Privacy-Aware Task Partitioning

• Privacy-Aware Task Partitioning algorithms are methods that decompose data, computation, or model components to enforce privacy controls while maintaining task effectiveness.
• They employ domain-specific mechanisms, such as splitting DNN layers, anonymizing event logs, or allocating token budgets, to optimize privacy-utility trade-offs.
• Empirical evaluations reveal significant gains in accuracy, latency reduction, and privacy budgets, highlighting practical benefits in diverse applications.

Privacy-aware task partitioning algorithm denotes a family of methods that deliberately split data, computation, model structure, or workload so that privacy protection can be enforced locally, selectively, or compositionally while preserving task utility. In the SPARSI framework, the problem is to partition a sensitive dataset among $k$ non-colluding adversaries so as to maximize utility and minimize disclosure (Rekatsinas et al., 2013). Subsequent work instantiates analogous ideas for event logs in process discovery (Lim et al., 8 Jul 2025), split neural inference between device and server (Chi et al., 2018), TEE/GPU layer partitioning (Rajasekar et al., 2024), token-level budget allocation in text privatization (Tian et al., 12 Mar 2026), privacy-preserving crowdsourcing partitions of worker-skill space (Duguépéroux et al., 2020), enterprise-cloud agent collaboration (She, 9 Mar 2026), and privacy-aware edge-device collaborative inference under a CMDP (Wang et al., 23 Feb 2026). Across these formulations, partitioning is the mechanism by which privacy budgets, exposure surfaces, and utility losses are jointly controlled.

1. Formal scope and canonical problem statements

The term does not refer to a single canonical optimization problem. Rather, the literature defines domain-specific partitioning objects, disclosure functions, and utility criteria.

In SPARSI, the atomic objects are data entries $D=\{d_1,\dots,d_{|D|}\}$, the receivers are adversaries $A=\{a_1,\dots,a_k\}$, and the privacy targets are sensitive properties $P=\{p_1,\dots,p_{|P|}\}$. Interdependencies are represented by a dependency hypergraph $\mathcal H=(D,P,E)$, where each hyperedge $e_j=D_{p_j}$ contains exactly the entries whose joint release would disclose property $p_j$ (Rekatsinas et al., 2013). The optimization is expressed either as a disclosure-budgeted problem,

$$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$

or as a Lagrangian trade-off,

$\max_S u(S)+\lambda(\tau_I-f(S)),$

with assignment constraints $1\le \sum_{a\in A} x_{d,a}\le t$ for every $D=\{d_1,\dots,d_{|D|}\}$0 (Rekatsinas et al., 2013).

In privacy-aware process discovery, the partitioned object is an event log $D=\{d_1,\dots,d_{|D|}\}$1 over activity universe $D=\{d_1,\dots,d_{|D|}\}$2, together with an abstraction mapping $D=\{d_1,\dots,d_{|D|}\}$3. The target partition is

$D=\{d_1,\dots,d_{|D|}\}$4

where $D=\{d_1,\dots,d_{|D|}\}$5 stores abstracted high-level trace skeletons and each $D=\{d_1,\dots,d_{|D|}\}$6 stores the low-level sub-log belonging to abstraction $D=\{d_1,\dots,d_{|D|}\}$7 (Lim et al., 8 Jul 2025).

In privacy-preserving layer partitioning for DNN inference, the decision variable is a cut point $D=\{d_1,\dots,d_{|D|}\}$8 that places layers $D=\{d_1,\dots,d_{|D|}\}$9 inside the enclave and layers $A=\{a_1,\dots,a_k\}$0 on the GPU. The latency objective is

$A=\{a_1,\dots,a_k\}$1

under the privacy constraint $A=\{a_1,\dots,a_k\}$2 (Rajasekar et al., 2024).

In SplitAgent, a raw enterprise task $A=\{a_1,\dots,a_k\}$3 is decomposed into subtasks $A=\{a_1,\dots,a_k\}$4, then partitioned into enterprise-side and cloud-side subsets $A=\{a_1,\dots,a_k\}$5 and $A=\{a_1,\dots,a_k\}$6, with per-subtask privacy allocations $A=\{a_1,\dots,a_k\}$7 satisfying $A=\{a_1,\dots,a_k\}$8. The optimization is

$A=\{a_1,\dots,a_k\}$9

subject to the DP budget, a utility threshold $P=\{p_1,\dots,p_{|P|}\}$0, and the requirement that raw data never leaves the enterprise environment (She, 9 Mar 2026).

