---
title: Privacy-Aware Task Partitioning
url: https://www.emergentmind.com/topics/privacy-aware-task-partitioning-algorithm
type: topic
---

# Privacy-Aware Task Partitioning

Privacy-aware task partitioning algorithm denotes a family of methods that deliberately split data, computation, model structure, or workload so that privacy protection can be enforced locally, selectively, or compositionally while preserving task utility. In the SPARSI framework, the problem is to partition a sensitive dataset among \(k\) non-colluding adversaries so as to maximize utility and minimize disclosure [1302.6556]. Subsequent work instantiates analogous ideas for event logs in process discovery [2507.06008], split neural inference between device and server [1812.02863], TEE/GPU layer partitioning [2404.07437], token-level budget allocation in text privatization [2603.12237], privacy-preserving crowdsourcing partitions of worker-skill space [2007.05373], enterprise-cloud agent collaboration [2603.08221], and privacy-aware edge-device collaborative inference under a CMDP [2603.00129]. Across these formulations, partitioning is the mechanism by which privacy budgets, exposure surfaces, and utility losses are jointly controlled.

## 1. Formal scope and canonical problem statements

The term does not refer to a single canonical optimization problem. Rather, the literature defines domain-specific partitioning objects, disclosure functions, and utility criteria.

In SPARSI, the atomic objects are data entries \(D=\{d_1,\dots,d_{|D|}\}\), the receivers are adversaries \(A=\{a_1,\dots,a_k\}\), and the privacy targets are sensitive properties \(P=\{p_1,\dots,p_{|P|}\}\). Interdependencies are represented by a dependency hypergraph \(\mathcal H=(D,P,E)\), where each hyperedge \(e_j=D_{p_j}\) contains exactly the entries whose joint release would disclose property \(p_j\) [1302.6556]. The optimization is expressed either as a disclosure-budgeted problem,
\[
\max_S u(S)\quad\text{subject to}\quad f(S)\le \tau_I,
\]
or as a Lagrangian trade-off,
\[
\max_S u(S)+\lambda(\tau_I-f(S)),
\]
with assignment constraints \(1\le \sum_{a\in A} x_{d,a}\le t\) for every \(d\in D\) [1302.6556].

In privacy-aware process discovery, the partitioned object is an event log \(L\in \mathcal L\) over activity universe \(A\), together with an abstraction mapping \(\psi:A\to A\cup\{\top\}\). The target partition is
\[
P=\psi_L(L)=\{L_\psi\}\cup\{L_\alpha\mid \alpha\neq \top,\ \exists a\in A:\psi(a)=\alpha\},
\]
where \(L_\psi\) stores abstracted high-level trace skeletons and each \(L_\alpha\) stores the low-level sub-log belonging to abstraction \(\alpha\) [2507.06008].

In privacy-preserving layer partitioning for DNN inference, the decision variable is a cut point \(\ell\in\{1,\dots,L\}\) that places layers \(1,\dots,\ell\) inside the enclave and layers \(\ell+1,\dots,L\) on the GPU. The latency objective is
\[
T_{\text{total}}(\ell)=\sum_{i=1}^{\ell}T_E(i)+C(\ell)+\sum_{j=\ell+1}^{L}T_G(j),
\]
under the privacy constraint \(\text{Leakage}(\ell)\le \epsilon\) [2404.07437].

In SplitAgent, a raw enterprise task \(T\) is decomposed into subtasks \(S=\{s_1,\dots,s_n\}\), then partitioned into enterprise-side and cloud-side subsets \(P_E\) and \(P_C\), with per-subtask privacy allocations \(\{\epsilon_i\}\) satisfying \(\sum_i \epsilon_i\le \epsilon_{\text{total}}\). The optimization is
\[
\max_{P,\{\epsilon_i\}} U(T,P)-\lambda L(T,P)
\]
subject to the DP budget, a utility threshold \(\tau\), and the requirement that raw data never leaves the enterprise environment [2603.08221].

| Setting | Partitioned object | Representative objective |
|---|---|---|
| SPARSI | Atomic data entries across adversaries | Maximize utility, minimize disclosure |
| Process discovery | Event log into skeleton log and sub-logs | Preserve process utility under DP |
| Split inference | DNN layers across local/device and server/GPU | Minimize latency under leakage bound |
| STAMP | Tokens into four privacy-utility groups | Allocate per-token budgets |
| SplitAgent | Enterprise subtasks across local and cloud agents | Maximize \(U-\lambda L\) under DP budget |

## 2. Partitioning mechanisms and algorithmic structure

The mechanisms used to realize partitioning differ sharply by domain, but they share a common structure: identify a semantically meaningful decomposition, privatize or protect each part separately, and then recombine the outputs.

