让文本转SQL更安全，精准控制字段使用权限。
Policy-Conditioned Constrained Decoding for Column-Level Access Control in Text-to-SQL
- 按字段用途（输出/过滤/聚合）定义访问策略，结合解码器语法追踪。
- 单次解码即可杜绝字段误用，漏泄率为0%，覆盖率达88.7%。
- 适合需要严格数据安全的文本转SQL系统，兼容主流模型。
文本转SQL正广泛应用于数据提供方与用户之间的信任边界。部署需平衡政策合规、答案覆盖率和成本可控三方面要求。现有方法通常基于查询提及的字段决定拒绝，并随机执行，但合规性不仅取决于字段存在，还取决于其语义使用方式，而随机执行无法确定性排除违规。本文将此需求形式化为基于语义使用的列使用策略：输出、过滤条件、聚合参数。通过将每种角色与解码器跟踪的语法生成对应，构建了PCC-SQL系统。该系统在解码时对每个词元应用逻辑掩码，可在单次解码中确定性地消除支持的SQL片段中的单查询列使用违规。在三个基准测试和三种开源模型上，PCC-SQL实现0%漏泄率，Spider-CU上覆盖率最高达88.7%，且仅比直接提示多消耗10%的词元。此外，通过执行准确率评估语义对齐效果。
原文摘要 · Abstract (English)
Text-to-SQL is increasingly deployed across trust boundaries between data providers and users. Such deployment must balance three competing requirements: policy compliance, answer coverage, and bounded cost. Existing approaches typically decide refusal based on which columns a query mentions and enforce it stochastically. Whether a query is compliant, however, depends not only on which columns appear but on how they are used, and stochastic enforcement cannot deterministically rule out violations. We formalize this requirement as a column-use policy over semantic use: output, filter condition, and aggregation argument. We integrate the policy by aligning each role with grammar productions tracked by the decoder. The resulting system, PCC-SQL, applies a per-token logits mask that deterministically eliminates single-query column-use violations on the supported SQL fragment in a single decoding pass. Across three benchmarks and three open-source models, PCC-SQL achieves 0% Leakage Rate and Coverage up to 88.7% on Spider-CU, while staying within +10% tokens of direct prompting. We additionally assess semantic alignment with execution accuracy.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。