Paper deep dive
Privacy-Preserving Text Sanitization for Distributed Agents Collaboration via Disentangled Representations
Xuan Liu, Hefeng Zhou, Sicheng Chen, Chao Yang, Xingcheng Xu, Jingjing Qu, Jiong Lou, Jie LI, Xia Hu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 98%
Last extracted: 6/20/2026, 5:24:23 AM
Summary
The paper introduces DiSan (Disentangled Sanitization), a privacy-preserving framework designed for distributed multi-agent collaboration. DiSan addresses the leakage of both explicit PII and implicit distributional signatures (style/formatting) by using a two-stream encoder to factorize text into a source-invariant 'role' subspace (preserving semantics) and a source-identifying 'style' subspace (kept local). The framework utilizes federated prototype alignment and adversarial regularization to ensure role representations are comparable across non-IID agents without centralizing raw data. Experimental results demonstrate that DiSan significantly outperforms traditional masking and LLM-based paraphrasing, reducing answer-level PII exposure by 20x and lowering Enron stylometric attribution by over 70%, while maintaining high answer faithfulness in RAG benchmarks.
Entities (7)
Relation Signals (4)
Shanghai Artificial Intelligence Laboratory → developed → Intern-Shannon
confidence 100% · Intern-Shannon is the next-generation Agentic Operating System developed by Shanghai AI Lab
DiSan → implements → Role Subspace
confidence 100% · DiSan uses a two-stream encoder to factorize text into a source-invariant role subspace
DiSan → iscomponentof → Intern-Shannon
confidence 100% · DiSan (Disentangled Sanitization), a privacy-preserving sanitization framework and a built-in component of Intern-Shannon
DiSan → uses → LongT5-TGlobal-Base
confidence 100% · In our implementation, the encoder–decoder backbone is LongT5-TGlobal-Base.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:When distributed agents exchange text across organizational boundaries, privacy leakage arises not only from explicit identifiers but also from distributional signatures such as formatting conventions, vocabulary choices, and syntactic patterns. We propose DiSan(Disentangled Sanitization), a privacy-preserving sanitization framework and a built-in component of Intern-Shannon for multi-agent collaboration. DiSan uses a two-stream encoder to factorize text into a source-invariant role subspace that preserves task semantics and a source-identifying style subspace that remains local. Federated proto-type alignment and adversarial regularization enable joint training without centralizing raw text. Experiments show that identifier-level masking is insufficient: masking 19.2% of tokens reduces TF-IDF stylometric attribution by only 18.6%. By contrast, DiSan reduces answer-level PII exposure by 20 times while maintaining 83% answer faithfulness on a distributed multi-agent RAG benchmark, and lowers Enron stylometric attribution by 73.2% under TF-IDF and 70.6% under a neural probe.
Tags
Links
- Source: https://arxiv.org/abs/2606.15335v1
- Canonical: https://arxiv.org/abs/2606.15335v1
Trouble viewing inline? Open PDF directly →
Full Text
106,130 characters extracted from source content.
Expand or collapse full text
Intern-Shannon Privacy-Preserving Text Sanitization for Distributed Agents Collaboration via Disentangled Representations Xuan Liu* Hefeng Zhou* Sicheng Chen Chao Yang Xingcheng Xu Jingjing Qu† Jiong Lou Jie LI Xia Hu 1Shanghai Artificial Intelligence Laboratory 2Shanghai Jiao Tong University Abstract When distributed agents exchange text across organizational boundaries, privacy leakage arises not only from explicit identifiers but also from distributional signatures such as formatting conventions, vocabulary choices, and syntactic patterns. We propose DiSan (Disentangled Sanitization), a privacy-preserving sanitization framework and a built-in component of Intern-Shannon for multi-agent collaboration. DiSan uses a two-stream encoder to factorize text into a source-invariant role subspace that preserves task semantics and a source-identifying style subspace that remains local. Federated prototype alignment and adversarial regularization enable joint training without centralizing raw text. Experiments show that identifier-level masking is insufficient: masking 19.2% of tokens reduces TF-IDF stylometric attribution by only 18.6%. By contrast, DiSan reduces answer-level PII exposure by 20× while maintaining 83% answer faithfulness on a distributed multi-agent RAG benchmark, and lowers Enron stylometric attribution by 73.2% under TF-IDF and 70.6% under a neural probe. Intern-Shannon Privacy-Preserving Text Sanitization for Distributed Agents Collaboration via Disentangled Representations Xuan Liu* Hefeng Zhou* Sicheng Chen Chao Yang Xingcheng Xu Jingjing Qu† Jiong Lou Jie LI Xia Hu 1Shanghai Artificial Intelligence Laboratory 2Shanghai Jiao Tong University **footnotetext: Equal contribution. †Corresponding author. Code is available at https://github.com/RezinChow/DiSan. Intern-Shannon is the next-generation Agentic Operating System developed by Shanghai AI Lab, which will be officially released soon. 1 Introduction Figure 1: Privacy risks in cross-organizational text sharing. Top: Three representative collaboration settings, ranging from no protection to preliminary filtering, each leaving source-identifying content exposed. Bottom: DiSan produces sanitized text that preserves task-relevant semantics while removing both explicit PII and distributional source signatures. Cross-organizational collaboration on text-intensive tasks, including retrieval-augmented generation Lewis et al. (2020), distributed question answering, and cross-institutional case retrieval Stubbs et al. (2015), requires parties to share textual evidence while keeping raw data local. Each party may hold proprietary document collections with distinct domain expertise, and a common pattern is for a requesting party to seek auxiliary evidence from helpers, who retrieve local snippets and transmit them for downstream use such as answer synthesis Minaee et al. (2024). However, any inter-agent text exchange exposes private organizational information beyond what public capability tags disclose. As illustrated in Figure˜1, this risk spans all levels of cross-organizational collaboration: from intra-organization transfers with no protection to inter-alliance sharing where only preliminary filtering is applied. In each setting, shared text leaks private organizational information at two levels: explicitly through identifiers such as names, account numbers, and addresses, and implicitly through distributional signatures: formatting conventions, vocabulary choices, and syntactic patterns that encode the originating party’s internal practices Malik and Dustdar (2011). This is fundamentally a representation-level problem, not an identifier-level one: private organizational information is a property of the text distribution, not of individual identifiers, and anonymization methods that operate in text space cannot alter these distributional properties. Table˜1 makes this concrete: raw sharing exposes not only a counterparty identity but also a proprietary bulletin format, reference scheme, and sector taxonomy; placeholder masking hides surface identifiers but leaves the naming convention intact and collapses distinct entities into generic tokens, weakening grounding, provenance tracking, and cross-document aggregation. DiSan instead preserves role facts such as exposure amount, sector, rating change, and review status while suppressing source-specific fingerprints. Table 1: Compact CorporateBank→ financial-risk example. Bold marks source-identifying patterns that survive identifier masking. Raw private text (d). “Per Meridian Bank’s Counterparty Risk Bulletin (Ref: CR-2024-047), Apex Dynamics carried $6.1M exposure as of Q3 close, was downgraded to B+, and was flagged for portfolio review.” Placeholder masking only. “Per Meridian Bank’s Counterparty Risk Bulletin (Ref: [ID]), [ORG] carried $6.1M exposure as of Q3 close, was downgraded to B+, and was flagged for portfolio review.” DiSan output (d~ d). “A corporate-bank Q3 risk bulletin flags an industrials counterparty with $6.1M exposure, a B+ downgrade, and mandatory portfolio review.” Existing approaches address symptoms rather than structure. Rule-based PII detectors Li et al. (2021a) target individual identifiers such as named entities and account numbers but are blind to distributional signatures, since private organizational information is distributed across the text as statistical patterns, not localized to individual spans. LLM-based paraphrasing Xiao et al. (2024) reshuffles surface form but provides no mechanism to ensure the output distribution is statistically source-invariant. Federated learning McMahan et al. (2017) decentralizes model training but produces shared predictors, not shareable data. The core challenge is structural: what is the minimal sufficient representation that preserves task semantics while being statistically source-invariant? We propose DiSan, a sanitization framework for cross-agent evidence exchange. It learns a role–style factorization of each evidence snippet, where the role subspace preserves task-relevant semantics and the style subspace captures source-linked variation. Orthogonality encourages the two subspaces to separate, while prototype alignment keeps role representations comparable across non-IID agents without centralizing raw text. The resulting sanitizer produces shareable text from the role stream while keeping style information local. DiSan further serves as a key privacy-preserving component of Intern-Shannon, where it is integrated as a built-in text-sanitization module and can be invoked on demand during multi-agent collaboration. Contributions. (i) Disentangled sanitization for text sharing: We formulate cross-agent text sanitization as role–style factorization, separating task semantics from source-linked variation. (i) Federated role alignment: We introduce lightweight prototype alignment to stabilize role spaces across non-IID agents without centralizing raw text. (i) Privacy diagnostics across sharing surfaces: We evaluate privacy at the output, representation, and prototype levels, distinguishing application-stage leakage from training-stage artifacts. (iv) Empirical validation: On distributed-agent RAG, DiSan reduces answer-level PII exposure by 20× while maintaining 83% answer faithfulness. On Enron emails, it reduces TF-IDF stylometric attribution by 73.2%, substantially outperforming identifier-level masking. 2 Related Work Privacy-Preserving Machine Learning. Protecting privacy across distributed data sources is a persistent challenge in collaborative machine learning Li et al. (2021a). Differential privacy (DP) Dwork et al. (2006) provides formal guarantees, and DP-SGD Ouadrhiri and Abdelhadi (2022) extends these to deep learning Feldman et al. (2020); Abadi et al. (2016); Canonne et al. (2020). Federated learning McMahan et al. (2017) enables collaborative model training without sharing raw data Li et al. (2020a); Liu et al. (2022); Karimireddy et al. (2020). Within this paradigm, prototype-based methods Tan et al. (2021); Zhang et al. (2024), representation-based approaches Li et al. (2021b); Wu et al. (2021), and communication-efficient techniques Zhang et al. (2022); Wu et al. (2024) have been proposed. Recent federated RAG formulations aim to enable multi-party retrieval under privacy constraints Qian et al. (2025); He et al. (2025); Mao et al. (2025); Chakraborty et al. (2025). While these methods focus on training shared models or retrievers, our work addresses a complementary problem: sanitizing text data itself so it can be safely shared for downstream use. Text Sanitization and De-identification. Traditional text de-identification relies on rule-based or NER-based PII detection followed by masking or replacement Malik and Dustdar (2011). While effective for explicit identifiers, these methods miss implicit leakage through writing style, document structure, and domain-specific patterns. Authorship attribution research Stamatatos (2009) demonstrates that stylometric features can identify sources even from short texts. Recent work explores LLM-based paraphrasing for privacy Shi et al. (2025) and DP-based text generation Meisenbacher and Matthes (2024); Xie et al. (2024). However, DP-text methods incur severe utility degradation (30–50% coherence loss for ϵ<10ε<10) that is prohibitive for RAG applications requiring semantic fidelity Meisenbacher and Matthes (2024). Our approach addresses both explicit PII and implicit stylistic fingerprints through learned disentanglement, achieving strong empirical privacy without the utility cost of DP noise on text outputs. Disentangled Representations. Disentangled representation learning aims to separate independent factors of variation in data Bengio et al. (2013). In NLP, disentanglement has been applied to separate content from style for style transfer John et al. (2019), sentiment from semantics, and speaker identity from linguistic content in speech Qian et al. (2019). Recent work enables explicit control in text generation via disentangled representations Liu et al. (2024); Han et al. (2024). These works establish that separating semantic content from stylistic or identity-related factors supports both controllable generation and privacy; we apply the same principle to text sharing, where the goal is to isolate task-relevant content from source-identifying patterns. 