Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

LLM Access Shield: Domain-Specific LLM Framework for Privacy Policy Compliance

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Privacy shield encrypts prompt data before it reaches the LLM.

desk verdict The detection half is a credible applied RL contribution, but the paper's headline claim—that FPE preserves functional accuracy—is unsupported and likely false for value-dependent tasks. read the letter →

arxiv 2505.17145 v1 pith:YKSSUF7N submitted 2025-05-22 cs.CR cs.AI

Yu Wang , Cailing Cai , Zhihua Xiao , Peifung E. Lam This is my paper
classification cs.CRcs.AI
keywords LLMprivacyformat-preservingencryptionsensitivedatadetectionpolicycompliancereinforcementfine-tuningcurriculumlearningpromptanonymizationdomain-specific
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LLM Access Shield claims that organizations can let employees use external chat and coding assistants without exposing regulated data by routing prompts through a local proxy. A purpose-built detector model (DLMS) classifies each prompt as safe or unsafe, names the violated data categories, and extracts sensitive strings; when a string is found, a format-preserving encryption module replaces it with ciphertext that keeps the same length and character shape, and the response is decrypted on the way back. The paper argues this gives a practical middle path between expensive fully homomorphic or secure-multiparty approaches and noise-based methods that degrade answers. The reported detection metrics are specific and detailed, while the claim that encrypted prompts preserve downstream task accuracy is supported by one illustrative comparison rather than a quantitative benchmark.

What carries the argument

The load-bearing machinery is the pair formed by DLMS and the Sensitive Data Anonymizer. DLMS is the domain-specific reasoning model that reads a prompt and emits a safety label, violated category codes, and exact sensitive strings, using either supervised fine-tuning or a reinforcement fine-tuning loop whose rule-based reward measures format, safety status, category set, and entity extraction; the analyze-then-decide paradigm trains it to show its reasoning in one tagged section before the final answer. The Sensitive Data Anonymizer applies FF3-1 format-preserving encryption, which keeps length, character classes, and delimiters unchanged, so a phone number stays a phone-number-shaped string and a monetary value stays a number; this is what lets the external LLM see coherent text while the true value remains secret.

What would settle it

Run a suite of standard LLM tasks (summarization, question answering, entity extraction, code completion) on prompts whose sensitive entities have been replaced by FF3-1 ciphertexts and compare against the same prompts in plaintext; if the encrypted-prompt outputs show a statistically significant drop in accuracy, similarity, or task completion, the utility-preservation claim is falsified.

Watch

Extended reading notes

Core claim

The central claim is that an end-to-end proxy framework can enforce privacy policies during LLM interaction at acceptable cost to utility. Detection is carried by DLMS, a 3-billion-parameter instruction-tuned model fine-tuned on 2,311 annotated prompts, either by supervised fine-tuning in the style of a safety-classifier prompt format or by reinforcement fine-tuning with an analyze-then-decide reasoning trace and rule-based rewards, optionally structured through a three-stage curriculum. On the six-category taxonomy, the supervised model reaches 0.935 safety accuracy and a 0.839 privacy hiding rate, and the curriculum-trained reinforcement model reaches 0.862 accuracy on four unseen natural-language privacy policies through few-shot prompting. For anonymization, the framework applies FF3-1 format-preserving encryption to detected entities so ciphertexts keep the format of emails, phone numbers, and monetary values, then decrypts any such entities that appear in the LLM response. The paper's conclusion is that confidentiality, contextual integrity, and functional accuracy can be balanced in high-assurance domains such as finance, law, and healthcare.

Load-bearing premise

The load-bearing premise is that replacing sensitive strings with format-preserving ciphertext leaves enough meaning intact for the external LLM to answer well; the paper supports this with a single illustrative comparison rather than a quantitative task-accuracy study.

