SocioTable-KZ: Ethical and Privacy-Aware Bilingual Generation from Sociological Survey Data

Abstract

Large language model (LLM)-based assistants can make large sociological survey collections more accessible, but they may also increase the exposure of respondent-level information and socially sensitive content. This study presents SocioTable-KZ, a privacy-aware, risk-reducing pipeline for bilingual natural-language interpretation of relational sociological survey data from Kazakhstan. The source collection contains 2,385,890 records distributed across 28 linked tables. The pipeline combines identifier exclusion, deterministic JoinGraph serialisation, language-specific QLoRA adaptation of Qwen-family models, a three-class Safe–Sensitive–Unsafe safety module, constrained rewriting, and controlled release. Reference analytical texts were prepared through expert-curated seed examples followed by few-shot candidate generation and factual review. Generation experiments used independent Kazakh and Russian 80/10/10 splits with seed 42. The best reported Qwen3-4B configuration achieved BLEU/ROUGE-L/chrF scores of 29.07/49.88/58.31 for Kazakh and 46.67/65.00/68.40 for Russian. The safety-labelled corpus contained 1347 Kazakh and 3376 Russian instances. On the reported Kazakh evaluation corpus, the safety module achieved 0.925 accuracy and F1-scores of 0.87, 0.95, and 0.70 for Safe, Sensitive, and Unsafe, respectively; Unsafe recall was 0.59. The revised deployment protocol therefore prohibits unattended respondent-level release and requires deterministic identifier screening and human review for non-Safe or uncertain outputs. An official letter from the original data-collecting institution confirms active informed consent and authorised scientific use of the anonymised dataset. The evidence supports preliminary feasibility, not a formal privacy guarantee or production-readiness claim.

1. Introduction

Large language model (LLM)-based assistants are increasingly used to make complex information accessible through natural-language interaction. In sociological research, such systems can help analysts, decision makers, and non-specialist users interpret findings stored in relational databases, coded response fields, and reference tables. However, generative access to survey data creates risks that extend beyond linguistic fluency. Survey databases may contain demographic characteristics, geographical information, political or religious views, perceptions of social justice, health-related information, and free-text responses. When those data are transformed into readable narratives, the system may reveal sensitive attributes, enable re-identification through combinations of quasi-identifiers, reproduce harmful framing, or present an individual response as a population-level conclusion.

Unlike general web text, survey responses are collected from human participants for defined research purposes and under expectations of confidentiality. The fact that an LLM can produce a coherent description does not imply that every available attribute should be reproduced. Automated generation changes the accessibility of the data: information previously available only to authorised analysts can be reformulated and delivered directly through a conversational interface. This transformation creates an obligation to minimise unnecessary disclosure, preserve respondent autonomy, avoid unsupported generalisations, and keep released text consistent with the original purpose of data collection.

Several risks make the problem consequential. Direct identifiers may occur in source fields or free-text responses. Even after their removal, combinations such as exact age, locality, survey wave, and rare response content may increase indirect identification risk. Classical privacy models, including k-anonymity and ℓ-diversity, show that removing direct identifiers alone is insufficient when attribute combinations reveal sensitive information [1,2]. Language models may also memorise and reproduce fragments of training data [3]. In addition, outputs may contain hallucinated claims, discriminatory framing, or unwarranted social inference [4,5].

This study proposes SocioTable-KZ, a privacy-aware bilingual pipeline for generating natural-language interpretations from interconnected sociological survey data. The expression privacy-aware is used deliberately: the method implements risk-reducing controls but does not claim differential privacy, cryptographic confidentiality, or a proven upper bound on re-identification risk. The pipeline combines protected relational-data preparation, deterministic JoinGraph serialisation, language-specific QLoRA adaptation, a domain-specific safety taxonomy, constrained rewriting, and controlled release.

