Large language models mask meaning to protect text privacy
LLMs as Linguistic Chameleons: Decoupling Semantics and Structure for Privacy-Preserving Communication
Cryptography and SecurityArtificial IntelligenceComputation and Language
Summary
This work tackles the challenge of keeping text data private when using large language models (LLMs) for tasks. The researchers developed a method called CROSS-MAP that changes the meaning of the input text into a different form before sending it to an LLM, while preserving the structure needed for the model to work correctly. After the LLM processes this altered input, the original meaning is restored so the result remains useful. Their tests show this approach prevents attackers from reconstructing the original text better than existing methods, without hurting performance.
What this means in practice
- •For enterprise software teams: Securely process sensitive text inputs with LLM APIs by masking original meanings to protect data during inference.
- •For legal document analysts: Analyze confidential legal text using language models without exposing the sensitive content to external APIs or attackers.
Authors
Yuzhu Mao, Liang Zhao
Abstract
As Large Language Model (LLM) APIs become increasingly integrated into privacy-sensitive workflows, ensuring inference-time privacy without compromising task utility remains a major challenge. Existing approaches preserve most of the original semantic content to maintain downstream performance, but this also leaves exploitable cues for reconstructing the original text. This work investigates semantic decoupling, which replaces original semantics with alternative content while preserving the structure needed for LLM reasoning. Based on this idea, we propose CROSS-MAP, a bidirectional framework that maps private inputs into a different semantic domain before inference and recovers the corresponding outputs afterward. Local models are trained with multi-objective optimization to maximize semantic divergence in the mapping stage while minimizing semantic inconsistency in the recovery stage. Experiments show that CROSS-MAP reduces reconstruction success across multiple attack settings while outperforming existing baselines in utility.