or generated data, where the trained model may encode information about the global secrets. This makes it unsuitable for our setting, in which QuanText is training-free and the attacker infers the secrets directly from the generated dataset. Utility: Inspired by [42], [43] on evaluating synthetic data, we adopt KNN-Precision, KNN-Recall, Fréchet Inception Distance, and Attribute Matching to evaluate the semantic and statistic performance of the generated data. KNN-Precision and KNN-Recall capture the semantic quality and coverage of the generated data. KNN-Precision and KNN-Recall are defined as the proportions of generated and real samples, respectively, whose embedding distance to at least one sample from the opposite dataset is smaller than the distance to the k-th nearest neighbor within their own dataset. Fréchet Inception Distance (FID) measures the embedding closeness of the real and generated data. Attribute Match (AM) quantifies the agreement between real and synthetic datasets with respect to predefined statistical and semantic features by measuring distances between their corresponding feature distributions. Specifically, it uses the Wasserstein-2 distance for numerical features and Total Variation (TV) distance for categorical
features. In our evaluation, we use sample token length as the statistical feature, together with dataset-specific semantic features. We summarize overall utility as the average of the four metrics above, each rescaled to [0, 1] so that larger values indicate better performance. Although averaging these values may not be ideal because the underlying metrics can have different scales, this practice is sometimes adopted in benchmarks to facilitate visualization and interpretation [43], [44]. D. Results We present the privacy and utility performance of QuanText and the baselines under varying privacy budgets for selected secrets on the Tweet Stance and ChatDoctor datasets in Figs. 3 and 4, which highlight two main takeaways: •
QuanText achieves a better privacy–utility trade-off than PE and DP-FT. As shown in Figs. 3 and 4, when the candidate dilution satisfies γk ≤ 8, QuanText consistently achieves both higher attack MAE and a higher aggregate utility score than PE and DP-FT across privacy budgets ϵ ∈ {1, 2, 3, 4}, indicating superior privacy and utility performance. For both PE and DP-FT, the attack MAE remains consistently low and varies only slightly across different DP budgets ϵ, which is consistent with prior observations that data generation methods with differential privacy guarantees are insufficient to
0.60
0.00
0.55
(40, 10)
(80, 20)
(120, 30)
( , k)
(160, 40)
Attack MAE
0.05
(a) Secret as the proportion of Target = Legalization of Abortion.
0.65
0.12
0.60
0.10
0.55
(40, 10)
(80, 20)
(120, 30)
( , k)
(160, 40)
0.55
(200, 50)
(c) Secret as the proportion of Sentiment = Negative.
(80, 20)
(120, 30)
( , k)
(160, 40)
(200, 50)
Stance, Target = FAVOR, Legalization of Abortion0.70 Attack MAE Aggregate Utility
Attack MAE
0.14
0.60
(b) Secret as the proportion of Stance = Favor.
0.70
Aggregate Utility
Attack MAE
Attack MAE Aggregate Utility
0.70 0.65
0.10
0.05 (40, 10)
(200, 50)
Sentiment = NEGATIVE
Attack MAE Aggregate Utility
0.15
0.65
Aggregate Utility
Attack MAE
0.10
Stance = FAVOR
0.70
Aggregate Utility
Attack MAE Aggregate Utility
0.06
0.65
0.04
0.60
0.02
0.55
(40, 10)
Aggregate Utility
Target = Legalization of Abortion
(80, 20)
(120, 30)
( , k)
(160, 40)
(200, 50)
(d) Secret as the proportion of Stance = Favor & Target = Legalization of Abortion.