The revised study makes five contributions:

• A deterministic JoinGraph representation for minimised, auditable serialisation of linked survey tables;
• A bilingual QLoRA generation procedure with independent Kazakh and Russian adapters and held-out automatic evaluation;
• A documented two-stage safety annotation protocol with three expert annotators and a conservative Safe–Sensitive–Unsafe taxonomy;
• Operational rules for identifier exclusion, quasi-identifier generalisation, human review, audit logging, and release control;
• An explicit evidence map distinguishing empirically evaluated components from design choices that still require controlled ablation and formal privacy evaluation.

The remainder of the paper is organised as follows. Section 2 reviews relational data-to-text generation, low-resource multilingual adaptation, and safety and privacy research. Section 3 describes data provenance, consent, target construction, JoinGraph serialisation, model adaptation, safety annotation, and deployment controls. Section 4 reports generation, training, safety, and operational-control results. Section 5 discusses architectural implications and limitations. Section 6 concludes the paper.

2. Related Work

2.1. Relational Data-to-Text Generation and Factuality

Data-to-text generation has progressed from templates and statistical realisation to neural and instruction-tuned models [6,7]. Structured representations improve content selection, but fluent text can still contain unsupported facts or omit source information. NLI-based evaluation has therefore been proposed to measure whether generated text contains all and only facts supported by the input [8]. Recent evaluation of open LLMs confirms that fluency does not guarantee semantic accuracy and motivates source-grounded and human evaluation [9]. Most established benchmarks represent a single table or compact record; they do not directly model the foreign-key dependencies and data-minimisation requirements of a 28-table sociological database.

2.2. Parameter-Efficient and Low-Resource Multilingual Adaptation

LoRA and QLoRA reduce adaptation cost by training low-rank updates while keeping the backbone frozen or quantised [10,11]. Their efficiency is useful for bilingual domain adaptation, but data imbalance can produce unequal quality across languages. This concern is particularly relevant for Kazakh, for which dedicated benchmarks and model resources remain limited. KazMMLU demonstrates persistent performance gaps for Kazakh and Kazakhstan-specific knowledge even among strong multilingual models [12]. Language-specific adapters can reduce direct competition between a larger Russian subset and a smaller Kazakh subset, although a shared-adapter baseline is still needed to isolate the effect experimentally.

2.3. Multilingual Safety, PII Control, and Formal Privacy

General guardrails and safety benchmarks evaluate harmful content and model refusals [13,14]. Multilingual safety studies show that non-English behaviour can differ substantially from English behaviour, so safety evaluation should be language-specific rather than assumed to transfer automatically [15]. PII redaction and classify-and-rewrite mechanisms can reduce disclosure, but they do not provide formal privacy guarantees. Differentially private fine-tuning provides a stronger, mathematically defined alternative, although it introduces a privacy–utility trade-off and was not implemented in the present study [16]. SocioTable-KZ therefore combines deterministic data minimisation and release governance with a learned safety module, while explicitly treating residual risk as unresolved.

At the governance level, global AI ethics guidelines, principle-based frameworks, critiques of principle-only approaches, and the NIST AI Risk Management Framework provide complementary foundations for transparency, accountability, human oversight, and operational risk management [17,18,19,20].

Table 1. Positioning of SocioTable-KZ relative to adjacent approaches.

Approach	Relational Structure	Bilingual/Low-Resource Focus	Privacy or Safety Control	Distinct Scope of SocioTable-KZ
Conventional table-to-text benchmarks	Usually one table or compact record	Usually not Kazakh–Russian-specific	Mainly factuality and fluency	Foreign-key-aware serialisation over 28 linked survey tables
General LLM guardrails	Unstructured prompts and outputs	Multilingual coverage varies	Generic harmful-content policy	Sociological Safe–Sensitive–Unsafe taxonomy and quasi-identifier rules
PII redaction pipelines	Field or span detection	Language-specific tools may be required	Removes recognised direct identifiers	Combines pre-inference exclusion, generalisation, rewrite, and release control
Differentially private fine-tuning	Model-training focus	Applicable across languages	Formal privacy accounting	Not implemented; identified as necessary for future formal guarantees
SocioTable-KZ	Deterministic JoinGraph active subgraph	Separate Kazakh and Russian adapters	Defence-in-depth, human review, and controlled release	Integrated relational, linguistic, safety, and governance workflow

summarises the positioning of SocioTable-KZ relative to adjacent data-to-text, LLM guardrail, PII-redaction, and privacy-preserving approaches.

