🤖 AI

CAMP: Cumulative Agentic Masking and Pruning for Privacy Protection in Multi-Turn LLM Conversations

This paper introduces CAMP, a novel framework that addresses the critical privacy vulnerability of cumulative PII exposure in multi-turn LLM conversations by maintaining a session-level registry and retroactively masking history when the re-identification risk of accumulated data fragments exceeds a configurable threshold.

Original authors: Aman Panjwani

Published 2026-04-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Aman Panjwani

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are talking to a very smart, helpful robot assistant. You want to ask it for advice on your health, your job, or your finances. The problem is, you don't want the robot (or the company behind it) to know exactly who you are.

The Problem: The "Slow Leak"

Most current safety tools work like a bouncer at a single door.

How they work: Every time you send a message, the bouncer checks just that one sentence. If you say, "My name is John," the bouncer stops you and says, "Nope, can't say that!"
The Flaw: But what if you play a game of "hide and seek" with your secrets?
- Turn 1: You say, "I'm feeling sick." (Safe)
- Turn 2: You say, "I live in a small town in Ohio." (Safe)
- Turn 3: You say, "I work at a specific bank." (Safe)
- Turn 4: You say, "I make $150,000 a year." (Safe)

Individually, none of these sentences look dangerous. The bouncer lets them all through. But by Turn 4, the robot has a complete puzzle piece: John, from Ohio, working at that specific bank, making that specific salary. It can easily guess who you are. This is called Cumulative PII Exposure. The danger isn't in one big leak; it's in the slow drip of many small, harmless drops that fill the bucket.

The Solution: CAMP (The "Smart Session Manager")

The paper introduces a new system called CAMP. Instead of just checking the door, CAMP is like a super-intelligent librarian who watches the entire conversation as it happens.

Here is how CAMP works, using a simple analogy:

1. The "Secret Notebook" (Session Registry)

Every time you talk to the robot, CAMP writes down a secret note in a local notebook. It doesn't send this notebook to the robot. It just keeps track: "Okay, the user mentioned a name, a city, and a job."

2. The "Danger Web" (Co-occurrence Graph)

CAMP draws a web connecting the dots.

If you mention a City alone, it's a weak dot.
If you mention a Job alone, it's a weak dot.
But if you have City + Job + Salary all in the same conversation, CAMP sees the web connecting them and realizes: "Oh no! These three things together create a super-identifiable profile!"

3. The "Alarm Bell" (CPE Score)

CAMP has a score counter. Every time you add a piece of info, the score goes up.

If you just say "Hello," the score is low.
If you start mixing your location with your job and medical history, the score spikes.
Once the score hits a "Danger Zone" (a threshold), the alarm rings.

4. The "Magic Eraser & Re-writer" (Retroactive Pseudonymization)

This is the coolest part. When the alarm rings, CAMP doesn't just stop the conversation. It goes back in time.

It takes the entire history of your chat (Turns 1 through 4).
It swaps your real name with a fake one (e.g., "John" becomes "Alex").
It swaps your real city with a fake one (e.g., "Cleveland" becomes "Springfield").
It swaps your real salary with a fake number.
Crucially: It keeps the logic consistent. If you said "Alex" in Turn 2, it makes sure the robot sees "Alex" in Turn 4, not a different name.

5. The "Magic Reveal" (De-masking)

The robot processes the chat with the fake names ("Alex from Springfield"). It gives you an answer.

Robot: "Hi Alex, based on your salary in Springfield, here is some advice..."
CAMP: Snaps fingers. "Wait, let me fix that for the user."
CAMP: Swaps "Alex" back to "John" and "Springfield" back to "Cleveland" before showing you the screen.
You see: "Hi John, based on your salary in Cleveland..."

Why This Matters

Old Way: You either have to hide your identity completely (which makes the conversation useless) or you risk leaking your identity slowly over time.
CAMP Way: You get the full, helpful conversation. The robot thinks it's talking to a generic "Alex," so it learns nothing about you. But you get the answer as if it were talking to you.

The Bottom Line

CAMP realizes that in a long conversation, the whole is greater than the sum of its parts. It protects you not by blocking every sentence, but by watching how the sentences combine, and then magically rewriting the story so the robot never knows the truth, while you still get the perfect answer.

1. Problem Statement: Cumulative PII Exposure (CPE)

The paper identifies a critical vulnerability in current Large Language Model (LLM) privacy protections: statelessness.

Current Limitation: Existing tools (e.g., Microsoft Presidio, PAPILLON) operate on a per-turn basis. They scan individual user messages for Personally Identifiable Information (PII) and mask them before sending them to the LLM. However, they discard the context of previous turns.
The Vulnerability: In agentic, multi-turn conversations, users often disclose PII fragments gradually (e.g., name in Turn 2, city in Turn 4, employer in Turn 6). While no single message triggers a mask, the accumulation of these fragments across the conversation history creates a fully re-identifiable profile.
The Mosaic Effect: This phenomenon, termed Cumulative PII Exposure (CPE), allows an external LLM to reconstruct a user's identity through the intersection of quasi-identifiers (e.g., Location + Salary + Job Title), even if no single message contained explicit identifiers. Current systems fail to detect this combinatorial risk.

