GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation

Ruiyi Yang; Gayathri Lihinikaduarachchi; Rahat Masood; Flora D. Salim; Salil S. Kanhere

cs.AIAug 29, 2026

GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation

Authors: Ruiyi Yang, Gayathri Lihinikaduarachchi, Rahat Masood, Flora D. Salim, Salil S. Kanhere

Organizations: School of Computer Science and Engineering, UNSW Sydney, Australia

Abstract

Privacy protection for live web traffic requires more than detecting private spans. Agent-based privacy protection systems must determine whether an outgoing action complies with the destination site's privacy policy, then apply only the level of rewriting or sanitisation justified by the residual disclosure risk. We present GuardianAgent, a policy-conditioned anonymization framework that couples structured risk assessment with verified adaptive rewriting. GuardianAgent computes risk through AMRSF (Adaptive Multi-factor Risk Scoring Formula), an explicit controller that combines policy-violation likelihood with data sensitivity, recipient transmission, purpose legitimacy, contextual basis, and policy transparency, rather than relying on an LLM to assign risk directly. This risk score determines both the allow/transform/deny decision and the initial anonymization level. For efficiency, GuardianAgent uses an evidential fast path for low-uncertainty policy matches and invokes an LLM slow path only for uncertain cases. For rewriting, it applies a five-level hierarchy driven by a verified adversarial guesser: guesses trigger escalation only when supported by the original text, preventing hallucinated attacker confidence from causing unnecessary over-anonymization. Experiments across three benchmarks spanning legal text (TAB), Reddit posts (SynthPAI), and multi-format synthetic PII records (PII-Masking-300k) show that GuardianAgent achieves the strongest privacy-utility trade-off among published baselines and is the only method to reach more than 0.90 privacy in all three domains, remaining robust under a backbone switch. Action-context stress tests further show that the same outgoing text receives different decisions and anonymization strengths under different recipients, purposes, action bases, and policy-transparency conditions.

Figures & tables

Figure 1: Framework of GuardianAgent. Policy matching estimates the violation likelihood $L$ , and AMRSF converts it into an action-conditioned risk score $R$ . The score has two effects: it determines the action decision $y\in\{\texttt{allow},\texttt{transform},\texttt{deny}\}$ , and, for transformed actions, its normalized transform-band position $z$ selects the initial anonymization level $\ell_{0}(z)$ . The hierarchical anonymizer then escalates when leakage is detected.

Figure 2: Example of the five-level anonymization hierarchy on a contextually sensitive paragraph. From L1 to L5, more entities and contextual cues are anonymized, making the text less specific while preserving overall meaning.

Iterative / multi-pass LLM rewriters
	TAB (legal, $n=811$ )				SynthPAI (Reddit, $n=200$ )				PII-Masking-300k ( $n=500$ )
Method	Priv $\uparrow$	Util $\uparrow$	Guess $\downarrow$	Lat.	Priv $\uparrow$	Util $\uparrow$	Guess $\downarrow$	Lat.	Priv $\uparrow$	Util $\uparrow$	Guess $\downarrow$	Lat.
A. Ours (full, L1–L5)	$\mathbf{.945}_{.010}$	$.696_{.008}$	$\mathbf{.283}_{.019}$	$\mathbf{5052}_{181}$	$\underline{.944}_{.007}$	$\mathbf{.888}_{.006}$	$.295_{.009}$	$9949_{467}$	$\mathbf{.901}_{.011}$	$.488_{.008}$	$.213_{.010}$	$7453_{299}$
B. Staab’25	$.695_{.013}$	$.564_{.017}$	$.335_{.019}$	$25152_{239}$	$\mathbf{.975}_{.005}^{\dagger}$	$.257_{.018}$	$\mathbf{.098}_{.014}$	$45418_{5663}$	$\underline{.850}_{.010}$	$.384_{.021}$	$\underline{.275}_{.020}$	$24975_{96}$
C. AgentStealth’25	$.689_{.012}$	$\mathbf{.789}_{.007}$	$.579_{.044}$	$16928_{563}$	$.864_{.009}$	$.700_{.005}$	$.260_{.009}$	$15485_{467}$	$.680_{.008}$	$.634_{.015}$	$.508_{.015}$	$19414_{394}$
D. HaS’23	$\underline{.926}_{.005}$	$.669_{.009}$	$.336_{.032}$	$5328_{594}$	$.811_{.026}$	$.841_{.005}$	$.477_{.020}$	$12892_{755}$	$.809_{.010}$	$.586_{.011}$	$.322_{.015}$	$\underline{8384}_{285}$

Table 1: Main comparison across TAB, SynthPAI, and PII-Masking-300k. All three corpora report 4-seed mean

{}_{\text{std}}

(42–45). Latency is mean ms per sample. Best and second-best are marked within each method block and dataset. † Staab’s high SynthPAI privacy is inflated by empty or placeholder outputs, which also explains its low utility.