3. Methodology

3.1. System Overview

Figure 1 presents the revised system architecture. Source records are cleaned, direct identifiers are excluded, and quasi-identifiers are typed before serialisation. The active relational context is transformed into a deterministic JoinGraph sequence and passed to a Qwen-family model with a language-specific QLoRA adapter. The candidate response is then assessed by the safety layer. Safe outputs can proceed to controlled release; Sensitive outputs are generalised or rewritten and rechecked; and Unsafe or uncertain outputs are withheld for human review.

3.2. Data Source, Secondary-Analysis Status, and Informed Consent

The protected source database contains 2,385,890 records distributed across 28 interconnected tables and covers sociological surveys conducted in Kazakhstan between 2011 and 2024. The original data collection was performed by the Institute of Philosophy, Political Science and Religious Studies, Committee of Science, Ministry of Science and Higher Education of the Republic of Kazakhstan. The authors of the present study did not recruit respondents, conduct interviews, or access direct identifiers; they performed secondary computational analysis on an analytical dataset anonymised before transfer.

The data-providing institution issued an official signed and stamped confirmation dated 30 July 2026 (Letter No. 01-11/244-Sh). The letter confirms that participation in the original surveys was voluntary and that consent was actively documented before access to substantive questions through the mandatory question “Do you agree to participate voluntarily in this survey?” Only respondents who selected “Yes, I agree” proceeded; respondents who selected “No, I do not agree” were not included. Before consent, respondents were informed about the organisation conducting the survey, the purpose of the research, confidentiality, scientific and academic-publication use, and the right to refuse or discontinue participation. The letter further confirms that the dataset supplied to the authors contained no names, telephone numbers, email addresses, identification numbers, exact residential addresses, or other direct identifiers and authorised scientific analysis and aggregated publication.

No retrospective ethics approval is claimed for the historical surveys. The present manuscript reports the consent confirmation transparently and limits its claims to secondary analysis of the anonymised dataset.

3.3. Data Preparation and Construction of Supervised Targets

The answers table served as the central fact table and was joined to question texts, survey themes, years, keywords, respondent-related attributes, response variants, and code values. Open-ended responses stored in answer_text and predefined responses stored in answer_variant were normalised into the unified field answer_final as follows:

$$\mathtt{answer}\_\mathtt{final}=\left\{\begin{array}{cc}\mathtt{answer}\_\mathtt{text},\hfill & \mathrm{if}\mathtt{answer}\_\mathtt{text}\ne ⌀,\hfill \\ \mathtt{answer}\_\mathtt{variant},\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(1)

Null values, malformed records, redundant technical fields, and duplicate representations were removed. The resulting model records contained the survey theme, year, question title, keyword, normalised answer, target language, and only the generalised contextual fields permitted by the privacy policy. Supervised target_text paragraphs were prepared in two stages. First, domain experts curated a seed set defining the expected analytical style, neutral terminology, and restrictions on unsupported inference. Second, candidate paragraphs were generated through few-shot prompting with Qwen models and reviewed for factual consistency against the structured question–answer record before inclusion. Thus, automatic generation metrics measured agreement with reviewed reference texts; they did not replace an independent human evaluation of factuality, completeness, social appropriateness, or residual privacy risk.

The deduplicated generation subsets contained 1192 Kazakh and 6229 Russian instances. Each language was split independently into training, validation, and test partitions using an 80/10/10 ratio and a random seed of 42. Splitting by language prevents the larger Russian subset from determining the Kazakh validation and test composition.