3 Problem Statement 3.1 Text Sharing for Distributed Agent Collaboration We consider C distributed agents, each hosting a private document repository cD_c. When a requesting agent cannot answer a query q locally, it routes to a candidate helper set (q)C(q) via embedding similarity over public capability tags, such as “AssetManager” and “CorporateBank”. Each helper retrieves a local snippet d and returns a sanitized snippet d~ d for downstream use in RAG or distributed question answering. Table˜1 concretizes the sanitization goal: raw text exposes explicit PII and institutional style fingerprints; placeholder masking removes identifiers but leaves distributional signatures intact and can weaken downstream grounding when masked spans are task-relevant; only a representation-level approach targets both privacy risks while preserving task semantics. 3.2 Threat Scope Our primary privacy concern arises in the application stage. A requesting agent receives sanitized evidence d~ d from a helper agent and may try to infer information beyond the helper’s public capability tag, including explicit PII, writing patterns tied to the source, or organizational document fingerprints. The sanitizer is trained federatively across the same agents; the coordinator follows the protocol and does not access raw text. We additionally evaluate whether training artifacts such as uploaded prototypes contain persistent distributional signatures tied to individual sources beyond public tags. We do not claim formal differential privacy or robustness to malicious servers, poisoning, prompt injection, or collusion; the complete threat model is in Appendix˜A. Goals and validation. We do not hide public capability tags or agent participation; we aim to prevent leakage beyond these facts while preserving downstream RAG utility. Our validation follows this scope: PII leakage and answer exposure measure explicit identifiers, stylometry measures source signatures in transmitted text, embedding and prototype attribution diagnose learned sharing artifacts, and F1, faithfulness, and ChunkHit@3 measure utility. 4 Method Overview. DiSan enforces role–style orthogonality as an explicit architectural constraint: a two-stream encoder projects each input into a role subspace encoding source-invariant task semantics and a style subspace encoding agent-specific variation. Role representations are used to decode sanitized text d~ d; style representations assist local generation for fluency and are then discarded. Only d~ d crosses the privacy boundary. Training without centralizing raw text poses a calibration challenge: per-agent isolation causes role spaces to drift across agents, degrading both utility and privacy. DiSan addresses this by exchanging compact role prototypes, aligning local role distributions to shared global anchors, and applying adversarial regularization to suppress source-specific prototype signatures beyond public agent tags. Figure˜2 illustrates the architecture. Figure 2: DiSan architecture. Left (agent): A two-stream encoder produces role representations rZ_r capturing source-invariant semantics and style representations sZ_s capturing agent-specific variation; ℒorthL_orth enforces their separation. Both are fused locally for decoding; sZ_s is discarded after use and never transmitted. Only role prototypes c μ_c cross the privacy boundary. Right (server): Prototypes are aligned spherically; gradient reversal suppresses source-specific signatures in uploaded prototypes. 4.1 Role–Style Disentangled Encoder Two-stream projection. Given an evidence sequence d=(d1,…,dT)d=(d_1,…,d_T), a pretrained encoder produces hidden states =Encoder(d)∈ℝT×dencH=Encoder(d) ^T× d_enc. We project H into a role stream and a style stream (backbone and projection dimensions in Section˜B.3): r _r =r,r∈ℝdenc×dr,r∈ℝT×dr, =HW_r, _r ^d_enc× d_r,\ Z_r ^T× d_r, (1) s _s =s,s∈ℝdenc×ds,s∈ℝT×ds. =HW_s, _s ^d_enc× d_s,\ Z_s ^T× d_s. (2) In our implementation, the encoder–decoder backbone is LongT5-TGlobal-Base. Both rZ_r and sZ_s are 256-dimensional token streams; their concatenation forms a 512-dimensional bottleneck that is projected back to dencd_enc before decoding. Intuitively, rZ_r captures shareable content structure (entities/relations/events), while sZ_s captures agent-specific phrasing and formatting. Fusion for generation. We fuse the two streams before decoding via fused=g([r;s])H_fused=g([Z_r;Z_s]), where g is a learned projection back to dencd_enc. An optional residual path out=α⋅fused+(1−α)⋅H_out=α·H_fused+(1-α)·H stabilizes early training (details in Section˜B.1). The pretrained LongT5 Transformer decoder then generates d~ d autoregressively from the modified encoder states; DiSan inserts a role–style bottleneck rather than replacing the generator. Although sZ_s may contain source-linked variation, it is used only inside the helper during decoding and is never transmitted. The decoder is trained to preserve role facts while removing identifiers and source-specific wording, so the local style stream serves as a fluency aid rather than a shared artifact. Residual leakage is evaluated on the transmitted d~ d through output-level PII and stylometry metrics. Disentanglement. Let ¯r=1T∑t=1Tr,t z_r= 1T _t=1^Tz_r,t and ¯s=1T∑t=1Ts,t z_s= 1T _t=1^Tz_s,t denote mean-pooled vectors. We encourage separation via: ℒorth=cos2(¯r,¯s)=(¯r⊤¯s‖¯r‖2‖¯s‖2+ϵ)2.L_orth= ^2( z_r, z_s)= ( z_r z_s\| z_r\|_2\,\| z_s\|_2+ε )^2. (3) 4.2 Prototype Alignment on the Role Space To train the privacy transformer under non-IID agents, we align role distributions across agents using lightweight role prototypes, providing global anchors without sharing raw evidence. Prototype computation and aggregation. For each role/placeholder type k∈k , each agent computes a local prototype k(c) μ^(c)_k as an EMA of batch role centroids (token-level averages over type-k positions). At each training round, the server aggregates a sample-weighted global prototype k∗ μ^*_k. Full definitions are provided in Section˜B.2. Spherical alignment. To avoid magnitude-based leakage, we align on the unit hypersphere: ℒproto=∑k∈(1−cos(¯^r,k,^k∗)),L_proto= _k (1- ( z_r,k, μ^*_k) ), (4) where ⋅ · denotes ℓ2 _2-normalization, and ¯r,k z_r,k is the batch role centroid for type k, defined as the token-level average over positions labeled as type k (see Section˜B.2). Prototype-level adversarial training. Prototypes may still carry source-specific distributional signatures beyond public agent tags. We apply a discriminator DψD_ψ with gradient reversal (GRL) Raff and Sylvester (2018) to make prototypes less predictive of their source: ℒadv=∑k∈CE(Dψ(GRLγ(¯k(c))),c),L_adv= _k CE\! (D_ψ(GRL_γ( μ^(c)_k)),\,c ), (5) where γ is the GRL strength and ¯k(c) μ^(c)_k is a gradient-enabled estimate (Section˜B.2). All attribution discriminators use the same compact MLP template, input →128→128→C→ 128→ 128→ C, with ReLU activations and dropout 0.1; the prototype discriminator takes 256-dimensional role prototypes as input. 4.3 Federated Optimization Local objective. On agent c, we minimize: ℒlocal(c)=ℒseq+λorthℒorth+λpℒproto+λadvℒadv+ℒprox, splitL^(c)_local=&L_seq+ _orthL_orth+ _pL_proto\\ &+ _advL_adv+L_prox, split (6) where ℒseqL_seq is the token-level cross-entropy on sanitization targets d~ d, and ℒprox=ν2‖θ−θ∗‖22L_prox= ν2\|θ-θ^*\|_2^2 is a FedProx term discouraging drift from the global model (we use ν to distinguish from prototype symbols μ). After local optimization, the server aggregates model weights and prototypes. Before uploading, agents apply ℓ2 _2-normalization and Gaussian noise perturbation (σ=0.01σ=0.01) to prototypes (Section˜D.4.1). For communication efficiency, we train LoRA adapters on the encoder attention projections together with the role projection and fusion layers. The style projection remains local and is never uploaded; per-round prototype exchange is only ||×256|K|× 256 floating-point values per agent, negligible compared with model synchronization. Table 2: Main single-round results. Bold = best, underline = second best. Metrics are defined in Section˜5.3. Method Semantic Similarity ↑ Faith. ↑ ChunkHit@3 ↑ PII Exposure ↓ F1 Prec. Rec. Cos. Avg. PII Ans. Rate RAG Baseline without PII process 0.6602 0.5519 0.8214 0.6421 86.10% 75.2% 6.4753 11.8% Placeholder (gliner-pii-large-v1.0) 0.5071 0.4624 0.5613 0.5923 74.60% 62.4% 0.4714 1.4% Placeholder (piiranha-v1-detect) 0.4894 0.4352 0.5587 0.5643 71.82% 58.6% 0.5126 1.6% Placeholder (deberta-pii-finetuned) 0.4768 0.4541 0.5018 0.5819 72.63% 60.2% 0.6287 2.0% LLM paraphrasing (llama-3.1-8b-instruct) 0.4991 0.4427 0.5719 0.5872 77.89% 66.4% 1.2479 3.6% LLM paraphrasing (Qwen2.5-7B-Instruct) 0.5407 0.5011 0.5872 0.6218 79.35% 67.0% 0.8412 2.6% LLM paraphrasing (GLM-4-9B-0414) 0.4732 0.4315 0.5237 0.6072 77.13% 64.6% 2.1091 3.8% Policy gating 0.5013 0.3876 0.7936 0.6322 78.49% 65.2% 0.9714 2.2% DiSan (ours) 0.5631 0.5341 0.6508 0.6558 83.17% 73.4% 0.1337 0.6% 4.4 Deployment: Multi-Agent Text Sharing The preceding sections describe how to train the sanitizer; this section describes how agents use it at deployment. Each agent deploys the trained model as a local sanitizer: given raw text d, it produces d~ d via role–style fusion and decoding. Crucially, sZ_s is used only locally to improve generation quality and is discarded after decoding. Only the sanitized text d~ d is transmitted. This design enables flexible inter-agent data-sharing protocols while preserving the privacy guarantees established during training. RAG pipeline. A requesting agent routes a query q to helper agents C via capability-based routing (Section˜3.1). Each helper c∈c retrieves local evidence dcd_c and returns: d~c=Sanitizeθ(dc,q), d_c=Sanitize_θ(d_c,q), (7) where SanitizeθSanitize_θ denotes the trained sanitizer (Section˜4.1–4.3). The requester aggregates ~=d~c∣c∈ D=\ d_c c \ and generates a final answer. This protocol naturally extends to multi-turn settings where the requester iteratively refines queries based on accumulated evidence (see Section˜5.6 for details). Convergence analysis is provided in Section˜B.4. 5 Experiments 5.1 Experimental Setup Dataset. We use a multilingual synthetic finance corpus with annotated PII spans, synthetic_pii_finance_multilingual Watson et al. (2024). Agent configuration. To simulate distributed agent collaboration, we construct C=7C=7 agents by assigning each agent a disjoint inventory of document types. The resulting partition induces non-IID skews by design. We denote agents by their capability tags: CorporateBank, AssetManager, FinTechPay, CorpGroup, MarketForecaster, ComplianceConsult, and SupplierCo. These tags are treated as public in our threat model (Section˜3.2); we therefore focus on leakage beyond this public prior. The exact doc-type identifiers used for each agent are listed in Section˜C.5. RAG evaluation pipeline. Documents are chunked into fixed windows (256 tokens, overlap 50) and indexed per agent. Given a query, the requesting agent routes to a candidate helper set via tag-based routing (Section˜3.1), retrieves top-k evidence from each helper’s local index using a BGE-M3 hybrid pipeline, receives sanitized snippets d~ d, and generates the final answer. Grounded QA examples are synthesized from retrieval anchors and retained only when evidence spans are found in the source chunk; each record stores its chunk_id for provenance-based ChunkHit@3. Query and ground-truth construction details are in Section˜C.6; retrieval architecture details are in Section˜C.6. We evaluate on single-round sharing as our main setting; the multi-turn deployment extension is discussed in Section˜5.6. Training configuration. Training runs for 12 rounds with 300 local steps per round per agent, batch size 4, and learning rate 2×10−42× 10^-4. We set the proximal regularization strength ν=0.1ν=0.1 to mitigate drift under non-IID data. Unless otherwise stated, we use λadv=1.0 _adv=1.0, GRL strength γ=0.5γ=0.5, λorth=0.2 _orth=0.2, and prototype noise scale σnoise=0.01 _noise=0.01 (convergence analysis in Section˜D.4.1). Full hyperparameters and schedules are deferred to Section˜C.5. 