LLM Privacy Layer — Complete Research Synthesis

# LLM Privacy Layer — Complete Research Synthesis

> Compiled from: Secludy website crawl, 4 Medium/blog articles, 10 GitHub repos, 2 deep research reports (85+ sources total), LinkedIn profiles, Google Scholar, web searches.

---

## 1. What Is Secludy Building (Exact Product)

### Core Product: Privacy-Safe Synthetic Data for AI Training

Secludy generates **synthetic replicas** of sensitive datasets using **differential privacy (DP)**, enabling organizations to train AI models without risking PII leakage. They position themselves as "release and approval infrastructure for blocked data."

### Two Data Types

**Unstructured Text Synthesis:**
- Input: Free-form text containing PII (emails, chat logs, legal docs, medical records)
- Output: Semantically equivalent text with PII replaced by fake but contextually appropriate data
- Example from their site:
  - Original: "I live by the golden gate bridge in San Francisco. My SSN is 231-34-2495."
  - Synthetic: "Our place is near the Bay Bridge. Here's my SSN 345-34-6975."
- Preserves: narrative structure, topics, sentiment, linguistic patterns
- Removes: all identifiable information

**Tabular Data Synthesis:**
- Input: Structured data (CSV, databases) with PII columns
- Output: Synthetic rows preserving statistical distributions
- Example from their site: Names, credit scores, SSNs all replaced while maintaining column correlations

### Technical Stack (Confirmed from GitHub + Deep Research)

| Component | Technology |
|-----------|-----------|
| PII Detection (NER) | BERT-based NER model |
| Text Replacement | Qwen-2.5-7B-Instruct (fine-tuned with DP-SGD via LoRA/PEFT) |
| Inference Engine | vLLM with BitsAndBytes 4-bit quantization |
| DP Training | fast-differential-privacy (AWS Labs fork) |
| Distributed Training | DeepSpeed |
| Fine-tuning Acceleration | Unsloth |
| Vector DB Integration | Milvus (for synthetic data quality validation) |
| Leak Detection | Aho-Corasick multi-pattern string matching |
| Deployment | Docker/Kubernetes (Helm charts), AWS SageMaker |
| Infrastructure | Self-hosted in customer VPC, no data leaves network |

### Product Features (From Website + Repos)

1. **Private Synthetic Data Generation** — Create synthetic replicas preserving statistical properties
2. **Secure Fine-Tuning Pipeline** — Set privacy budgets (epsilon/delta) for model training
3. **Leakage Detection Toolkit** — Canary PII injection + leak detection to verify zero leakage
4. **Bias & Diversity Measurement** — Reduce bias, improve dataset balance
5. **Fully Self-Hosted Deployment** — VPC/on-prem with AWS, Azure, GCP, Databricks
6. **Easy Enterprise Integration** — Plug into existing MLOps platforms
7. **"PrivateTransformer Agent"** — Natural language config setup (marketing name, no public technical docs)

### AWS Marketplace Products

1. **PII Leakage Detection and Monitor** — $299/month, Docker on ECS/EKS, 50+ PII categories
2. **PII-Free Synthetic Text Replicas** — $10/hr training (ml.g5.xlarge), $16/hr inference (ml.p3.2xlarge)
   - Epsilon: 1.0-16.0 (default 8.0)
   - Batch size: 1-128 (default 1)
   - Epochs: 0.01-100.0 (default 0.01)
   - Learning rate: 0.0001-0.1 (default 0.001)
   - Max sequence length: 128-2048 tokens (default 512)

### How It Works (4-Step Pipeline from Website)

1. **Configure Privacy** — Select a privacy preset or customize epsilon/delta
2. **Generate Unstructured Data** — DP-guaranteed synthetic text retaining semantic meaning
3. **Generate Tabular Data** — DP-guaranteed synthetic data retaining statistical properties
4. **Safe Downstream AI Application** — Use for fine-tuning, testing, vendor sharing, simulations