3.4. JoinGraph Relational Serialisation

The schema is represented as a directed attributed graph $G=(V,E,\lambda ,\mu )$, where V contains table and attribute nodes, E contains relational edges, $\lambda$ assigns structural roles, and $\mu$ labels foreign-key, reference, or aggregation relations. For record $\rho$, the active subgraph $G\left(\rho \right)$ is the minimum connected subgraph containing non-null attributes necessary for interpretation. Its deterministic sequence is

$$s\left(\rho \right)=\mathrm{DFS}\left(G\left(\rho \right),v_{\mathrm{fact}},\lambda ,\mu \right),$$

(2)

and the model prompt is

$$P(q,\rho ,\mathsf{\ell })=[\mathrm{instruction};\mathrm{query};s(\rho );\mathsf{\ell }],$$

(3)

where $\mathsf{\ell }\in \{\mathrm{Kazakh},\mathrm{Russian}\}$. Deterministic ordering makes the input auditable and reduces schema noise. Every field is typed as an identifier, quasi-identifier, or content field before prompt construction.

3.5. Operational Rules for Identifiers and Quasi-Identifiers

Table 2. Operational disclosure-control rules.

Attribute Type	Examples	Prompt Rule	Output Rule
Direct identifier	name, telephone, email, user identifier, exact address	Excluded before serialisation	Replace accidental occurrence with typed placeholder and block automatic release
Exact age	numeric age	Convert to decade bracket when context is needed	Use age range; suppress for rare combinations
Precise locality	village, street, exact settlement	Promote to region or larger administrative unit	Release only generalised location
Rare category combination	age + locality + rare answer	Remove the least analytically necessary field	Escalate to Sensitive and require review
Respondent reference	row-level person description	Use neutral participant token	Avoid language implying identification or representativeness
Aggregate statistic	sufficiently broad group result	Retain when permitted by query and data-sharing terms	May be released with scope and denominator stated

formalises the operational rules that were previously described only generally. Rules are applied before inference and, where necessary, again during output rewriting.

These operational rules were formulated with reference to the requirements of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” [21].

3.6. Bilingual QLoRA Generation

Qwen-family instruction models were adapted with 4-bit NF4 QLoRA [11]. LoRA rank was $r=32$, scaling $\alpha =64$, and dropout $0.05$. Prompt tokens were assigned the ignore index $-100$, so the causal-language-model objective was calculated only over target tokens:

$$\mathcal{L}\left(\theta \right)=-{\displaystyle \sum _{t=m+1}^T}\log p_{\theta }(x_t\mid x_{<t}).$$

(4)

Training used AdamW-8bit, a cosine learning-rate schedule, a learning rate of $2\times {10}^{-4}$, a weight decay of $0.01$, a warm-up ratio of $0.03$, a maximum gradient norm of $0.3$, a per-device batch size of 4, a gradient accumulation of 4, and a maximum sequence length of 1408 tokens (1024 prompt and 384 target tokens). Separate Kazakh and Russian adapters were trained. Later comparative runs were limited to three epochs, validation was checked every 100 steps, and early stopping used patience 3; these settings were introduced after the four-epoch prototype run showed a validation-loss rebound.

3.7. Safety Taxonomy, Annotation, and Classify-and-Rewrite Module

The safety taxonomy contains three classes:

• Safe: no direct identifier, prohibited quasi-identifier combination, or socially harmful framing requiring intervention;
• Sensitive: indirect identifiers or context-dependent social content requiring generalisation, qualification, or human review;
• Unsafe: direct PII, precise geolocation, or content that must not be released automatically.

Borderline cases are conservatively escalated from Safe to Sensitive.

Annotation was conducted in two stages. A rule-based tagger first flagged Kazakhstan-format telephone numbers, user-identifier strings, and postal-code patterns, while Gemini was used as a zero-shot bootstrap labeler. These automatic assignments were drafts. Three domain experts then independently labelled a stratified sample of 2000 generated texts. Disagreements were resolved by majority vote, with borderline Sensitive cases adjudicated by a senior annotator. Fleiss’ $\kappa$ for the three annotators was 0.81. The adjudicated safety set was partitioned into training, validation, and test sets using a 70/15/15 split.

