用虚拟数据替换敏感信息，让大模型对话更安全且不失效。
SurrogateShield: Beyond Redaction for High-Utility, Privacy-Preserving LLM Interactions
- 用本地生成的虚拟值替代敏感信息再发送，回复时还原原值。
- 在1124条查询中检测准确率达98.87%，语义质量提升13.26个百分点。
- 隐私零泄露，适合对数据安全要求高的医疗、金融等场景使用。
基于大模型的助手会将用户查询原文发送至用户无法审计或控制的第三方API。当查询包含个人身份信息（PII）时，数据可能长期留存于外部系统，面临泄露、司法调取或政策变更风险。当前主流缓解手段是占位符替换，但会破坏语义连贯性，导致查询和响应质量下降。本文提出SurrogateShield，一种客户端代理，在数据发出前将检测到的PII替换为本地生成的、类型一致的虚拟值，并在返回结果中还原原始内容。真实PII不离开设备。检测采用三阶段级联流程（PatternScan、EntityTrace、ContextGuard），覆盖22种PII类型及准标识符组合，基于Sweeney的k-匿名框架设计。虚拟值与原始值的映射关系以AES-256-GCM加密存储于每会话独立的ShadowMap中，永不离开本地。在1,124条查询的评估中，该方法整体F1得分达98.87%。相比占位符替换，语义保真度显著提升：BERTScore（roberta-large）从81.59%提高至94.85%。在所有测试查询类型中，本地管道完全阻断真实PII传输；在100条对抗性测试中，提示攻击的大模型对手未能恢复任何原始值。
原文摘要 · Abstract (English)
LLM-based assistants transmit user queries verbatim to third-party API endpoints that lie outside the user's audit or control. When those queries contain personally identifiable information (PII), the data persists on remote infrastructure subject to breach, subpoena, or policy change. Placeholder redaction (the prevailing mitigation) suppresses PII at the cost of semantic coherence, producing structurally degraded queries and correspondingly degraded responses. We present SurrogateShield, a client-side proxy that substitutes detected PII with locally generated, type-consistent surrogate values prior to transmission and restores originals in the response. No real PII crosses the network boundary. Detection runs through a three-stage cascade (PatternScan, EntityTrace, and ContextGuard) covering 22 PII types and quasi-identifier combinations grounded in Sweeney's k-anonymity framework. Surrogate-to-original mappings are sealed in an AES-256-GCM encrypted per-conversation ShadowMap that never leaves the device. Evaluations on a 1,124-query corpus demonstrate that the cascade reliably detects PII, achieving an overall F1 score of 98.87%. Surrogate substitution substantially outperforms placeholder redaction in semantic utility, yielding a 13.26 pp improvement in BERTScore (roberta-large), from 81.59% to 94.85%. Within this corpus, the local pipeline restricted real PII transmission across all tested query types; in a 100-query adversarial trial, a prompted LLM adversary recovered no original values from surrogate-substituted messages.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。