缓解标记数据稀缺：利用LLMs对HTTP流量中的PII值进行类别无关的标注
Addressing Labelled Data Scarcity: Taxonomy-Agnostic Annotation of PII Values in HTTP Traffic using LLMs
AI总结：
本文探讨LLMs能否在运行时提供类别信息的情况下，对HTTP消息体中的显式传输PII值进行类别无关的标注，通过多阶段流程实现灵活的标注方法，验证了其在不同PII领域和粒度下的有效性。
摘要：
自动隐私审计Web和移动应用时，常分析出站HTTP流量以检测个人可识别信息（PII）泄露。然而，现有基于学习的检测器通常依赖稀缺的手动标记流量，并且紧密耦合于固定标签分类法，限制了跨领域和PII定义演变的可转移性。本文研究LLMs是否能支持在运行时提供分类法的情况下，对HTTP消息体中的显式传输PII值进行类别无关的标注。我们引入一个多阶段基于LLM的流程，结合确定性预处理与标签级分类、针对实例级值标注和输出验证。为实现受控评估和基于示例的提示而不依赖敏感真实用户捕获，我们进一步提出一个基于LLM的生成器，用于生成具有人工验证的分类法衍生PII注释的合成HTTP流量。我们评估了该方法在三个跨越不同PII领域和粒度级别的分类法上的表现。结果表明，该流程能准确检测PII类型并提取相应值，对于具体的PII分类法。总体而言，我们的发现将LLMs定位为灵活、类别无关的流量标注和在演变隐私分类法下创建标记数据的有希望的基础。
英文摘要：
Automated privacy audits of web and mobile applications often analyse outbound HTTP traffic to detect Personally Identifiable Information (PII) leakage. However, existing learning-based detectors typically depend on scarce, manually labelled traffic and are tightly coupled to fixed label taxonomies, limiting transferability across domains and evolving definitions of PII. This paper investigates whether Large Language Models (LLMs) can support taxonomy-agnostic annotation of explicitly transmitted PII values in HTTP message bodies when the taxonomy is provided at runtime. We introduce a multi-stage LLM-based pipeline that combines deterministic pre-processing with label-level classification, targeted instance-level value annotation, and output validation. To enable controlled evaluation and exemplar-based prompting without relying on sensitive real-user captures, we further propose an LLM-based generator for synthetic HTTP traffic with manually validated, taxonomy-derived PII annotations. We evaluate the approach across three taxonomies spanning different PII domains and granularity levels. Results show that the pipeline accurately detects PII types and extracts corresponding values for concrete PII taxonomies. Overall, our findings position LLMs as a promising foundation for flexible, taxonomy-agnostic traffic annotation and for creating labelled data under evolving privacy taxonomies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