Editorial extensions

If this is right

  • A deployment can add the shield as a proxy or integrator without modifying the external LLM, so existing corporate chat and coding assistants can be brought under a privacy policy with configuration rather than model replacement.
  • New or changed privacy policies can be enforced at inference time by injecting them into the prompt with few-shot examples, removing the need to retrain the detector for every regulatory update.
  • Because format-preserving encryption retains token format, downstream processing that depends on schema shape, such as parsers, validation rules, and structured outputs, can continue to operate on the ciphertext.
  • The reasoning traces emitted inside the tagged analysis section give auditors a human-readable record of why a prompt was flagged, supporting explainability requirements in regulated settings.
  • The curriculum-based reinforcement variant improves multi-label category accuracy over single-stage training, suggesting that staged rewards help the model handle prompts that violate several data categories at once.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the same encryption key and tweak are reused across many prompts, a curious external provider could compare repeated ciphertext patterns and infer correlations; the paper treats the external LLM as honest-but-curious but does not analyze this side-channel, and a natural extension would be per-request tweaks.
  • The utility-preservation claim would be much stronger if tested on standard summarization, question-answering, and coding benchmarks; the paper shows one illustrative example, so measuring task accuracy on such benchmarks is the direct next experiment.
  • The shield's detection and encryption logic sits entirely on the input side; the authors list output-side leakage as future work, but the same architecture could eventually filter responses by role-based access if a separate response-compliance detector were trained.
  • For adoption in regulated industries, the audit trail of reasoning tokens plus decryption logs is only as credible as the reasoning itself, so an evaluation of reasoning accuracy, not just final labels, would be a useful public benchmark.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes LLM Access Shield, an end-to-end framework for enforcing organizational privacy policies during user interactions with external LLM services. It combines a domain-specific fine-tuned model (DLMS), trained with supervised fine-tuning and reinforcement fine-tuning under an "analyze-then-decide" reasoning paradigm, with format-preserving encryption (FPE) for anonymizing detected sensitive entities. The authors evaluate DLMS on synthetic datasets built from a six-category taxonomy, report detection accuracy at safety, category, and entity levels, test generalization to four non-taxonomy policies via prompting, and argue that FPE preserves the semantic utility of prompts for downstream LLM tasks. The central claims are that the framework mitigates security risks and preserves functional accuracy of LLM-driven tasks.

Significance. If the detection and utility-preservation claims were fully established, the framework would be a useful practical contribution: it has a sensible modular architecture, a lightweight 3B-parameter detector, a clearly described two-stage workflow, and an interesting combination of curriculum learning and rule-based rewards for reinforcement fine-tuning. The paper also gives explicit credit where due: it documents training configurations, provides sample prompts and outputs in appendices, and compares qualitatively with prior prompt-sanitization systems. However, the current evidence is not sufficient to support the central claims. The detection evaluation is based on a self-referential synthetic dataset with no released artifacts, and the claimed comparison to Llama-Guard-3-8B is not present in the reported table. The utility-preservation claim rests on a single qualitative example and is structurally doubtful for value-dependent downstream tasks. These issues affect load-bearing parts of the paper, so the contribution is currently more a promising system description than a validated framework.

