Private Counterfactual Retrieval (PCR)

• Private Counterfactual Retrieval (PCR) is a collection of protocols that retrieve nearest-neighbor counterfactual explanations while ensuring perfect user privacy using information-theoretic guarantees.
• PCR schemes employ secure operations over finite fields and multi-server interactions to compute exact distances with minimal leakage and controlled communication costs.
• Recent advances extend PCR to immutable features and differential privacy settings, enabling practical applications in counterfactual generation and multi-stream reasoning models.

Searching arXiv for papers on Private Counterfactual Retrieval and related formulations. I’ll look up the key arXiv entries on “Private Counterfactual Retrieval” and adjacent formulations to ground the article in current papers. Private Counterfactual Retrieval (PCR) most directly denotes a family of private-information-retrieval-style protocols for obtaining a nearest-neighbor counterfactual explanation from a database of accepted instances while preserving information-theoretic privacy for the querying user (Nomeir et al., 2024). In recent arXiv usage, the same label has also been applied to a counterfactual-likelihood intervention for measuring whether a downstream reasoning channel is influenced by an upstream private channel in a role-typed autoregressive model (Lorup, 18 May 2026). A related but distinct line studies differentially private release of counterfactual explanations via the functional mechanism, where the privacy target is the training data underlying the explanation mechanism rather than the secrecy of the user’s query (Yang et al., 2022).

1. Core definitions and scope

In the PIR-style formulation, a user has a private feature vector $x \in \mathcal X \subseteq \{0,1,\dots,R\}^d$ and observes that a black-box classifier rejects it. An institution stores a database $\mathcal D=\{y_1,\dots,y_M\}$ of accepted points. A counterfactual explanation is chosen as the nearest accepted point, with index

$\theta^*=\arg\min_{i\in[M]} d(x,y_i),$

where the default metric is $d(x,y)=\|y-x\|_2^2$, and a preference-aware extension uses

$d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$

for a private actionability vector $w \in \mathbb Z_{>0}^d$ or $w \in [L_1]^d$ (Nomeir et al., 2024).

The privacy objective is asymmetric. User privacy is perfect and information-theoretic: for each non-colluding server $n$, the protocol requires that the server’s view reveal zero mutual information about the user’s input and, in weighted variants, the actionability weights. The institution’s database cannot generally remain fully hidden, so database privacy is quantified by a mutual-information leakage metric such as

$$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$

or, in immutable-feature settings,

$$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$

where $\mathcal D=\{y_1,\dots,y_M\}$0 is the user’s private immutable set (Meel et al., 5 Aug 2025).

A second use of the term PCR arises in multi-stream reasoning models. There, one agent privately computes a block $\mathcal D=\{y_1,\dots,y_M\}$1, emits a public utterance $\mathcal D=\{y_1,\dots,y_M\}$2, and another agent produces a downstream continuation $\mathcal D=\{y_1,\dots,y_M\}$3. The goal is not retrieval of an explanation from a database, but measurement of whether $\mathcal D=\{y_1,\dots,y_M\}$4 depends on $\mathcal D=\{y_1,\dots,y_M\}$5 beyond what is already encoded in $\mathcal D=\{y_1,\dots,y_M\}$6. The key quantity is the counterfactual negative-log-likelihood shift

$\mathcal D=\{y_1,\dots,y_M\}$7

with $\mathcal D=\{y_1,\dots,y_M\}$8 a donor private block of equal token length (Lorup, 18 May 2026). This suggests that current usage of the acronym is technically non-uniform and must be disambiguated by context.

2. PIR-style PCR for exact nearest-neighbor counterfactuals

The baseline PCR scheme retrieves the exact nearest-neighbor counterfactual while achieving perfect user privacy with replicated non-colluding servers. In the simplest two-server construction, all arithmetic is over a prime field $\mathcal D=\{y_1,\dots,y_M\}$9 with $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$0. The user samples a uniform random mask $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$1, chooses public distinct field elements $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$2, and sends

$\theta^*=\arg\min_{i\in[M]} d(x,y_i),$3

to server $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$4. Each server computes, for every database point $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$5,

$\theta^*=\arg\min_{i\in[M]} d(x,y_i),$6

where $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$7 is shared server-side randomness. After subtracting the known $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$8 term, the user inverts a $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$9 Vandermonde system and recovers each $d(x,y)=\|y-x\|_2^2$0, then sets $d(x,y)=\|y-x\|_2^2$1 (Meel et al., 5 Aug 2025).