Setting	Partitioned object	Representative objective
SPARSI	Atomic data entries across adversaries	Maximize utility, minimize disclosure
Process discovery	Event log into skeleton log and sub-logs	Preserve process utility under DP
Split inference	DNN layers across local/device and server/GPU	Minimize latency under leakage bound
STAMP	Tokens into four privacy-utility groups	Allocate per-token budgets
SplitAgent	Enterprise subtasks across local and cloud agents	Maximize $P=\{p_1,\dots,p_{|P|}\}$1 under DP budget

2. Partitioning mechanisms and algorithmic structure

The mechanisms used to realize partitioning differ sharply by domain, but they share a common structure: identify a semantically meaningful decomposition, privatize or protect each part separately, and then recombine the outputs.

For event logs, the proposed pipeline has three phases: event-data partitioning via abstraction, independent anonymization of each partition, and process discovery on the anonymized sub-logs (Lim et al., 8 Jul 2025). Algorithm 1 iterates over each trace $P=\{p_1,\dots,p_{|P|}\}$2, builds a map $P=\{p_1,\dots,p_{|P|}\}$3 from abstraction labels to sub-traces, replaces every low-level event $P=\{p_1,\dots,p_{|P|}\}$4 by its abstraction $P=\{p_1,\dots,p_{|P|}\}$5 when $P=\{p_1,\dots,p_{|P|}\}$6, appends the original event to the corresponding sub-trace $P=\{p_1,\dots,p_{|P|}\}$7, then applies compress(\sigma) to remove duplicate $P=\{p_1,\dots,p_{|P|}\}$8 except first+last. The output contains one skeleton log $P=\{p_1,\dots,p_{|P|}\}$9 plus one sub-log per sub-process $\mathcal H=(D,P,E)$0 (Lim et al., 8 Jul 2025). The choice of $\mathcal H=(D,P,E)$1 can be user-defined or automated, including clustering by Günther et al., FHM by Lu et al., or Random clustering (Lim et al., 8 Jul 2025).

In “Privacy Partitioning,” the model $\mathcal H=(D,P,E)$2 is split into a local sub-model $\mathcal H=(D,P,E)$3 with parameters $\mathcal H=(D,P,E)$4 and a remote sub-model $\mathcal H=(D,P,E)$5 with parameters $\mathcal H=(D,P,E)$6, with interface $\mathcal H=(D,P,E)$7 (Chi et al., 2018). The construction is interactive and adversarial: every candidate cut $\mathcal H=(D,P,E)$8 is trained by alternating between an adversarial reconstructor $\mathcal H=(D,P,E)$9, which maximizes the reconstruction-quality term $e_j=D_{p_j}$0, and the split model, which minimizes $e_j=D_{p_j}$1. The chosen cut $e_j=D_{p_j}$2 is the one that best meets the privacy-utility specification (Chi et al., 2018).

The TEE/GPU method uses a simpler scan. It evaluates every $e_j=D_{p_j}$3, measures $e_j=D_{p_j}$4, reconstructs the input from the plaintext feature map $e_j=D_{p_j}$5 using a trained conditional GAN, computes $e_j=D_{p_j}$6, records all cuts satisfying the privacy threshold, and returns the candidate with minimum latency; if none exist, it falls back to full-TEE execution (Rajasekar et al., 2024).

STAMP applies partitioning at the token level. Each token $e_j=D_{p_j}$7 receives a binary sensitivity signal $e_j=D_{p_j}$8 from a PII/NER detector and a task-importance score

$e_j=D_{p_j}$9

thresholded at $p_j$0. This induces four groups: sensitive and important, sensitive and unimportant, non-sensitive and important, and non-sensitive and unimportant. The per-token budget is then

$p_j$1

with experimental weights $p_j$2 (Tian et al., 12 Mar 2026).

SplitAgent likewise performs subtask-level budget partitioning, but with context-aware weights: $p_j$3 The resulting plan assigns some subtasks to the enterprise-side Privacy Agent and others to the cloud-side Reasoning Agent, while local sanitization functions $p_j$4 are applied before any cloud transfer (She, 9 Mar 2026).

3. Privacy models, leakage notions, and threat assumptions

A central feature of this literature is that “privacy-aware” does not imply a single privacy formalism. The partitioning algorithm must therefore be read together with its threat model.