major comments (3)
  1. [Section 7.1, Table 5] The text states that "all DLMS models significantly outperform the baseline Llama-Guard-3-8B" across Accuracy, F1-Score, and AUPRC, but Table 5 contains no Llama-Guard-3-8B row; the only non-DLMS row is Llama-3.2-3B-Instruct. This is a load-bearing comparison error because the claimed advantage over an established safety-classification model is not actually reported. Please either add the Llama-Guard-3-8B results (with the same prompt format and metrics) or revise the text so that the comparison is only against the base model. In addition, all results in Tables 5-7 are reported on a single split with no confidence intervals or error bars, so the reader cannot assess the stability of the differences.
  2. [Section 9, Section 2.3, Table 8] The central claim that the framework "preserving the functional accuracy of LLM-driven tasks" (Abstract) is not supported by the evidence. The paper defines utility as preservation of semantic context, but FPE changes the actual values of sensitive entities: Table 8 shows the monetary value 1,452,500 becoming 6,423,095. In the workflow of Section 2.3, step 6 decrypts only exact ciphertext occurrences that appear verbatim in the LLM response. If a downstream task reasons over the encrypted value (for example, computing 10% of 6,423,095), the LLM's output is a new number that is not in the ciphertext and therefore will not be decrypted, so the user receives an incorrect result. The only evidence for utility preservation is one qualitative example in Figure A.1, and no quantitative task-accuracy evaluation is provided. The paper cites the No Free Lunch theorem for privacy-preserving inference [46] but never quantifies where the trade-off lands. Please add a task-level accuracy evaluation on representative value-dependent and entity-dependent workloads, or narrow the utility claim to the class of tasks for which FPE is actually lossless.
  3. [Section 3.2, Appendix A, Section 8] The evaluation benchmark is self-referential. The training and testing datasets are generated from the same six-category taxonomy and template-based prompt generation procedure described in Appendix A, so high scores on the test set may reflect template memorization rather than robust privacy-policy compliance. The non-taxonomy policy test in Section 8 is a step in the right direction, but the four policies' examples overlap heavily with the training categories: POL02 names phone numbers, POL03 names email addresses and phone numbers, and POL04 names bank account and credit card information, all of which are T-categories in Table A.2. The claim of generalization to unseen policies would be stronger with an externally curated or independently annotated benchmark, and with release of the generated datasets and evaluation scripts for reproducibility.
minor comments (5)
  1. [Section 5.4 and Section 5.5] Section 5.4 states that "All four reward components are active during training," but Section 5.5 describes a stage-specific reward schedule in which format penalties and category/entity rewards are introduced progressively. Please clarify whether the four components are active at every stage of the curriculum or only in the later stages.
  2. [Section 9] The definition of utility as preservation of semantic context cites reference [1], which is a study of privacy leakage in GPT conversations rather than a semantics or utility reference; a more appropriate citation would be a work on semantic similarity or prompt utility.
  3. [Table 6] Several cells in Table 6 are missing spaces (for example "0.9220.7120.703"), making the table difficult to read; please fix the formatting.
  4. [Appendix D] Table A.1 is referenced in Section 8 as being in Appendix A, but it appears in Appendix D together with Tables A.2 and A.3; please renumber or update the cross-reference.
  5. [General] The manuscript contains several typographical errors and spacing artifacts (e.g., "Incontract," "mayinferorretain," "GDPR the HIPAA"), which should be corrected in a careful proofreading pass.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the framework's detection results rest on held-out evaluation, and the FPE utility concern is an evidentiary gap rather than a definitional or self-citational reduction.

full rationale

I walked the claimed derivation chain: DLMS detects sensitive entities (trained with SFT/RFT on a taxonomy-derived dataset and evaluated on held-out splits), SDA applies FPE to detected entities, and the response is decrypted only when exact ciphertext spans appear. None of the seven circularity patterns is load-bearing. The paper does not justify any central premise by a self-citation: the cited foundations are external (Llama-Guard, DeepSeek-R1-Zero, REINFORCE++, FPE/NIST standards, and the No Free Lunch theorem), and there is no uniqueness theorem imported from the authors' prior work. The training and test data share the same taxonomy and template-based generation process, but test instances are held out rather than fitted, so this is a closed-world benchmark rather than a prediction forced by construction. The RFT reward functions are aligned with the downstream evaluation metrics, which is normal objective alignment and not a reduction of the evaluation to the training signal. The main weakness is the FPE utility claim: Section 9.2 supports 'preserving functional accuracy' with only a single qualitative example (Appendix Fig. A.1), and Section 2.3 step 6 decrypts only verbatim ciphertext occurrences, so value-derived outputs would not be reverted. That is an unsupported empirical claim and a correctness risk, not a circular derivation; the paper even acknowledges the privacy-utility trade-off via the No Free Lunch Theorem without quantifying it. Under the strict exhibit-the-reduction standard, no circular step can be identified, so the appropriate finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The framework's security guarantees rest on standard cryptographic assumptions (FPE security) and on threat-model assumptions about users and external LLMs. The training process uses hand-chosen reward weights and curriculum schedules that were adjusted based on observed validation behavior. No new physical or conceptual entities are introduced; the components are software modules and a fine-tuned model.