The safety component is a single bilingual instruction-tuned Qwen3.5-4B model adapted with LoRA. Its fixed input template contains the survey question and normalised answer; its target contains a structured label and, for non-Safe cases, a constrained rewrite:

• Safety: <Safe | Sensitive | Unsafe>
• Rewrite: <neutralised and de-identified text>
• The same prompt-masking principle is used as in generation. Decoding is greedy with a mild repetition penalty. The historical run retained the naturally imbalanced class distribution and did not apply post hoc resampling. Because the class is emitted as a token sequence rather than selected from calibrated logits, it also did not use an independently optimised probability threshold. These choices are limitations for the rare Unsafe class and motivate future cost-sensitive training and discriminative calibration.

3.8. Deployment Protocol and Interim Risk Mitigation

The reported Unsafe recall is insufficient for unattended respondent-level release. The revised protocol therefore requires the following safeguards:

• Public-facing access is restricted to aggregate results; respondent-level generation is limited to authorised analysts.
• Deterministic PII screening is applied before model inference and again before release.
• Sensitive, Unsafe, malformed, or uncertain outputs are withheld from automatic delivery and require human review.
• Audit logs record the query, data scope, model version, safety decision, rewrite decision, and reviewer action.
• Access to and use of the data must remain consistent with the scope of the original informed consent and the applicable data-sharing agreement.
• Annotation guidance and borderline examples are periodically re-adjudicated as legal and social expectations evolve.

These controls are deployment requirements rather than evidence that the current prototype is production-ready.

3.9. Evaluation Scope

Generation quality is evaluated on held-out language-specific test sets using BLEU-4, ROUGE-1/2/L, chrF, METEOR, token F1, and Exact Match. These metrics assess overlap and surface-level semantic agreement with reviewed references but do not directly measure respondent re-identification risk. Safety performance is reported with per-class precision, recall, and F1, macro and weighted averages, and special emphasis on Unsafe recall. Operational privacy handling is quantified through the proportion of annotated cases routed to direct release, rewrite/review, or blocking. No formal differential-privacy budget, membership-inference test, reconstruction attack, or expert rewrite-fidelity evaluation is claimed.

4. Results

4.1. Corpus and Safety-Label Distribution

The safety-labelled corpus contained 1347 Kazakh and 3376 Russian instances.

Table 3. Distribution of safety labels by language.

Language	Safe	Sensitive	Unsafe	Total
Kazakh	292 (21.7%)	1011 (75.1%)	44 (3.3%)	1347
Russian	792 (23.5%)	2536 (75.1%)	48 (1.4%)	3376

shows that Sensitive records represented 75.1% in both languages, while Unsafe records were rare.

The distribution of the three safety categories across the Kazakh and Russian subsets is visualised in Figure 2.

4.2. Held-Out Bilingual Generation Evaluation

Table 4. Automatic generation metrics on held-out test sets (values in percentage points).

Model	BLEU	R-1	R-2	R-L	chrF	METEOR	Token F1	EM
Qwen3-4B (KZ)	29.07	52.67	35.44	49.88	58.31	49.89	52.44	2.00
Qwen3-4B (RU)	46.67	67.01	52.46	65.00	68.40	60.41	63.62	10.00
Qwen2.5-3B (KZ)	26.69	47.51	30.41	45.62	55.63	45.08	47.18	0.00
Qwen2.5-3B (RU)	41.72	63.21	47.26	61.22	65.55	56.35	60.02	10.00

reports held-out automatic results for two Qwen backbones. Qwen3-4B outperformed Qwen2.5-3B in both languages. Russian scores were higher than Kazakh scores across all metrics, consistent with the larger Russian training subset and broader Russian pretraining coverage. Exact Match remained low because multiple valid surface formulations can express the same structured record.