For event logs, the proposed pipeline has three phases: event-data partitioning via abstraction, independent anonymization of each partition, and process discovery on the anonymized sub-logs [2507.06008]. Algorithm 1 iterates over each trace \(\sigma\in L\), builds a map \(C\) from abstraction labels to sub-traces, replaces every low-level event \(\sigma(i)\) by its abstraction \(\alpha'=\psi(\sigma(i))\) when \(\psi(\sigma(i))\neq \sigma(i)\), appends the original event to the corresponding sub-trace \(\sigma_{\alpha'}\), then applies `compress(\sigma)` to remove duplicate \(\alpha'\) except first+last. The output contains one skeleton log \(L_\psi\) plus one sub-log per sub-process \(\alpha\) [2507.06008]. The choice of \(\psi\) can be user-defined or automated, including clustering by Günther et al., FHM by Lu et al., or Random clustering [2507.06008].

In “Privacy Partitioning,” the model \(f\) is split into a local sub-model \(f_L\) with parameters \(\theta_L\) and a remote sub-model \(f_R\) with parameters \(\theta_R\), with interface \(h=f_L(x)\) [1812.02863]. The construction is interactive and adversarial: every candidate cut \(k\in\{1,\dots,K-1\}\) is trained by alternating between an adversarial reconstructor \(g_\phi\), which maximizes the reconstruction-quality term \(L_{\text{priv}}(\theta_L,\phi)\), and the split model, which minimizes \(L_{\text{task}}-\lambda L_{\text{priv}}\). The chosen cut \(k^*\) is the one that best meets the privacy-utility specification [1812.02863].

The TEE/GPU method uses a simpler scan. It evaluates every \(\ell=1,\dots,L\), measures \(T_{\text{total}}(\ell)\), reconstructs the input from the plaintext feature map \(F_\ell\) using a trained conditional GAN, computes \(SSIM(X,\hat Y)\), records all cuts satisfying the privacy threshold, and returns the candidate with minimum latency; if none exist, it falls back to full-TEE execution [2404.07437].

STAMP applies partitioning at the token level. Each token \(w_i\) receives a binary sensitivity signal \(S_i\in\{0,1\}\) from a PII/NER detector and a task-importance score
\[
I_i=\cos(e(w_i),q),
\]
thresholded at \(\tau\). This induces four groups: sensitive and important, sensitive and unimportant, non-sensitive and important, and non-sensitive and unimportant. The per-token budget is then
\[
\epsilon_i=\epsilon_{\text{total}}\cdot \frac{\alpha_{c_i}}{\sum_{c=1}^4 \alpha_c n_c},
\]
with experimental weights \((\alpha_1:\alpha_2:\alpha_3:\alpha_4)=(2:1:4:3)\) [2603.12237].

SplitAgent likewise performs subtask-level budget partitioning, but with context-aware weights:
\[
\epsilon_i=\epsilon_{\text{total}}\times \frac{w(c,i)}{\sum_{j\in S} w(c,j)},\qquad
w(c,i)=\frac{1}{\alpha_c\cdot \mathrm{Sens}_i+\beta_c}.
\]
The resulting plan assigns some subtasks to the enterprise-side Privacy Agent and others to the cloud-side Reasoning Agent, while local sanitization functions \(S_i\) are applied before any cloud transfer [2603.08221].

## 3. Privacy models, leakage notions, and threat assumptions

A central feature of this literature is that “privacy-aware” does not imply a single privacy formalism. The partitioning algorithm must therefore be read together with its threat model.

In privacy-aware process discovery, privacy is expressed as \(\epsilon\)-differential privacy on event logs, with neighboring logs defined as logs that differ in exactly one trace. An anonymization \(\gamma:\mathcal L\to \mathcal L\) is \(\epsilon\)-differentially private if
\[
P[\gamma(L_1)\in S]\le e^\epsilon\cdot P[\gamma(L_2)\in S]
\]
for all neighboring \(L_1,L_2\) and measurable \(S\subseteq \mathrm{img}(\gamma)\). Because the sub-logs produced by the partition are disjoint in traces, anonymizing each with the same \(\epsilon\) yields an overall \(\epsilon\)-DP guarantee under parallel composition [2507.06008].

STAMP uses metric local differential privacy rather than standard record-level DP. Its normalized Polar mechanism samples \(u_i'\sim \mathrm{vMF}(\mu=\bar e_i,\kappa=\epsilon_i)\) on the unit sphere and satisfies \((\epsilon,0)\)-metric-LDP with \(\epsilon=\kappa\) under the Euclidean chordal metric. Sequence-level composition yields a weighted sum of per-position budgets [2603.12237].