free parameters (3)
  • Reward component weights = {R_fmt: ±2, R_safety: ±1, R_cat: +2/+1/-1, R_ent: +4/+2/-1}
    Chosen by hand in Section 5.4; no sensitivity analysis. The paper modified these penalties during training to curb overprediction, so the final values are tuned to the validation set.
  • Curriculum format penalty schedule = {stage 1: 0, stage 2 and 3: -2}
    Hand-chosen in Section 5.5 to encourage format compliance at later stages; no systematic comparison of schedules.
  • RFT hyperparameters = temperature=0.7, KL beta=0.001, epochs=3, lr=1e-6
    Training settings in Section 5.6 follow defaults or prior work; not fitted to data, but still choices that affect results.
assumptions (4)
  • domain assumption FF3-1 FPE is secure against cryptanalytic attacks as per NIST SP 800-38G.
    Section 2.2 lists this as a security assumption; the system's confidentiality guarantee depends on it.
  • domain assumption External LLM services are honest-but-curious and do not collude with the user.
    Section 2.2 defines the threat model; the proxy design relies on this assumption.
  • domain assumption The synthetic data generated by uncensored LLMs and template prompts approximates real enterprise user prompts.
    Appendix A describes the data generation; the reported detection accuracy is measured on this artificial distribution, not on real traffic.
  • ad hoc to paper The selected model checkpoint (highest validation reward on the taxonomy task) is also the best for unseen policies.
    Section 8 uses the stage-1 checkpoint with highest validation reward for the policy generalization test; there is no validation on the policy task during selection.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LLM Access Shield: Domain-Specific LLM Framework for Privacy Policy Compliance." pith.science (2026). https://pith.science/paper/YKSSUF7N

@misc{pith2026250517145,
  author       = {Pith},
  title        = {Pith review of: LLM Access Shield: Domain-Specific LLM Framework for Privacy Policy Compliance},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YKSSUF7N}},
  note         = {Machine review of arXiv:2505.17145}
}
read the original abstract

Large language models (LLMs) are increasingly applied in fields such as finance, education, and governance due to their ability to generate human-like text and adapt to specialized tasks. However, their widespread adoption raises critical concerns about data privacy and security, including the risk of sensitive data exposure. In this paper, we propose a security framework to enforce policy compliance and mitigate risks in LLM interactions. Our approach introduces three key innovations: (i) LLM-based policy enforcement: a customizable mechanism that enhances domain-specific detection of sensitive data. (ii) Dynamic policy customization: real-time policy adaptation and enforcement during user-LLM interactions to ensure compliance with evolving security requirements. (iii) Sensitive data anonymization: a format-preserving encryption technique that protects sensitive information while maintaining contextual integrity. Experimental results demonstrate that our framework effectively mitigates security risks while preserving the functional accuracy of LLM-driven tasks.

Figures

Figures reproduced from arXiv: 2505.17145 by the authors.

Figure 1
Figure 1. LLM Access Shield: System Infrastructure. DLMS. The application process primarily involves the orga￾nization administrator, organization user, and the following five core entities. • LLM Services: External large language model ser￾vices (e.g., Microsoft’s Copilot, OpenAI’s ChatGPT, Perplexity) provide advanced AI capabilities for gen￾erating responses to user prompts. • Domain-specific LLM for Security (DLMS): A cus… view at source ↗
Figure 2
Figure 2. Simplified Workflow of LLM Access Shield. • Public LLM services are assumed as honest-but￾curious, meaning they adhere to agreed-upon proto￾cols but may infer or retain sensitive information from user inputs. • The integrator, DLMS, and SDA operate within the organization’s secure boundary and are considered trusted. • It is assumed that the organization securely installs a Certificate Authority (CA) certificate whe… view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. A Survey on Model Extraction Attacks and Defenses for Large Language Models

    cs.CR 2025-06 conditional novelty 4.0 of 10

    A taxonomy of model extraction attacks and defenses for large language models, with proposed evaluation metrics and future research directions.

