BodhiPromptShield: Pre-Inference Prompt Mediation for Suppressing Privacy Propagation in LLM/VLM Agents

1. Problem Definition

The paper addresses a critical gap in the privacy protection of Large Language Model (LLM) and Vision-Language Model (VLM) agents. While traditional privacy methods focus on training-time protection (e.g., differential privacy) or post-hoc de-identification of stored records, they fail to address inference-time propagation risks in multi-stage agent workflows.

• The Core Issue: In agent systems, a raw user prompt containing sensitive data (PII, financial, medical) does not just enter a single model call. It propagates through a directed graph of components: retrieval queries, memory writes, tool calls, and logs.
• The Failure Mode: Existing redaction tools often mask sensitive spans at the document boundary (ingress). However, if a masked span is copied into a retrieval query, cached in memory, or used as a tool argument before the final authorized execution, the privacy protection is effectively bypassed.
• The Challenge: The system must suppress the propagation of sensitive content across these internal agent boundaries while preserving enough semantic structure for the agent to perform reasoning and task execution correctly.

2. Methodology: BodhiPromptShield

The authors propose BodhiPromptShield, a policy-aware, pre-inference mediation framework designed to intercept and sanitize prompts before they enter the agent pipeline.

A. System Architecture

The framework operates as a middleware layer between the user and the downstream agent pipeline ($G = (V, E)$). The workflow consists of four stages:

1. Privacy Entity Extraction: Detects sensitive spans ($S(x)$) using rule-based recognizers, Named Entity Recognition (NER), and contextual judgment. For multimodal inputs, it integrates OCR and VLM-based extraction.
2. Semantic-Preserving Sanitization: Transforms detected spans into protected surrogates ($\hat{s}_i$) using a policy-instantiated operator ($T_\pi$).
3. Downstream Inference: The sanitized prompt ($\tilde{x}$) is sent to the agent (LLM/VLM, retrieval, tools, memory).
4. Secure Restoration: Optional, authorized recovery of exact values only at specific execution boundaries (e.g., final tool call) using a secure mapping table ($K$).

B. Sanitization Modes

The framework dynamically selects one of three sanitization modes based on a Policy Profile ($\pi$) and routing state:

1. Typed Placeholder Replacement: Replaces entities with type-specific tokens (e.g., <PERSON_1>, <PHONE_1>). Best for stable identifiers where exact values aren't needed for reasoning.
2. Semantic Abstraction: Replaces specific details with generalized descriptions (e.g., "a residential address in Auckland"). Preserves context for reasoning without revealing the exact entity.
3. Secure Symbolic Mapping: Replaces spans with opaque tokens linked to a secure, encrypted mapping table. Exact values are only restored at authorized boundaries (e.g., tool execution), preventing leakage in retrieval or memory stages.

C. Policy-Aware Routing

The system uses a routing policy $\Pi_\pi$ that balances Privacy Exposure vs. Utility Preservation.

• Policy Profiles: Users can select Lenient (prioritizes utility), Balanced (trade-off), or Strict (prioritizes suppression).
• Decision Logic: The selector evaluates the privacy category, detection confidence, downstream task requirements (e.g., does the tool need the exact value?), and latency constraints to choose the optimal sanitization mode.

D. Evaluation Metrics

The paper introduces Propagation-Aware metrics rather than simple document-boundary scores:

• Privacy Exposure Rate (PER): The ratio of residual sensitive spans in the released prompt.
• Stage-wise Propagation Exposure (SPE): Measures how much sensitive content survives at specific boundaries (Retrieval $\to$ Memory $\to$ Tool).
• Utility Preservation Ratio (UPR): Measures Answer Consistency (AC) and Task Success Rate (TSR) compared to raw prompts.

3. Key Contributions

1. Reformulation of Prompt Privacy: Shifts the paradigm from "single-document masking" to "propagation-control" across agent states, explicitly defining the gap between document boundaries and agent internal edges.
2. Policy-Aware Mediation Mechanism: Introduces a framework that treats restoration timing as a security variable, ensuring exact values only re-enter the pipeline at authorized execution points.
3. Controlled Evaluation Protocol (CPPB): Defines the Controlled Prompt-Privacy Benchmark (CPPB), a dataset of 256 prompts covering diverse tasks (QA, agent execution, multimodal) and privacy categories, specifically designed to measure cross-stage leakage.
4. Explicit Evidence Hierarchy: Distinguishes between record-backed core results and controlled supporting slices, providing transparency regarding the scope of privacy guarantees (e.g., acknowledging that the system is not end-to-end differential privacy).

4. Experimental Results

Evaluated on the CPPB, BodhiPromptShield demonstrates significant improvements over existing baselines (Regex-only, NER-only, Generic De-identification, and Enterprise Staged Redaction).

• Propagation Suppression:
  • Without Mediation: Sensitive content propagates at 100% across retrieval, memory, and tool stages.
  • With BodhiPromptShield: Stage-wise exposure drops from 10.7% (at retrieval) to 7.1% (at tool invocation).
  • Comparison: Regex-only masking only reduced exposure to ~60%, proving that late-stage suppression is ineffective once data has propagated.
• Privacy-Utility Trade-off:
  • PER: The proposed method achieved a 9.3% PER, outperforming generic de-identification (12.4%) and matching enterprise staged redaction (8.1%) closely.
  • Utility: Crucially, it maintained high utility with AC = 0.94 and TSR = 0.92, significantly outperforming generic de-identification (AC 0.73, TSR 0.71) which destroys task semantics.
• Robustness:
  • The system includes normalization to handle Unicode/homoglyph substitutions, reducing exposure from 94.1% (baseline) to 43.9%.
  • It performs well across text-only and multimodal (OCR) inputs, though OCR noise remains a challenge.
• Latency: The balanced policy adds approximately 41ms of mean latency, which is considered acceptable for the privacy gains.

5. Significance and Implications

• Practical Deployment: Unlike theoretical cryptographic solutions, BodhiPromptShield is designed for practical integration into existing LLM/VLM agent stacks without requiring model retraining.
• Agent Security: It addresses the unique risk of multi-stage leakage, where data is safe at the input but leaks during intermediate agent operations (retrieval/memory).
• Policy Flexibility: By decoupling the sanitization strategy from the model, organizations can tune policies (Lenient/Strict) based on their specific threat models and compliance requirements (e.g., healthcare vs. general chat).
• Limitations & Future Work: The authors acknowledge that the system relies on the security of the mapping table and key management. It does not provide formal end-to-end differential privacy guarantees and struggles with highly ambiguous context or adversarial prompt injections designed to bypass detection. Future work focuses on broader external benchmark transfers and stronger adversarial robustness.

In summary, BodhiPromptShield provides a critical "interface-layer" defense that prevents sensitive user data from cascading through the complex internal states of AI agents, ensuring that privacy is maintained not just at the point of entry, but throughout the entire reasoning and execution lifecycle.