ORBIT: Dual-Shell Latent Geometry for Differentially Private Anomaly Representation Sharing

Sharing learned representations is increasingly important in cross-institutional anomaly detection, where differential privacy (DP) protects the released embeddings. Under extreme class imbalance, full-dimensional latent DP can erase the rare-class structure that makes the shared representation useful. We show that no per-record $ϵ$-DP release that protects the class can exceed precision $e^{ϵ}/(e^{ϵ}+r)$ at imbalance ratio $r$, and that a two-point release of a single coordinate attains this bound. We propose ORBIT (One-dimensional Radial Budgeting with Inter-shell Topology), which concentrates class-separating structure into a bounded radial coordinate rather than perturbing the full latent representation. Its encoder is trained with a dual-shell margin objective that places normal and anomalous records around two target radii. ORBIT clips the radius to a fixed range and releases it through a one-dimensional Laplace mechanism whose sensitivity depends on that range rather than the latent dimension. Under the same per-record guarantee, full-dimensional latent DP stays near the base rate up to $ϵ=20$ on 577:1 fraud data, whereas ORBIT's released radius reaches AUPRC 0.74 at $ϵ=10$ (bound 0.97), on par with a supervised score released in the same way. On the tabular datasets, unsupervised one-dimensional summaries reach at most 0.43 at $ϵ=10$, so compression alone does not explain the gain. Unlike a supervised score, ORBIT's representation also carries a direction, which a scoped variant publishes. This variant lies outside the bound because it declares the class public, and its formal guarantee covers only the radius. The identity leakage of the direction is bounded under an angular-concentration condition and audited with direction-only attacks, which are consistent with chance on both tabular datasets but detect training-set membership of minority records on CIFAR-10. Under this scope, ORBIT's latent-space synthetic release retains the non-private AUPRC at $ϵ=1$ on all three datasets.