5.2 Baselines We compare against practical alternatives for privacy-preserving text sharing: Placeholder-only: This approach first applies a PII detection model to identify sensitive spans (names, dates, addresses, account numbers, etc.), then replaces each detected span with a type-specific placeholder token (e.g., [NAME], [DATE], [ADDRESS], [ACCOUNT]). We evaluate three PII detectors: gliner-pii-large-v1.0 Zaratiana et al. (2024), a generalist NER model; piiranha-v1-detect-personal-information, a DeBERTa-based model He et al. (2020) fine-tuned for PII detection; and deberta-pii-finetuned, another DeBERTa variant trained on PII corpora. While placeholder replacement removes explicit identifiers, it does not address implicit stylistic fingerprints; furthermore, opaque placeholder tokens can degrade downstream RAG by collapsing task-relevant spans into generic tokens and weakening answer grounding, provenance, and cross-document aggregation. LLM paraphrasing: Locally paraphrase text with open-source LLMs using a privacy-focused prompt, then share the rewritten text. Policy gating: Adapted from dynamic access-control memory sharing Rezazadeh et al. (2025), a local policy model (Qwen2.5-7B) decides per chunk whether to share the original text, provide a summary, or refuse sharing, based on the requester’s agent tag and the helper’s data sensitivity level. Prompts and policy templates are in Section˜C.7. 5.3 Evaluation Metrics We evaluate sanitization quality using privacy and utility metrics. Privacy metrics. (i) Avg. PII: the average number of PII spans detected in sanitized chunks by an external detector (lower is better). (i) Ans. Rate: the fraction of final answers that contain at least one exposed PII entity. We instantiate the external detector as gliner-pii-large-v1.0 with a 0.3 confidence threshold over common PII labels; implementation details are in Section˜C.6. (i) Distributional fingerprint leakage: 7-way attribution accuracy/macro-F1 from learned role embeddings (EXP-1) and sanitized text via stylometry (EXP-3). (iv) Prototype fingerprint leakage: 7-way attribution accuracy/macro-F1 from uploaded prototypes (EXP-2). Since capability tags and participation are public, these probes do not test whether the helper capability tag is hidden. They test whether transmitted text or learned artifacts still carry residual source-correlated fingerprints beyond that public information; full protocols are in Section˜C.1. Utility metrics. (i) F1/Prec./Rec./Cos.: token-level F1, precision, recall, and cosine similarity between generated answers and ground-truth answers (bag-of-words TF representation; see Section˜C.6). (i) Faithfulness: the fraction of stopword-removed content words in the answer that appear in retrieved evidence. (i) ChunkHit@3: the fraction of ground-truth chunks appearing in top-3 retrieved results. 5.4 Main Results DiSan achieves strong privacy protection with modest utility loss. As shown in Table˜2, it reduces answer-level PII exposure from 11.8% under unprotected sharing to just 0.6%, while preserving answer faithfulness at 83.17% close to the 86.10% unprotected baseline. Figure˜3 further shows that DiSan offers the most favorable privacy–utility trade-off among the evaluated sanitizers, being the only method that simultaneously achieves sub-1% answer-level PII leakage and near-baseline task performance. Figure 3: Privacy–utility trade-off. The ideal region (green, upper-right) represents high utility with strong privacy. Among evaluated methods, DiSan achieves the most favorable trade-off on this benchmark. 5.5 Ablation Study We ablate two key components: style isolation and prototype alignment. Full results are in Section˜C.8. Table 3: Ablation results (single-round). Bold = best column value; underline = second best. These are not competing sanitizers: A1 and A2 relax privacy constraints, so their higher utility metrics reflect under-sanitization rather than improvement. The relevant comparison is privacy cost vs. utility gain. Method Sem. F1 ↑ Cos. ↑ Faith. ↑ ChunkHit@3 ↑ Avg. PII ↓ Ans. Rate ↓ DiSan (ours) 0.5631 0.6558 83.17% 73.4% 0.1337 0.6% A1: w/o ℒorthL_orth 0.5694 0.6309 83.46% 72.7% 0.9706 1.4% A2: high-α fusion 0.5768 0.6664 84.12% 74.4% 1.2419 2.2% B: No-ProtoAlign 0.5487 0.6163 81.92% 69.8% 0.3588 0.8% Style isolation ablations. We test: (A1) removing ℒorthL_orth (λorth=0 _orth=0), allowing role embeddings to absorb stylometric cues; and (A2) high-α fusion (α=0.9α=0.9), amplifying style influence during decoding. A1 and A2 show slightly higher RAG utility metrics because weaker style isolation allows more source-specific lexical content to pass through the decoder, surfacing additional matching tokens in the answer. This is precisely the privacy failure mechanism: the same leaked content that boosts surface utility exposes source-identifying information. A1 increases Avg. PII by 7.3×7.3× and A2 by 9.3×9.3×, with answer-level exposure rising to 1.4% and 2.2% respectively. The appendix confirms the effect at the representation level: role attribution F1 rises from 0.13 (DiSan) to 0.18 (A1) and 0.24 (A2). These ablations reveal the privacy–utility trade-off: relaxing style isolation shifts the operating point toward higher utility at the cost of substantially weaker privacy. DiSan is selected as the operating point that maximizes privacy while incurring only modest utility loss. Prototype alignment ablation. We remove all prototype components: no EMA prototypes, no global aggregation, and λp=0 _p=0 (removing ℒprotoL_proto from Equation˜6). Without prototype anchors, role spaces drift under non-IID training, degrading both utility and privacy: cosine similarity drops 6%, ChunkHit@3 drops 3.6p, and PII exposure increases 2.7×. Disentanglement verification. Beyond privacy metrics, we verify that the model learns the intended decomposition. As diagnostic evidence, role embeddings used for sharing are near-random under the 7-way fingerprint probe (F1==0.05), while local-only style embeddings remain strongly source-correlated (F1==0.84). Figure˜5 further confirms successful role–style separation: cosine similarity between role and style embeddings clusters near zero across all agents, and a t-SNE projection shows clear geometric separation between the two subspaces. This indicates that ℒorthL_orth concentrates source-correlated variation primarily in the local-only style subspace. DiSan does not provide formal differential-privacy guarantees; full attack protocols across three surfaces are in Section˜C.1. Table 4: Enron stylometry probe (7 authors). Lower F1 indicates weaker residual distributional fingerprints. Method Mask% TF-IDF BERT Red. Raw text – 0.825 0.691 – GLiNER masking 19.2% 0.672 0.618 18.6% DiSan – 0.221 0.203 73.2% Random – 0.143 0.143 – Table˜4 treats Enron as a stylometry diagnostic rather than hidden-tag evaluation; DiSan lowers TF-IDF/BERT attribution to 0.221/0.203, near random and far below GLiNER. Appendix C.1 further compares with dedicated authorship-obfuscation baselines, JAMDEC and StyleRemix, which target stylometric leakage rather than RAG utility and yield substantially smaller reductions. We adopt LoRA Hu et al. (2022) for efficient training (details in Sections˜B.3 and B.4). 5.6 Multi-Party Collaboration Analysis Multi-turn RAG. The single-round protocol extends naturally to multi-turn settings where the requester refines queries based on accumulated evidence. At each turn t, the requester issues a refined query qtq_t to a possibly different helper subset; each helper sanitizes new evidence independently before transmitting it. The key property is preserved: only sanitized text crosses the privacy boundary at every turn. We treat this as a deployment extension of the same sanitization interface and leave dedicated multi-turn benchmarking to future work. Case study: cross-organizational IPO analysis. Figure˜6 (see Section˜C.9) illustrates a realistic multi-party scenario where Lumina Capital’s Audit-Core agent evaluates a company for IPO eligibility but lacks sufficient external benchmarks. Audit-Core queries partner agents via a data broker; each external agent sanitizes its response with DiSan before transmission, removing entity names, geographic identifiers, and organizational details while preserving task-relevant financial metrics. This scenario instantiates the same agent setting used in our benchmark: routing is based on public capability tags, while each helper keeps its repository and retrieval index local. The privacy boundary is therefore the transmitted sanitized snippet, not the helper identity or the fact of collaboration. The final answer aggregates benchmark figures without exposing any source-identifying information, enabling accurate cross-party assessment across organizational boundaries. 6 Conclusion Identifier-level anonymization is insufficient for source-invariant text sharing because private organizational information is often a distributional property of text rather than a set of localized identifiers. DiSan addresses this by enforcing role–style orthogonality and federated role alignment, producing sanitized text that preserves task semantics while suppressing source-identifying patterns. Across distributed-agent RAG and Enron stylometry evaluations, the results show that representation-level disentanglement provides a practical path toward safer text sharing across distributed agents. Future work should study stronger adaptive adversaries, repeated-query settings, and broader cross-domain deployments. Limitations Dataset. Our main experiments use a synthetic finance corpus with annotated PII spans. The use of synthetic data is a necessary constraint rather than a methodological choice: datasets containing real PII cannot legally or ethically be used for research publication, and this is standard practice in privacy-preserving NLP. Among publicly available PII-annotated corpora, most are unsuitable for RAG evaluation due to very short texts (social media, medical notes) or insufficient document-type diversity for multi-party simulation; the selected corpus provides the document length, PII annotation quality, and domain variety required by our setup. RAG evaluation queries are synthesized on top of this validated base rather than generating both PII data and queries from scratch, which would compound synthesis risk across two stages. External validation on the Enron email corpus, with real stylistic variation outside the finance domain, partially addresses domain generalizability. Formal privacy guarantees. DiSan does not provide formal differential privacy guarantees. Applying DP to sequence-to-sequence generation requires per-token noise calibration incompatible with coherent text generation; we instead rely on empirical validation across three attack surfaces. Formal privacy analysis for generative sanitizers is an important direction for future work. References Abadi et al. (2016) Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, pages 308–318, New York, NY, USA. Association for Computing Machinery. Bengio et al. (2013) Yoshua Bengio, Aaron Courville, and Pascal Vincent. 2013. Representation learning: A review and new perspectives. IEEE transactions on pattern analysis and machine intelligence, 35(8):1798–1828. Canonne et al. (2020) Clément L Canonne, Gautam Kamath, and Thomas Steinke. 