SurrogateShield：超越脱敏的高效用隐私保护LLM交互
SurrogateShield: Beyond Redaction for High-Utility, Privacy-Preserving LLM Interactions
AI总结：
提出客户端代理SurrogateShield，用本地生成的类型一致替代值替换检测到的PII，在保护隐私的同时保持语义效用，在1124条查询语料上F1达98.87%，BERTScore提升13.26个百分点。
摘要：
基于LLM的助手将用户查询逐字传输到用户无法审计或控制的第三方API端点。当这些查询包含个人身份信息（PII）时，数据会持久存在于远程基础设施上，面临泄露、传票或政策变更的风险。占位符脱敏（当前的主流缓解措施）以牺牲语义连贯性为代价抑制PII，产生结构退化的查询和相应的退化响应。\n我们提出SurrogateShield，一个客户端代理，在传输前将检测到的PII替换为本地生成的、类型一致的替代值，并在响应中恢复原始值。没有真实的PII跨越网络边界。检测通过三级级联（PatternScan、EntityTrace和ContextGuard）运行，覆盖22种PII类型和基于Sweeney的k-匿名框架的准标识符组合。替代到原始映射被密封在AES-256-GCM加密的每对话ShadowMap中，该映射从不离开设备。\n在1124条查询语料上的评估表明，该级联可靠地检测PII，总体F1分数达到98.87%。替代替换在语义效用上显著优于占位符脱敏，BERTScore（roberta-large）从81.59%提升至94.85%，提高了13.26个百分点。在该语料中，本地流水线在所有测试的查询类型上限制了真实PII的传输；在100条查询的对抗性试验中，提示的LLM对手无法从替代替换的消息中恢复任何原始值。
英文摘要：
LLM-based assistants transmit user queries verbatim to third-party API endpoints that lie outside the user's audit or control. When those queries contain personally identifiable information (PII), the data persists on remote infrastructure subject to breach, subpoena, or policy change. Placeholder redaction (the prevailing mitigation) suppresses PII at the cost of semantic coherence, producing structurally degraded queries and correspondingly degraded responses. We present SurrogateShield, a client-side proxy that substitutes detected PII with locally generated, type-consistent surrogate values prior to transmission and restores originals in the response. No real PII crosses the network boundary. Detection runs through a three-stage cascade (PatternScan, EntityTrace, and ContextGuard) covering 22 PII types and quasi-identifier combinations grounded in Sweeney's k-anonymity framework. Surrogate-to-original mappings are sealed in an AES-256-GCM encrypted per-conversation ShadowMap that never leaves the device. Evaluations on a 1,124-query corpus demonstrate that the cascade reliably detects PII, achieving an overall F1 score of 98.87%. Surrogate substitution substantially outperforms placeholder redaction in semantic utility, yielding a 13.26 pp improvement in BERTScore (roberta-large), from 81.59% to 94.85%. Within this corpus, the local pipeline restricted real PII transmission across all tested query types; in a 100-query adversarial trial, a prompted LLM adversary recovered no original values from surrogate-substituted messages.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