These results strengthen the empirical basis beyond validation loss, but they do not by themselves establish factual completeness, absence of hallucinations, or social appropriateness. Qualitative inspection found that rare answer categories sometimes produced generic interpretations and that Kazakh outputs occasionally contained Russian technical terms. A blinded expert study and a source-grounded factuality metric remain necessary.

4.3. Training Dynamics and Overfitting Analysis

In the four-epoch prototype run, training loss decreased from 0.1476 to 0.0490. Validation loss decreased from 0.2220 to 0.1569 at epoch 3 and then increased to 0.1807 at epoch 4 (Figure 3). The divergence is consistent with incipient overfitting: the adapter continued fitting the limited domain corpus after validation performance had peaked. Likely contributors include the small Kazakh subset, repeated analytical templates, class and language imbalance, and an additional epoch after the validation minimum.

The epoch 3 checkpoint was therefore retained. Subsequent comparative configurations used a maximum of three epochs, validation every 100 steps, early stopping with a patience of 3, dropout of 0.05, and weight decay of 0.01. These controls mitigate but do not eliminate overfitting, and the result should not be interpreted as proof of factual or privacy performance.

4.4. Safety Classification Performance

Table 5. Safety-module performance on the reported Kazakh evaluation corpus.

Category	Precision	Recall	F1-Score	Support
Safe	0.830	0.900	0.870	292
Sensitive	0.960	0.950	0.950	1011
Unsafe	0.870	0.590	0.700	44
Macro average	0.887	0.813	0.840	1347
Weighted average	0.930	0.925	0.920	1347
Accuracy	–	–	0.925	1347

reports the archived Kazakh evaluation corpus. The model achieved an accuracy of 0.925, weighted F1 of 0.920, and macro F1 of 0.840. Unsafe recall was 0.59, corresponding to an estimated false-negative rate of 0.41 under the reported rounded values.

The Unsafe class contains only 44 examples, and its low recall is the most consequential limitation. The metric means that the classifier cannot serve as the sole release gate. The revised protocol therefore applies deterministic screening and human review to respondent-level, non-Safe, or uncertain outputs. Equivalent Russian prediction metrics were not retained in the archived evaluation report; the manuscript now states this limitation rather than implying bilingual validation of the safety classifier.

4.5. Quantitative Operational Privacy-Control Assessment

The method does not provide formal privacy guarantees, but the annotated corpus allows the release policy to be quantified.

Table 6. Operational disposition of annotated records under the SocioTable-KZ release policy.

Language	Safe/Direct	Sensitive/Review	Unsafe/Block	Intervention
Kazakh	21.7%	75.1%	3.3%	78.4%
Russian	23.5%	75.1%	1.4%	76.5%

shows the share of records assigned to direct release, rewrite/review, or blocking. Under this policy, 78.4% of Kazakh and 76.5% of Russian annotated instances receive an intervention rather than direct release.

This is an operational coverage measure, not an estimate of re-identification probability. The remaining quantitative risk evidence is the Unsafe false-negative rate of approximately 0.41. Formal evaluation would require attack-based testing, membership or reconstruction analysis, and a validated privacy–utility study of rewritten outputs.

4.6. Evidence for Individual Components

Reviewer concerns about ablation motivated an explicit evidence audit (

Table 7. Evidence status for the proposed components.

Component	Available Evidence	Remaining Ablation
Qwen backbone size	Qwen3-4B outperforms Qwen2.5-3B in both languages	Broader model and seed comparison
Language-specific adapters	Separate KZ/RU held-out metrics expose the language gap	Shared bilingual-adapter baseline
JoinGraph serialisation	Deterministic schema preservation and auditable active-subgraph design	Flat-concatenation and schema-free baselines
Prompt masking	Target-only objective is specified and reproducible	Full-sequence-loss baseline
Safety module	Per-class KZ report and intervention coverage	No-guardrail baseline, calibrated thresholds, and RU metrics
Constrained rewrite	Operational hierarchy and examples	Expert fidelity and residual-risk evaluation

). The current experiments compare language and model configurations but do not isolate every architectural contribution. The revision therefore narrows causal claims.

