Aug 2026· Italian National Conference on Sensors· 0 citations· 22 references
TL;DR
Generative semantic chaffing (GS-Chaff), a training-free multi-agent framework for privacy-preserving LLM inference over natural-language text queries that hides the user’s true intent among semantically plausible chaff queries, is proposed.
Abstract
Cloud-based large language model (LLM) services are increasingly used to process natural-language queries that may contain private or sensitive information. Conventional privacy-preserving approaches, such as cryptographic protection and text sanitization, often introduce substantial computational overhead or disrupt the semantic integrity of the original query, resulting in a trade-off between privacy protection and task utility. To address this limitation, we propose generative semantic chaffing (GS-Chaff), a training-free multi-agent framework for privacy-preserving LLM inference over natural-language text queries. Rather than explicitly masking sensitive content, GS-Chaff hides the user’s true intent among semantically plausible chaff queries. The framework is implemented through two small language model (SLM)-based agents: a privacy policy agent that adaptively determines the required semantic abstraction level and chaffing factor for each text query, and a generative semantic chaffing agent that produces semantically aligned dummy queries. After cloud-side inference, the response corresponding to the protected real query is recovered locally using a stateless index, without modifying the cloud-based LLM. Experimental results on text-based benchmarks demonstrate that GS-Chaff reduces the attacker’s real-query identification rate to 22.5%, close to random guessing, while maintaining inference utility on the evaluated benchmarks. In addition, GS-Chaff reduces local preprocessing time by 1.85× compared with a fixed chaffing configuration using β=5.
Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream. We introduce Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol that selects a task-sufficient disclosure from an application-authored candidate family and binds it to explicit recipient, purpose, forwarding, lifetime, logging, and memory scopes. A reference monitor enforces these scopes across subsequent operations, while a history-aware extension accounts for inference risk accumulated over repeated disclosures. Controlled semantic-join, memory, probing, and longitudinal experiments show that conventional defenses can preserve protocol-level utility while exposing substantial additional inference signal. Under identical receipt text, MNC preserves authorized delivery while blocking unauthorized forwarding, logging, durable storage, and retrieval after expiration that a text-only semantic declassifier permits. Two-backbone MAGPIE executions further show that mediated disclosures propagate through subsequent planning, tool use, coordination, and memory retrieval. These results support scope-bound semantic declassification as a practical communication boundary for private LLM-agent systems.
Jing Xu, Longze Fan, Zeyuan Wang et al.· 0 citations
Generating long-form content from extensive internal reports remains challenging for organizations operating under strict privacy and security constraints, where proprietary cloud-based LLM APIs are often not viable. While locally deployed open-weight models offer a privacy-preserving alternative, existing retrieval-augmented generation (RAG) approaches on smaller models frequently lack effective global planning and accumulate factual inconsistencies over long outputs. To address these limitations, we present RH-RAG, a multi-agent framework for secure and trustworthy long form generation using local language models. RH-RAG decomposes generation into three coordinated stages: a Planner Agent that constructs a global document outline from high-level semantic summaries, a Writer Agent that incrementally generates coherent section-wise content using bounded coherence memory, and a Checker Agent that mitigates hallucinations through natural language inference-based factual verification and an attestation-driven revision loop. The framework further employs a dual-level retrieval index that supports efficient planning and fine-grained contextual generation on consumer-grade hardware. Evaluations across literary, financial, and legal domains demonstrate that RH-RAG consistently improves factual grounding, semantic coherence, and document-level alignment compared to standard and hierarchical RAG baselines, while achieving reliability competitive with proprietary cloud-based systems without compromising data privacy.