The privacy guarantee follows from the one-time-pad structure of $d(x,y)=\|y-x\|_2^2$2. Each query is uniformly random in $d(x,y)=\|y-x\|_2^2$3, and the additional server-side randomization masks the interference term that arises when $d(x,y)=\|y-x\|_2^2$4 is expanded. In the weighted PCR$d(x,y)=\|y-x\|_2^2$5 variant, the user additionally hides $d(x,y)=\|y-x\|_2^2$6 by sending masked pairs such as $d(x,y)=\|y-x\|_2^2$7, and the servers evaluate a quadratic form using $d(x,y)=\|y-x\|_2^2$8. Recovery then requires three servers because the expansion becomes cubic in $d(x,y)=\|y-x\|_2^2$9 (Nomeir et al., 2024).

Communication cost is explicit. For the baseline two-server PCR scheme, upload is $d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$0 symbols and download is $d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$1 symbols. In the three-server weighted variant, the communication cost becomes upload $d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$2 and download $d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$3 (Nomeir et al., 2024). A central structural fact is that exact nearest-neighbor retrieval and perfect user privacy are achieved simultaneously, while database privacy is only partial and must be analyzed separately.

3. Leakage-reduction schemes and ordering-based retrieval

The baseline scheme reveals all squared distances $d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$4 to the user, and thus its leakage is

$d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$5

Two refinements reduce this leakage by returning less than the full distance vector (Meel et al., 5 Aug 2025).

Diff-PCR replaces direct distance recovery with pairwise distance differences. The servers return, for $d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$6,

$d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$7

so the user recovers only

$d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$8

A sequential minimum-finding scan over these differences yields $d_w(x,y)=(y-x)^\top \diag(w)\,(y-x)$9. By data-processing,

$w \in \mathbb Z_{>0}^d$0

Its communication cost is upload $w \in \mathbb Z_{>0}^d$1, download $w \in \mathbb Z_{>0}^d$2 (Meel et al., 5 Aug 2025).

Mask-PCR preserves the ordering of distances while masking their values. It requires preprocessing of the rejected set $w \in \mathbb Z_{>0}^d$3 and its closure

$w \in \mathbb Z_{>0}^d$4

together with

$w \in \mathbb Z_{>0}^d$5

The user samples $w \in \mathbb Z_{>0}^d$6 uniformly from $w \in \mathbb Z_{>0}^d$7, and after Vandermonde inversion obtains $w \in \mathbb Z_{>0}^d$8. If $w \in \mathbb Z_{>0}^d$9, the ordering of true distances is preserved, so the nearest neighbor can still be found. Leakage satisfies

$w \in [L_1]^d$0

The communication cost remains upload $w \in [L_1]^d$1, download $w \in [L_1]^d$2 (Meel et al., 5 Aug 2025).

The numerical results are consistent with the leakage hierarchy. On a synthetic $w \in [L_1]^d$3D experiment with $w \in [L_1]^d$4 and $w \in [L_1]^d$5, baseline PCR leakage is $w \in [L_1]^d$6 (log-$w \in [L_1]^d$7), Diff-PCR leakage is $w \in [L_1]^d$8, and Mask-PCR leakage is $w \in [L_1]^d$9 for $n$0 and $n$1 for $n$2 (Meel et al., 5 Aug 2025). On Wine Quality, after quantization, accuracy rises rapidly as $n$3 increases, indicating the expected trade-off between finite-field embedding granularity and exact nearest-neighbor recovery (Nomeir et al., 2024).

4. Immutable features, feasible sets, and preference-aware generalizations

Immutable private counterfactual retrieval (I-PCR) extends PCR to the case where the user insists that a private subset of coordinates cannot change. Let $n$4 be the immutable set, $n$5 the mutable coordinates, and

$n$6

The I-PCR target is

$n$7

The institution should not learn $n$8, $n$9, or $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$0, and the user should learn as little as possible about $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$1 beyond what is necessary to identify the feasible nearest counterfactual (Meel et al., 2024).