Figure 3: Privacy–utility Pareto frontiers across the three benchmarks. Baseline methods define each frontier, with GuardianAgent plotted separately. GuardianAgent lies above or beyond the baseline frontier on all three datasets, indicating a stronger cross-domain privacy–utility trade-off.

Context	$R$	Allow	Trans.	Deny	$\overline{\ell_{\text{cf}}}$
$C_{\text{low}}$ (first-party / functionality / paste / full)	$.119_{.017}$	$\mathbf{100.0}$	$0.0$	$0.0$	$2.02_{1.31}$
$C_{\text{med}}$ (provider / analytics / default / partial)	$.413_{.057}$	$0.5$	$\mathbf{98.0}$	$1.5$	$2.10_{1.29}$
$C_{\text{high}}$ (advertising / profiling / background / vague)	$.909_{.016}$	$0.0$	$0.5$	$\mathbf{99.5}$	$4.33_{0.50}$
$C_{\text{ext}}$ (data broker / advertising / background / missing)	$.909_{.011}$	$0.0$	$0.0$	$\mathbf{100.0}$	$4.34_{0.49}$

Table 2: Action-conditioned decision control on 200 PII-Masking samples with the same texts and fixed

L=0.7

. Riskier action contexts shift decisions from allow to transform and deny .

\bar{\ell}_{cf}

is a counterfactual final anonymization level computed by routing all samples through the anonymizer; at deployment time, allow samples are released unchanged, while deny samples are blocked.

Context	Recipient	Purpose	Basis	$R$	$z$	Trans. %	$\overline{\ell_{0}(z)}$	L1	L2	L3	L4	$\overline{\ell_{\text{final}}}$
$T_{\text{mild}}$	first-party	Personalization	default	$.340_{.050}$	$.252_{.179}$	$99.0$	$1.48$	$\mathbf{65}$	$22$	$13$	$0$	$2.37$
$T_{\text{moderate}}$	service-provider	Personalization	default	$.457_{.066}$	$.538_{.208}$	$89.0$	$2.52$	$1$	$\mathbf{64}$	$16$	$18$	$2.93$
$T_{\text{strong}}$	service-provider	Marketing	default	$.557_{.082}$	$.744_{.170}$	$81.5$	$3.33$	$1$	$0$	$\mathbf{64}$	$35$	$3.64$
$T_{\text{near-deny}}$	advertising	Marketing	default	$.704_{.053}$	$.980_{.080}$	$13.0$	$3.98$	$0$	$0$	$0$	$\mathbf{99}$	$4.42$

Table 3: Transform-band risk-to-level control on 200 PII-Masking samples with fixed

L=0.7

. As normalized band position

z

increases, the dominant starting level shifts from L1 to L4, the mean initial level

\overline{\ell_{0}(z)}

rises monotonically, and the final level after verified escalation also increases. Trans. % is the fraction of samples remaining within the transform region.

	TAB			SynthPAI			PII-Mask
Cap	Priv	Util	Guess	Priv	Util	Guess	Priv	Util	Guess
$\ell_{\text{max}}{=}3$	$.924$	$\mathbf{.709}$	$.356$	$.913$	$.897$	$.329$	$.869$	$\underline{.533}$	$\underline{.247}$
$\ell_{\text{max}}{=}4$	$.933$	$.706$	$.325$	$.912$	$\mathbf{.905}$	$.316$	$.849$	$\mathbf{.539}$	$.283$
$\ell_{\text{max}}{=}5$	$\mathbf{.945}_{.011}$	$.696_{.009}$	$\mathbf{.296}$	$\mathbf{.944}_{.007}$	$.888_{.006}$	$\mathbf{.299}$	$\mathbf{.901}_{.011}$	$.488_{.008}$	$\mathbf{.213}_{.010}$

Table 4: Level-progression ablation with maximum level

\ell_{\max}\in\{3,4,5\}

. L3 uses only rule-based masking/tagging, L4 adds minimal-edit rewriting, and L5 adds the semantic safety-net.

Variant	Priv $\uparrow$	Util $\uparrow$	ms
SynthPAI
A. NER only	$.483_{.003}$	$.944_{.001}$	23
B. + guesser	$.569_{.007}$	$.938_{.001}$	729
C. + LLM rewrite	$.910_{.011}$	$.899_{.003}$	2518
D. + L1–L5 adaptive	$\mathbf{.944}_{.007}$	$.888_{.006}$	9949
TAB

Table 5: Component ablation on SynthPAI, TAB, and PII-Masking-300k (mean

{}_{\text{std}}

across 4 seeds;

n=200

for SynthPAI/TAB and

n=500

for PII-Masking). Variants are cumulative: NER only, plus adversarial feedback, plus single-level LLM rewriting, and the full verified L1–L5 adaptive stack.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Category	Wt.	Source
Credentials	1.00	NIST 800-122
Financial	0.95	Milne’04
Health, Biometric, Genetic	0.95	GDPR Art. 9
SSN	0.90	NIST 800-122
Location (precise)	0.85	Milne’04
Location (unspec.)	0.75	default

Appendix

Table 6: Full data-sensitivity weights

\mathrm{DW}(c)

. Some rows group categories assigned the same weight.