Multi-agent large language model (LLM) systems built on LangGraph-style frameworks share an unencrypted state store with no field-level read access control, so one agent can read another’s private fields. The 2026 OWASP Agentic Top 10 and CVE-2025-67644 show that this layer is already being exploited. We propose CapChain, a replacement for the step that merges each agent’s output into shared state, with three primitives: capability tokens that cryptographically bind which agent may read which field, a tamper-evident provenance log with logarithmic-cost audit, and a capability-aware reducer that decides whether each field may be forwarded, redacting and logging unauthorized merges. We evaluate the reducer’s attribute–purpose gate on the MAGPIE contextual-privacy benchmark, with scoring based on two deterministic tiers: verbatim matching and keyword-and-entity salience. Across 150 conditions (25 scenarios × 3 open-source models × 2 instruction modes), the Salient tier triggers the redactor for 4.67% of inter-agent messages. This rate counts the reducer’s gate activations (redaction decisions), not leakage prevented. By relocating enforcement from the language model to the state-transition layer that graph-structured orchestrators expose, CapChain brings cryptographic, capability-based access control and audit-by-construction provenance to a structural locus that prompt-level defenses cannot reach.
Retrieval-Augmented Generation (RAG) systems enable robust knowledge integration for large language models but also pose significant security and privacy risks. RAG systems combine two components: a retriever, which searches external data sources for relevant information, and a generator, typically a large language model that uses both the retrieved documents and user queries to produce answers. This study conducts a systematic literature review to assess these challenges using Socio-Technical Systems Theory (which considers interactions among people, technology, and organizational context) and Privacy by Design (PbD, a framework for embedding privacy into system design). Addressing five objectives, the research detects and classifies privacy attacks, evaluates risks throughout the storage, retrieval, and generation phases, scrutinizes measurement methods, contrasts mitigation strategies, and introduces a unified solution. The work culminates in the Integrated Privacy-Preserving RAG Framework (IPRAG), a five-tier architecture supported by a three-phase deployment protocol. This study presents a detailed, actionable approach to constructing secure, privacy-focused RAG systems.
Firoz Mohammed Ozman· International Journal of Fro...· 0 citations
Retrieval-Augmented Generation (RAG) is widely used to improve the performance of Large Language Models (LLMs) in answering user queries. Existing privacy research on RAG has focused on preventing unauthorized users from accessing sensitive data. However, another important problem that is often overlooked in RAG privacy research is that external generators have access to the query and the retrieved documents, which may contain confidential information that could potentially be misused or accessed for unintended purposes. In this paper, we introduce the Sensitive Entity Alias Generator (SEAG), a privacy-preserving framework that empowers users to utilize powerful third-party generators without disclosing sensitive information. SEAG introduces a lightweight model that locates sensitive entities, generates corresponding aliases, and constructs an entity replacement table. The table is used to replace sensitive words in the user's query and in the retrieved documents before they are forwarded to an external generator. For this purpose, two datasets were constructed: one for fine-tuning SEAG models to generate entity replacement tables, and another for evaluating the entire SEAG framework. The experimental results demonstrate the success of the SEAG framework. As for the User metric, which measures the ability of the model to provide a correct response to the user while hiding sensitive information from the external generator, all SEAG models achieved over 80% accuracy. Additional analysis further evaluated the ability of SEAG models Qwen-3, LLaMA-3.2, and Phi-4 to hide all sensitive entities within given documents. The results show good performance with total accuracies of 77.83%, 76.73%, and 74.91%, respectively.
Saleh Almohaimeed, Saad Almohaimeed, Mousa Jari et al.· 0 citations
Large Language Models (LLMs) such as ChatGPT, Gemini, Claude, etc. have become integral tools for technical writing, software development, and communication. However, these systems, despite privacy assurances, still expose a significant privacy risk. User prompts often contain personally identifiable or proprietary information that is transmitted in plain-text to external providers, where it may be logged or accessed despite opt-out policies. This research aims to address this gap by designing a lightweight local encryption middleware that acts as a privacy firewall between users and remote AI APIs. Before a message is sent, the middleware automatically detects sensitive entities (Personally Identifiable Information or PII) and replaces them with typed placeholders such as [PERSON_1] or [ORG_1]. A local mapping (with optional authenticated encryption at rest) links these placeholders to their original values, allowing the system to reconstruct (rehydrate) the final response once the model replies. This design aims to reduce the exposure of sensitive information in human-readable form while maintaining the AI output. We evaluate the system in terms of detection accuracy, reconstruction fidelity, and utility preservation, demonstrating a practical solution for privacy-preserving LLM interaction.
Aditya Vishwakarma, Wencen Wu· International Conference on...· 0 citations