2. Methodology: The CAMP Framework

The authors propose CAMP (Cumulative Agentic Masking and Pruning), a session-level middleware framework that operates between the user and the external LLM. It introduces a stateful approach to privacy protection.

Core Components:

Per-Turn PII Extractor: Uses Named Entity Recognition (NER) and pattern matching (e.g., Microsoft Presidio) to identify PII in the current user message.
Session Registry: A stateful database that maintains a record of all PII entities detected across the entire conversation session, storing the entity type, original value, and the turn index of first appearance.
Co-occurrence Graph:
- Models the relationship between different PII entity types within a session.
- Nodes represent entity types (e.g., Person, Location, Salary); edges connect types that appear in the same session.
- Amplification: As the graph becomes more connected, the privacy risk of individual entities increases. A "combination amplifier" ( $f(v)$ ) boosts the weight of entities based on their degree of connectivity.
CPE Score Calculation:
- Computes a dynamic risk score after every turn: $CPE(t) = \sum w(v) \cdot (1 + \alpha \cdot \deg(v))$ .
- Where $w(v)$ is the base sensitivity weight of the entity, $\deg(v)$ is the number of connections in the graph, and $\alpha$ is a sensitivity parameter.
- The score grows superlinearly as new entity types form connections with existing ones.
Retroactive Pseudonymization:
- Trigger: When $CPE(t)$ exceeds a configurable threshold ( $\tau$ ).
- Action: The system rewrites the entire conversation history (not just the current turn). Real PII values are replaced with consistent synthetic substitutes (e.g., "John Doe" $\to$ "Alex Smith") generated locally using the Faker library.
- Consistency: The same real value always maps to the same synthetic value throughout the session to maintain conversational coherence for the LLM.
De-masking Layer:
- Intercepts the LLM's response.
- Replaces synthetic identities with the original real-world values before returning the response to the user.
- Ensures the user experiences a natural conversation while the external LLM only processes synthetic data.
Hard Block Rules: Certain high-risk identifiers (SSN, Credit Card, Bank Account) are immediately blocked and replaced with placeholders like [BLOCKED] regardless of the CPE score.

3. Key Contributions

Formalization of CPE: The first formal definition of Cumulative PII Exposure as a session-level privacy risk metric, distinguishing it from single-message leakage.
Co-occurrence Graph Model: A novel method to quantify combination risk, demonstrating that the intersection of quasi-identifiers poses a greater threat than the sum of individual entities.
Retroactive Intervention: A framework capable of rewriting historical conversation context when risk thresholds are crossed, a capability absent in existing per-turn masking systems.
Full Round-Trip Privacy: A complete pipeline that protects data from the user to the model and back, preserving conversational utility through consistent de-masking.

4. Experimental Results

The authors evaluated CAMP on four synthetic multi-turn scenarios: Healthcare, HR/Hiring, Finance, and General Conversation. They compared CAMP against a standard per-turn Presidio baseline.

Privacy Efficacy:
- Presidio Baseline: Exposed between 3 to 6 distinct PII entity types per session to the external model, as it failed to detect the cumulative risk.
- CAMP: Reduced real PII exposure to zero across all scenarios. It successfully intervened before the re-identification threshold was crossed.
Intervention Timing:
- Intervention occurred early in high-risk domains (e.g., Turn 2 in Finance and HR) and later in general conversation (Turn 5), demonstrating adaptability to disclosure patterns.
- The system successfully detected the "cliff" where individual innocuous disclosures became dangerous when combined.
Utility Preservation:
- The LLM produced coherent, contextually appropriate responses in all scenarios.
- The de-masking layer successfully restored original identities, ensuring the user saw no synthetic artifacts.
Threshold Sensitivity: Experiments with thresholds $\tau \in \{1.5, 2.0, 2.5\}$ showed that lower thresholds provide stronger privacy (earlier intervention) while higher thresholds preserve more natural context. $\tau = 2.0$ was identified as a balanced default.

5. Significance and Future Directions

Architectural Shift: CAMP challenges the prevailing "stateless" assumption in LLM privacy. It argues that privacy in agentic systems must be managed at the session level to address the mosaic effect.
Regulatory Alignment: The framework offers a technical implementation of "Privacy by Design" and data minimization principles (e.g., GDPR Article 25), allowing operators to configure risk thresholds based on domain sensitivity.
Limitations & Future Work:
- Current reliance on explicit NER means implicit disclosures (e.g., describing a job without naming the company) may be missed. Future work suggests using local small LLMs for implicit inference.
- Future directions include adaptive threshold selection, multi-agent session tracking, and integrating formal Differential Privacy guarantees.

Conclusion: The paper demonstrates that traditional per-turn masking is insufficient for modern agentic LLMs. By introducing a session-aware, graph-based risk model and retroactive pseudonymization, CAMP effectively neutralizes cumulative privacy risks while maintaining the full utility of the conversation.