Accordingly, SocioTable-KZ is presented as an integrated, preliminary framework. The results do not prove that each component independently causes the observed performance improvement.

4.7. Prototype Deployment

The selected generator and safety module were integrated into a Telegram prototype. Figure 4 shows aggregate safety statistics and a generated analysis with a visible safety label. The interface demonstrates implementation feasibility but is not a user study or evidence of unattended deployment readiness.

5. Discussion

The main architectural implication is that privacy risk is distributed across the pipeline rather than concentrated in one classifier. JoinGraph contributes by limiting the model input to an active connected subgraph and preserving the provenance of each field. This structure supports auditability: analysts can inspect which attributes entered a prompt and why. A flat prompt may contain the same values, but it does not provide the same explicit relationship and minimisation logic. Controlled ablation against flat serialisation remains necessary to quantify the performance contribution.

Language-specific adapters address a different problem. The Russian subset is substantially larger, and the held-out results show a 15.12-point ROUGE-L gap and a 17.60-point BLEU gap between Russian and Kazakh for Qwen3-4B. Independent adapters prevent the larger language from directly dominating a shared update and allow targeted Kazakh improvement. However, separate adapters increase maintenance cost and do not prove that they outperform a balanced shared adapter. The language gap is therefore treated as an empirical equity concern, not merely a technical detail.

The privacy–utility trade-off is clearest in quasi-identifier generalisation. Exact ages and localities can increase analytical specificity but may also permit re-identification when combined with rare answers. The hierarchy in Table 2 preserves broader sociological meaning while reducing specificity. Aggressive generalisation can remove useful distinctions, whereas weak generalisation can leave residual disclosure risk. The present study quantifies routing decisions but does not yet quantify rewrite fidelity or residual identifiability.

The generator and safety module are interdependent. A fluent generator can produce a factually faithful but ethically inappropriate respondent-level narrative; conversely, an overly conservative safety module may suppress legitimate aggregate analysis. The three-class taxonomy allows a middle state in which content is not treated as harmless but can be generalised and reviewed. The low Unsafe recall shows that this learned module must remain subordinate to deterministic screening and human governance.

Several limitations remain. First, the reported safety metrics are available only for the Kazakh evaluation corpus; equivalent Russian predictions and threshold curves are required. Second, the historical safety module emits labels through generation rather than calibrated class probabilities. Third, automatic generation metrics do not directly quantify hallucination, factual completeness, or expert acceptability. Fourth, the component analysis is not a full empirical ablation. Fifth, no formal differential privacy, membership-inference evaluation, or reconstruction attack was performed. Sixth, the consent confirmation supports authorised secondary use of anonymised data but is not a retrospective institutional ethics approval for the historical surveys. These limitations restrict the conclusion to preliminary feasibility.

6. Conclusions

SocioTable-KZ integrates deterministic relational serialisation, bilingual parameter-efficient adaptation, safety annotation, constrained rewriting, and controlled release for sociological survey data. The revised evaluation adds held-out generation metrics, a documented target-construction and annotation process, an explicit overfitting analysis, operational quasi-identifier rules, a quantified release-policy assessment, and an evidence map for each architectural component.

The strongest generation configuration achieved BLEU/ROUGE-L/chrF of 29.07/49.88/58.31 for Kazakh and 46.67/65.00/68.40 for Russian. The safety module achieved 0.925 accuracy on the reported Kazakh evaluation corpus, but Unsafe recall of 0.59 precludes unattended respondent-level release. The system must therefore be used with deterministic PII screening, restricted access, human review, audit logging, and periodic re-annotation.

The framework should be understood as a privacy-aware and risk-reducing methodology rather than a formally privacy-preserving system. Future work will conduct controlled JoinGraph and adapter ablations, evaluate Russian safety performance, calibrate Unsafe detection, measure factual completeness and rewrite fidelity with expert review, and investigate differentially private adaptation.