Protect user data during local large language model tasks with verified de-identification
Reversibility-Verified De-identification for Cloud-Local LLM Inference: A Locally Certified Dehydrate-Rehydrate Loop with Layered Assurance (DR-SL)
Cryptography and Security
Summary
Using large language models on devices can expose sensitive user information if data is sent to the cloud. The authors propose a way to remove personal data while keeping answers useful, by repeatedly checking that no secrets leak. Their method balances privacy and usefulness through automated tests, strong attacker simulations, and human review. Although some technical bounds show limits, the approach greatly reduces data leaks on tough tests and can automatically release many safe cases. The authors also tested how well their measures match real understanding and human judgment.
What this means in practice
- •For mobile app developers: Keep sensitive user input private while using cloud-assisted language features by automatically certifying safe data release with layered testing and fallback.
- •For enterprise it security teams: Mitigate privacy risks in hybrid local-cloud language model deployments by integrating a looped verification to identify and block data leaks before cloud transmission.
Authors
Wen Hu, Ya Yu, Xutong Wang
Abstract
Cloud-local LLM inference must keep sensitive user data on-device while exploiting cloud-grade reasoning, yet existing sanitization approaches (placeholder substitution, differential-privacy perturbation, and skill distillation) lack a release decision that is simultaneously safe and utility-preserving. We propose DR-SL (Dehydrate-Rehydrate with Self-Learning loop), which formalizes de-identification completeness as two measurable conditions: de-identification sufficiency under Pufferfish semantics, and task-information preservation via QA probes. A fully local two-branch verifier iterates dehydration under a lexicographic gate with guaranteed termination, backed by a deterministic hard line, an external strong-attacker re-test, and human fallback. We prove Fano-type lower bounds, a Pufferfish witness, and a rate-privacy feasibility criterion, and state their scope plainly: the bounds certify leakage, never safety, and are near-vacuous at our operating point, so release safety rests on empirical calibration, the hard line, and human review. On a worst-case fully task-coupled benchmark the loop reduces leakage from 0.457 to 0.304 (p approx. 0) and the release chain delivers 0.000 literal leakage at egress (160 instances, two strong attackers), the system degrading to certification-and-routing exactly as the feasibility criterion predicts. On a mixed-coupling benchmark the same safe point releases 67.5% of instances automatically at zero measured leakage, Pareto-dominating placeholder and selective-LDP corners under an identical release rule. Two human studies anchor the semantic utility metric (Spearman rho = 0.839) and the annotation gold (type-level recall at least 0.987). The exploratory self-learning hypothesis was not supported and is reported as such. All theoretical bounds pass numerical verification; code, synthetic datasets, protocol, and human-study packages are public.