Reference graph

Works this paper leans on

62 extracted references · 38 canonical work pages · cited by 1 Pith paper

  1. [46]

    Zhang, Y

    X. Zhang, Y. Pang, Y. Kang, W. Chen, L. Fan, H. Jin, Q. Yang, No free lunch theorem for privacy-preserving llm inference, Artificial Intelligence (2025) 104293

    work page 2025

  2. [1]

    J. Chu, Z. Sha, M. Backes, Y. Zhang, Reconstruct your previous conversations!comprehensivelyinvestigatingprivacyleakagerisksin conversations with GPT models, in: EMNLP, 2024, pp. 6584–6600

    work page 2024

  3. [2]

    T.ElGamal,Apublickeycryptosystemandasignatureschemebased on discrete logarithms, IEEE transactions on information theory 31 (4) (1985) 469–472

    work page 1985

  4. [3]

    P. Paillier, Public-key cryptosystems based on composite degree residuosity classes, in: International conference on the theory and applications of cryptographic techniques, Springer, 1999, pp. 223– 238

    work page 1999

  5. [4]

    Gentry, Fully homomorphic encryption using ideal lattices, in: ACM symposium on Theory of computing, 2009, pp

    C. Gentry, Fully homomorphic encryption using ideal lattices, in: ACM symposium on Theory of computing, 2009, pp. 169–178

    work page 2009

  6. [5]

    Brakerski, V

    Z. Brakerski, V. Vaikuntanathan, Fully homomorphic encryption fromring-lweandsecurityforkeydependentmessages,in:CRYPTO, Vol. 6841, Springer, 2011, pp. 505–524

    work page 2011

  7. [6]

    J. Fan, F. Vercauteren, Somewhat practical fully homomorphic en- cryption, Cryptology ePrint Archive (2012)

    work page 2012

  8. [7]

    J.H.Cheon,A.Kim,M.Kim,Y.Song,Homomorphicencryptionfor arithmeticofapproximatenumbers,in:ASIACRYPT,Springer,2017, pp. 409–437

    work page 2017

Show all 62 references
  1. [8]

    648– 677

    B.Li,D.Micciancio,Onthesecurityofhomomorphicencryptionon approximate numbers, in: EUROCRYPT, Springer, 2021, pp. 648– 677

    2021

  2. [9]

    Cramer, I

    R. Cramer, I. B. Damgård, et al., Secure multiparty computation, Cambridge University Press, 2015

    2015

  3. [10]

    Asharov, Y

    G. Asharov, Y. Lindell, T. Schneider, M. Zohner, More efficient oblivious transfer and extensions for faster secure computation, in: Proceedings of the ACM SIGSAC conference on Computer & com- munications security, 2013, pp. 535–548

    2013

  4. [11]

    Gilad-Bachrach, N

    R. Gilad-Bachrach, N. Dowlin, K. Laine, K. E. Lauter, M. Naehrig, J.Wernsing,Cryptonets:Applyingneuralnetworkstoencrypteddata with high throughput and accuracy, in: International Conference on Machine Learning (ICML), Vol. 48, 2016, pp. 201–210

    2016

  5. [12]

    M. Hao, H. Li, H. Chen, P. Xing, G. Xu, T. Zhang, Iron: Private inferenceontransformers,in:NeuralInformationProcessingSystems (NeurIPS), 2022

    2022

  6. [13]

    T. Chen, H. Bao, S. Huang, L. Dong, B. Jiao, D. Jiang, H. Zhou, J. Li, F. Wei, THE-X: privacy-preserving transformer inference with homomorphic encryption, in: Findings of the Association for Com- putational Linguistics (ACL), 2022, pp. 3510–3520

    2022

  7. [14]

    W. Lu, Z. Huang, Z. Gu, J. Li, J. Liu, C. Hong, K. Ren, T. Wei, W.Chen,Bumblebee:Securetwo-partyinferenceframeworkforlarge transformers, Cryptology ePrint Archive (2023)

    2023

  8. [15]

    Zimerman, M

    I. Zimerman, M. Baruch, N. Drucker, G. Ezov, O. Soceanu, L. Wolf, Convertingtransformerstopolynomialformforsecureinferenceover homomorphic encryption, in: International Conference on Machine Learning (ICML), 2024

    2024

  9. [16]

    X. Liu, Z. Liu, Llms can understand encrypted prompt: To- wards privacy-computing friendly transformers, arXiv preprint arXiv:2305.18396 (2023)

    2023 arXiv

  10. [17]