### Compliance Claims

| Regulation | Claim |
|-----------|-------|
| GDPR | DP synthetic data is "fully anonymized" — out of scope for GDPR (NOTE: contested, see Critical Analysis) |
| HIPAA | Patient data safe for AI training via synthetic replicas |
| CCPA | No actual consumer records in synthetic data |
| Corporate IP | Locked-down datasets usable via synthetic replicas |

---

## 2. The Team

### Ben Cerchio — CEO & Co-founder
- **Education**: BBA, Lindner College of Business, University of Cincinnati
- **Career**:
  - IT Risk Advisory @ Schneider Downs (Jan 2017 - Mar 2019)
  - IT Internal Auditor @ TriNet (Mar 2019 - May 2020)
  - Innovation Lab + Technology Auditor @ PayPal (May 2020 - Dec 2021)
  - Product Privacy @ TikTok (Dec 2021 - Jun 2023)
  - CEO @ Secludy (2024 - present)
- **Profile**: Privacy/compliance expert, not technical ML. Understands enterprise buyer pain points from audit/privacy roles. Active at IAPP conferences (DPI 2025, GPS 2025). Most viral LinkedIn post: "Another day, another AI agent leaks sensitive data" — 2,089 reactions.
- **No academic publications.**

### Mingze He, Ph.D. — CTO & Co-founder
- **Education**:
  - B.S. Biotechnology, South China University of Technology (2012)
  - Ph.D. Bioinformatics & Computational Biology, Iowa State University (2018)
  - Advisors: Dr. Carolyn J. Lawrence-Dill, Dr. Peng Liu
  - ORCID: 0000-0002-8164-2480
- **Career**:
  - Bioinformatics Researcher @ BGI-Shenzhen (2010-2013)
  - Visiting Researcher @ UC-Berkeley (2012-2013)
  - Graduate Researcher @ Iowa State University (2013-2018)
  - ML Researcher @ SRI International (Feb 2019 - Jan 2020)
  - AI/ML Lead (Sr. Data Scientist) @ Williams-Sonoma (Jan 2020 - Jul 2024)
  - CTO @ Secludy (2024 - present)
- **Currently hiring**: Machine Learning Engineer (on-site, SF Bay Area)
- **Key milestone**: "Kicked off pilots with leading fintech and pharma companies" (2025-2026)

#### Mingze He's Complete Publication Record (9 Papers)

**CRITICAL FINDING: Zero publications on differential privacy, text anonymization, or synthetic data. All papers are in genomics/bioinformatics.**

| # | Title | Venue | Year | Citations | Role |
|---|-------|-------|------|-----------|------|
| 1 | Altitude adaptation in Tibetans caused by introgression of Denisovan-like DNA | **Nature** | 2014 | ~944 | Co-author (9th of 27) |
| 2 | Detection of clinically relevant genetic variants in autism spectrum disorder | Am. J. Human Genetics | 2013 | ~488 | Co-author |
| 3 | Whole-genome sequencing in an autism multiplex family | Molecular Autism | 2013 | ~80 | Co-author |
| 4 | An effort to use human-based exome capture methods for chimpanzee/macaque exomes | PLoS ONE | 2012 | ~29 | Co-author |
| 5 | An ontology approach to comparative phenomics in plants | Plant Methods | 2015 | ~26 | Co-author |
| 6 | A hypothesis-driven approach to RNA expression levels among gene groups | bioRxiv/Current Plant Biology | 2017 | ~6 | **Lead author** |
| 7 | Response to persistent ER stress in plants | The Plant Cell | 2018 | ~76 | Co-author |
| 8 | C-REx: Compare expression profiles for gene groups | J. Open Source Software | 2019 | ~0 | **Lead author** |
| 9 | Validation of computationally predicted synthetic lethal interactions for KRAS | Cancer Research (AACR) | 2021 | ~0 | Co-author (SRI International) |

**PhD Dissertation**: "Analysis of G-quadruplexes as environmental sensors" (Iowa State, 2018) — about maize gene expression under salt stress.