Fig. 5: Attack MAE & aggregate utility of QuanText with γ/k = 4 on Tweet. protect global-level properties [7], [45], [46]. We also observe that the attack MAE of Raw Data Release and Subsampling remains near zero, indicating that property inference attack succeeds on these naive baselines. γ • Smaller candidate dilution k improves privacy while preserving utility for QuanText. As shown in Fig. 3a and consistently observed across the other subplots in Figs. 3 and 4, decreasing the candidate dilution from 12 to 2 substantially improves privacy: the attack MAE increases from approximately 0.01 to 0.1. At the same time, this change incurs only a minor utility loss, with the aggregate utility score decreasing from 0.85 to 0.77. Intuitively, this is because QuanText primarily adjusts the proportions of selected attributes, while the reused attribute-related snippets help preserve the semantic quality and coverage of the generated samples. A similar phenomenon has been observed in tabular data generation with SML guarantees [7]. These results indicate that smaller candidate dilution provides a more favorable privacy–utility trade-off in practice. 1) Ablation Studies: We further study how QuanText performs under different parameter choices and against different attacker models. a) Sensitivity analysis of parameters γ and k under fixed candidate dilution: In Fig. 5, we fix the candidate dilution at γk = 4 and vary γ and k proportionally to examine whether their individual values affect the privacy and utility
performance of QuanText on the Tweet Stance dataset. For each parameter setting, we run QuanText three times and report the mean and standard deviation of both privacy and utility. We observe that, across different types of secrets, both the attack MAE and aggregate utility remain largely stable as γ and k vary. This demonstrates that QuanText is robust to the specific choices of γ and k, provided that the candidate dilution is fixed. b) Robustness of QuanText to attacks from different backend models: To examine whether QuanText is robust to attacks performed by different models, we consider three backend models: Llama3.1-8B-Instruct, Mistral-7B-Instruct, and Qwen3-4B-Instruct. For each backend model, we perform the labeling-based attack for all secrets on Tweet Stance datasets generated by QuanText with γk = 4, PE and DP-FT with ϵ = 1, Raw Data Release, and Subsampling. For each secret, we rank these methods according to their attack MAE. We then compute the Spearman correlation between the rankings produced by each pair of backend models for each secret and average the correlations across secrets. The resulting averaged Spearman correlation matrix is shown in Table I. We observe that the Spearman correlation between any pair of models exceeds 0.6, indicating a strong correlation [47]. This suggests that the relative protection provided by each method is largely preserved across attack models, implying that the privacy advantage of QuanText is not tied to any particular attack model.
TABLE I: Averaged Spearman correlation matrix between backend models. For each backend model and secret, we rank the generation methods by their attack MAE, compute the Spearman correlation between the rankings for each pair of models, and average the correlations across secrets.
Llama Mistral Qwen
Llama
Mistral
Qwen
1.0000 0.7766 0.6878
0.7766 1.0000 0.7724
0.6878 0.7724 1.0000
VI. C ONCLUSION In this work, we studied privacy-preserving textual data generation for protecting sensitive global properties, specifically the proportions of samples associated with specified attribute categories. We proposed QuanText, a model-agnostic, training-free mechanism that protects global secrets while limiting leakage through correlated attributes and preserving data utility. QuanText efficiently constructs candidate release distributions, randomly selects one close to the private empirical distribution, and rewrites samples using attribute-related snippets to match the chosen distribution. We analyzed its privacy guarantee using Statistic Maximal Leakage and characterized the privacy degradation when textual style is correlated with the secret. Experiments on real-world datasets show that QuanText achieves a favorable privacy–utility trade-off and outperforms differentially private data generation baselines in both privacy and utility. R EFERENCES [1] E. M. Bender and B. Friedman, “Data statements for natural language processing: Toward mitigating system bias and enabling better science,” Transactions of the Association for Computational Linguistics, vol. 6, pp. 587–604, 2018. [2] T. Gebru, J. Morgenstern, B. Vecchione, J. W. Vaughan, H. Wallach, H. D. Iii, and K. Crawford, “Datasheets for datasets,” Communications of the ACM, vol. 64, no. 12, pp. 86–92, 2021. [3] N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson et al., “Extracting training data from large language models,” in USENIX Security Symposium, 2021. [4] N. Lukas, A. Salem, R. Sim, S. Tople, L. Wutschitz, and S. ZanellaBéguelin, “Analyzing leakage of personally identifiable information in language models,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2023, pp. 346–363. [5] J. Zhou, Y. Chen, C. Shen, and Y. Zhang, “Property inference attacks against gans,” arXiv preprint arXiv:2111.07608, 2021. [6] P. Huang, C. Yadav, R. Wu, and K. Chaudhuri, “Can we infer confidential properties of training data from llms?” arXiv preprint arXiv:2506.10364, 2025. [7] S. Wang, Z. Lin, and G. Fanti, “Statistic maximal leakage,” Entropy, 2026. [8] Y. Li, Z. Li, K. Zhang, R. Dan, S. Jiang, and Y. Zhang, “Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (llama) using medical domain knowledge,” Cureus, vol. 15, no. 6, 2023. [9] S. M. Mohammad, S. Kiritchenko, P. Sobhani, X. Zhu, and C. Cherry, “Semeval-2016 task 6: Detecting stance in tweets,” in Proceedings of the International Workshop on Semantic Evaluation, ser. SemEval ’16, San Diego, California, June 2016. [10] H. Hu and J. Pang, “Prisampler: Mitigating property inference of diffusion models,” arXiv preprint arXiv:2306.05208, 2023. [11] L. Wang, J. Wang, J. Wan, L. Long, Z. Yang, and Z. Qin, “Property existence inference against generative models,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 2423–2440.