In privacy-aware process discovery, privacy is expressed as $p_j$5-differential privacy on event logs, with neighboring logs defined as logs that differ in exactly one trace. An anonymization $p_j$6 is $p_j$7-differentially private if

$p_j$8

for all neighboring $p_j$9 and measurable $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$0. Because the sub-logs produced by the partition are disjoint in traces, anonymizing each with the same $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$1 yields an overall $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$2-DP guarantee under parallel composition (Lim et al., 8 Jul 2025).

STAMP uses metric local differential privacy rather than standard record-level DP. Its normalized Polar mechanism samples $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$3 on the unit sphere and satisfies $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$4-metric-LDP with $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$5 under the Euclidean chordal metric. Sequence-level composition yields a weighted sum of per-position budgets (Tian et al., 12 Mar 2026).

SplitAgent uses the Laplace mechanism for numeric or vector outputs and the Exponential mechanism for categorical outputs. Sequential composition gives

$$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$6

and the protocol additionally introduces zero-knowledge tool verification through a Pedersen commitment and proof $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$7 that the local tool output is correct under the commitment (She, 9 Mar 2026).

Other settings adopt different leakage notions. Privacy Partitioning assumes an adversary that fully controls the remote server side, has $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$8, and sees every intermediate representation $$\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,$$9; privacy is quantified by reconstruction error or sensitive-attribute inference accuracy (Chi et al., 2018). The TEE/GPU partitioning paper assumes an honest-but-curious cloud that observes every plaintext intermediate feature map and measures leakage as $\max_S u(S)+\lambda(\tau_I-f(S)),$0, with $\max_S u(S)+\lambda(\tau_I-f(S)),$1 designated as the maximum allowable SSIM (Rajasekar et al., 2024). SPARSI explicitly assumes non-colluding adversaries, and the paper states that the assumption of no collusion is both reasonable and necessary in the application domains that require release of private user information (Rekatsinas et al., 2013). APCC instead proves complete data privacy preservation against any coalition of up to $\max_S u(S)+\lambda(\tau_I-f(S)),$2 colluding workers by showing

$\max_S u(S)+\lambda(\tau_I-f(S)),$3

for every set $\max_S u(S)+\lambda(\tau_I-f(S)),$4 (Zeng et al., 2023).

4. Objectives, approximation schemes, and computational properties

The optimization landscape is heterogeneous: some formulations admit exact scans, some rely on DP composition arguments, and some are NP-hard and require approximation or heuristic search.

SPARSI proves that both DiscBudget and Tradeoff are NP-hard in general. For step disclosure functions and linear disclosure functions, the problem reduces to maximizing a nondecreasing submodular function subject to packing constraints, and a randomized $\max_S u(S)+\lambda(\tau_I-f(S)),$5-approximation can be obtained in polynomial time via the result of Kulik et al. For quadratic disclosure, the trade-off becomes a $\max_S u(S)+\lambda(\tau_I-f(S)),$6-$\max_S u(S)+\lambda(\tau_I-f(S)),$7 quadratically constrained program, and an SOCP relaxation yields a fractional solution in polynomial time, while rounding remains open. For arbitrary disclosure functions, the paper proposes a two-phase GRASP-style algorithm with a construction phase and a local-search phase; the stated complexity is $\max_S u(S)+\lambda(\tau_I-f(S)),$8 for global construction and $\max_S u(S)+\lambda(\tau_I-f(S)),$9 for local search (Rekatsinas et al., 2013).

The event-log partitioner is much lighter computationally. Its complexity is $1\le \sum_{a\in A} x_{d,a}\le t$0, linear in the total number of events. The reported anonymization mechanisms dominate: DF-Laplace requires $1\le \sum_{a\in A} x_{d,a}\le t$1 to compute and perturb directly-follows pairs, SaCoFa builds a prefix tree up to length $1\le \sum_{a\in A} x_{d,a}\le t$2 in worst-case $1\le \sum_{a\in A} x_{d,a}\le t$3, and discovery is polynomial in the size of each anonymized sub-log. The paper states that the additional overhead of partitioning is negligible compared to anonymization plus discovery on large logs (Lim et al., 8 Jul 2025).

The TEE/GPU method solves a constrained scan over layers rather than a hard combinatorial program. Its runtime hinges on pre-measured $1\le \sum_{a\in A} x_{d,a}\le t$4, $1\le \sum_{a\in A} x_{d,a}\le t$5, $1\le \sum_{a\in A} x_{d,a}\le t$6, and leakage estimates from c-GAN reconstructions. The rule of thumb given is to pick the first layer $1\le \sum_{a\in A} x_{d,a}\le t$7 where SSIM drops below threshold, then verify that $1\le \sum_{a\in A} x_{d,a}\le t$8 still gives worthwhile speedup (Rajasekar et al., 2024).

