💬 NLP

Differentially-Private Text Rewriting reshapes Linguistic Style

This paper demonstrates that differentially-private text rewriting, while preserving semantic content and grammatical coherence, systematically degrades linguistic style by stripping away interactive markers and complex structures, thereby forcing diverse texts into a homogenized, non-involved register.

Original authors: Stefan Arnold

Published 2026-04-30

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Stefan Arnold

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very talented, but slightly nervous, translator. Your job is to take a personal letter written by a friend and rewrite it so that no one can figure out who wrote it, while still keeping the main story intact. This is what Differentially Private (DP) text rewriting tries to do: it scrambles the text just enough to protect the author's identity, but keeps the meaning clear.

For a long time, these translators were clumsy. They would swap out individual words like "cat" for "dog" or "house" for "building." The result was often a jumbled, grammatically broken mess that made no sense.

Recently, we've upgraded these translators to be Language Models (AI that writes whole sentences at once). They are much better at keeping the grammar correct. But this paper asks a new question: Just because the grammar is perfect, does the personality of the text survive?

The authors, led by Stefan Arnold, say: No, the personality is getting lost.

Here is what they found, explained through simple analogies:

1. The "Sterile Hospital" Effect

When you rewrite a text to protect privacy, the AI doesn't just change the words; it changes the vibe.

Original Text: Imagine a lively dinner party conversation. People are using "I think," "you know," asking questions, telling stories about "yesterday," and trying to convince you of something. It's messy, emotional, and interactive.
Privatized Text: The AI rewrites this into a sterile hospital report. It removes all the "I"s and "you"s. It stops telling stories about specific times or places. It stops trying to persuade you.
The Result: The text still says the same facts (e.g., "The meeting happened"), but it sounds like a robot reading a manual. It loses the "human touch" that makes communication feel real.

2. Two Different Types of "Nervous" Translators

The paper tested two different AI architectures to see which one handled this "personality loss" better. Think of them as two different types of translators:

The "Autoregressive" Translator (DP-PARAPHRASE):
- How it works: It writes the sentence one word at a time, like a person typing from left to right without looking back.
- The Problem: This translator is stuck in a rut. It was trained on a specific type of "paraphrasing" data, so it has a bad habit of turning everything into a dry, repetitive style. Even if you tell it to be less strict about privacy, it keeps writing in this boring, formulaic way. It's like a musician who only knows how to play one sad song, no matter what genre you ask for.
- The Outcome: It completely destroys the original style, turning everything into a flat, neutral report.
The "Bidirectional" Translator (DP-MLM):
- How it works: It looks at the whole sentence at once, like a painter stepping back to see the whole canvas before adding a brushstroke. It can swap words in the middle of a sentence while keeping the context in mind.
- The Good News: This translator is much better at keeping the original "flavor." It keeps more of the human style than the first one.
- The Bad News: Even this "better" translator still sanitizes the text. It still strips away the emotional and interactive parts, just not as aggressively as the first one.

3. What Exactly Gets Deleted?

The researchers looked at the specific "ingredients" that make writing sound human and found they were being systematically removed:

Interactive Markers: Words like "you," "I," and direct questions ("Do you think...?") vanish. The text stops talking to you and starts talking at you.
Context: References to specific times ("yesterday") and places ("here") are removed. The text becomes untethered from reality.
Complex Logic: The AI stops using complex "because" or "although" structures that show deep reasoning. Instead, it overuses simple "since" or "whereas" to make the text look logical, but it feels shallow.

The Big Takeaway

The paper concludes that while we have successfully taught AI to write grammatically correct, private text, we have accidentally taught it to be boring and impersonal.

It's like taking a vibrant, colorful painting and running it through a filter that makes everything black and white. The shapes (the facts) are still there, but the color (the style, the emotion, the persuasion) is gone.

The authors warn that current privacy tools are "register-blind." They don't care if the text is a passionate opinion piece or a dry legal document; they treat them all the same, flattening them all into a single, safe, but soulless style. To truly protect privacy without destroying human communication, we need to teach these AI translators to respect the personality of the text, not just the facts.

1. Problem Statement

While Differential Privacy (DP) for text has evolved from disjointed word-level substitutions to fluent, sentence-level rewriting using Large Language Models (LLMs), a critical gap remains in understanding its impact on linguistic style.

The Gap: Current DP mechanisms successfully preserve semantic content and grammatical coherence but are assumed to be "register-blind." It is unknown whether these mechanisms inadvertently distort the communicative intent and stylistic identity (e.g., persuasive vs. neutral, interactive vs. informational) of the original text.
The Risk: If privacy mechanisms systematically strip away stylistic markers (such as personal pronouns, complex subordination, or interactive cues), the resulting text may lose its functional nuance, transforming diverse human discourse into a sterile, homogenized format.

2. Methodology

The authors conducted a multidimensional stylistic profiling of differentially-private text to quantify stylistic drift.

Models Compared:
1. DP-PARAPHRASE (Autoregressive): A GPT-2 backbone fine-tuned for paraphrasing (Mattern et al., 2022). Generates text sequentially.
2. DP-MLM (Bidirectional): A pre-trained RoBERTa architecture (Meisenbacher et al., 2024). Generates text by substituting tokens within the full context of the sentence.
Privacy Budgets: Evaluated across a spectrum of $\epsilon \in \{10, 25, 50, 100, 250\}$ . Both models utilize temperate sampling as an instantiation of the exponential mechanism to satisfy DP guarantees.
Dataset: A subset of 9,691 documents from the Corpus of Online Registers of English (CORE), covering 47 diverse registers (from personal blogs to legal documents).
Stylometric Framework:
- Instead of opaque embeddings, the study uses 67 lexico-grammatical features derived from Biber (1991), organized into 16 categories (e.g., tense, modality, subordination).
- Analysis Levels:
  1. Stylistic Fidelity: Measured using Burrows' Delta to calculate the distributional distance between human and rewritten text.
  2. Feature Deviation: Analyzed usage ratios ( $R = f_{model}/f_{human}$ ) to identify specific grammatical markers that are suppressed or over-generated.
  3. Functional Shift: Projected feature frequencies onto Biber's four canonical multidimensional axes:
    - Involved vs. Informational Production
    - Narrative vs. Expository Discourse
    - Situational vs. Elaborated Reference
    - Persuasive vs. Neutral Argumentation

3. Key Contributions

The paper makes three primary contributions demonstrating that DP rewriting systematically reshapes linguistic style:

Architectural Disparity in Stylistic Preservation:
- Bidirectional (DP-MLM) captures and reproduces human style more effectively across all privacy budgets. As privacy constraints relax, its style converges toward the human baseline.
- Autoregressive (DP-PARAPHRASE) reaches a distinct convergence plateau, failing to recover the original human style even at high privacy budgets. This is attributed to stylistic artifacts inherited from its training on limited paraphrase corpora.
Systematic Grammatical Sanitization:
- Both architectures induce a "sanitization" process characterized by the severe attrition of interactive markers (e.g., 2nd person pronouns, direct questions, place/time adverbials).
- Subordination Shift: There is a loss of complex causative (e.g., because) and concessive (e.g., although) structures. These are replaced by a narrow set of temporal and adversative subordinators to maintain a veneer of logical coherence, resulting in simplified sentence structures.
Functional Transformation of Communicative Intent:
- The study proves that DP rewriting forces a convergence toward a non-involved and non-persuasive register.
- Dynamic, person-oriented discourse is transformed into sterile, informational reports. While semantic content is preserved, the functional identity of the text (e.g., its ability to persuade or engage) is fundamentally distorted.

4. Key Results

Stylistic Distance: DP-MLM consistently shows lower Burrows' Delta values (closer to human style) than DP-PARAPHRASE. DP-PARAPHRASE exhibits erratic behavior under tight privacy and fails to converge even when privacy guarantees are relaxed.
Feature Ratios:
- Under-representation: Place/time adverbials, personal pronouns, and direct questions are significantly under-represented (ratios $< 1$ ).
- Over-generation: DP-PARAPHRASE over-generates temporal and adversative subordinators (up to 2.5x human baseline) to compensate for the loss of other logical connectors.
Dimensional Shifts:
- Involved $\to$ Informational: Both models shift text from interactive/affective discourse to abstract, information-dense prose. DP-PARAPHRASE shows a much larger drift than DP-MLM.
- Persuasive $\to$ Neutral: The rhetorical force of arguments is neutralized. DP-PARAPHRASE flattens subjective stances significantly more than the bidirectional approach.
- Narrative $\to$ Expository: Narrative arcs are eroded, converting storytelling into detached expository statements.

5. Significance and Conclusion

Beyond Lexical Noise: The paper establishes that the cost of privacy extends far beyond simple lexical variation; it induces a systematic functional mutation of text.
Register-Blindness: Current DP mechanisms are "register-blind." They preserve topic and semantic content but fail to maintain the nuanced stylistic markers that define human-authored discourse.
Architectural Implications: The choice of model architecture is critical. Autoregressive paraphrasing models are prone to "style trapping" based on their training history, whereas bidirectional substitution offers better stylistic robustness.
Future Directions: The authors argue that future DP research must move beyond optimizing for fluency and semantic equivalence. It must address stylistic erosion to ensure that privatized text retains not only formal privacy guarantees but also the diverse functional integrity of human communication.

Limitation Note: The study isolates linguistic style from adversarial authorship attribution. While it confirms that DP sanitizes communicative intent, it does not yet quantify whether this sanitization is a necessary prerequisite for preventing deanonymization (i.e., the trade-off between preserving register identity and ensuring author privacy).