**Disambiguation Warning**: A different "Mingze He" at CUNY publishes on photonics/polaritons (Google Scholar iPWtyYMAAAAJ). Another "Mingze He" publishes on digital watermarking (DBLP pid/243/7441). Neither is the Secludy CTO.

#### Applied Privacy Research (Medium/Secludy — Not Peer-Reviewed)

| # | Title | Date | Key Finding |
|---|-------|------|-------------|
| 1 | Can Synthetic Data Be Reversed? | Sep 2024 | DP makes synthetic data mathematically improbable to reverse-engineer |
| 2 | How to Detect PII Leakage in Real-time | 2025 | Canary PII injection + Aho-Corasick detection tool |
| 3 | Fine-tuning LLMs on Sensitive Data → 19% PII Leakage | Jan 2025 | Headline finding: 19% leakage without DP, 0% with DP |
| 4 | How to Build Trust with Private Synthetic Data | Nov 2024 | Trust framework for synthetic data |
| 5 | Why Data Masking Doesn't Work in the World of LLMs | Jun 2025 | Contextual re-identification defeats masking |

#### What's Incorporable From His Background Into Our MVP

1. **Statistical comparison methodology (C-REx)** — Verify synthetic data preserves statistical distributions of original
2. **ML classification expertise (99.8% tumor classification)** — Build high-accuracy PII detection
3. **NLP + ontology structuring** — Categorize PII in unstructured text
4. **Pipeline engineering (Docker, AWS, HPC)** — Build the data processing pipeline
5. **Canary PII injection methodology** — Testing framework for validating privacy guarantees
6. **DP-SGD with epsilon tuning** — Privacy mechanism (epsilon 2-8 proven effective)
7. **Aho-Corasick string matching** — Efficient multi-pattern PII scanning in outputs

### David Zagardo — Researcher/Engineer
- **Education**: M.S. Privacy Engineering, Carnegie Mellon University
- **Certification**: CIPT (Certified Information Privacy Technologist)
- **Key Research**: "Empirical Analysis of PII Leakage in LLM Training: A Case Study Using Differential Privacy"
- **GitHub**: github.com/dzagardo
- **Key Findings**:
  - 19% PII leakage at injection rate 4 (non-DP training)
  - 0% leakage with DP-SGD at epsilon 2.0, 4.0, 8.0
  - Token frequency correlates strongly with leakage probability
  - Bitcoin wallets and VINs leak most (distinctive patterns); SSNs leak least

### Company Details

- **Founded**: 2024, San Francisco, CA (Delaware incorporation, entity #6363226)
- **Employees**: ~3 (Ben, Mingze, David)
- **Pre-seed Round** (Sep 2024): Oversubscribed, est. $500K-$2M
  - Lead: Forty Three ("43")
  - Participants: Script Capital, Precursor Ventures, Hustle Fund, Karman Ventures
- **Seed Round**: Reportedly just closed (per interview Apr 2, 2026) — not yet public
- **Press Coverage**: Minimal — no TechCrunch, VentureBeat, etc. Self-generated content only.
- **Conference Activity**: IAPP GPS 2025, DPI 2025; Unstructured Data Meetup (Milvus integration demo)

