Selective Token-Level Cryptographic Redaction for Privacy-Preserving Clinical Deployment of Large Language Models
2026-06-02 • Computation and Language
Computation and LanguageCryptography and Security
AI summaryⓘ
The authors developed HERALD, a system to protect sensitive health information when using large language models. Instead of encrypting all data, which is slow and unwieldy, HERALD only encrypts sensitive words like medical terms, keeping the rest readable for the model to understand. It does this by identifying key terms using language tools and replacing them with coded versions on the user's device before sending data. Their tests show that HERALD keeps private information safe while still allowing the models to work almost as well as if they had the original data. This approach works with any model and strengthens privacy without needing big changes to existing systems.
large language modelsdata encryptionprivacymedical named-entity recognitionpart-of-speech taggingtokenizationclient-side processingmedical question answeringlemmatizationcryptographic redaction
Authors
Farhan Sheth, Ziyuan Yang, Yongying Lan, Si Yong Yeo
Abstract
While large language models (LLMs) are increasingly used for clinical applications, many existing pipelines require sending raw sensitive health information to remote servers for processing, which heightens the risk of privacy leakage. A natural approach to mitigate this risk is to encrypt the data before transmission. However, straightforward solutions such as encrypting the entire dataset introduce prohibitive computational, alignment, and communication overheads, rendering large-scale practical deployment infeasible. To preserve privacy while maintaining usability, we present Healthcare Encryption & Redaction via Adaptive Linguistic Decomposition (HERALD), a token-level cryptographic redaction framework designed to achieve this balance by encrypting only sensitive tokens while preserving the surrounding context for downstream model utility. HERALD combines medical named-entity recognizer (NER) with part-of-speech (POS) driven policies to select candidate tokens, performs targeted lemmatization to stabilize surface forms, and substitutes each protected token with a deterministic ciphertext wrapped in explicit delimiters. Notably, HERALD is model-agnostic and operates entirely on the client side, ensuring that sensitive content remains encrypted throughout storage, transmission, and processing without requiring changes to downstream models. We evaluated HERALD on both classification and medical question answering (MQA) tasks on public datasets. Across different tasks, experiments illustrate that fully secured baselines suffer significant utility loss, whereas HERALD consistently recovers performance close to plaintext. Overall, HERALD provides a novel utilization pipeline.