2020. The discrete gaussian for differential privacy. In Advances in Neural Information Processing Systems, volume 33, pages 15676–15688. Curran Associates, Inc. Chakraborty et al. (2025) Abhijit Chakraborty, Chahana Dahal, and Vivek Gupta. 2025. Federated retrieval-augmented generation: A systematic mapping study. Preprint, arXiv:2505.18906. Cover and Thomas (2006) Thomas M. Cover and Joy A. Thomas. 2006. Elements of Information Theory. Wiley-Interscience. Dwork et al. (2006) Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography, pages 265–284, Berlin, Heidelberg. Springer Berlin Heidelberg. Feldman et al. (2020) Vitaly Feldman, Tomer Koren, and Kunal Talwar. 2020. Private stochastic convex optimization: optimal rates in linear time. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, STOC 2020, pages 439–449, New York, NY, USA. Association for Computing Machinery. Fisher et al. (2024a) Jillian Fisher, Skyler Hallinan, Ximing Lu, Mitchell L Gordon, Zaid Harchaoui, and Yejin Choi. 2024a. StyleRemix: Interpretable authorship obfuscation via distillation and perturbation of style elements. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 4172–4206, Miami, Florida, USA. Association for Computational Linguistics. Fisher et al. (2024b) Jillian Fisher, Ximing Lu, Jaehun Jung, Liwei Jiang, Zaid Harchaoui, and Yejin Choi. 2024b. JAMDEC: Unsupervised authorship obfuscation using constrained decoding over small language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 1552–1581, Mexico City, Mexico. Association for Computational Linguistics. Han et al. (2024) Jingxuan Han, Quan Wang, Zikang Guo, Benfeng Xu, Licheng Zhang, and Zhendong Mao. 2024. Disentangled learning with synthetic parallel data for text style transfer. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 15187–15201. He et al. (2025) Hangyu He, Xin Yuan, Kai Wu, Ren Ping Liu, and Wei Ni. 2025. pfedrag: A personalized federated retrieval-augmented generation system with depth-adaptive tiered embedding tuning. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 14255–14268. He et al. (2020) Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. 2020. Deberta: Decoding-enhanced bert with disentangled attention. arXiv preprint arXiv:2006.03654. Hu et al. (2022) Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, and 1 others. 2022. Lora: Low-rank adaptation of large language models. ICLR, 1(2):3. John et al. (2019) Vineet John, Lili Mou, Hareesh Bahuleyan, and Olga Vechtomova. 2019. Disentangled representation learning for non-parallel text style transfer. In Proceedings of the 57th annual meeting of the association for computational linguistics, pages 424–434. Karimireddy et al. (2020) Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. 2020. SCAFFOLD: Stochastic controlled averaging for federated learning. In Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pages 5132–5143. PMLR. Klimt and Yang (2004) Bryan Klimt and Yiming Yang. 2004. The enron corpus: A new dataset for email classification research. In European conference on machine learning, pages 217–226. Springer. Lewis et al. (2020) Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. In Advances in Neural Information Processing Systems, volume 33, pages 9459–9474. Curran Associates, Inc. Li et al. (2020a) Li Li, Yuxi Fan, Mike Tse, and Kuo-Yi Lin. 2020a. A review of applications in federated learning. Computers & Industrial Engineering, 149:106854. Li et al. (2021a) Q. Li, Yiqun Diao, Quan Chen, and Bingsheng He. 2021a. Federated learning on non-iid data silos: An experimental study. 2022 IEEE 38th International Conference on Data Engineering (ICDE), pages 965–978. Li et al. (2021b) Qinbin Li, Bingsheng He, and Dawn Song. 2021b. Model-contrastive federated learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10713–10722. Li et al. (2020b) Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. 2020b. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429–450. Liu et al. (2022) Dianqi Liu, Liang Bai, Tianyuan Yu, and Aiming Zhang. 2022. Towards method of horizontal federated learning: A survey. In 2022 8th International Conference on Big Data and Information Analytics (BigDIA), pages 259–266. Liu et al. (2024) Yi Liu, Xiangyu Liu, Xiangrong Zhu, and Wei Hu. 2024. Multi-aspect controllable text generation with disentangled counterfactual augmentation. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 9231–9253. Malik and Dustdar (2011) Ahmad Kamran Malik and Schahram Dustdar. 2011. Enhanced sharing and privacy in distributed information sharing environments. 2011 7th International Conference on Information Assurance and Security (IAS), pages 286–291. Mao et al. (2025) Qianren Mao, Qili Zhang, Hanwen Hao, Zhentao Han, Runhua Xu, Weifeng Jiang, Qi Hu, Zhijun Chen, Tyler Zhou, Bo Li, and 1 others. 2025. Privacy-preserving federated embedding learning for localized retrieval-augmented generation. arXiv preprint arXiv:2504.19101. McMahan et al. (2017) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-Efficient Learning of Deep Networks from Decentralized Data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, volume 54 of Proceedings of Machine Learning Research, pages 1273–1282. PMLR. Meisenbacher and Matthes (2024) Stephen Meisenbacher and Florian Matthes. 2024. Just rewrite it again: A post-processing method for enhanced semantic similarity and privacy preservation of differentially private rewritten text. In Proceedings of the 19th International Conference on Availability, Reliability and Security, ARES ’24. Association for Computing Machinery. Minaee et al. (2024) Shervin Minaee, Tomas Mikolov, Narjes Nikzad, Meysam Chenaghlu, Richard Socher, Xavier Amatriain, and Jianfeng Gao. 2024. Large language models: A survey. arXiv preprint arXiv:2402.06196. Ouadrhiri and Abdelhadi (2022) Ahmed El Ouadrhiri and Ahmed Abdelhadi. 2022. Differential privacy for deep and federated learning: A survey. IEEE Access, 10:22359–22380. Qian et al. (2025) Cheng Qian, Hainan Zhang, Yongxin Tong, Hong-Wei Zheng, and Zhiming Zheng. 2025. Hyfedrag: A federated retrieval-augmented generation framework for heterogeneous and privacy-sensitive data. arXiv preprint arXiv:2509.06444. Qian et al. (2019) Kaizhi Qian, Yang Zhang, Shiyu Chang, Xuesong Yang, and Mark Hasegawa-Johnson. 2019. Autovc: Zero-shot voice style transfer with only autoencoder loss. In International Conference on Machine Learning, pages 5210–5219. PMLR. Raff and Sylvester (2018) Edward Raff and Jared Sylvester. 2018. Gradient reversal against discrimination: A fair neural network learning approach. In 2018 IEEE 5th International Conference on Data Science and Advanced Analytics (DSAA), pages 189–198. IEEE. Reimers and Gurevych (2019) Nils Reimers and Iryna Gurevych. 2019. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 3982–3992. Rezazadeh et al. (2025) Alireza Rezazadeh, Zichao Li, Ange Lou, Yuying Zhao, Wei Wei, and Yujia Bao. 2025. Collaborative memory: Multi-user memory sharing in llm agents with dynamic access control. ArXiv preprint arXiv:2505.18279. Shi et al. (2025) Zitong Shi, Guancheng Wan, Wenke Huang, Guibin Zhang, Jiawei Shao, Mang Ye, and Carl Yang. 2025. Privacy-enhancing paradigms within federated multi-agent systems. arXiv preprint arXiv:2503.08175. Stamatatos (2009) Efstathios Stamatatos. 2009. A survey of modern authorship attribution methods. Journal of the American Society for information Science and Technology, 60(3):538–556. Stubbs et al. (2015) Amber Stubbs, Christopher Kotfila, and Özlem Uzuner. 2015. Automated systems for the de-identification of longitudinal clinical narratives: Overview of 2014 i2b2/uthealth shared task track 1. Journal of biomedical informatics, 58:S11–S19. Tan et al. (2021) Yue Tan, Guodong Long, Lu Liu, Tianyi Zhou, Qinghua Lu, Jing Jiang, and Chengqi Zhang. 2021. Fedproto: Federated prototype learning across heterogeneous clients. In AAAI Conference on Artificial Intelligence. Wang et al. (2020) Wenhui Wang, Furu Wei, Li Dong, Hangbo Bao, Nan Yang, and Ming Zhou. 2020. MiniLM: Deep self-attention distillation for task-agnostic compression of pre-trained transformers. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NeurIPS 2020. Watson et al. (2024) Alex Watson, Yev Meyer, Maarten Van Segbroeck, Matthew Grossman, Sami Torbey, Piotr Mlocek, and Johnny Greco. 2024. Synthetic-PII-Financial-Documents-North-America: A synthetic dataset for training language models to label and detect pii in domain specific formats. Hugging Face dataset. https://huggingface.co/datasets/gretelai/synthetic_pii_finance_multilingual. Wu et al. (2024) Feijie Wu, Zitao Li, Yaliang Li, Bolin Ding, and Jing Gao. 2024. Fedbiot: Llm local fine-tuning in federated learning without full model. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD ’24, pages 3345–3355, New York, NY, USA. Association for Computing Machinery. Wu et al. (2021) Yawen Wu, Dewen Zeng, Zhepeng Wang, Yiyu Shi, and Jingtong Hu. 2021. Federated contrastive learning for volumetric medical image segmentation. In Medical Image Computing and Computer Assisted Intervention – MICCAI 2021, pages 367–377, Cham. Springer International Publishing. Xiao et al. (2024) Yijia Xiao, Yiqiao Jin, Yushi Bai, Yue Wu, Xianjun Yang, Xiao Luo, Wenchao Yu, Xujiang Zhao, Yanchi Liu, Quanquan Gu, and 1 others. 2024. Large language models can be contextual privacy protection learners. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 14179–14201. Xie et al. (2024) Chulin Xie, Zinan Lin, Arturs Backurs, Sivakanth Gopi, Da Yu, Huseyin Inan, Harsha Nori, Haotian Jiang, Huishuai Zhang, Yin Tat Lee, Bo Li, and Sergey Yekhanin. 2024. Differentially private synthetic data via foundation model APIs 2: Text. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. Zaratiana et al. (2024) Urchade Zaratiana, Nadi Tomeh, Pierre Holat, and Thierry Charnois. 2024. GLiNER: Generalist model for named entity recognition using bidirectional transformer. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 5364–5376, Mexico City, Mexico. Association for Computational Linguistics. Zhang et al. (2024) Jianqing Zhang, Yang Liu, Yang Hua, and Jian Cao. 2024. Fedtgp: Trainable global prototypes with adaptive-margin-enhanced contrastive learning for data and model heterogeneity in federated learning. Proceedings of the AAAI Conference on Artificial Intelligence, 38(15):16768–16776. Zhang et al. (2022) Jie Zhang, Chen Chen, Bo Li, Lingjuan Lyu, Shuang Wu, Shouhong Ding, Chunhua Shen, and Chao Wu. 2022. Dense: data-free one-shot federated learning. In Proceedings of the 36th International Conference on Neural Information Processing Systems, pages 21414–21428. Appendix A Threat Model Details This section expands the threat scope summarized in Section˜3.2. A.1 Adversary Roles We distinguish the primary adversary in the application stage from a narrower diagnostic in the training stage. In both cases, capability tags and participation are public; privacy is defined as leakage beyond these public facts. Table 5: Two-stage threat scope. Capability tags and agent participation are public in both stages. Stage Observer Visible information Privacy concern Evaluation Application Requesting agent Sanitized snippet, query context, and helper capability tag Leakage beyond the public tag, including explicit PII, private evidence in the returned text, and organizational fingerprints PII leakage metrics and text stylometry Training Federated coordinator or auditor Model updates and uploaded role prototypes, but not raw text or full local embeddings Persistent prototype signatures that reveal private corpus structure beyond public participation Representation and prototype attribution probes Primary recipient adversary. A collaborating agent receives sanitized text d~ d together with public routing metadata, including the helper’s capability tag. The recipient may try to recover private information from the sanitized content, including explicit PII, stylistic fingerprints tied to the source, organizational document conventions, or other evidence about the helper’s private repository beyond the public tag used for routing. This is the primary adversary addressed by the role and style disentanglement in DiSan. Illustrative application scenario. In the IPO analysis case study (Section˜C.9), Lumina Capital’s Audit-Core agent lacks sufficient external evidence