💻 computer science

Privacy-Preserving Data Drift Detection and Recovery for Large-Scale LLM Applications via Proxy Representations

This paper introduces ProxyDrift, a privacy-preserving framework that detects and recovers from data drift in large-scale LLM applications by analyzing non-PII proxy representations to continuously monitor production traffic and generate targeted synthetic evaluation datasets without accessing raw user data.

Original authors: Michael Levit, Josh Ledgard, Haoyu Dong, Vishwas Suryanarayanan, Eyal Kolman, Sharon Tan, Qiang Gan, Vishal Chowdhary

Published 2026-08-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Michael Levit, Josh Ledgard, Haoyu Dong, Vishwas Suryanarayanan, Eyal Kolman, Sharon Tan, Qiang Gan, Vishal Chowdhary

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the head chef of a massive, bustling restaurant that serves millions of people every day. You want to make sure your food is delicious, so you taste-test new recipes in a quiet kitchen before serving them. But here's the catch: the customers in the dining room are wearing masks, and the restaurant's strict privacy rules forbid you from ever seeing their faces or hearing their specific orders. You can't walk out there, peek at the menus, or ask, "What did you just eat?" You only know that people are eating, and you have to guess what they want based on a tiny, anonymous note left on the table.

This is the daily reality for the giant AI chatbots that power our modern digital lives. These Large Language Models (LLMs) are like super-chefs who write code, draft emails, and create documents for hundreds of millions of users. But because of strict privacy laws, the companies running these AIs can't look at the actual questions people ask or the answers they get. They are flying blind. If the "customers" (users) suddenly start asking for very different things—like switching from writing poetry to debugging code—the AI's training data might become outdated. This is called "data drift." Without seeing the real traffic, the AI might keep serving the same old menu to people who want something new, leading to bad experiences. The big question is: How do you fix a recipe when you aren't allowed to taste the food?

Enter PROXYDRIFT, a clever new framework developed by researchers at Microsoft that solves this puzzle without ever breaking the privacy rules. Think of it as a magical translator that turns secret customer orders into a simple, safe checklist. Instead of looking at the raw text of a user's question (which is private), the system uses an AI to classify the question into a set of non-sensitive "tags." For example, instead of seeing "Write a scary story about a haunted toaster," the system just sees a list of tags: Intent: Creative Writing, Tone: Spooky, Format: Story, Length: Medium. These tags are the "proxy representations." They capture the shape and style of the conversation without keeping any of the actual words.

The paper shows that by using these tags, the team can do three amazing things. First, they can measure how different the current user requests are from their old test data. They use a special math score (called a "chance-calibrated alignment score") to see if their test menu matches the real dining room. If the score is low, they know they are out of sync. Second, they can build a brand-new test menu that perfectly mimics the real users. They use a smart sampling method (based on something called a "Chow-Liu tree," which is like a family tree for how different tags usually go together) to generate thousands of fake but realistic questions that match the current trends. Finally, they can figure out exactly which types of questions are making users unhappy. By linking the tags to simple "thumbs up" or "thumbs down" feedback, they can spot trouble spots—like realizing that users get frustrated when asking about specific Excel formulas—without ever reading a single user's private spreadsheet.

In their experiments, the researchers found that their new method works incredibly well. When they compared their old, hand-picked test sets to the real world, the old sets were a terrible match (scoring only about 0.28 out of 1). But the new, AI-generated test sets matched the real world almost perfectly (scoring about 0.91). They also tested if a human could tell the difference between a real user's question and the AI's fake one; without any special hints, the human couldn't tell them apart. Most importantly, they used this system to fix a real problem in Microsoft Copilot. By noticing that users were unhappy with how the AI handled Excel charts and formulas, they tweaked the system to pay more attention to those details. The result? The AI got much better at answering those specific questions, proving that you can improve a massive AI system and keep it aligned with its users, all while keeping everyone's private data completely safe.

Technical Summary: PROXYDRIFT

Problem Statement

Large Language Model (LLM) applications deployed at scale face a critical bottleneck in offline evaluation: strict privacy and compliance constraints prevent direct access to raw user interaction data (queries, responses, and grounding documents). Consequently, practitioners cannot inspect production traffic to assemble representative evaluation datasets or track the evolution of user behavior over time. Without this visibility, offline evaluation sets become static, unverified snapshots that degrade in relevance as user populations shift and new workflows emerge. This misalignment leads to distorted quality scores, hidden user pain points, and model iterations tuned against non-existent user profiles. Traditional drift detection methods, which rely on comparing distributions of raw inputs, are inapplicable because the inputs themselves cannot leave the production environment.

Methodology: PROXYDRIFT Framework

To address this, the authors present PROXYDRIFT, a framework that enables drift detection and evaluation dataset reconstruction entirely without access to raw user data. The core innovation is the replacement of sensitive interaction data with structured, multi-dimensional proxy representations. These proxies are non-PII descriptors derived from LLM-based classification of user interactions within the production compliance boundary.