A related differential privacy antecedent is DAWA, which privately learns a partition of a 1D domain into buckets by assigning a noisy cost

$1\le \sum_{a\in A} x_{d,a}\le t$9

and then solving a dynamic program for the minimum-cost partition. The paper shows that the Laplace-plus-argmin construction is equivalent to an exponential mechanism with score $D=\{d_1,\dots,d_{|D|}\}$00 (Li et al., 2014). This is not a task-allocation method, but it illustrates a recurring design pattern in privacy-aware partition selection: privatize the partition objective first, then optimize on noisy scores.

5. Empirical behavior across application domains

Empirical results indicate that partitioning can substantially improve the privacy-utility trade-off, but the effect depends strongly on the underlying mechanism.

In privacy-aware process discovery, the gains are clearest for directly-follows-based anonymization. With DF-Laplace, precision jumps from $D=\{d_1,\dots,d_{|D|}\}$01 under global anonymization to $D=\{d_1,\dots,d_{|D|}\}$02 after partitioning, while fitness and generalization stay above $D=\{d_1,\dots,d_{|D|}\}$03; the $D=\{d_1,\dots,d_{|D|}\}$04-score improves by $D=\{d_1,\dots,d_{|D|}\}$05–$D=\{d_1,\dots,d_{|D|}\}$06 points. With SaCoFa, precision is already high at $D=\{d_1,\dots,d_{|D|}\}$07–$D=\{d_1,\dots,d_{|D|}\}$08, and partitioning yields only marginal gains, mainly reducing variance in precision. The study concludes that, for directly-follows-based anonymization, partitioning before anonymization yields a clear utility gain (Lim et al., 8 Jul 2025).

In adversarial split inference, the reported trade-off is similarly explicit. On MNIST, a cut after layer $D=\{d_1,\dots,d_{|D|}\}$09 with $D=\{d_1,\dots,d_{|D|}\}$10 yields $D=\{d_1,\dots,d_{|D|}\}$11 accuracy while raising reconstruction MSE by $D=\{d_1,\dots,d_{|D|}\}$12 relative to the unprotected baseline, from $D=\{d_1,\dots,d_{|D|}\}$13 to $D=\{d_1,\dots,d_{|D|}\}$14. On CelebA, partitioning at conv3 with $D=\{d_1,\dots,d_{|D|}\}$15 reduces classification accuracy from $D=\{d_1,\dots,d_{|D|}\}$16 to $D=\{d_1,\dots,d_{|D|}\}$17, while reconstruction SSIM drops from $D=\{d_1,\dots,d_{|D|}\}$18 to $D=\{d_1,\dots,d_{|D|}\}$19 (Chi et al., 2018).

The TEE/GPU layer-partitioning paper reports architecture-specific optima. On ImageNet, VGG-16 moves from $D=\{d_1,\dots,d_{|D|}\}$20 s in full enclave to $D=\{d_1,\dots,d_{|D|}\}$21 s at $D=\{d_1,\dots,d_{|D|}\}$22, a $D=\{d_1,\dots,d_{|D|}\}$23 speedup; ResNet-50 moves from $D=\{d_1,\dots,d_{|D|}\}$24 s to $D=\{d_1,\dots,d_{|D|}\}$25 s at $D=\{d_1,\dots,d_{|D|}\}$26, a $D=\{d_1,\dots,d_{|D|}\}$27 speedup; EfficientNetB0 moves from $D=\{d_1,\dots,d_{|D|}\}$28 s to $D=\{d_1,\dots,d_{|D|}\}$29 s at $D=\{d_1,\dots,d_{|D|}\}$30, a $D=\{d_1,\dots,d_{|D|}\}$31 speedup. The same paper reports that, for VGG-16, SSIM is $D=\{d_1,\dots,d_{|D|}\}$32 at $D=\{d_1,\dots,d_{|D|}\}$33, $D=\{d_1,\dots,d_{|D|}\}$34 at $D=\{d_1,\dots,d_{|D|}\}$35, and below $D=\{d_1,\dots,d_{|D|}\}$36 at $D=\{d_1,\dots,d_{|D|}\}$37 (Rajasekar et al., 2024).