One construction is a two-phase three-server protocol. In Phase 1, the user hides the immutable set via a binary mask $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$2, sends masked queries of the form

$$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$3

and the servers return quantities whose leading coefficient is $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$4. This vanishes if and only if $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$5, so the user recovers $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$6. In Phase 2, the user hides the indicator of $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$7 and recovers exact distances only on feasible indices. Infeasible indices yield an uninformative $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$8. The two-phase communication totals are upload $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,w\bigr)$$9 and download $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$0, i.e. total symbols $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$1 in one formulation, and worst-case upload $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$2 and download $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$3 in the summarized theorem statement (Meel et al., 2024).

A more communication-efficient single-phase I-PCR scheme uses a public bound $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$4 on $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$5 and a public integer $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$6. The user builds a weight vector $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$7 with $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$8 for $$I\bigl(y_1,\dots,y_M;\,Q_{[N]},A_{[N]}\mid x,\mathcal I\bigr),$$9 and $\mathcal D=\{y_1,\dots,y_M\}$00 for $\mathcal D=\{y_1,\dots,y_M\}$01, sends masked versions of $\mathcal D=\{y_1,\dots,y_M\}$02 to three servers, and recovers

$\mathcal D=\{y_1,\dots,y_M\}$03

If $\mathcal D=\{y_1,\dots,y_M\}$04, then $\mathcal D=\{y_1,\dots,y_M\}$05; otherwise $\mathcal D=\{y_1,\dots,y_M\}$06. This simultaneously reveals feasibility and distance on the feasible set. Its communication cost is total $\mathcal D=\{y_1,\dots,y_M\}$07, saving $\mathcal D=\{y_1,\dots,y_M\}$08 over the two-phase scheme (Meel et al., 2024).

The two I-PCR schemes differ primarily in leakage. The two-phase scheme leaks which indices satisfy $\mathcal D=\{y_1,\dots,y_M\}$09 and the exact distances for those indices. The single-phase scheme leaks the same matching bits plus coarse information about nonmatching entries through the magnitude of $\mathcal D=\{y_1,\dots,y_M\}$10. Numerical examples reflect this distinction: on a synthetic $\mathcal D=\{y_1,\dots,y_M\}$11 setup, single-phase leakage values are $\mathcal D=\{y_1,\dots,y_M\}$12 as $\mathcal D=\{y_1,\dots,y_M\}$13 varies, whereas two-phase leakage values are $\mathcal D=\{y_1,\dots,y_M\}$14 (Meel et al., 5 Aug 2025). Preference-aware PCR$\mathcal D=\{y_1,\dots,y_M\}$15 and I-PCR$\mathcal D=\{y_1,\dots,y_M\}$16 incorporate private user weights into the same general machinery by carrying $\mathcal D=\{y_1,\dots,y_M\}$17 in the query tuple and decoding weighted distances via higher-degree polynomial interpolation (Meel et al., 5 Aug 2025).

5. Differential privacy and private counterfactual generation

A separate line addresses privacy through differential privacy rather than PIR. In “Differentially Private Counterfactuals via Functional Mechanism,” the objective is to generate counterfactual explanations without touching the deployed model or explanation set, while protecting against extraction and inference attacks through an $\mathcal D=\{y_1,\dots,y_M\}$18-DP training procedure (Yang et al., 2022).

The core mechanism trains a one-hidden-layer sigmoid autoencoder under the functional mechanism. With input $\mathcal D=\{y_1,\dots,y_M\}$19, encoder $\mathcal D=\{y_1,\dots,y_M\}$20, decoder $\mathcal D=\{y_1,\dots,y_M\}$21, and reconstruction loss

$\mathcal D=\{y_1,\dots,y_M\}$22

the loss is expanded polynomially in the entries of $\mathcal D=\{y_1,\dots,y_M\}$23. For each monomial coefficient sum

$\mathcal D=\{y_1,\dots,y_M\}$24

Laplace noise of scale $\mathcal D=\{y_1,\dots,y_M\}$25 is added:

$\mathcal D=\{y_1,\dots,y_M\}$26

Minimizing the perturbed objective $\mathcal D=\{y_1,\dots,y_M\}$27 yields DP parameters $\mathcal D=\{y_1,\dots,y_M\}$28. Class prototypes are then computed in latent space as

$\mathcal D=\{y_1,\dots,y_M\}$29

and remain $\mathcal D=\{y_1,\dots,y_M\}$30-DP by post-processing immunity (Yang et al., 2022).

