PromptPET: Privacy-Utility Optimized Prompt Obfuscation
2026-07-03 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceHuman-Computer InteractionMachine Learning
AI summaryⓘ
The authors focus on protecting user privacy when people talk to AI chatbots, since chats can include sensitive info that might be misused. They study four ways to hide or change sensitive parts of messages—like erasing, summarizing, swapping words, or adding noise—and measure how each affects privacy and chatbot usefulness. They also create PROMPTPET, a system that smartly picks the best hiding method for each sensitive part to keep responses helpful while protecting privacy. Using real chat data, they show PROMPTPET works better than previous methods by balancing privacy protection with getting good chatbot answers.
user privacyAI chatbotsdata obfuscationprivacy-utility tradeoffredactionabstractionreplacementnoising/denoisingreinforcement learningLLM-based agent
Authors
Ke Yang, Olivia Figueira, Umar Iqbal, Athina Markopoulou
Abstract
Privacy is an important challenge when users interact with AI chatbots, since users may share sensitive information, explicitly or implicitly, and AI chatbots can use this information for user profiling. In this paper, we aim to protect user privacy via a user-side mechanism that transforms sensitive information in a user prompt, while preserving enough information to elicit a useful response from the chatbot. This approach faces an inherent tradeoff between protecting privacy (i.e., avoiding profiling) and preserving utility (i.e., getting personalized and task-specific responses). To that end, we consider, evaluate, and compare four different obfuscation actions, namely redaction, abstraction, replacement, and a novel noising/denoising scheme that we introduce. Additional novel insights include: utilizing a data type taxonomy to both identify and obfuscate sensitive information and explicitly taking into account the utility of chat responses in making the obfuscation decision. First, we systematically optimize and evaluate each obfuscation action independently in terms of the privacy-utility tradeoff it achieves. Second, we propose PROMPTPET, an LLM-based agent that selects the best obfuscation action for each sensitive part of the prompt, using a reinforcement-learning inspired rule optimizer, applied for the first time in this context. Using a real-world chat dataset, we show that PROMPTPET matches the best privacy-utility tradeoff attainable by any single obfuscation action and significantly outperforms prior state-of-the-art approaches.