and routes subqueries to helper agents using public capability tags such as CorporateBank, MarketForecaster, and AssetManager. The tag itself is not private, since Audit-Core already knows that a CorporateBank helper is being queried for credit risk evidence. The privacy risk is that the returned sanitized snippet may reveal information beyond this public tag. Examples include residual company names, account or location identifiers, proprietary report templates, recurring credit assessment language, sector taxonomies, and other organizational fingerprints. Such leakage could allow the requester to infer private properties of the helper’s repository or internal business process even without seeing the raw document. Our evaluations match these surfaces. PII metrics measure explicit identifier leakage in sanitized outputs and final answers. Stylometric attribution on sanitized text measures distributional fingerprints tied to the source. Representation and prototype attribution probes diagnose whether the learned role space and uploaded prototypes retain signals associated with the source that could support inference beyond public tags. We do not claim protection against arbitrary reconstruction of a helper’s full private corpus. Training stage prototype observer. During federated training, the coordinator observes model updates and uploaded role prototypes but not raw text or full local embeddings. We do not aim to hide which public agent participates in training from the coordinator. Instead, EXP-2 asks whether uploaded prototypes become persistent source fingerprints that reveal private distributional properties of an agent’s repository beyond its public tag. Because agents hold non-IID corpora, their prototypes can reflect distinctive document type mixtures, role and entity frequencies, and business process patterns. For example, a CorporateBank agent centered on counterparty risk and credit assessments may induce different role space directions than a MarketForecaster agent centered on equity forecasts and price targets. If such directions remain stable across rounds, an observer can link training artifacts over time or across tasks and infer how an agent’s private corpus is organized, without seeing raw text. DiSan addresses this through adversarial training on prototypes, expressed by ℒadvL_adv, and Gaussian noise perturbation with σ=0.01σ=0.01 before upload. Together, these mechanisms suppress the directional signatures evaluated in EXP-2 (Section˜C.1). Out-of-scope adversaries. We do not address active adversaries (malicious servers, poisoning, prompt injection) or collusion between multiple recipients and the coordinator. These represent important directions for future work but are orthogonal to the sanitization objective studied here. A.2 Validation Scope Section˜3.2 summarizes the validation goals in the main text. The detailed protocols are reported in Sections˜5.4 and C.1: PII metrics evaluate explicit identifier leakage, stylometry evaluates source signatures in transmitted text, and embedding/prototype attribution probes diagnose whether learned sharing artifacts carry persistent source information. Appendix B Additional Method Details This appendix collects components omitted from the main paper for space, including (i) fusion/residual design, (i) expanded prototype objectives and prototype-level adversarial training, and (i) the federated training procedure. B.1 Fusion and Residual Stabilization After fusing the role and style streams via fused=g([r;s])H_fused=g([Z_r;Z_s]), we apply a residual path to stabilize training: out=α⋅fused+(1−α)⋅,H_out=α·H_fused+(1-α)·H, (8) where α=σ(a)∈(0,1)α=σ(a)∈(0,1) is a learnable scalar gate initialized so that α is small early in training. For completeness, we provide the gradient decomposition induced by this residual gate. Let θenc _enc denote the parameters of the pretrained encoder backbone (the component that produces H from input tokens). Note that θenc _enc excludes the fusion layer g, gating parameters a,α\a,α\, and projection heads r,sW_r,W_s. Under this convention: ∂ℒ∂θenc=∂ℒ∂out[α∂fused∂+(1−α)]∂θenc. ∂ _enc= _out [α _fused +(1-α)I ] ∂ _enc. (9) The residual path helps maintain stable gradients early in training when the role/style streams are still adapting. B.2 Expanded Prototype Objectives Batch role centroid. For each type k∈k , agent c computes the batch role centroid as a token-level average: ¯r,k(c)=1|Ωk(c)|∑(i,t)∈Ωk(c)r,t(i),Ωk(c)=(i,t):ℓi,t=k. z_r,k^(c)= 1| _k^(c)| _(i,t)∈ _k^(c)z^(i)_r,t, _k^(c)=\(i,t): _i,t=k\. (10) If Ωk(c)=∅ _k^(c)= , we skip type k in the corresponding loss term. Decomposed alignment terms. The main paper uses the spherical cosine alignment in Equation˜4. Equivalently, one can view prototype alignment as matching (i) centroid distance, (i) angular direction, and (i) within-batch dispersion, defined per type k∈k : ℒalign _align =∑k∈‖¯r,k(c)−k∗‖22, = _k \| z_r,k^(c)- μ^*_k \|_2^2, (11) ℒcos _cos =∑k∈(1−¯r,k(c)⊤k∗‖¯r,k(c)‖2⋅‖k∗‖2+ϵ), = _k (1- z_r,k^(c) μ^*_k\| z_r,k^(c)\|_2·\| μ^*_k\|_2+ε ), (12) ℒvar _var =∑k∈1|Ωk(c)|∑(i,t)∈Ωk(c)‖r,t(i)−¯r,k(c)‖22, = _k 1| _k^(c)| _(i,t)∈ _k^(c) \|z_r,t^(i)- z_r,k^(c) \|_2^2, (13) ℒproto(full) _proto(full) =ℒalign+ℒcos+λvarℒvar. =L_align+L_cos+ _var\,L_var. (14) Here Ωk(c)=(i,t):ℓi,t=k _k^(c)=\(i,t): _i,t=k\ is the token index set for type k in agent c’s batch (Equation˜10). In practice, the spherical objective in Equation˜4 is a compact alternative that avoids redundant hyperparameters. EMA prototype update. Each agent maintains an EMA prototype for each type: k,s(c)=βk,s−1(c)+(1−β)¯r,k,s(c), μ^(c)_k,s=β\, μ^(c)_k,s-1+(1-β)\, z^(c)_r,k,s, (15) where s indexes steps and β∈(0,1)β∈(0,1). Spherical EMA. When using spherical alignment, we maintain the running prototype on the unit sphere: ^k,s(c)=normalize(β^k,s−1(c)+(1−β)¯^r,k,s(c)), μ^(c)_k,s=normalize\! (β\, μ^(c)_k,s-1+(1-β)\, z^(c)_r,k,s ), (16) where ¯^r,k,s(c)=normalize(¯r,k,s(c)) z^(c)_r,k,s=normalize( z^(c)_r,k,s). Prototype adversarial training. As a diagnostic in the training stage, uploaded prototypes may carry persistent distributional signatures tied to individual sources beyond public agent tags. We therefore train a prototype discriminator DψD_ψ to predict the source of uploaded prototypes, and train the encoder to fool this discriminator using the GRL objective in Equation˜5. To enable gradient flow despite EMA, we use an estimate that preserves gradients: ¯k(c)=(1−η)sg(k(c))+η¯r,k(c), μ^(c)_k=(1-η)\,sg( μ^(c)_k)+η\, z^(c)_r,k, (17) where sg(⋅)sg(·) stops gradients and η∈[0,1]η∈[0,1]. Note that ¯k(c) μ^(c)_k is used only for backpropagation and is not uploaded to the server. The discriminator is trained on the perturbed prototypes that are uploaded: ℒdisc=∑c=1C∑k∈CE(Dψ(~k(c)),c),L_disc= _c=1^C _k CE\! (D_ψ( μ^(c)_k),\,c ), (18) where ~k(c) μ^(c)_k is the perturbed prototype uploaded to the server, as defined in Equation˜21. On the client side, we apply GRL to the estimate that preserves gradients and optimize the adversarial loss: ℒadv=∑k∈CE(Dψ(GRLγ(¯k(c))),c),L_adv= _k CE\! (D_ψ(GRL_γ( μ^(c)_k)),\,c ), (19) where γ is the GRL strength used in Equation˜5. The adversarial loss uses ¯k(c) μ^(c)_k to ensure gradient flow, while the discriminator DψD_ψ is trained on the perturbed uploaded prototypes ~k(c) μ^(c)_k to match the actual attack surface. B.3 Model Architecture Details Backbone. DiSan uses LongT5-TGlobal-Base as its backbone. The encoder combines local sliding-window attention with dynamically constructed global tokens, enabling linear-complexity modeling of sequences up to 16,384 tokens while preserving long-range context. The backbone hidden size is denoted dencd_enc; in our implementation the maximum input length is 1,536 tokens. The decoder is the LongT5 Transformer decoder and generates sanitized text autoregressively from modified encoder states. Thus DiSan does not replace the pretrained decoder with a separate generator; it inserts a role–style bottleneck between the pretrained encoder and decoder. Projection heads and discriminator. LoRA adapters with rank 8 are applied to the attention Q and V projections of the encoder, adding approximately 0.9M trainable parameters. Given encoder states ∈ℝT×dencH ^T× d_enc, the role and style projection heads are linear layers followed by dropout with p=0.1p=0.1 that map each token to 256-dimensional subspaces: r,s∈ℝdenc×256W_r,W_s ^d_enc× 256 (Equations˜1 and 2). The two streams are concatenated and mapped back to dencd_enc by a linear fusion layer g:ℝ512→ℝdencg:R^512 ^d_enc. We use the projected-residual variant by default: the original encoder state is first compressed through the same 512-dimensional bottleneck and projected back to dencd_enc, then mixed with the fused representation using a learnable scalar initialized to 0.5. This preserves generation stability without passing raw encoder states directly to the decoder. Adversarial classifiers. All source attribution discriminators use the same MLP template, input →128→128→C→ 128→ 128→ C, with ReLU activations and dropout 0.1 after each hidden layer; C=7C=7 in our experiments. The role discriminator takes mean-pooled role embeddings with 256 dimensions, and the fused discriminator takes mean-pooled fused encoder states with dimension dencd_enc. Both are trained through a gradient reversal layer to discourage signals tied to individual sources from being encoded in the shareable role stream or in the final decoder input. The prototype discriminator DψD_ψ uses the same MLP architecture with a 256-dimensional input and is trained on uploaded role prototypes; the client-side adversarial loss applies GRL to a prototype estimate with gradients so that local updates make prototypes less predictive of their source agent. B.4 Federated Training Details Parameter-efficient fine-tuning. We employ LoRA Hu et al. (2022) for communication-efficient federated training. Specifically, we freeze the pretrained encoder backbone and apply low-rank adapters only to the attention query and value projections (target modules: q, v). The trainable parameters include: (i) LoRA adapters (≈ 0.9M parameters); (i) role projection rW_r and style projection sW_s; (i) fusion layer g(⋅)g(·) and residual components; (iv) adversarial classifiers. Note that when using LoRA, the gradient decomposition in Equation˜9 flows only through the LoRA-adapted attention layers (not the frozen FFN and normalization layers), while the projection heads rW_r, sW_s receive full gradients. Communication cost. LoRA substantially reduces communication cost compared to full-model synchronization. The pretrained encoder backbone is frozen; only LoRA adapters (applied to attention Q/V projections) and the disentanglement heads are trainable. During each round, agents upload only trainable parameters: LoRA adapters (≈ 0.9M parameters, ≈ 5 MB), role projection head rW_r, and fusion layer g. Style projection weights sW_s remain strictly local and are never transmitted. In addition, each agent uploads and downloads a set of role prototypes of size ||×dr|K|× d_r per round (256-dimensional centroids for |||K| entity types), which is negligible (≈ 1 KB) compared to model synchronization. Convergence analysis. Our method builds on FedProx Li et al. (2020b), which incorporates a proximal term ν2‖θ−θ∗‖2 ν2\|θ-θ^*\|^2 to control client drift under non-IID data. Under standard assumptions (L-smoothness, bounded gradient variance), FedProx guarantees convergence to a stationary point Li et al. (2020b). Our additional loss components (ℒorthL_orth, ℒprotoL_proto) are smooth regularizers that preserve this guarantee. The adversarial component ℒadvL_adv introduces additional complexity; we rely on empirical validation of stable convergence through training curves and loss monitoring across all federated rounds. FedProx. We add a proximal regularizer during updates: ℒprox=ν2‖θ−θ∗‖22.L_prox= ν2 \|θ-θ^* \|_2^2. (20) Prototype perturbation. Before uploading, agents may apply ℓ2 _2-normalization and add Gaussian noise: ~k(c)=normalize(k(c)+(,σnoise2)). μ^(c)_k=normalize\! ( μ^(c)_k+N(0, _noise^2I) ). (21) Pseudocode. Algorithm 1 summarizes the end-to-end federated training procedure. Algorithm 1 DiSan Training Input: Agents 1,…,C\1,…,C\ with local data c\D_c\, rounds R, local steps K Initialize global model θ∗θ^* and prototype discriminator DψD_ψ Initialize global prototypes k∗k∈\ μ^*_k\_k (e.g., zeros) for ρ=1ρ=1 to R do Broadcast θ∗θ^*, DψD_ψ, and k∗k∈\ μ^*_k\_k to all agents for agent c=1c=1 to C in parallel do θ(c)←θ∗θ^(c)←θ^* for s=1s=1 to K do Sample a batch from cD_c Compute ℒlocal(c)L^(c)_local (Equation˜6) Update θ(c)θ^(c) via gradient descent Update running prototypes k(c)k∈\ μ^(c)_k\_k (Equation˜15 or Equation˜16) end for Optional perturbation: ~k(c)←perturb(k(c))∀k∈ μ^(c)_k ( μ^(c)_k)\ ∀ k Upload (θ(c),~k(c)k∈,Nc,kk∈) (θ^(c),\ μ^(c)_k\_k ,\N_c,k\_k ) to server end for θ∗←weighted_avg(θ(c)c=1C)θ^*← weighted\_avg(\θ^(c)\_c=1^C) for k∈k do k∗←∑c=1CNc,k~k(c)∑c=1CNc,k μ^*_k← Σ _c=1^CN_c,k\, μ^(c)_kΣ _c=1^CN_c,k end for Train DψD_ψ on (~k(c),c)c,k\( μ^(c)_k,c)\_c,k using Equation˜18 end for Return θ∗θ^* Appendix C Experimental Supplement C.1 Attack Evaluation We empirically evaluate privacy on three surfaces: sanitized output text, learned representations, and uploaded prototypes, as shown in Tables˜7 and 8. The primary surface in the application stage is sanitized text received by another agent. Capability tags and participation are public in our threat model, so the 7-way probes are not meant to hide the helper capability tag itself. They serve as diagnostics for whether sanitized text, role representations, or uploaded prototypes still carry residual source-correlated distributional fingerprints beyond that public information. Style representations remain strictly local and are reported only as a sanity check that variation identifying agents has been isolated into the local stream. EXP-1: Embedding Attribution. We employ an SVM classifier with RBF kernel to probe whether embeddings retain source-correlated fingerprints beyond public tags. For role embeddings, which form the internal stream from which sanitized text and prototypes are derived, the SVM achieves close to random performance, with F1==0.05 and Acc==0.18. This indicates successful privacy protection. As a disentanglement sanity check, style embeddings remain strictly local and are never transmitted. They achieve high accuracy, with Acc==0.89 and F1==0.84, confirming that ℒorthL_orth isolates source-correlated variation into the local style stream. This contrast validates the design. Style carries agent fingerprints but never crosses the privacy boundary, while only sanitized text d~ d derived from role representations is transmitted. Matched distribution tests confirm robustness: role F1 remains at 0.05 while style F1 stays at 0.80. EXP-2: Prototype Attribution. We test whether uploaded role prototypes expose stable fingerprints tied to individual sources beyond public agent tags through two probes. Sample-to-Proto predicts which client prototype is closest to a training sample embedding. Bootstrap-Proto trains a probe on local client data and tests it on uploaded prototypes. Both achieve close to random performance, with Acc==0.14–0.16 and F1≈ 0.09. The 95% confidence intervals include zero, indicating that prototype defenses, including normalization, noise perturbation, and adversarial training, suppress persistent prototype signatures. Cross-round linkage attacks train on round-1 prototypes and test on round-12 prototypes. They achieve F1==0.10, confirming that temporal linkage is also ineffective. EXP-3: Text Stylometry. We evaluate stylometric leakage in sanitized text using two complementary probes: (i) TF-IDF features (5000 dimensions, unigrams + bigrams) with classical classifiers (Logistic Regression, LinearSVC, Random Forest); and (i) a neural encoder probe (all-MiniLM-L6-v2) Reimers and Gurevych (2019); Wang et al. (2020) capturing deeper contextual patterns beyond surface n-grams. These probes use source labels as a diagnostic signal for residual distributional fingerprints, rather than as a claim that public capability tags are hidden. EXP-3a (Synthetic Finance): The full 7-way test shows high F1 (≈ 0.90) for both raw and sanitized text, reflecting document-type confounding rather than stylistic signals. Controlled binary tests isolating stylometric variation show attribution F1 of 0.51–0.56 (sanitized) vs. 0.54–0.57 (raw), both near the 0.50 random baseline, suggesting limited intrinsic style variation in the synthetic data. EXP-3b (Enron Emails, External Validation): To validate on real-world data with genuine author variation, we evaluate on the Enron email corpus Klimt and Yang (2004) (7 authors, 500 emails each; details in Section˜C.3). On raw emails, TF-IDF achieves 82.5% F1 and the BERT probe achieves 69.1% F1 (vs. 14.3% random baseline). We also run stylometric attribution after placeholder masking with each PII detector from our baselines, to directly test whether token-level removal resolves distributional leakage. Even GLiNER, the strongest detector (masking 19.2% of tokens), reduces TF-IDF attribution to 67.2% (18.6% reduction) and BERT attribution to 61.8% (10.6% reduction). After DiSan sanitization, TF-IDF drops to 22.1% (73.2% reduction) and the BERT probe drops to 20.3% (70.6% reduction), both approaching the random baseline. The gap confirms that distributional signatures persist even after aggressive masking, and that a representation-level approach is necessary to suppress them. EXP-3c (Authorship Obfuscation Baselines): We compare against two recent authorship obfuscation methods on the identical Enron setup: JAMDEC Fisher et al. (2024b), which applies constrained decoding over a small language model to suppress author-specific tokens, and StyleRemix Fisher et al. (2024a), which perturbs fine-grained style elements via LoRA modules in two modes (Fixed: uniform style target; Adaptive: per-author target). Results are in Table˜6. JAMDEC barely moves the attribution needle (TF-IDF F1: 0.825→0.8160.825→ 0.816, 1.2% reduction), suggesting that constrained decoding without explicit disentanglement leaves distributional fingerprints intact. StyleRemix Fixed achieves 11.5% TF-IDF reduction but only 3.4% under the neural BERT probe, indicating that surface n-gram perturbation does not fully remove contextual attribution cues. StyleRemix Adaptive backfires: by steering each author toward a distinct style target it introduces new per-author signatures, increasing TF-IDF F1 to 0.970 and BERT F1 to 0.845, both above the raw baseline. DiSan delivers 73.2% TF-IDF reduction and 70.6% BERT reduction, approximately 60×60× greater than JAMDEC and 6×6× greater than the best StyleRemix variant, by enforcing explicit role–style disentanglement rather than surface-level rewriting. Table 6: EXP-3c: Authorship obfuscation baselines on Enron Emails (7-way). Reduction is relative to the 0.825 TF-IDF / 0.691 BERT raw baseline. Negative values indicate worse-than-raw attribution (backfire). Random baseline: F1==0.143. Method TF-IDF F1 TF-IDF Red. BERT F1 BERT Red. Raw text 0.825 – 0.691 – JAMDEC 0.816 1.2% 0.696 −-0.6% StyleRemix Fixed 0.737 11.5% 0.664 3.4% StyleRemix Adaptive 0.970 −-20.8% 0.845 −-27.9% DiSan (ours) 0.221 73.2% 0.203 70.6% Random baseline 0.143 – 0.143 – Attack model scope. Our evaluation employs a principled hierarchy: (i) classical stylometry (TF-IDF + linear classifiers) Stamatatos (2009) for reproducibility; (i) neural encoder probes (all-MiniLM-L6-v2) capturing deeper contextual patterns; and (i) dedicated authorship obfuscation baselines (JAMDEC, StyleRemix) that directly target distributional fingerprints. Consistency across all levels (F1≈ 0.05 for embeddings, 73.2% stylometric reduction on Enron, 6–60×6--60× greater reduction than obfuscation baselines) provides converging evidence of effective privacy protection under the honest-but-curious threat model. Stronger attacks (LLM-based attribution, adaptive adversaries with repeated queries) remain important future directions but exceed typical honest-but-curious capabilities. Table 7: Attack evaluation: Embedding and Prototype Attribution (EXP-1, EXP-2). Random baseline: Acc==F1==0.14. EXP-1: Embedding Attribution (SVM, 7-way) Embedding Acc F1 Match F1 Note role (shared) 0.18 0.05 0.05 Near-random style (local) 0.89 0.84 0.80 Validated EXP-2: Prototype Attribution Attack Acc F1 Boot Acc 95% CI Sample-to-Proto 0.16 0.09 – – Bootstrap-Proto 0.14 0.07 0.13± 0.13 [0.00, 0.43] Table 8: Attack evaluation: Text Stylometry (EXP-3a, EXP-3b). TF-IDF and BERT probes on synthetic finance and Enron emails. EXP-3b also includes placeholder-masking baselines to directly test whether token-level removal resolves distributional leakage. Random baseline: F1==0.143. EXP-3a: Synthetic Finance (7-way) Setting Best F1 Random Controlled Raw (TF-IDF) 0.90 0.14 0.54–0.57 Raw (BERT) 0.87 0.14 0.52–0.55 DiSan (TF-IDF) 0.89 0.14 0.51–0.56 DiSan (BERT) 0.86 0.14 0.49–0.53 EXP-3b: Enron Emails (7-way) Method Mask% TF-IDF F1 BERT F1 TF-IDF Red. Raw text – 0.825 0.691 – +Piiranha 5.3% 0.785 0.669 4.9% +DeBERTa 17.5% 0.744 0.649 9.9% +GLiNER 19.2% 0.672 0.618 18.6% DiSan – 0.221 0.203 73.2% Random – 0.143 0.143 – C.2 Attack Evaluation Details For all embedding attribution attacks (EXP-1), we use Support Vector Machines (SVM) with RBF kernel. For prototype attribution (EXP-2), we evaluate two attacks: • Sample-to-Proto: For each test sample, compute its role embedding centroid and measure cosine similarity to each client’s global prototype; predict the client with highest similarity. • Bootstrap-Proto (MLP): Train an MLP classifier on prototype embeddings from training rounds and evaluate on held-out rounds, testing cross-round linkability. C.3 Enron Email Experiment Details To validate stylometric protection on real-world data with genuine author variation, we conduct an external evaluation on the Enron email corpus Klimt and Yang (2004). This dataset contains approximately 500,000 emails from 150 Enron employees, released during the 2001 federal investigation. It is widely used as a benchmark for authorship attribution and email classification research. Data selection and preprocessing. We select the top 7 senders by email volume to match the number of agents in our main experiments: kaminski-v (20,123 emails), mann-k (16,891), dasovich-j (16,359), jones-t (15,491), kean-s (15,352), shackleton-s (14,076), and farmer-d (9,869). For each sender, we randomly sample 500 emails (stratified), yielding 3,500 total samples. Preprocessing steps: • Extract email body by removing headers (To, From, Subject, Date, etc.) • Remove forwarded message markers and quoted reply sections • Filter emails by body length: minimum 100 characters, maximum 2,000 characters Feature extraction. We use TF-IDF vectorization with the following parameters: • Maximum features: 5,000 • N-gram range: unigrams and bigrams • Minimum document frequency: 2 • Maximum document frequency: 0.95 Classification. We evaluate three classifiers commonly used in stylometry research: • Logistic Regression: L2 regularization, max iterations = 1,000 • LinearSVC: Linear kernel SVM, max iterations = 1,000 • Random Forest: 100 estimators For stronger attack evaluation, we also employ a pre-trained transformer encoder (all-MiniLM-L6-v2) to generate 384-dimensional sentence embeddings, followed by SVM-RBF classification. This neural probe captures deeper contextual patterns beyond surface-level n-grams. Data is split into 70% training and 30% test sets using stratified sampling (random seed = 42). We report the best F1 (macro) across all classifiers. Sanitization. Raw emails are processed through the trained DiSan model using greedy decoding (beam size = 1) with the task prefix ‘deidentify:’. Both TF-IDF and BERT pipelines are then applied to the sanitized outputs to evaluate residual stylometric leakage. Results interpretation. The 82.5% F1 on raw emails versus 14.3% random baseline confirms that Enron emails exhibit strong, distinguishable stylistic patterns across senders, unlike our synthetic finance dataset where controlled tests showed near-random attribution even on raw text. Placeholder masking offers diminishing returns: even GLiNER, the strongest detector at 19.2% token removal, reduces TF-IDF F1 to only 67.2% (18.6% reduction). This directly demonstrates that source-identifying signals are distributed across the text rather than concentrated in explicit identifiers. DiSan reduces TF-IDF F1 to 22.1% (73.2% reduction, 0.825→0.2210.825→ 0.221), nearly 4× the best masking baseline, demonstrating effective removal of author-identifying