arXiv:2609.38934v1 Announce Type: cross Abstract: Differentially private (DP) text generation can protect individual records, but privacy alone does not specify what evidence a released statement car...
The paper introduces MIMIC-DOS, a dataset derived from MIMIC-IV that focuses on ICU cases where patient symptoms and medical signs are discordant. It presents CARE, a privacy‑compliant multi‑stage agentic reasoning framework that uses a proprietary LLM to generate structured categories and transitions, while a local LLM performs evidence acquisition and decision‑making. In retrospective evaluations on MIMIC‑DOS, CARE outperforms other LLMs and agentic workflows, demonstrating stronger handling of conflicting clinical evidence while preserving patient privacy.
The paper introduces a clinically grounded privacy evaluation framework for medical language models, assessing leakage across a spectrum of adversarial access levels—from publicly inferable demographics to leaked note fragments. Using this framework on an LM pretrained on 378,000 clinical notes, the authors find that routine encounter metadata leads to high verbatim memorization and significant recovery of sensitive diagnoses (e.g., AUROC 0.91 for abortion, 0.82 for HIV). They also note that exact-match memorization can overstate disclosure, with 36% of memorized tokens being templated documentation, underscoring the risks of training on longitudinal clinical data and offering a reusable evaluation tool.
The paper introduces SHIP, a method that generates differentially private insights from textual data by mapping queries to attributes, constructing a hierarchical hybrid taxonomy, and releasing a DP synthetic table for analysis. It treats these insights as reusable representations to answer analytical queries, enabling a common basis for utility assessment. Experiments show SHIP outperforms existing private insight baselines in QA performance and structured fidelity, while highlighting remaining challenges for structured representations.
The paper compares data-level and training-level methods for balancing language model capability and privacy leakage on synthetic medical records with embedded canaries. Direct finetuning achieves the highest capability but leaks the most private information, while DP‑SGD reduces leakage at a significant cost to performance. Generating privacy‑aware synthetic data—especially with uniqueness‑aware rewriting—offers a better trade‑off, and more capable rewriting models tend to lower downstream privacy risks, though gains are inconsistent with increased compute.
Efficient Provably Private Classification with a Tabular Foundation Model introduces PrivTab, a tabular foundation model that embeds differential privacy directly into its architecture. Pretrained on simulated datasets, PrivTab uses in-context learning to convert sensitive rows into compact, provably private summaries, enabling a single forward pass for classification. The model outperforms private linear and neural‑network baselines under moderate-to-strong privacy, shows negligible membership leakage, maintains well‑calibrated predictions, and reduces dataset fitting time by 10,000×.
The paper introduces Term2Note, a method for generating full-length clinical notes under differential privacy constraints. It separates content and form, conditioning note sections on medical terms and applying distinct DP protections to terms and notes, followed by a DP quality maximizer. Experiments show that the synthetic notes closely match real clinical notes in statistical properties, and models trained on them perform comparably to those trained on real data, outperforming existing DP text generation baselines.
QuasiLeak-Bench is a new benchmark that evaluates large language model (LLM) based privacy detectors on their ability to recover quasi‑evidence groups—sets of weak quasi‑identifiers that jointly reveal private attributes—while respecting sender‑specified disclosure policies. The benchmark uses a reverse‑construction pipeline to generate documents containing verified quasi‑evidence groups and applies automated quality control to produce reliable ground truth at scale. Experiments show that current privacy detectors perform poorly on this task, but a fine‑tuned 4B LLM can outperform the best prompted models, indicating the task is learnable.
arXiv:2606. 04067v1 Announce Type: cross Abstract: As LLMs become increasingly woven into everyday workflows, user queries sent to cloud hosted LLMs routinely mix task-essential content with task non-essential sensitive disclosures, yet type based PII redaction is context agnostic and may raise two issues: over disclosing untyped sensitive context and over removing answer bearing spans.
arXiv:2606. 16952v2 Announce Type: replace-cross Abstract: The rapid adoption of generative AI and Large Language Models (LLMs) has spurred interest in synthetic data as a privacy-preserving alternative to sensitive real-world datasets.
Code-as-Auditor is an LLM-based framework that transforms regulatory information into formal checklists and executable decision trees, encoding rules as interpretable code. During inference, the model expands each checklist item into factual and counterfactual questions, guiding reasoning over case-specific evidence and potential violations. This pipeline moves from evidence identification to rule application and final decision-making, with a self‑verification loop that enhances logical consistency and traceability, leading to more accurate and evidence‑backed compliance evaluations in privacy and data protection scenarios.
The paper introduces CARE‑SD, a four‑module architecture designed to enhance the reasoning and explanation capabilities of small language models (SLMs) for analyzing self‑disclosure in cybersecurity interview transcripts. By integrating context‑adaptive processing, hierarchical disclosure reasoning, explanation‑consistency verification, and cross‑batch reconciliation, CARE‑SD improves the accuracy and evidence reliability of SLMs, raising Llama 3B’s Macro‑F1 from 0.80 to 0.88 and cutting unsupported claims by 60%. The study demonstrates that a 3B model can match the performance of a 20B reference model, highlighting the architecture’s effectiveness without needing larger models.