---

## 3. Secludy's GitHub Repositories (Technical Intel)

| Repo | Type | Description | Key Tech |
|------|------|-------------|----------|
| pii-redaction | Fork (OpenPipe) | LLM-based PII detection. 20 PII types, tag/redact/replace modes | Transformers + vLLM backends |
| fast-differential-privacy | Fork (AWS Labs) | DP-SGD for PyTorch. RDP/GLW accountants | Core DP library |
| Secludy-PII-Free-Synthetic-Text-Replicas | Original | AWS Marketplace synthetic text generator | Epsilon control, S3 I/O |
| LLM_fine-tuning-leaking-PII | Original | PII leakage research experiments | Mistral-7B, LoRA, TRL |
| PII-inject-detect-tool | Original | Canary injection + Aho-Corasick detection | Docker, Apache 2.0 |
| Mask9Leak1 | Original | Data masking failure demo: BERT + regex + Qwen-2.5-7B pipeline still leaks ~10% | Jupyter/Python |
| Secludy_AutoPilot_Redacto_helm_charts | Original | K8s deployment (product name: "AutoPilot Redacto") | Helm/Smarty |
| unsloth_GPUs | Fork | LLM fine-tuning 2x faster, 70% less memory | Optimization |
| DeepSpeed | Fork | Distributed training | Scale-out |
| data-caterer | Fork | Test data management | Scala |
| supabase-mcp-server | Fork | Supabase via chat interface | Python |

---

## 4. Key Research Findings (From Blog Posts + Experiments)

### Why Data Masking Fails with LLMs

1. **Contextual re-identification**: "top scorer of the national bar exam in 2022" — identifiable even without name
2. **Pattern reconstruction**: LLMs infer masked values from surrounding context
3. **Unstructured text gaps**: PII in natural language doesn't follow fixed formats — masking tools miss it
4. **Measured leakage rates from masked data**: Driver's License 9.35%, VINs 7.32%, SSNs 6.5%, Bitcoin 5.47%
5. **Mask9Leak1 finding**: Even BERT + regex + LLM masking pipeline fails ~10% of the time

### Canary PII Injection Experiment (Zagardo/He)

- **Model**: Mistral-7B-Instruct-v0.3, fine-tuned with LoRA/PEFT (4-bit quantization)
- **Dataset**: 4,660 corporate email records (Costco-style), 19 categories
- **Canaries**: 100 unique PII per type (SSN, VIN, Driver's License, Bitcoin), at injection rates 1, 2, 4
- **Training**: Batch 4 (effective 64), LR 5e-4, 3 epochs, max seq 512, adamw_8bit
- **Generation**: vLLM, temperature 0.8, top-p 0.95, ~4,655 synthetic outputs
- **Detection**: Aho-Corasick multi-pattern matching

| Injection Rate | Non-DP Leakage | DP (epsilon=2) | DP (epsilon=4) | DP (epsilon=8) |
|:-:|:-:|:-:|:-:|:-:|
| 1 | 0% | 0% | 0% | 0% |
| 2 | 0% | 0% | 0% | 0% |
| 4 | **19% (306 instances)** | 0% | 0% | 0% |

### Broader Academic Findings Relevant to MVP Design

- **ICLR 2025**: Strict DP (epsilon=3) on text makes utility **worse than random** — this justifies our MVP's decision to use Faker-based replacement rather than DP-SGD (which requires GPU infrastructure and degrades text quality)
- **SynBench 2025**: Pre-training contamination means DP during fine-tuning doesn't protect against info memorized during pre-training — relevant because our proxy sends data to pre-trained LLMs that may already "know" things about the user's domain
- **IEEE S&P 2025**: Industry privacy metrics (similarity-based) are fundamentally broken — means we should not claim quantitative privacy guarantees, only "reduces PII exposure"
- **Secludy's Mask9Leak1**: Even a 3-layer pipeline (BERT + regex + LLM) fails ~10% — sets realistic expectations for our simpler spaCy + regex detector

---

## 5. Competitive Landscape

### Market Size
- **$2.5-9.7B by 2030** (31-42% CAGR depending on scope definition)
- Gartner predicts 75% of businesses will use generative AI for synthetic data by 2026
- 55% of organizations already invested in PETs; 36% planning to within 12-24 months