patterns when they exist in the source data. The BERT probe (SVM-RBF on transformer embeddings) yields lower raw F1 (69.1%) than TF-IDF, suggesting that Enron stylometry relies more on surface-level n-gram patterns than deep semantic structure. Nevertheless, DiSan still achieves 70.6% reduction (0.691→0.2030.691→ 0.203), showing that the reduction also holds under a neural attribution probe. C.4 Agent construction and non-IID statistics We construct agents by doc-type as described in Section˜5. This induces (i) quantity skew (agents have different numbers of documents), (i) label skew (doc-type inventories differ by design), and (i) feature skew (document length and entity-type distributions differ across agents). In our threat model (Section˜3.2), capability tags (agent identities such as “AssetManager”) are treated as public; therefore, our privacy evaluation focuses on leakage beyond these public priors. Figure˜4 visualizes these heterogeneity patterns across the seven agents. Figure 4: Non-IID data heterogeneity across agents. (a) Entity type distribution (normalized) shows different agents emphasize different PII categories. (b) Document type distribution confirms disjoint doc-type inventories by design. C.5 Agent doc-type inventories and hyperparameters Table˜9 lists the exact doc-type identifiers used to construct each agent and the complete hyperparameter set for reproducibility. Table 9: (Left) Agent doc-type inventories for C=7C=7 agents. (Right) Hyperparameters and schedules. Agent Doc-type identifiers CorporateBank Financial_Regulatory_Compliance _Report; Financial_Risk_Assessment. AssetManager Investment_Prospectus; Product_Disclosure_Statement. FinTechPay Business_Plan; Dispute_Resolution_Policy. CorpGroup Annual_Report; Audit_Report; Financial_Risk_Assessment. MarketForecaster Financial_Forecast. ComplianceConsult Financial_Regulatory_Compliance _Report; Regulatory_Compliance_Guide. SupplierCo Supply_Chain_Management_Agreement. Federated training Rounds 12 Local steps per round 300 Batch size 4 Learning rate 2×10−42× 10^-4 FedProx ν 0.1 Loss weights and schedules λadv _adv 1.0 GRL strength γ 0.5 λorth _orth 0.2 λp _p (prototype alignment) 1.0 Proto alignment warmup 30 steps (round 2) Prototype discriminator steps/round 200 Prototype noise scale σ 0.01 C.6 Implementation and Evaluation Details Model architecture. DiSan uses LongT5-TGlobal-Base as its backbone; full architecture details are in Section˜B.3. RAG evaluation: query and ground-truth construction. We construct the RAG benchmark from the sanitized/re-written document records rather than generating free-form queries from scratch. Each input JSONL record contains a document identifier, domain, document type, PII annotations, and a rewritten_text field used as the retrieval corpus. The construction pipeline is: 1. Chunking. Documents are split into sentence-aware chunks with a 256-token target length and 50-token overlap. Each chunk keeps its uid, document type, source file, sample index, chunk index, and a stable chunk_id. Chunks are grouped by document type for generation and by agent identifier for retrieval. 2. Anchor extraction. For every chunk, a schema-guided LLM prompt extracts retrieval-oriented anchors: role hooks, topic/procedure hooks, deadlines, required items, logic gates, regulations, temporal buckets, and a short summary of the local business rule. The prompt requires anchors to be supported by verbatim or near-verbatim evidence from the chunk and discourages PII-bearing names or addresses unless they are essential to the rule. 3. Grounded QA synthesis. We sample anchor-annotated chunks with a fixed random seed and ask the LLM to generate one focused question, a concise ground-truth answer, and evidence snippets for each sampled chunk. The question must be answerable using only that chunk; the answer records decision factors such as role, requirement/deadline, and logic gate when they are explicitly present. 4. Validation and provenance. Generated examples are discarded if the evidence is not found in the source chunk or if the query/answer introduces known unsupported concepts. Each retained record stores the originating chunk_id, merged anchors, evidence spans, and document metadata, so ChunkHit@3 can be computed against the true retrieval target. This procedure yields a JSONL file of grounded QA records and a separate set of per-agent context files used by the retrieval services. The ground-truth answers are therefore anchored to verbatim source spans, while the evaluation query is natural language and may require the retriever to recover the correct chunk from an agent’s local index. Retrieval architecture. Each agent maintains a private local index built from its own context file; raw documents are not centralized for retrieval. At evaluation time, the requester first selects candidate helper agents using the public capability tags described in Section˜3.1. Each selected helper executes the same local retrieval stack over its own chunks and then applies the evaluated sharing policy (raw sharing, placeholder masking, paraphrasing, policy gating, or DiSan) before transmitting evidence to the requester. The local retrieval stack uses a three-stage hybrid pipeline based on BGE-M3. Stage 1 computes candidate sets from dense semantic embeddings, learned sparse lexical vectors, and ColBERT-style late-interaction vectors. Stage 2 normalizes and fuses the candidate scores, with adaptive weights that increase the sparse component for keyword-rich queries. Stage 3 re-ranks the fused candidates with bge-reranker-v2-m3; the final top-k chunks can be expanded with neighboring chunks from the same document to provide broader context for answer generation. The requester deduplicates returned chunks by chunk_id, keeps the highest-scoring evidence up to the evaluation budget, and prompts the answer model to respond only from the received sanitized context. Artifact licenses and terms. We use publicly available datasets, models, and evaluation tools under their respective licenses or terms of use, including the synthetic finance corpus, Enron email corpus, GLiNER, BGE-M3, LongT5, and open-source LLM baselines. We do not redistribute restricted raw data; released code and derived artifacts are intended for research use. PII detector for leakage metrics. For Avg. PII and Ans. Rate in Table˜2, we evaluate the text exposed to the requester using gliner-pii-large-v1.0 Zaratiana et al. (2024), a generalist named-entity detector configured with a PII label set covering names, first/last names, email addresses, phone numbers, street/location addresses, city/state/zip, credit-card and bank-account numbers, SSNs, dates of birth, dates, company/organization names, usernames, IP addresses, URLs, passport numbers, and driver-license numbers. We use a confidence threshold of 0.3 and count non-overlapping detected spans. Avg. PII is the mean number of detected PII spans per shared/retrieved chunk after the method under evaluation has been applied. Ans. Rate is the percentage of generated final answers for which the same detector finds at least one PII span. The detector is used only for evaluation; training still relies on the dataset’s annotated spans and token-level labels, with optional detector-derived masks used only as auxiliary signals when available. Utility metrics: cosine similarity. The cosine similarity reported in Table˜2 uses a bag-of-words term-frequency representation rather than neural embeddings, serving as a lightweight lexical similarity measure that complements token-level F1. This is distinct from the 768-dimensional BGE-M3 dense embeddings used in retrieval. C.7 Baselines: prompts and policies For LLM paraphrasing, we apply a privacy-focused prompt that (i) removes or generalizes PII, (i) preserves relational semantics needed for grounding, and (i) avoids source-identifying formatting. For policy gating, following dynamic access-control memory sharing Rezazadeh et al. (2025), the policy model decides per chunk based on the requester’s agent tag and the helper’s data sensitivity level, outputting one of three actions: share (return original text), share summary (return a LLM-generated summary), or refuse (return nothing). LLM paraphrasing prompt. The following prompt is used solely for the RAG utility evaluation reported in Table˜2 and discussed in Section˜5.4, where LLM paraphrasing serves as a PII-removal baseline: You are an assistant that rewrites English financial or compliance-related text to remove personally identifiable information (PII) while preserving all task-relevant content. Your task is to produce a clear, natural-sounding rewritten version that protects individual privacy while retaining the informational value of the text. The rewritten text should preserve financial metrics, business relationships, temporal context, and domain-specific details that are important for downstream tasks. Guidelines: • Remove or replace explicit PII such as personal names, phone numbers, email addresses, account numbers, and physical addresses. • Preserve important non-private information including: financial figures, percentages, growth rates, industry terms, product categories, and general business context. • Keep temporal references (e.g., “Q3 2023”, “fiscal year”) and geographic regions when they provide useful context without identifying individuals. • Maintain the logical structure, professional tone, and factual accuracy of the original text. • When generalizing, prefer minimal changes that protect privacy while maximizing retained information. Return only the rewritten text. Do not include explanations, examples, or commentary. RAG question-answering prompt. For the downstream RAG evaluation, we use the following prompt to ensure the answering model relies strictly on retrieved (sanitized) evidence: You are a knowledgeable assistant that answers questions strictly based on the provided context. Instructions: 1. Answer ONLY using information from the provided context. Do not use external knowledge. 2. If the context lacks sufficient information, respond: “I cannot answer this based on the provided context.” 3. Keep your answer concise, accurate, and directly relevant to the question. C.8 Ablation Results The ablation results in Table˜3 (main paper) demonstrate the importance of each component. Removing style isolation (A1, A2) dramatically increases PII exposure (7–9×) while slightly improving some surface utility metrics, demonstrating the privacy cost of weaker disentanglement. Removing prototype alignment (B) degrades both utility and privacy, confirming that cross-client anchoring prevents role-space drift. Table˜10 reports attack evaluation: A1/A2 increase Role Acc from 0.28 to 0.34–0.40, further confirming that ℒorthL_orth suppresses client-identifying signals in role embeddings. Table 10: Attack evaluation (ablation). EXP-1: representation probe (7-way); higher Role Acc/F1 indicates weaker privacy, while high Style Acc/F1 is a disentanglement sanity check. EXP-2: prototype-based client attribution (Bootstrap-MLP); only applicable to settings that upload prototypes. EXP-1: Representation Probe EXP-2: ProtoAttrib (Bootstrap-MLP) Setting Role Acc Role F1 Style Acc Style F1 Acc Boot Acc (Mean± ) 95% CI DiSan (ours) 0.2765 0.1338 0.8743 0.8300 0.1429 0.1314 ± 0.1207 [0.00, 0.43] A1: w/o ℒorthL_orth 0.3381 0.1842 0.8751 0.8312 0.2286 0.2194 ± 0.1091 [0.09, 0.43] A2: high-α fusion 0.4012 0.2428 0.8760 0.8324 0.3000 0.2897 ± 0.1158 [0.14, 0.51] B: No-ProtoAlign 0.2946 0.1510 0.8748 0.8307 N/A N/A N/A Figure 5: Role–style disentanglement visualization. (a) Role-style orthogonality per agent: cosine similarity between role and style embeddings clusters tightly around zero, indicating successful disentanglement via ℒorthL_orth. (b) Combined t-SNE projection shows clear separation between role (shared, blue circles) and style (private, orange triangles) embeddings in the latent space. C.9 Case Study: Cross-Organizational IPO Analysis Figure 6: Cross-organizational IPO analysis. Lumina Capital’s Audit-Core agent queries partner agents via a data broker; each external agent sanitizes its response with DiSan before transmission. Entity names, geographic identifiers, and organizational details are removed while task-relevant financial metrics are preserved, enabling accurate