Counterfactual search is carried out entirely as post-processing of the DP prototypes. For each target class, a latent perturbation $\mathcal D=\{y_1,\dots,y_M\}$31 is optimized against a loss combining target-class cross-entropy, proximity to the query, and prototype regularization, with trade-off weights $\mathcal D=\{y_1,\dots,y_M\}$32. The sensitivity bound is

$\mathcal D=\{y_1,\dots,y_M\}$33

and for the sigmoid-MSE one-hidden-layer case with inputs scaled to $\mathcal D=\{y_1,\dots,y_M\}$34, the guide states that $\mathcal D=\{y_1,\dots,y_M\}$35 for a $\mathcal D=\{y_1,\dots,y_M\}$36-unit hidden layer (Yang et al., 2022).

Empirical evaluation covers Adult, Hospital, HomeCredit, MNIST, Purchase, and Texas. Utility is measured by Flipping Ratio, Average Distance, reconstruction MSE, and time cost per query. Lower $\mathcal D=\{y_1,\dots,y_M\}$37 increases reconstruction MSE and slightly lowers FR. At $\mathcal D=\{y_1,\dots,y_M\}$38, FR is within $\mathcal D=\{y_1,\dots,y_M\}$39–$\mathcal D=\{y_1,\dots,y_M\}$40 of non-private baselines DiCE, CADEX, C-CHVAE, and REVISE; when $\mathcal D=\{y_1,\dots,y_M\}$41 decreases to $\mathcal D=\{y_1,\dots,y_M\}$42, FR degrades modestly, for example from $\mathcal D=\{y_1,\dots,y_M\}$43 on Adult, and AD increases by approximately $\mathcal D=\{y_1,\dots,y_M\}$44–$\mathcal D=\{y_1,\dots,y_M\}$45. In model extraction, DPC reduces surrogate accuracy by $\mathcal D=\{y_1,\dots,y_M\}$46–$\mathcal D=\{y_1,\dots,y_M\}$47 compared with non-private counterfactuals, and membership inference accuracy drops to near random for some datasets under small $\mathcal D=\{y_1,\dots,y_M\}$48 (Yang et al., 2022). This suggests an adjacent notion of “private counterfactuals” in which the privacy target is the training data rather than the secrecy of the user’s query.

6. Counterfactual-likelihood PCR in private reasoning channels

In “Counterfactual Likelihood Tests for Indirect Influence in Private Reasoning Channels,” PCR is a behavioral intervention technique for measuring how much a downstream public reasoning channel is influenced, directly or indirectly, by the contents of an upstream private channel in an autoregressive architecture with role-typed streams (Lorup, 18 May 2026). The setting uses a role-structured trace in which agent $\mathcal D=\{y_1,\dots,y_M\}$49 privately computes a block $\mathcal D=\{y_1,\dots,y_M\}$50, then emits a public block $\mathcal D=\{y_1,\dots,y_M\}$51, after which agent $\mathcal D=\{y_1,\dots,y_M\}$52 reads $\mathcal D=\{y_1,\dots,y_M\}$53 and produces a downstream continuation $\mathcal D=\{y_1,\dots,y_M\}$54.

The method compares two prefixes. The natural prefix is

$\mathcal D=\{y_1,\dots,y_M\}$55

and the counterfactual prefix is

$\mathcal D=\{y_1,\dots,y_M\}$56

where $\mathcal D=\{y_1,\dots,y_M\}$57 is a donor private block drawn from other traces and constrained to satisfy $\mathcal D=\{y_1,\dots,y_M\}$58. If

$\mathcal D=\{y_1,\dots,y_M\}$59

then the per-trace influence score is

$\mathcal D=\{y_1,\dots,y_M\}$60

Positive $\mathcal D=\{y_1,\dots,y_M\}$61 indicates that the natural private block made $\mathcal D=\{y_1,\dots,y_M\}$62 more likely than the donor block. Aggregation uses the influence rate, defined as the fraction of traces with $\mathcal D=\{y_1,\dots,y_M\}$63, and the mean $\mathcal D=\{y_1,\dots,y_M\}$64 in nats/token (Lorup, 18 May 2026).

