Abstract
In LLM/VLM agents, prompt privacy risk propagates beyond a single model call because raw user content can flow into retrieval queries, memory writes, tool calls, and logs. Existing de-identification pipelines address document boundaries but not this cross-stage propagation. We propose BodhiPromptShield, a policy-aware framework that detects sensitive spans, routes them via typed placeholders, semantic abstraction, or secure symbolic mapping, and delays restoration to authorized boundaries. Relative to enterprise redaction, this adds explicit propagation-aware mediation and restoration timing as a security variable. Under controlled evaluation on the Controlled Prompt-Privacy Benchmark (CPPB), stage-wise propagation suppresses from 10.7\% to 7.1\% across retrieval, memory, and tool stages; PER reaches 9.3\% with 0.94 AC and 0.92 TSR, outperforming generic de-identification. These are controlled systems results on CPPB rather than formal privacy guarantees or public-benchmark transfer claims. The project repository is available at this https URL.
Abstract (translated)
在LLM/VLM智能体中，提示隐私风险会超越单次模型调用的范围，因为原始用户内容可能流入检索查询、记忆写入、工具调用和日志中。现有去标识化流程仅处理文档边界，却未解决这种跨阶段传播问题。我们提出BodhiPromptShield——一个具备策略感知能力的框架，它能检测敏感片段，通过类型化占位符、语义抽象或安全符号映射进行路由，并将还原操作延迟至授权边界。相对于企业脱敏方案，该框架增加了明确的传播感知中介机制和作为安全变量的还原时机。在受控提示隐私基准（CPPB）的评估中，分阶段传播使检索、记忆和工具阶段的泄露率分别从10.7%降至7.1%；PER指标达到9.3%，准确率0.94、真阳性率0.92，优于通用去标识化方案。这些结果来自CPPB受控系统测试，不构成形式化隐私保证或公共基准迁移声明。项目仓库可通过此链接访问。
URL
https://arxiv.org/abs/2604.05793