### Acquisition Wave (2022-2025)

| Company | Acquirer | Date | Amount/Context |
|---------|----------|------|---------------|
| Gretel AI | NVIDIA | Mar 2025 | $320M+ valuation, ~80 employees |
| Hazy | SAS | Nov 2024 | $11.3M raised, UCL spinout |
| YData | KPMG | Oct 2025 | $3.24M raised, Portuguese |
| Statice | Anonos | Nov 2022 | Berlin-based |

**Implication**: Synthetic data increasingly viewed as a feature for larger platforms, not a standalone category.

### Independent Competitors

| Company | Raised | Key Differentiator |
|---------|--------|-------------------|
| Tonic.ai | $45M | Broadest platform (Fabricate + Structural + **Textual**). Most direct competitor for text PII. |
| Mostly AI | $31.1M | Open-source SDK, European/GDPR-first positioning |
| Synthesized | $30.5M | UBS + Deutsche Bank backing |
| DataCebo | $8.5M | MIT-origin Synthetic Data Vault (SDV), open-source ecosystem |

### Market Failures (Cautionary Tales)
- **Datagen**: Raised $70M, shut down in 2024 despite having $20M cash reserves
- **AI.Reverie**: Acquired by Meta purely as talent acquisition (product abandoned)
- **Key insight** (Pebblous analysis): "Single-function synthetic data tools alone cannot sustain viable businesses" — survivors need multi-module platforms, deep workflow embedding, ecosystem partnerships

### Secludy's Differentiation
1. **Text-focused** (most competitors focus on tabular)
2. **Self-hosted** (data never leaves customer network)
3. **Dramatically underfunded** ($500K-$2M vs $30-65M for peers)

---

## 6. Critical Analysis (From Deep Research)

### GDPR "Out of Scope" Claim — Contested
- No DPA has definitively approved DP synthetic data as "anonymized" under GDPR
- GDPR Recital 26 requires anonymization to be irreversible — still debated for synthetic data
- Canadian Privacy Commissioner has expressed skepticism
- **Accurate framing**: DP significantly reduces risk, but regulatory classification is not settled

### Academic Challenges to Synthetic Data
1. **DP-SGD outperforms synthetic data** — arXiv:2502.12976 (2025): Direct DP training is **385x cheaper** and strictly better for privacy than synthetic data generation
2. **Privacy metrics are broken** — IEEE S&P 2025 Distinguished Paper (Ganev & De Cristofaro): ReconSyn attack reconstructs **78-100% of outlier records** from data certified "truly anonymous" by industry metrics
3. **ALL records vulnerable, not just outliers** — USENIX Security 2024 (Annamalai et al., Oxford): Linear reconstruction attack works on **arbitrary records**, not only outliers
4. **Text DP is especially hard** — ICLR 2025: Text sanitization leaves **74% of information inferable**; strict DP (epsilon=3) makes utility **worse than random** (-0.46); coherence drops 36%
5. **Canary testing has limits** — ICML 2025 (Microsoft Research, "The Canary's Echo"): Canaries designed for model attacks are "sub-optimal for privacy auditing when only synthetic data is released"
6. **Pre-training contamination** — DP during fine-tuning doesn't protect against info memorized during pre-training (SynBench 2025)
7. **New attack classes emerging** — TAMIS (cheaper than MAMA-MIA), LLM-based re-identification from DP data, ensemble attacks improving success rates
8. **Masking pipelines fail ~10%** — Secludy's own Mask9Leak1 repo shows BERT + regex + Qwen-2.5-7B replacement still leaks ~10% of entities

### Secludy's Unsubstantiated Claims
- "99.99% privacy and IP leakage proof" — no published methodology
- "PrivateTransformer Agent" — no technical documentation exists
- "Self-improving algorithms" — marketing only
- Default epsilon 8.0 — weak by academic standards (NIST says >10 may not be meaningful)

---

## 7. What We're Building (Features for Our MVP)

### MVP Privacy Model — Critical Distinction

**Our MVP does NOT provide differential privacy guarantees.** It uses deterministic PII replacement (spaCy NER + regex detection, Faker-based synthetic generation). This is fundamentally different from Secludy's DP-SGD approach.