SplitAgent uses the Laplace mechanism for numeric or vector outputs and the Exponential mechanism for categorical outputs. Sequential composition gives
\[
\sum_{i=1}^n \epsilon_i=\epsilon_{\text{total}}\Longrightarrow (\{\tilde D_i\}_{i=1}^n)\text{ is }(\epsilon_{\text{total}},0)\text{-DP},
\]
and the protocol additionally introduces zero-knowledge tool verification through a Pedersen commitment and proof \(\pi\) that the local tool output is correct under the commitment [2603.08221].

Other settings adopt different leakage notions. Privacy Partitioning assumes an adversary that fully controls the remote server side, has \(\theta_R\), and sees every intermediate representation \(h=f_L(x)\); privacy is quantified by reconstruction error or sensitive-attribute inference accuracy [1812.02863]. The TEE/GPU partitioning paper assumes an honest-but-curious cloud that observes every plaintext intermediate feature map and measures leakage as \(SSIM(X,\hat Y)\), with \(\epsilon=0.2\) designated as the maximum allowable SSIM [2404.07437]. SPARSI explicitly assumes non-colluding adversaries, and the paper states that the assumption of no collusion is both reasonable and necessary in the application domains that require release of private user information [1302.6556]. APCC instead proves complete data privacy preservation against any coalition of up to \(L\) colluding workers by showing
\[
I(D_{i,0},\dots,D_{i,K_i-1};\widetilde D_{i,\mathcal L})=0
\]
for every set \(i\) [2305.06654].

## 4. Objectives, approximation schemes, and computational properties

The optimization landscape is heterogeneous: some formulations admit exact scans, some rely on DP composition arguments, and some are NP-hard and require approximation or heuristic search.

SPARSI proves that both DiscBudget and Tradeoff are NP-hard in general. For step disclosure functions and linear disclosure functions, the problem reduces to maximizing a nondecreasing submodular function subject to packing constraints, and a randomized \((1-\epsilon)(1-1/e)\)-approximation can be obtained in polynomial time via the result of Kulik et al. For quadratic disclosure, the trade-off becomes a \(0\)-\(1\) quadratically constrained program, and an SOCP relaxation yields a fractional solution in polynomial time, while rounding remains open. For arbitrary disclosure functions, the paper proposes a two-phase GRASP-style algorithm with a construction phase and a local-search phase; the stated complexity is \(O(t\cdot |A|\cdot |D|^2)\) for global construction and \(O(t\cdot |A|\cdot |D|)\) for local search [1302.6556].

The event-log partitioner is much lighter computationally. Its complexity is \(O(\sum_{\sigma\in L}|\sigma|)\), linear in the total number of events. The reported anonymization mechanisms dominate: DF-Laplace requires \(O(|A|^2)\) to compute and perturb directly-follows pairs, SaCoFa builds a prefix tree up to length \(l\) in worst-case \(O(|L|\cdot l)\), and discovery is polynomial in the size of each anonymized sub-log. The paper states that the additional overhead of partitioning is negligible compared to anonymization plus discovery on large logs [2507.06008].

The TEE/GPU method solves a constrained scan over layers rather than a hard combinatorial program. Its runtime hinges on pre-measured \(T_E(i)\), \(T_G(j)\), \(C(\ell)\), and leakage estimates from c-GAN reconstructions. The rule of thumb given is to pick the first layer \(\ell\) where SSIM drops below threshold, then verify that \(T_{\text{total}}(\ell)\) still gives worthwhile speedup [2404.07437].

A related differential privacy antecedent is DAWA, which privately learns a partition of a 1D domain into buckets by assigning a noisy cost
\[
\widetilde{bcost}(x,b)=bcost(x,b)+Z_b,\qquad Z_b\sim \mathrm{Laplace}(4/\epsilon_1),
\]
and then solving a dynamic program for the minimum-cost partition. The paper shows that the Laplace-plus-argmin construction is equivalent to an exponential mechanism with score \(-cost(x,B)\) [1410.0265]. This is not a task-allocation method, but it illustrates a recurring design pattern in privacy-aware partition selection: privatize the partition objective first, then optimize on noisy scores.

## 5. Empirical behavior across application domains

Empirical results indicate that partitioning can substantially improve the privacy-utility trade-off, but the effect depends strongly on the underlying mechanism.

In privacy-aware process discovery, the gains are clearest for directly-follows-based anonymization. With DF-Laplace, precision jumps from \(\approx 0.2\) under global anonymization to \(\approx 0.6\) after partitioning, while fitness and generalization stay above \(0.8\); the \(F_1\)-score improves by \(30\)–\(40\) points. With SaCoFa, precision is already high at \(\approx 0.6\)–\(0.7\), and partitioning yields only marginal gains, mainly reducing variance in precision. The study concludes that, for directly-follows-based anonymization, partitioning before anonymization yields a clear utility gain [2507.06008].