    Y. Wang, G. E. Suh, W. Xiong, B. Lefaudeux, B. Knott, M. An- navaram, H. S. Lee, Characterization of mpc-based private inference for transformer-based models, in: IEEE Symposium on Performance Analysis of Systems and Software (ISPASS), 2022, pp. 187–197

    2022

  11. [18]

    X. Hou, J. Liu, J. Li, Y. Li, W.-j. Lu, C. Hong, K. Ren, Ciphergpt: Secure two-party gpt inference, Cryptology ePrint Archive (2023)

    2023

  12. [19]

    Y. Ding, H. Guo, Y. Guan, W. Liu, J. Huo, Z. Guan, X. Zhang, East: Efficient and accurate secure transformer framework for inference, arXiv preprint arXiv:2308.09923 (2023)

    2023 arXiv

  13. [20]

    Akimoto, K

    Y. Akimoto, K. Fukuchi, Y. Akimoto, J. Sakuma, Privformer: Privacy-preserving transformer with MPC, in: 8th IEEE European SymposiumonSecurityandPrivacy(EuroS&P),2023,pp.392–410

    2023

  14. [21]

    Y.Dong,W.Lu,Y.Zheng,H.Wu,D.Zhao,J.Tan,Z.Huang,C.Hong, T.Wei,W.Chen,Puma:Secureinferenceofllama-7binfiveminutes, arXiv preprint arXiv:2307.12533 (2023)

    2023

  15. [22]

    Sharma, Sigma: Secure gpt inference with function secret sharing, Cryptology ePrint Archive (2023)

    K.Gupta,N.Jawalkar,A.Mukherjee,N.Chandran,D.Gupta,A.Pan- war, R. Sharma, Sigma: Secure gpt inference with function secret sharing, Cryptology ePrint Archive (2023)

    2023

  16. [23]

    Behnia, M

    R. Behnia, M. Ebrahimi, J. Pacheco, B. Padmanabhan, Ew-tune: A framework for privately fine-tuning large language models with dif- ferential privacy, in: IEEE International Conference on Data Mining Workshops, (ICDM) Workshop, 2022, pp. 560–566

    2022

  17. [24]

    W. Shi, R. Shea, S. Chen, C. Zhang, R. Jia, Z. Yu, Just fine-tune twice: Selective differential privacy for large language models, in: Conference on Empirical Methods in Natural Language Processing, (EMNLP), 2022, pp. 6327–6340

    2022

  18. [25]

    X.Wu,L.Gong,D.Xiong,Adaptivedifferentialprivacyforlanguage modeltraining,in:FederatedLearningforNaturalLanguageProcess- ing (FL4NLP) Workshop, 2022, pp. 21–26

    2022

  19. [26]

    J.Majmudar,C.Dupuy,C.Peris,S.Smaili,R.Gupta,R.Zemel,Dif- ferentially private decoding in large language models, arXiv preprint arXiv:2205.13621 (2022)

    2022 arXiv

  20. [27]

    M. Du, X. Yue, S. S. M. Chow, T. Wang, C. Huang, H. Sun, Dp- forward: Fine-tuning and inference on language models with differ- ential privacy in forward pass, in: ACM SIGSAC Conference on ComputerandCommunicationsSecurityCCS,2023,pp.2665–2679

    2023

  21. [28]

    P.Mai,R.Yan,Z.Huang,Y.Yang,Y.Pang,Split-and-denoise:Protect large language model inference with local differential privacy, arXiv preprint arXiv:2310.09130 (2023)

    2023 arXiv

  22. [29]

    Ullah, N

    I. Ullah, N. Hassan, S. S. Gill, B. Suleiman, T. A. Ahanger, Z. Shah, J. Qadir, S. S. Kanhere, Privacy preserving large language models: Chatgpt case study based vision and framework, IET Blockchain (2023)

    2023

  23. [30]

    M. Tong, K. Chen, Y. Qi, J. Zhang, W. Zhang, N. Yu, Privinfer: Privacy-preserving inference for black-box large language model, arXiv preprint arXiv:2310.12214 (2023)

    2023

  24. [31]

    Y. Li, Z. Tan, Y. Liu, Privacy-preserving prompt tuning for large language model services, arXiv preprint arXiv:2305.06212 (2023)

