防止大模型中用户隐私在多阶段传播，通过延迟恢复敏感信息
BodhiPromptShield: Pre-Inference Prompt Mediation for Suppressing Privacy Propagation in LLM/VLM Agents
- 用占位符和语义抽象隔离敏感内容，控制其传播路径
- 在检索、记忆和工具调用阶段，隐私泄露率从10.7%降至7.1%
- 适合关注推理前隐私保护的AI系统开发者
在大模型/视觉语言模型代理中，原始用户内容会通过检索查询、内存写入、工具调用和日志等环节引发隐私风险跨阶段传播。现有去标识化流程仅处理文档边界，无法应对这种跨阶段扩散。我们提出BodhiPromptShield，一种策略感知框架，能检测敏感文本片段，通过类型化占位符、语义抽象或安全符号映射进行路由，并延迟恢复至授权边界。相比企业级去标识化，该方法引入传播感知的中介与恢复时机作为安全变量。在受控的可控提示隐私基准（CPPB）上评估显示，检索、记忆和工具阶段的隐私传播率从10.7%降至7.1%；PER达9.3%，AC为0.94，TSR为0.92，优于通用去标识化方法。结果基于受控系统测试，非正式隐私保证或公开基准迁移结论。项目代码已开源：https://github.com/mabo1215/BodhiPromptShield.git。
原文摘要 · Abstract (English)
In LLM/VLM agents, prompt privacy risk propagates beyond a single model call because raw user content can flow into retrieval queries, memory writes, tool calls, and logs. Existing de-identification pipelines address document boundaries but not this cross-stage propagation. We propose BodhiPromptShield, a policy-aware framework that detects sensitive spans, routes them via typed placeholders, semantic abstraction, or secure symbolic mapping, and delays restoration to authorized boundaries. Relative to enterprise redaction, this adds explicit propagation-aware mediation and restoration timing as a security variable. Under controlled evaluation on the Controlled Prompt-Privacy Benchmark (CPPB), stage-wise propagation suppresses from 10.7\% to 7.1\% across retrieval, memory, and tool stages; PER reaches 9.3\% with 0.94 AC and 0.92 TSR, outperforming generic de-identification. These are controlled systems results on CPPB rather than formal privacy guarantees or public-benchmark transfer claims. The project repository is available at https://github.com/mabo1215/BodhiPromptShield.git.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。