Two confound controls are central. First, length matching removes a RoPE positional confound: in a rotary-position-encoding transformer, replacing $\mathcal D=\{y_1,\dots,y_M\}$65 with a differently sized donor block would shift the absolute positions of all downstream tokens, so $\mathcal D=\{y_1,\dots,y_M\}$66 ensures that any NLL change reflects content differences rather than position shifts. Second, a graph-separation or attention-cut control zeros all attention edges from replaced private-block positions to public-speech positions. Under this cut mask, the substitution $\mathcal D=\{y_1,\dots,y_M\}$67 cannot affect any hidden state used to generate $\mathcal D=\{y_1,\dots,y_M\}$68, so one should observe bit-for-bit equality of natural and counterfactual NLLs. Empirically, $\mathcal D=\{y_1,\dots,y_M\}$69 on $\mathcal D=\{y_1,\dots,y_M\}$70 controls, i.e. $\mathcal D=\{y_1,\dots,y_M\}$71 (Lorup, 18 May 2026).

The validation model is a 7B-parameter autoregressive transformer with four parallel streams: $\mathcal D=\{y_1,\dots,y_M\}$72, $\mathcal D=\{y_1,\dots,y_M\}$73, $\mathcal D=\{y_1,\dots,y_M\}$74, and $\mathcal D=\{y_1,\dots,y_M\}$75, together with stream-aware RoPE and a cross-stream causal mask that blocks private-to-private attention except via public channels. The protocol uses three checkpoints, five random seeds per checkpoint, and $\mathcal D=\{y_1,\dots,y_M\}$76 sampled traces per $\mathcal D=\{y_1,\dots,y_M\}$77. After filtering for donor availability and length matching, there are $\mathcal D=\{y_1,\dots,y_M\}$78 valid directional contrasts and approximately $\mathcal D=\{y_1,\dots,y_M\}$79 total NLL computations (Lorup, 18 May 2026).

The findings separate textual probes from counterfactual-likelihood measurement. Canary probes reproduced $\mathcal D=\{y_1,\dots,y_M\}$80 nonsense in $\mathcal D=\{y_1,\dots,y_M\}$81, raw $\mathcal D=\{y_1,\dots,y_M\}$82-gram overlap reached $\mathcal D=\{y_1,\dots,y_M\}$83 on a masked model, corrected overlap remained noisy with an approximately $\mathcal D=\{y_1,\dots,y_M\}$84-point gap, and counterfactual likelihood cleanly separated unmasked and masked pilot conditions, with influence rates $\mathcal D=\{y_1,\dots,y_M\}$85 and $\mathcal D=\{y_1,\dots,y_M\}$86 respectively. After length matching on the hardened masked variant, $\mathcal D=\{y_1,\dots,y_M\}$87 had rate $\mathcal D=\{y_1,\dots,y_M\}$88 and mean $\mathcal D=\{y_1,\dots,y_M\}$89 nats/token, while $\mathcal D=\{y_1,\dots,y_M\}$90 had rate $\mathcal D=\{y_1,\dots,y_M\}$91 and mean $\mathcal D=\{y_1,\dots,y_M\}$92 nats/token. At the $\mathcal D=\{y_1,\dots,y_M\}$93 threshold, multi-checkpoint replication gave A-to-B rates of $\mathcal D=\{y_1,\dots,y_M\}$94, $\mathcal D=\{y_1,\dots,y_M\}$95, and $\mathcal D=\{y_1,\dots,y_M\}$96 across checkpoints $\mathcal D=\{y_1,\dots,y_M\}$97–$\mathcal D=\{y_1,\dots,y_M\}$98, with corresponding B-to-A rates of $\mathcal D=\{y_1,\dots,y_M\}$99, $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$00, and $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$01 (Lorup, 18 May 2026).

The practical conclusion in this line is that private-channel evaluation should report direct and indirect influence separately, and that counterfactual likelihood probes provide a practical default for measuring these boundaries. The stated limitations are that PCR measures only likelihood influence under the current policy mask, does not localize which layer or head carries the signal, depends on architecture-specific role-visibility graphs, and uses a synthetic continuation bridge for many $\theta^*=\arg\min_{i\in[M]} d(x,y_i),$02 traces (Lorup, 18 May 2026). A plausible implication is that, in this literature, “private counterfactual retrieval” is less about explanation retrieval than about isolating information-flow pathways through controlled counterfactual substitution.