cross-party assessment without exposing source identity. Appendix D Theoretical Analysis This section provides theoretical justification for key design choices in DiSan: (i) how prototype alignment mitigates role-space drift under non-IID data, and (i) how orthogonality constraints promote disentanglement. We complement this analysis with comprehensive empirical validation (Sections˜5 and C.1). D.1 Prototype Alignment and Role-Space Drift Without global coordination, each agent c learns a local role encoder r(c)W_r^(c) that maps text to role representations. Under non-IID data, these local role spaces can drift apart: the same semantic concept (e.g., “account number”) may be encoded differently across agents. This drift harms both privacy (agent-specific encodings leak identity) and utility (inconsistent representations degrade downstream tasks). Our prototype alignment loss (Equation˜4) acts as a semantic anchor that pulls local role distributions toward a shared global reference. Formally, for each entity type k∈k , the loss penalizes angular deviation between the local batch centroid ¯^r,k(c) z_r,k^(c) and the global prototype ^k∗ μ_k^*: ℒproto(c)=∑k∈(1−cos(¯^r,k(c),^k∗)).L_proto^(c)= _k (1- ( z_r,k^(c), μ_k^*) ). (22) We now show that this regularizer bounds the divergence between local role spaces under well-specified assumptions. Assumption D.1 (Normalized Centroid Boundedness). For any agent c and entity type k, the normalized centroid has bounded norm away from zero: ‖¯^r,k(c)‖=1\| z_r,k^(c)\|=1 by definition, and ‖¯r,k(c)‖≥δk>0\| z_r,k^(c)\|≥ _k>0 for some constant δk _k (which holds in practice since embeddings are initialized with non-zero norms and gradients preserve this property). Assumption D.2 (Sub-Gaussian Token Embeddings). For each entity type k, the token embeddings r,t(i)(i,t)∈Ωk(c)\z_r,t^(i)\_(i,t)∈ _k^(c) are independently drawn from a distribution with bounded sub-Gaussian norm ψk _k, i.e., Pr(‖−μ‖2≥t)≤2exp(−ψk2t2/2) (\|z-μ\|_2≥ t)≤ 2 (- _k^2t^2/2) for all t>0t>0. Assumption D.3 (Within-Type Variance Bound). The within-type variance is bounded: 1Nc,k∑(i,t)∈Ωk(c)‖r,t(i)−¯r,k(c)‖2≤σk2 1N_c,k _(i,t)∈ _k^(c)\|z_r,t^(i)- z_r,k^(c)\|^2≤ _k^2, where Ωk(c) _k^(c) is the set of token positions of type k in agent c’s batch, and Nc,k=|Ωk(c)|N_c,k=| _k^(c)|. Assumption D.4 (Prototype Loss Bound). The prototype alignment loss satisfies ℒproto(c)≤ϵL_proto^(c)≤ε for all agents c. Assumption D.5 (Sufficient Samples). Each agent c has at least NminN_ samples of type k in the batch. Theorem D.6 (Prototype Alignment Bounds Role-Space Divergence). Under Assumptions D.1–D.5, for any two agents c,c′c,c that both have samples of type k, the angular distance between their normalized batch centroids satisfies: Pr(arccos(¯^r,k(c)⋅¯^r,k(c′))>22ϵ+tσkNmin)≤4exp(−ψk2Nmint28), ( ( z_r,k^(c)· z_r,k^(c ) )>2 2ε+ t\, _k N_ )≤ 4 (- _k^2N_ t^28 ), (23) where t>0t>0 is a confidence parameter, σk2 _k^2 is the within-type variance, ψk _k is the sub-Gaussian parameter, and ¯^r,k(c)=¯r,k(c)/‖¯r,k(c)‖ z_r,k^(c)= z_r,k^(c)/\| z_r,k^(c)\| denotes the normalized centroid. Proof. By the triangle inequality for angular distance on the unit sphere: arccos(¯^r,k(c)⋅¯^r,k(c′)) ( z_r,k^(c)· z_r,k^(c ) ) ≤arccos(¯^r,k(c)⋅^k∗)+arccos(^k∗⋅¯^r,k(c′)). ≤ ( z_r,k^(c)· μ_k^* )+ ( μ_k^*· z_r,k^(c ) ). (24) From Assumption D.4, we have: 1−cos(¯^r,k(c),^k∗)≤ϵ1- ( z_r,k^(c), μ_k^*)≤ε, since each term in the sum is non-negative. For small x, we have arccos(1−x)≤2x (1-x)≤ 2x (this follows from the Taylor expansion arccos(1−x)=2x(1+O(x)) (1-x)= 2x(1+O(x)) for x→0x→ 0). Applying this with x=1−cos(¯^r,k(c),^k∗)x=1- ( z_r,k^(c), μ_k^*): arccos(¯^r,k(c)⋅^k∗)≤2ϵ. ( z_r,k^(c)· μ_k^* )≤ 2ε. (25) The same bound holds for agent c′c . Substituting into Equation˜24: arccos(¯^r,k(c)⋅¯^r,k(c′))≤22ϵ. ( z_r,k^(c)· z_r,k^(c ) )≤ 2 2ε. (26) We now account for finite-sample effects. Under Assumption D.2 and Assumption D.3, the empirical centroid ¯r,k(c) z_r,k^(c) concentrates around the population mean r,k μ_r,k as NminN_ increases. We assume the global prototype k∗ μ_k^* converges to r,k μ_r,k as the number of federated rounds increases (justified by EMA aggregation across all agents). Specifically, by the sub-Gaussian concentration inequality, for any t>0t>0: Pr(‖¯r,k(c)−r,k‖2≥tσkNmin)≤2exp(−ψk2Nmint22). ( \| z_r,k^(c)- μ_r,k \|_2≥ t _k N_ )≤ 2 (- _k^2N_ t^22 ). (27) To bridge Euclidean error to angular error, we use the following inequality: for any vectors u,vu,v with ‖u‖≥δ\|u\|≥δ and ‖v‖≥δ\|v\|≥δ, arccos(u‖u‖⋅v‖v‖)≤2δ‖u−v‖2. ( u\|u\|· v\|v\| )≤ 2δ\|u-v\|_2. (28) This follows from the relationship between angular distance and chordal distance on the unit sphere. Applying this with δ=δkδ= _k (Assumption D.1), we have: arccos(¯^r,k(c)⋅^k∗)≤2δk‖¯r,k(c)−r,k‖2. ( z_r,k^(c)· μ_k^* )≤ 2 _k \| z_r,k^(c)- μ_r,k \|_2. (29) Combining the deterministic bound 22ϵ2 2ε with the probabilistic error term and applying a union bound over both agents yields the stated result with the confidence parameter t. The constants are absorbed into the exponential decay rate for clarity. ∎ This result formalizes the intuition that prototype alignment prevents role-space drift: as long as all agents maintain low prototype loss (ϵε small), their role representations for the same semantic type remain close in angular distance with high probability. The bound degrades gracefully with within-type variance σk2 _k^2 and improves with more samples per type. Bounded role-space divergence has a privacy implication: if all agents’ role representations for type k are concentrated around a shared prototype ^k∗ μ_k^*, then observing a role embedding rz_r provides limited information about which agent produced it (beyond what is revealed by the type label k itself). This is validated empirically in Table˜7, where role embeddings yield low attribution performance (Acc=0.18, F1=0.05; 7-way random baseline = 0.14). D.2 Orthogonality as a Geometric Proxy for Disentanglement Disentanglement aims to separate role information R (task-relevant semantics) from style information S (agent-identifying patterns) in the learned representations. Ideally, the role embedding rZ_r should capture R but not S, while the style embedding sZ_s should capture S but not R. Our orthogonality loss (Equation˜3) enforces cos2(¯r,¯s)≈0 ^2( z_r, z_s)≈ 0, which geometrically separates the two subspaces. We now provide an information-theoretic perspective on why orthogonality promotes statistical independence. Definition D.7 (Covariance Matrix for Joint Gaussian). For jointly Gaussian random vectors r∈ℝdrZ_r ^d_r and s∈ℝdsZ_s ^d_s, let the joint covariance matrix be =[rrsrs⊤ss] = bmatrix _r& _rs\\ _rs & _s bmatrix. We assume the full covariance matrix ≻0 0 (positive definite), which implies rr≻0 _r 0 and ss≻0 _s 0, ensuring all determinants are well-defined and positive. Lemma D.8 (Gaussian Mutual Information Cover and Thomas (2006)). Under Definition D.7, the mutual information between rZ_r and sZ_s is: I(r;s)=12log|rr|⋅|ss|||.I(Z_r;Z_s)= 12 | _r|·| _s|| |. (30) If the cross-covariance is zero (rs= _rs=0), then ||=|rr|⋅|ss|| |=| _r|·| _s| and consequently I(r;s)=0I(Z_r;Z_s)=0 (statistical independence). Lemma D.8 shows that under jointly Gaussian representations with zero cross-covariance, role and style are statistically independent. Our orthogonality loss ℒorth=cos2(¯r,¯s)L_orth= ^2( z_r, z_s) enforces this separation between mean-pooled vectors, balancing theoretical grounding with computational efficiency in federated training. Ablations (Section˜5.5) confirm its effectiveness: removing ℒorthL_orth increases PII exposure by 7×. D.3 Summary We have provided theoretical justification for two key design choices: 1. Prototype alignment (Theorem˜D.6): Role-space divergence across agents is bounded with high probability, formalizing why prototype alignment prevents drift under non-IID data and why aligned role embeddings leak minimal agent identity. 2. Orthogonality constraint (Lemma˜D.8): Under Gaussian assumptions, orthogonality implies zero mutual information between role and style, providing geometric intuition for why ℒorthL_orth promotes disentanglement. D.4 Privacy Analysis Our primary privacy protection comes from architectural design (style never transmitted), learned disentanglement, and adversarial training. This section discusses the noise injection mechanism applied to prototype uploads. D.4.1 Noise Injection for Prototype Communication During federated training, each agent uploads role prototypes ~k(c) μ_k^(c) to the server. We apply Gaussian perturbation (Equation˜21) before upload: ~k(c)=normalize(k(c)+(,σnoise2)). μ_k^(c)=normalize ( μ_k^(c)+N(0, _noise^2I) ). (31) We use σnoise=0.01 _noise=0.01, which provides mild perturbation while preserving prototype semantics. This noise scale can be tuned: larger values provide stronger perturbation but may degrade prototype quality and downstream utility. Design rationale. Noise injection provides an additional defense layer complementing the core privacy mechanisms in DiSan: 1. Architectural privacy: Style representations sZ_s are never transmitted; they remain strictly local. 2. Learned disentanglement: The role encoder produces agent-invariant representations via ℒorthL_orth and ℒadvL_adv. 3. Empirical validation: Attack evaluations confirm near-random attribution (F1=0.05 for embeddings, F1=0.07 for prototypes). These mechanisms achieve strong empirical privacy without requiring formal differential privacy guarantees, which would impose significant utility costs in federated text settings. Effect of noise on prototype convergence. The noise scale σnoise=0.01 _noise=0.01 is chosen to be a supplementary defense-in-depth layer; the primary privacy guarantees come from architectural isolation of sZ_s, ℒorthL_orth, and ℒadvL_adv. Training remains stable across all 12 rounds because σ=0.01σ=0.01 induces roughly 1% perturbation relative to the ℓ2 _2-normalized prototype norm, and server-side sample-weighted averaging further attenuates per-agent noise by a factor of approximately 1/C1/ C. EXP-2 (Table˜7) confirms that this configuration is sufficient: prototype attribution under both attack variants achieves near-random performance (F1≈ 0.09), while training loss curves show no instability attributable to noise injection. D.4.2 Disentanglement vs. DP for Text Privacy For text output privacy, we adopt disentanglement rather than DP-based approaches for two reasons: (1) Aligned threat model. DP-SGD and DP-text methods protect training data membership, whereas our goal is inference-time source attribution resistance. Disentanglement directly removes agent-identifying patterns from generated text, addressing this threat model precisely. (2) Superior utility-privacy tradeoff. Existing DP-text methods Meisenbacher and Matthes (2024); Xie et al. (2024) show 30–50% coherence loss for ϵ<10ε<10. In contrast, disentanglement achieves strong empirical privacy (73.2% TF-IDF and 70.6% neural-probe stylometric reduction on Enron) with only a 2.93-point faithfulness drop on the RAG benchmark. Comparison to prior work. Recent DP-text generation Meisenbacher and Matthes (2024) achieves ϵ≈8ε≈ 8 with 40% BLEU degradation. Our method achieves 83% faithfulness (vs. 86% baseline) with strong empirical privacy, demonstrating that disentanglement-based approaches achieve better utility-privacy tradeoffs for source attribution tasks. D.4.3 Summary: Layered Privacy Mechanisms DiSan provides privacy through multiple complementary mechanisms: 1. Architectural privacy (strong, by design): Style representations sZ_s are never transmitted; they remain strictly local and are discarded after decoding. 2. Learned privacy (empirical, validated): Disentanglement (ℒorthL_orth) and adversarial training (ℒadvL_adv) produce agent-invariant role representations: • Low embedding-attribution performance (Acc = 0.18, F1 = 0.05; 7-way random baseline = 0.14, EXP-1) • Stylometric reduction (73.2% TF-IDF and 70.6% neural-probe reduction on Enron, EXP-3b) • Near-random prototype attribution (EXP-2) 3. Noise perturbation: Prototype uploads are perturbed with Gaussian noise (σ=0.01σ=0.01) before transmission. Design rationale. Our default configuration prioritizes utility, relying on architectural and learned mechanisms that empirically achieve strong privacy (near-random attribution).