[12] G. Ateniese, L. V. Mancini, A. Spognardi, A. Villani, D. Vitali, and G. Felici, “Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers,” International Journal of Security and Networks, vol. 10, no. 3, pp. 137–150, 2015. [13] A. Suri, Y. Lu, Y. Chen, and D. Evans, “Dissecting distribution inference,” in 2023 IEEE conference on secure and trustworthy machine learning (saTML). IEEE, 2023, pp. 150–164. [14] Y. Jiang, X. Luo, Y. Wu, X. Zhu, X. Xiao, and B. C. Ooi, “On data distribution leakage in cross-silo federated learning,” IEEE Transactions on Knowledge and Data Engineering, vol. 36, no. 7, pp. 3312–3328, 2024. [15] A.-M. Creţu, F. Guépin, and Y.-A. de Montjoye, “Correlation inference attacks against machine learning models,” Science Advances, vol. 10, no. 28, p. eadj9260, 2024. [16] C. Chow and C. Liu, “Approximating discrete probability distributions with dependence trees,” IEEE transactions on Information Theory, vol. 14, no. 3, pp. 462–467, 1968. [17] M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, 2015, pp. 1322–1333. [18] B. Z. H. Zhao, A. Agrawal, C. Coburn, H. J. Asghar, R. Bhaskar, M. A. Kaafar, D. Webb, and P. Dickinson, “On the (in) feasibility of attribute inference attacks on machine learning models,” arXiv preprint arXiv:2103.07101, 2021. [19] S. Mehnaz, S. V. Dibbo, E. Kabir, N. Li, and E. Bertino, “Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models,” in 31st USENIX security symposium (USENIX Security 22), 2022, pp. 4579–4596. [20] B. Jayaraman and D. Evans, “Are attribute inference attacks just imputation?” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 1569–1582. [21] V. Duddu and A. Boutet, “Inferring sensitive attributes from model explanations,” in Proceedings of the 31st ACM International Conference on Information & Knowledge Management, 2022, pp. 416–425. [22] H. Chaudhari, J. Abascal, A. Oprea, M. Jagielski, F. Tramèr, and J. Ullman, “Snap: Efficient extraction of private properties with poisoning,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 400–417. [23] K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov, “Property inference attacks on fully connected neural networks using permutation invariant representations,” in Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, 2018, pp. 619– 633. [24] A. Suri and D. Evans, “Formalizing and estimating distribution inference risks,” arXiv preprint arXiv:2109.06024, 2021. [25] W. Zhang, S. Tople, and O. Ohrimenko, “Leakage of dataset properties in {Multi-Party} machine learning,” in 30th USENIX security symposium (USENIX Security 21), 2021, pp. 2687–2704. [26] V. Hartmann, L. Meynent, M. Peyrard, D. Dimitriadis, S. Tople, and R. West, “Distribution inference risks: Identifying and mitigating sources of leakage,” in 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE, 2023, pp. 136–149. [27] J. Stock, J. Wettlaufer, D. Demmler, and H. Federrath, “Lessons learned: defending against property inference attacks,” arXiv preprint arXiv:2205.08821, 2022. [28] J. Stock, L. Lange, E. Rahm, and H. Federrath, “Property inference as a regression problem: Attacks and defense,” in Proceedings of the International Conference on Security and Cryptography, Bengaluru, India, 2024, pp. 18–19. [29] T. Shen, T. Lei, R. Barzilay, and T. Jaakkola, “Style transfer from non-parallel text by cross-alignment,” Advances in neural information processing systems, vol. 30, 2017. [30] Z. Fu, X. Tan, N. Peng, D. Zhao, and R. Yan, “Style transfer in text: Exploration and evaluation,” in Proceedings of the AAAI conference on artificial intelligence, vol. 32, no. 1, 2018. [31] V. John, L. Mou, H. Bahuleyan, and O. Vechtomova, “Disentangled representation learning for non-parallel text style transfer,” in Proceedings of the 57th annual meeting of the association for computational linguistics, 2019, pp. 424–434. [32] Z. Lin, S. Gopi, J. Kulkarni, H. Nori, and S. Yekhanin, “Differentially private synthetic data via foundation model APIs 1: Images,” in International Conference on Learning Representations (ICLR), 2024.
