Veil-then-reveal protects personal data during large language model use
Veil-Then-Reveal: Protecting PII Privacy via Reversible Pseudo-Anonymization in Zero-Trust User--LLM Interaction
Cryptography and SecurityComputation and Language
Summary
People often need to share personal information when using large language models (LLMs), but sending this information directly can risk privacy. The authors developed Veil-then-Reveal, a way to hide sensitive details by replacing them with believable fake data before sending it to the model. This keeps the structure and meaning intact so the model can still understand the text, and later the original information is restored safely on the user's device. Their system works well to detect and protect personal info while allowing effective interactions with LLMs.
What this means in practice
- •For enterprise it security teams: Enable enterprises to interact with cloud-based large language models without risking exposure of sensitive personal data by sending encrypted and pseudo-anonymized prompts.
- •For software developers integrating ai services: Allow developers to build applications that use remote LLM APIs while preventing leakage of user private information through reversible anonymization techniques.
Authors
Mohamed Shaaban, Mohamed Elmahallawy, Thomas E. Carroll
Abstract
Large language models (LLMs) increasingly process sensitive documents and personal information, yet sending prompts containing personally identifiable information (PII) to remote providers exposes data subjects and organizations to risks from logging, retention, model training, and unintended disclosure. Existing anonymization methods often mask or remove PII, while conventional encryption eliminates the lexical and structural cues needed for effective LLM processing. We present Veil-then-Reveal (VtR), a user-side PII pseudo-anonymization framework for privacy-preserving LLM interaction under a zero-trust threat model. VtR treats remote LLM providers as untrusted and sends only pseudo-anonymized prompts, keeping plaintext PII on the user. VtR first detects PII and replaces it with realistic, same-type, in-vocabulary surrogates before prompts leave the user's device, preserving their linguistic and structural properties. It combines format-preserving encryption (FPE) for structured PII, such as phone and credit-card numbers, with a keyed-hash dictionary and secure vault for semantic PII, such as names, locations, and organizations. Session-specific mappings provide cross-session unlinkability, while user-side restoration reversibly replaces surrogates with their original values in LLM responses. We further introduce a rank-class FPE strategy for dates that preserves format and ambiguity while reducing cipher evaluations. Evaluation on three datasets containing 11,322 annotated PII instances achieves 97.9% detection recall, 95.2% protection of detected values, and 99.9% round trip; 100% of echoed surrogates end-to-end round-trip restoration.