In adversarial split inference, the reported trade-off is similarly explicit. On MNIST, a cut after layer \(2\) with \(\lambda=0.5\) yields \(98.2\%\) accuracy while raising reconstruction MSE by \(5\times\) relative to the unprotected baseline, from \(0.002\) to \(0.01\). On CelebA, partitioning at `conv3` with \(\lambda=1.0\) reduces classification accuracy from \(89.4\%\) to \(87.0\%\), while reconstruction SSIM drops from \(0.88\) to \(0.37\) [1812.02863].

The TEE/GPU layer-partitioning paper reports architecture-specific optima. On ImageNet, VGG-16 moves from \(4.20\) s in full enclave to \(1.40\) s at \(\ell^*=8\), a \(66.6\%\) speedup; ResNet-50 moves from \(4.02\) s to \(3.60\) s at \(\ell^*=4\), a \(10.4\%\) speedup; EfficientNetB0 moves from \(3.70\) s to \(2.50\) s at \(\ell^*=4\), a \(32.4\%\) speedup. The same paper reports that, for VGG-16, SSIM is \(\approx 0.75\) at \(\ell=2\), \(\approx 0.18\) at \(\ell=7\), and below \(0.15\) at \(\ell=8+\) [2404.07437].

STAMP reports gains from both selective budget allocation and directional perturbation. At matched per-token privacy budgets, Polar delivered up to \(0.83\) cosine similarity on SQuAD versus \(0.34\) for Laplace; on Yelp, Polar achieved \(\sim 56\%\) accuracy versus \(\sim 18\)–\(22\%\) for Laplace, with a non-private baseline of \(58\%\); on AG News, Polar reached \(\sim 80\%\) versus \(\sim 52\%\) for Laplace, with a baseline of \(92\%\). STAMP’s four-group allocation lay strictly above the uniform curve in the low-to-mid \(\epsilon\) regime, with up to \(+0.2\) cosine similarity on SQuAD and up to \(+10\)–\(15\%\) accuracy on Yelp and AG News [2603.12237].

SplitAgent reports an average task accuracy of \(0.838\) and privacy protection of \(0.901\), compared with \(0.732\) and \(0.797\) for Static-Split. Its privacy-utility product \(U\times P\) is optimized at \(\epsilon=0.5\), where the paper reports \(83.4\%\) accuracy, \(94.5\%\) privacy, and \(U\times P=0.788\) [2603.08221].

## 6. Misconceptions, limitations, and emerging directions

Several recurring misconceptions are addressed directly by the literature.

First, partitioning is not itself a privacy guarantee. In TEE/GPU inference, layer partitioning exposes intermediate feature maps in the clear and can lead to reconstruction attacks [2404.07437]. In Privacy Partitioning, the adversary fully controls the remote server side and sees every \(h\) [1812.02863]. The privacy gain comes from the mechanism attached to the partition boundary—adversarial training, DP, encryption, masking, or formal leakage control—not from splitting alone.

Second, partitioning is not uniformly helpful across mechanisms. In privacy-aware process discovery, the strong gains are specific to directly-follows-based anonymization, whereas SaCoFa shows only marginal gains [2507.06008]. This suggests that the benefit of partitioning is largest when the partition reduces the sensitivity or noise burden of the statistics actually used by the privacy mechanism.

Third, privacy assumptions are not interchangeable. SPARSI relies on non-colluding adversaries [1302.6556]; APCC proves privacy against up to \(L\) colluding workers [2305.06654]; STAMP provides metric-LDP rather than standard event-level or record-level DP [2603.12237]. A method can therefore be “privacy-aware” while still operating under a threat model that is narrower, stronger, or simply different from another method’s threat model.

Current research directions point toward more adaptive and compositional forms of partitioning. Randomness in model and data partitioning has been analyzed as a source of privacy amplification, including Balanced Iteration Subsampling and randomized model splitting under RDP accounting [2503.03043]. Privacy-aware edge-device collaborative inference has been formulated as a CMDP and solved by a hierarchical constrained MARL algorithm that jointly handles deployment, association, partitioning, and allocation under long-term delay constraints [2603.00129]. Context-aware dynamic sanitization in SplitAgent and task-aware token grouping in STAMP indicate a broader movement toward partition criteria that depend on task semantics, sensitivity heterogeneity, and downstream workload [2603.08221; 2603.12237]. A plausible implication is that future privacy-aware task partitioning algorithms will be increasingly adaptive, with partition boundaries determined not only by system topology or static abstraction, but also by dynamic utility gradients, privacy preferences, and formal composition budgets.

Source: https://www.emergentmind.com/topics/privacy-aware-task-partitioning-algorithm