    2023

  25. [32]

    J.Hong,J.T.Wang,C.Zhang,Z.Li,B.Li,Z.Wang,DP-OPT:make large language model your privacy-preserving prompt engineer, in: InternationalConferenceonLearningRepresentations(ICLR),2024

    2024

  26. [33]

    Ullah, N

    I. Ullah, N. Hassan, S. S. Gill, B. Suleiman, T. A. Ahanger, Z. Shah, J. Qadir, S. S. Kanhere, Privacy preserving large language models: Chatgpt case study based vision and framework, IET Blockchain 4 (2024) 706–724

    2024

  27. [34]

    G. Lin, W. Hua, Y. Zhang, Emojicrypt: Prompt encryption for se- cure communication with large language models, arXiv preprint arXiv:2402.05868 (2024)

    2024 arXiv

  28. [35]

    Z.Shen,Z.Xi,Y.He,W.Tong,J.Hua,S.Zhong,Thefirethiefisalso thekeeper:Balancingusabilityandprivacyinprompts,arXivpreprint arXiv:2406.14318 (2024)

    2024 arXiv

  29. [36]

    C. J. Chong, C. Hou, Z. Yao, S. M. S. Talebi, Casper: Prompt sanitization for protecting user privacy in web-based large language models, arXiv preprint arXiv:2408.07004 (2024)

    2024

  30. [37]

    P. Mai, R. Yan, R. Ye, Y. Yang, Y. Li, Y. Pang, Confusionprompt: Practical private inference for online large language models, arXiv e-prints (2023) arXiv–2401

    2023

  31. [38]

    Herrera Montano, J

    I. Herrera Montano, J. J. Garcia Aranda, J. Ramos Diaz, S. Molina Cardin, I. De la Torre Díez, J. J. Rodrigues, Survey of techniques on data leakage protection and methods to address the insider threat, Cluster Computing 25 (6) (2022) 4289–4302. Page 13 of 18

    2022

  32. [39]

    Vaishnav, S

    L. Vaishnav, S. Singh, K. A. Cornell, Transparency, security, and workplace training & awareness in the age of generative ai, arXiv preprint arXiv:2501.10389 (2024)

    2024 arXiv

  33. [40]

    Dworkin, Recommendation for block cipher modes of operation: Methods for format-preserving encryption, Methods and Techniques (2016)

    M. Dworkin, Recommendation for block cipher modes of operation: Methods for format-preserving encryption, Methods and Techniques (2016)

    2016

  34. [41]

    H.Inan,K.Upasani,J.Chi,R.Rungta,K.Iyer,Y.Mao,M.Tontchev, Q. Hu, B. Fuller, D. Testuggine, et al., Llama guard: Llm-based input-output safeguard for human-ai conversations, arXiv Preprint arXiv:2312.06674 (2023)

    2023 arXiv

  35. [42]

    D.Guo,D.Yang,H.Zhang,J.Song,R.Zhang,R.Xu,Q.Zhu,S.Ma, P.Wang,X.Bi,etal.,Deepseek-r1:Incentivizingreasoningcapability in llms via reinforcement learning, arXiv preprint arXiv:2501.12948 (2025)

    2025 arXiv

  36. [43]

    J.Hu,Reinforce++:Asimpleandefficientapproachforaligninglarge language models, arXiv preprint arXiv:2501.03262 (2025)

    2025 arXiv

  37. [44]

    T. Xie, Z. Gao, Q. Ren, H. Luo, Y. Hong, B. Dai, J. Zhou, K. Qiu, Z. Wu, C. Luo, Logic-rl: Unleashing llm reasoning with rule-based reinforcement learning, arXiv preprint arXiv:2502.14768 (2025)

    2025 arXiv

  38. [45]

    E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, W. Chen, Lora: Low-rank adaptation of large language models, in: International Conference on Learning Representations, 2022

    2022

  39. [47]

    N.I.ofStandards,T.(NIST),M.J.Dworkin,E.Barker,J.Nechvatal, J. Foti, L. E. Bassham, E. Roback, J. D. Jr., Advanced encryption standard (AES) (2001-11-26 00:11:00 2001)

