CounterPersona defends personal data from unauthorized skill copying
CounterPersona: Append-Only Defense Against Unauthorized Persona Skill Distillation
Cryptography and Security
Summary
Sometimes, computer programs try to copy how a person behaves by studying their past information, which can invade privacy. The authors found that current ways to stop this copying only work if people can change their data before it’s taken, but often the data is already collected and can't be changed. They created a new method called CounterPersona that adds special misleading patterns to a person's data, making it harder for others to copy their behavior without permission. Their tests show this method works well at protecting privacy against different copying tools.
What this means in practice
- •For privacy engineers: Develop tools to embed deceptive signals in collected user data to prevent unauthorized behavioral copying.
- •For platform security teams: Strengthen defenses against AI attackers distilling user skill data from stored behavioral records.
Authors
Pengwei Wang, Zihan Wang, Hangcheng Cao, Qingchuan Zhao, Hongwei Li, Guowen Xu
Abstract
Persona skill distillation can extract recurring patterns from personal information and encode them into reusable skills, enabling AI systems to closely replicate an individual's behavior. However, such replication also raises serious concerns regarding personal privacy and labor autonomy. Unlike existing perturbation-based defenses that require individuals to modify their data before collection, once historical records are collected by an attacker, they can no longer be altered, sanitized, or revoked. Therefore, such defenses are difficult to adapt to this append-only setting. To solve this challenge, we introduce CounterPersona, which constructs targeted counter-persona evidence, packs compatible behavioral states into compact realization units, and strengthens them through rationale-guided consistency rewriting. We conduct extensive experiments showing that CounterPersona achieves strong and consistent effectiveness across lexical, semantic, and LLM-based measures, while remaining robust across distillers. Our work establishes a skill anti-distillation paradigm for protecting personal privacy and labor autonomy against unauthorized skill distillation.