- **Our privacy guarantee**: Detection coverage (recall of the PII detector). Any PII the detector misses passes through unmodified.
- **Secludy's privacy guarantee**: Mathematical bound via epsilon/delta differential privacy.
- **Why this is the right MVP choice**: Strict DP on text (epsilon=3) makes utility worse than random (ICLR 2025). DP-SGD requires GPU infrastructure. Faker replacement is fast, deterministic, and produces readable output.
- **What this means for claims**: We should NOT claim mathematical privacy guarantees or regulatory compliance. We claim "significantly reduces PII exposure risk." Users should evaluate compliance with their own legal teams.

### PII Detection Limitations (Known Weaknesses)

spaCy's `en_core_web_sm` model has known limitations that set realistic expectations:
- **Informal text**: Poor performance on chat messages, social media, non-standard formatting
- **Non-English names**: Lower recall on names from non-Western cultures
- **Domain-specific entities**: Medical record numbers, case IDs, and custom identifiers require additional regex patterns
- **Contextual PII**: Indirect identifiers ("top scorer of the bar exam in 2022") cannot be caught by NER or regex
- **Expected recall**: Even Secludy's 3-layer pipeline (BERT + regex + Qwen-2.5-7B) leaks ~10%. Our simpler detector will likely have **15-25% miss rate** depending on text type.
- **Mitigation**: The test suite should include recall measurement. Future improvements can add transformer-based NER or LLM-based detection.

### Product A: Dataset Scrubbing Pipeline (Replicates Secludy's core product)

**Features**:
1. PII detection using spaCy NER + regex patterns (20+ PII categories)
2. Three processing modes: Replace (Faker synthetic), Redact (remove), Tag (XML markers)
3. Session consistency — same PII always maps to same fake value
4. Multi-format support: CSV, JSON, JSONL, plain text
5. Processing report: PII found by type, counts, replacement summary
6. Side-by-side comparison view (original vs scrubbed)

**PII Categories**: Person names, emails, phone numbers, SSNs, credit cards (Luhn validation), street addresses, dates of birth, IP addresses, organizations, medical conditions, VINs, Bitcoin wallets, driver's license numbers, passwords, bank accounts, demographics, custom regex patterns

### Product B: Real-Time LLM Privacy Proxy (Our additional product idea)

**Features**:
1. Reverse proxy between users and LLM APIs (OpenAI, Anthropic)
2. Intercept outgoing messages, detect and replace PII
3. Bidirectional mapping: forward (scrub) + reverse (re-inject) passes
4. Users see seamless experience with original PII in responses
5. Companies can host internally — data never leaves network
6. Session-scoped mapping tables for consistency

**This product has a larger TAM than dataset scrubbing** — it lets any company's employees safely use ChatGPT/Claude/etc. without risk of sending sensitive data to external APIs.

### Product C: PII Leak Detection (POST-MVP — Validates both products)

> Descoped from MVP per design spec. The `/api/v1/detect/scan` endpoint provides detection-only functionality. The full canary injection + leak testing framework below is a future enhancement.

**Post-MVP Features**:
1. Canary PII injection into datasets
2. Aho-Corasick multi-pattern matching for leak detection
3. Per-category leakage statistics
4. Detection report (JSON + visual)

### Web Dashboard

**Pages**:
- Dashboard — overview stats, feature cards, system health
- Scrub — file upload, text input, mode selection, side-by-side results
- Proxy — provider config, chat interface with PII highlighting
- Results — history of all scrubbing jobs with download