    2001

  40. [48]

    Bellare, T

    M. Bellare, T. Ristenpart, P. Rogaway, T. Stegers, Format-preserving encryption,in:SelectedAreasinCryptography:16thAnnualInterna- tional Workshop, Springer, 2009, pp. 295–312

    2009

  41. [49]

    Shumailov, D

    I. Shumailov, D. Ramage, S. Meiklejohn, P. Kairouz, F. Hartmann, B. Balle, E. Bagdasarian, Trusted machine learning models unlock privateinferenceforproblemscurrentlyinfeasiblewithcryptography, arXiv preprint arXiv:2501.08970 (2025)

    2025 arXiv

  42. [50]

    A.Frikha,N.Walha,R.Mendes,K.K.Nakka,X.Jiang,X.Zhou,Ob- fuscatune:Obfuscatedoffsitefine-tuningandinferenceofproprietary llms on private datasets, arXiv preprint arXiv:2407.02960 (2024)

    2024 arXiv

  43. [51]

    I. Gim, C. Li, L. Zhong, Confidential prompting: Protecting user prompts from cloud llm providers, arXiv preprint arXiv:2409.19134 (2024)

    2024

  44. [52]

    X.Liu,J.Wang,J.Sun,X.Yuan,G.Dong,P.Di,W.Wang,D.Wang, Prompting frameworks for large language models: A survey, arXiv preprint arXiv:2311.12785 (2023)

    2023 arXiv

  45. [53]

    Edemacu, X

    K. Edemacu, X. Wu, Privacy preserving prompt engineering: A survey, arXiv preprint arXiv:2404.06001 (2024)

    2024 arXiv

  46. [54]

    B. Yan, K. Li, M. Xu, Y. Dong, Y. Zhang, Z. Ren, X. Cheng, On protectingthedataprivacyoflargelanguagemodels(llms):Asurvey, arXiv preprint arXiv:2403.05156 (2024)

    2024 arXiv

  47. [55]

    S. Wang, T. Zhu, B. Liu, M. Ding, X. Guo, D. Ye, W. Zhou, P. S. Yu, Unique security and privacy threats of large language model: A comprehensive survey, arXiv preprint arXiv:2406.07973 (2024)

    2024

  48. [56]

    B. C. Das, M. H. Amini, Y. Wu, Security and privacy challenges of large language models: A survey, arXiv preprint arXiv:2402.00888 (2024)

    2024 arXiv

  49. [57]

    Z.Kan,L.Qiao,H.Yu,L.Peng,Y.Gao,D.Li,Protectinguserprivacy in remote conversational systems: A privacy-preserving framework based on text sanitization, arXiv preprint arXiv:2306.08223 (2023)

    2023 arXiv

  50. [58]

    Y. Yao, F. Wang, S. Ravi, M. Chen, Privacy-preserving lan- guage model inference with instance obfuscation, arXiv preprint arXiv:2402.08227 (2024)

    2024 arXiv

  51. [59]

    Y. Chen, T. Li, H. Liu, Y. Yu, Hide and seek (has): A lightweight framework for prompt privacy protection, arXiv preprint arXiv:2309.03057 (2023)

    2023 arXiv

  52. [60]

    X. Sun, G. Liu, Z. He, H. Li, X. Li, Deprompt: Desensitization and evaluation of personal identifiable information in large language model prompts, arXiv preprint arXiv:2408.08930 (2024). Appendix A. Testing Data Generation ToevaluatetheperformanceofDLMSanditsadaptabil- ity to...

    2024 arXiv

  53. [61]

    - Enclose the analyzing process within '<analyze>...</analyze>'tags

    **Analyzing Process**: - Analyze the user's message for each unsafe content category and reason your way to a conclusion. - Enclose the analyzing process within '<analyze>...</analyze>'tags

  54. [62]

    data provided in this report,

    **Final Answer**: - Provide your final safety assessment enclosed within '<answer>...</answer>'tags. - The format inside'<answer>...</answer>'should be as follows: - The first line must state either'safe'or'unsafe'. - If the assessment is'unsafe': - The second line must list t...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.