[33] C. Xie, Z. Lin, A. Backurs, S. Gopi, D. Yu, H. A. Inan, H. Nori, H. Jiang, H. Zhang, Y. T. Lee et al., “Differentially private synthetic data via foundation model apis 2: Text,” arXiv preprint arXiv:2403.01749, 2024. [34] Z. Lin, T. Baltrusaitis, W. Wang, and S. Yekhanin, “Differentially private synthetic data via apis 3: Using simulators instead of foundation model,” arXiv preprint arXiv:2502.05505, 2025. [35] D. Yu, S. Naik, A. Backurs, S. Gopi, H. A. Inan, G. Kamath, J. Kulkarni, Y. T. Lee, A. Manoel, L. Wutschitz et al., “Differentially private finetuning of language models,” arXiv preprint arXiv:2110.06500, 2021. [36] L. Wutschitz, H. A. Inan, and A. Manoel, “dp-transformers: Training transformer models with differential privacy,” 2022. [37] X. Yue, H. A. Inan, X. Li, G. Kumar, J. McAnallen, H. Sun, D. Levitan, and R. Sim, “Synthetic text generation with differential privacy: A simple and practical recipe,” in ACL, 2023. [38] T. Tran, A. Backurs, Z. Lin, V. Reis, L. Xiong, and S. Yekhanin, “Differentially private synthetic data via apis 4: Tabular data,” 2026. [39] C. Hou, A. Shrivastava, H. Zhan, R. Conway, T. Le, A. Sagar, G. Fanti, and D. Lazar, “Pre-text: training language models on private federated data in the age of llms,” in Proceedings of the 41st International Conference on Machine Learning, 2024, pp. 19 043–19 061. [40] C. Gong, K. Li, Z. Lin, and T. Wang, “Dpimagebench: A unified benchmark for differentially private image synthesis,” arXiv preprint arXiv:2503.14681, 2025. [41] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in ACM CCS 2016, 2016, pp. 308–318. [42] S. Wang, V. Raunak, A. Backurs, V. Reis, P. Zhou, S. Chen, L. Yang, Z. Lin, S. Yekhanin, and G. Fanti, “Struct-bench: A benchmark for differentially private structured text generation,” Advances in Neural Information Processing Systems, vol. 38, 2026. [43] S. Wang, A. Maddi, Z. Lin, and G. Fanti, “Synae: A framework for measuring the quality of synthetic data for tool-calling agent evaluations,” arXiv preprint arXiv:2605.22564, 2026. [44] B. Wang, W. Chen, H. Pei, C. Xie, M. Kang, C. Zhang, C. Xu, Z. Xiong, R. Dutta, R. Schaeffer et al., “DecodingTrust: A comprehensive assessment of trustworthiness in GPT models,” in Conference on Neural Information Processing Systems (NeurIPS), 2023. [45] Z. Lin, S. Wang, V. Sekar, and G. Fanti, “Summary statistic privacy in data sharing,” IEEE Journal on Selected Areas in Information Theory, 2024. [46] S. Wang, R. Wei, M. Ghassemi, E. Kreacic, and V. K. Potluru, “Guarding multiple secrets: Enhanced summary statistic privacy for data sharing,” arXiv preprint arXiv:2405.13804, 2024. [47] J. D. Evans, Straightforward statistics for the behavioral sciences. Thomson Brooks/Cole Publishing Co, 1996.