1. Proxy Representation

The system maps user interactions to a JSON schema with $D=21$ categorical dimensions, categorized as:

Classified vs. Observable: Classified dimensions (e.g., intent, tone, domain) are generated by an LLM classifier; observable dimensions (e.g., word count, language) are computed deterministically from metadata.
Nominal vs. Ordinal: Distinguishing between unordered categories and ordered values to inform distance calculations.
Single-valued vs. Multi-valued: Allowing for multiple labels per dimension (e.g., a query having both "Document Creation" and "Research" intents).
Confidence Scoring: Each label carries a confidence score ($0-5$), with a self-correction loop ensuring schema compliance up to $K=10$ attempts.

2. Drift Measurement

PROXYDRIFT quantifies drift between production traffic ( $P$ ) and offline evaluation sets ( $O$ ) using a chance-calibrated, redundancy-aware (RA) alignment score:

Distance Metric: Uses Jensen–Shannon Distance (JSD) to penalize support mismatches (categories present in production but missing in evaluation).
Chance Calibration: Normalizes the distance against a permutation baseline (randomly shuffling $O$ ) to produce an alignment score $a \in [0, 1]$ , where $1$ indicates identical distributions and $0$ indicates performance no better than random chance.
Redundancy Discounting: Aggregates per-dimension scores using a weighted average that discounts dimensions based on their mutual information with previously processed dimensions. This prevents clusters of correlated dimensions from dominating the aggregate score.

3. Synthetic Dataset Generation

To refresh evaluation sets, PROXYDRIFT employs a Chow–Liu tree-based conditional sampler:

Dependency Modeling: Constructs a maximum-weight spanning tree over dimensions using mutual information as edge weights, capturing pairwise dependencies (e.g., between "intent" and "output format").
Finite-Sample Corrections:
- MI Dampening: Applies a sigmoid dampening factor to Mutual Information estimates to correct for positive bias in small sample sizes, preventing spurious edges.
- Conditional Shrinkage: Shrinks empirical conditional probabilities toward the marginal prior for rare parent values, using a $\chi^2$ -based coefficient to determine the shrinkage strength.
Hydration: The sampled synthetic proxies are converted back into natural-language queries by an LLM generator, which reverses the classification process.

4. Intrinsic Consistency and Feedback Linkage

Roundtrip Analysis: The framework tests the fidelity of the proxy representation by generating a query from a proxy, reclassifying it, and measuring the reconstruction distance. This drives iterative taxonomy refinement.
Feedback Linkage: Proxy distributions are linked to user satisfaction signals (thumbs-up/down) to identify specific dimensions and values that correlate with failure or success modes.

Key Results

The framework was deployed in a cloud-based productivity suite serving hundreds of millions of users, monitoring scenarios like document generation and Excel-based question answering.

Drift Alignment: The conditional (Chow–Liu) sampler achieved a Redundancy-Aware (RA) alignment score of 0.917 with production traffic, significantly outperforming legacy hand-curated datasets (0.284) and basic independent samplers (0.897).
Roundtrip Consistency: After taxonomy refinement, the mean reconstruction distance dropped from 0.282 to 0.158 (a 44% reduction), and the roundtrip failure rate decreased from 6.9% to 0.4%.
Indistinguishability: In a naturalness test, an unguided LLM discriminator could not reliably distinguish synthetic queries from human queries ( $p=0.14$ ). Even with guided prompts, synthetic recall remained low (39%), indicating the synthetic data closely mimics human output.
Actionable Diagnostics: The system successfully identified specific proxy values (e.g., "Frustration" in tone, "Formula" in Excel queries) that correlated strongly with user dissatisfaction. Applying these insights to refine the Excel encoding in Microsoft Copilot resulted in significant accuracy gains on public benchmarks (e.g., +55.6 points for formula-related queries).

Significance and Claims

The paper claims that PROXYDRIFT provides a practical, privacy-preserving solution to the "blind spot" in large-scale LLM evaluation. Its significance lies in:

Enabling Continuous Monitoring: Allowing organizations to track production drift and refresh evaluation sets without violating data privacy constraints.
Correcting Evaluation Bias: Demonstrating that legacy offline sets systematically inflate quality scores, whereas distribution-aligned synthetic data reveals true performance gaps.
Closing the Loop: Showing that proxy-based diagnostics can directly drive engineering improvements (e.g., context encoding refinements) that improve model performance on specific failure modes.
Scalability: Proving that structured proxy representations can serve as a robust, high-fidelity substrate for both drift detection and synthetic data generation in production environments serving hundreds of millions of users.

The authors position this work not as a replacement for raw data analysis where permitted, but as a necessary capability for the "privacy-sensitive settings" that characterize modern enterprise LLM deployments.