STAMP reports gains from both selective budget allocation and directional perturbation. At matched per-token privacy budgets, Polar delivered up to $D=\{d_1,\dots,d_{|D|}\}$38 cosine similarity on SQuAD versus $D=\{d_1,\dots,d_{|D|}\}$39 for Laplace; on Yelp, Polar achieved $D=\{d_1,\dots,d_{|D|}\}$40 accuracy versus $D=\{d_1,\dots,d_{|D|}\}$41–$D=\{d_1,\dots,d_{|D|}\}$42 for Laplace, with a non-private baseline of $D=\{d_1,\dots,d_{|D|}\}$43; on AG News, Polar reached $D=\{d_1,\dots,d_{|D|}\}$44 versus $D=\{d_1,\dots,d_{|D|}\}$45 for Laplace, with a baseline of $D=\{d_1,\dots,d_{|D|}\}$46. STAMP’s four-group allocation lay strictly above the uniform curve in the low-to-mid $D=\{d_1,\dots,d_{|D|}\}$47 regime, with up to $D=\{d_1,\dots,d_{|D|}\}$48 cosine similarity on SQuAD and up to $D=\{d_1,\dots,d_{|D|}\}$49–$D=\{d_1,\dots,d_{|D|}\}$50 accuracy on Yelp and AG News (Tian et al., 12 Mar 2026).

SplitAgent reports an average task accuracy of $D=\{d_1,\dots,d_{|D|}\}$51 and privacy protection of $D=\{d_1,\dots,d_{|D|}\}$52, compared with $D=\{d_1,\dots,d_{|D|}\}$53 and $D=\{d_1,\dots,d_{|D|}\}$54 for Static-Split. Its privacy-utility product $D=\{d_1,\dots,d_{|D|}\}$55 is optimized at $D=\{d_1,\dots,d_{|D|}\}$56, where the paper reports $D=\{d_1,\dots,d_{|D|}\}$57 accuracy, $D=\{d_1,\dots,d_{|D|}\}$58 privacy, and $D=\{d_1,\dots,d_{|D|}\}$59 (She, 9 Mar 2026).

6. Misconceptions, limitations, and emerging directions

Several recurring misconceptions are addressed directly by the literature.

First, partitioning is not itself a privacy guarantee. In TEE/GPU inference, layer partitioning exposes intermediate feature maps in the clear and can lead to reconstruction attacks (Rajasekar et al., 2024). In Privacy Partitioning, the adversary fully controls the remote server side and sees every $D=\{d_1,\dots,d_{|D|}\}$60 (Chi et al., 2018). The privacy gain comes from the mechanism attached to the partition boundary—adversarial training, DP, encryption, masking, or formal leakage control—not from splitting alone.

Second, partitioning is not uniformly helpful across mechanisms. In privacy-aware process discovery, the strong gains are specific to directly-follows-based anonymization, whereas SaCoFa shows only marginal gains (Lim et al., 8 Jul 2025). This suggests that the benefit of partitioning is largest when the partition reduces the sensitivity or noise burden of the statistics actually used by the privacy mechanism.

Third, privacy assumptions are not interchangeable. SPARSI relies on non-colluding adversaries (Rekatsinas et al., 2013); APCC proves privacy against up to $D=\{d_1,\dots,d_{|D|}\}$61 colluding workers (Zeng et al., 2023); STAMP provides metric-LDP rather than standard event-level or record-level DP (Tian et al., 12 Mar 2026). A method can therefore be “privacy-aware” while still operating under a threat model that is narrower, stronger, or simply different from another method’s threat model.

Current research directions point toward more adaptive and compositional forms of partitioning. Randomness in model and data partitioning has been analyzed as a source of privacy amplification, including Balanced Iteration Subsampling and randomized model splitting under RDP accounting (Dong et al., 4 Mar 2025). Privacy-aware edge-device collaborative inference has been formulated as a CMDP and solved by a hierarchical constrained MARL algorithm that jointly handles deployment, association, partitioning, and allocation under long-term delay constraints (Wang et al., 23 Feb 2026). Context-aware dynamic sanitization in SplitAgent and task-aware token grouping in STAMP indicate a broader movement toward partition criteria that depend on task semantics, sensitivity heterogeneity, and downstream workload (She, 9 Mar 2026, Tian et al., 12 Mar 2026). A plausible implication is that future privacy-aware task partitioning algorithms will be increasingly adaptive, with partition boundaries determined not only by system topology or static abstraction, but also by dynamic utility gradients, privacy preferences, and formal composition budgets.