A PPENDIX A C ANDIDATE D ISTRIBUTION C ONSTRUCTION We specify the candidate distribution construction algorithm in Alg. 2. Specifically, for each distribution component P, we draw a pool of L distributions from a symmetric Dirichlet distribution with concentration parameter α, where the default choice α = 1 yields the uniform Dirichlet distribution. We then select γ distributions from this pool to form the candidate set, with the goal of making the selected candidate distributions as far apart as possible. To this end, we adopt a greedy farthest-point selection rule: at each step, we choose the distribution that maximizes its minimum TV distance to the set of candidates selected so far. The time complexity of Alg. 2 is O(γ 2 L). A PPENDIX B P ROOF OF T HM . IV.3 Proof. Let M′ be the data release mechanism consisting only of the first four steps of QuanText. By [7], we have X ΠM′ ,g = sup log sup PΘ′ |Θ (θ′ |θg ) , PΘ|G ∈{0,1}
θ ′ ∈Θ′
g∈G
Algorithm 2: Candidate Distribution Construction Input: Distribution component P; Dirichlet concentration α; pool size L; number of candidate distributions γ. Output: Candidate distribution set Q with size γ. // Pool sampling Initialize pool L ← ∅. 2 for ℓ ← 1 to L do 3 Draw P̄(ℓ) ∼ Dirichletsym (α) over the support of P. 4 L ← L ∪ P̄(ℓ) . 5 end 1
// Greedy selection of γ candidates Pick an arbitrary q1 ∈ L and set Q ← q1 . 7 for t ← 2 to γ do 8 q ⋆ ← arg maxp∈L\Q minq∈Q dTV (p, q). 9 Q ← Q ∪ q⋆ . 10 end 6
11
return Q.
where Θ and Θ′ denote the distribution parameters of the private and released data respectively, and θg satisfies PΘ|G (θg |g) = 1. Since the number of distribution components Pm Pm is 1 + i=2 ϕπ(i) , we have |Θ′ | = γ 1+ i=2 |ϕπ(i) | and 1+Pm i=2 |ϕπ(i) | 1 ′ , ∀θ ∈ Θ, θ′ ∈ Θ′ . PΘ′ |Θ (θ |θ) ≤ k Hence, when L (Y ; Z) = 0, we can get that Pm
ΠM′ ,g ≤
sup
log
PΘ|G ∈{0,1}
X 1 1+ θ ′ ∈Θ′
k
|
i=2 ϕπ(i)
| = log
γ 1+Pm |ϕπ(i) | i=2
k
Since SML satisfies post-processing and, by Thm. IV.2, the attribute-related snippets reveal no information about the secret, the SML of QuanText satisfies γ 1+Pm i=2 |ϕπ(i) | ΠM,g ≤ log . k When L (Y ; Z) ≤ l, under Thm. IV.2, we can get that P Ĝ = G
P Ĝ = G
= sup sup log supg∈G PG (g) supg∈G PG (g) PZ|Y PY ,A X ′ sup PΘ′ |Y θ |yg sup log
ΠM,g = sup log P,A
= sup
PZ|Y PY |G ∈{0,1}
≤ sup
sup
θ ′ ∈Θ′
X
log
PZ|Y PY |G ∈{0,1}
g∈G
y ′ ∈Y ′ ,z∈Z
sup PZ|Y (z|yg ) ·
g∈G
1+Pm |ϕπ(i) | i=2 1 k
1+Pm |ϕπ(i) | X i=2 1 ≤ sup sup log l· k PZ|Y PY |G ∈{0,1} ′ ′ y ∈Y
= log
γ 1+Pm |ϕπ(i) | i=2
k
+ log l,
where yg satisfies PY |G (yg |g) = 1, and Y ′ denotes the set of released content parameter vectors.
.