### Tech Stack

| Component | Technology |
|-----------|-----------|
| Backend | Python 3.11+ / FastAPI |
| PII Detection | spaCy (en_core_web_sm) + regex |
| Synthetic Data | Faker |
| LLM Proxy | httpx (async HTTP) |
| Frontend | Next.js 15 / TypeScript / Tailwind CSS |
| Deployment | Docker / Docker Compose |
| Testing | pytest |

### API Endpoints

| Method | Path | Description |
|--------|------|-------------|
| POST | /api/v1/scrub/text | Scrub PII from text |
| POST | /api/v1/scrub/file | Upload and scrub file |
| GET | /api/v1/scrub/result/{id} | Get scrub result |
| POST | /api/v1/proxy/chat | Proxy chat through PII scrubbing |
| POST | /api/v1/proxy/config | Configure proxy target |
| POST | /api/v1/detect/scan | Detect PII without replacing |
| GET | /api/v1/health | Health check |

---

## 8. Implementation Recommendations (From Deep Research)

1. **Adopt Secludy's canary injection methodology** as testing/validation — open-source, Apache 2.0, well-documented
2. **Build on established academic DP work**: DP-SGD (Abadi et al. CCS 2016), Yue et al. synthetic text recipe (ACL 2023), NIST SP 800-226 guidelines
3. **Target epsilon <= 4.0** for meaningful privacy guarantees in future DP implementation (Secludy defaults to 8.0 which is weak; NIST says >10 is meaningless). Not applicable to MVP which uses Faker replacement.
4. **Layer defenses**: PII detection + synthetic replacement + canary validation + runtime monitoring
5. **Account for pre-training contamination** in any privacy claims
6. **For MVP**: spaCy + regex is sufficient for PII detection (no need for BERT/LLM-based detection yet)
7. **Faker-based replacement** is appropriate for MVP — deterministic seeding ensures session consistency

### Key Academic Papers to Reference (for credibility)

| Paper | Venue | Year | Why It Matters |
|-------|-------|------|---------------|
| Abadi et al. — "Deep Learning with Differential Privacy" | CCS | 2016 | Foundational DP-SGD algorithm |
| Yue et al. — "Synthetic Text Generation with DP: A Simple Recipe" | ACL | 2023 | Practical playbook for DP text generation |
| Kurakin et al. — "Harnessing LLMs to Generate Private Synthetic Text" | Google | 2023 | Paper Ming explicitly cites in his Secludy article |
| Feyisetan et al. — "Privacy-Preserving Textual Analysis" | WSDM | 2020 | Word-level metric DP: embed → noise → decode |
| Igamberdiev & Habernal — "DP-BART" | ACL | 2023 | Document-level text rewriting under local DP |
| Carvalho et al. — "TEM: Truncated Exponential Mechanism" | SDM | 2023 | Higher-utility word perturbation |
| NIST SP 800-226 | NIST | 2024 | Official guidelines for evaluating DP guarantees |
| Ganev & De Cristofaro — "Inadequacy of Similarity-based Privacy Metrics" | IEEE S&P | 2025 | Why industry privacy metrics are broken |

---

## Sources

### Deep Research Reports (Full versions in ~/Documents/Research/)
- Secludy Company Analysis: ~/Documents/Research/Secludy_Company_20260404_49669314/ (406 lines, 38+ sources)
- Mingze He Research: ~/Documents/Research/Mingze_He_Research_20260404_BFD26A44/ (459 lines, 47 sources)

### Primary Sources
- secludy.com (full website crawl via Chrome extension)
- medium.com/secludy (4 blog posts)
- github.com/Secludy (10 repositories analyzed)
- LinkedIn: Ben Cerchio, Mingze He (profiles + activity feeds)
- Iowa State BCB: bcb.iastate.edu/people/mingze-he
- Google Scholar searches (confirmed disambiguation of 3 different "Mingze He" researchers)
- AWS Marketplace product listings
- Crunchbase, Tracxn, PitchBook company profiles
- David Zagardo's Medium articles and GitHub