Recipient	$M_{tr}$
first-party only	$0.20$
service provider (Art. 28)	$0.40$
analytics / government	$0.50$
social-media platform	$0.60$
unknown third party	$0.70$
advertising network	$0.80$

Appendix

Table 7: Transmission risk

s_{tr}

by recipient type.

Purpose	$M_{p}$
functionality, security, auth.	$0.15$
personalization, research	$0.35$
analytics	$0.45$
marketing	$0.65$
profiling (Art. 22)	$0.75$
advertising	$0.80$

Appendix

Table 8: Purpose legitimacy

s_{p}

Signal	Credit
substantial text ( $\geq 50$ chars)	$-0.10$
covers the action’s data category	$-0.15$
covers the action’s declared purpose	$-0.10$
states a legal basis (GDPR Art. 6)	$-0.08$
discloses user rights	$-0.05$
specifies retention	$-0.02$

Appendix

Table 9: Transparency multiplier

M_{T}

signal credits.

Data tier	Allow ceiling $\tau_{a}^{t}$	Deny floor $\tau_{d}^{t}$
Critical	$0.10$	$0.55$
High	$0.25$	$0.65$
Moderate	$0.35$	$0.75$
Low	$0.45$	$0.80$

Appendix

Table 10: Tier-specific thresholds for the action decision in Eq. 6 . Tiers are assigned to data categories as: Critical (Credentials, Health, Biometric, Genetic, Financial, SSN), High (precise Location, Phone, Content), Moderate (Email, Contact, SearchHistory, BrowsingHistory), Low (Cookies, AppUsage, DeviceID, Language). The transform region width

\tau_{d}^{t}-\tau_{a}^{t}

is widest for sensitive tiers, biasing borderline actions on sensitive data toward rewriting rather than passing through unchanged.

Expert-rated scenarios ( $n=500$ )
Method	$\rho$	$r$	MAE	Macro-F1
AMRSF (full)	0.982	0.947	0.119	$\mathbf{0.812}$
AMRSF $-M_{b}$	$0.965$	$0.940$	$0.136$	$0.683$
AMRSF $-M_{T}$	$0.985$	$0.956$	$0.134$	$0.738$
AMRSF $-$ purpose	$0.976$	$0.947$	$0.135$	$0.738$
NIST L $\times$ I	$0.964$	$0.949$	$0.108$	$0.756$

Appendix

Table 11: Risk-score calibration on the expert-rated scenario set and Staab public corpus. The larger Staab corpus provides a more stable estimate because the expert-rated set is small.

Metric	Value
Test pairs (OPP-115)	$6{,}392$
Accuracy	$0.928$
Precision	$1.000$
Recall	$0.857$
$F_{1}$	$0.923$
Expected Calibration Error	$0.048$

Appendix

Table 12: System 1 evidential classifier on OPP-115.

	TAB		SynthPAI
D variant	Priv	Util	Priv	Util
D (semantic only)	$.974$	$.628$	$.942$	$.847$
D (min-edit only)	$.866$	$\mathbf{.740}$	$.892$	$.892$
D (L1–L5 adaptive)	$\mathbf{.945}_{.011}$	$.696_{.009}$	$\mathbf{.944}_{.007}$	$\mathbf{.888}_{.006}$

Appendix

Table 13: Rewrite-strategy comparison for variant D. The adaptive L1–L5 row reports mean

{}_{\text{std}}

across 4 seeds at

n=200

; the two pilot rows are single-seed.

Metric	V ON	V OFF	$\Delta$
Final level	$3.52$	$3.96$	$-0.44$
Upgrade rate	$0.52$	$0.80$	$-0.28$
Privacy	$0.975$	$0.975$	$\pm 0$
Utility	$0.850$	$0.834$	$+0.016$
Latency (ms)	$6713$	$7350$	$-637$
Unnecessary upgrades	$32.0\%$ $[20.8,45.8]$

Appendix

Table 14: Verification A/B on SynthPAI (

n\!=\!50

, Wilson CIs). OFF reproduces the raw-confidence behaviour of Staab/HaS/AgentStealth.

	TAB		SynthPAI
Method	Priv	Util	Priv	Util
D. GuardianAgent	$\mathbf{.941}_{.024}$	$.695_{.012}$	$\mathbf{.962}_{.015}$	$.879_{.034}$
G. HaS	$.925_{.017}$	$.668_{.020}$	$.797_{.015}$	$.845_{.009}$
F. CONFAIDE	$.899_{.024}$	$.641_{.009}$	$.843_{.026}$	$.830_{.020}$
K. Pissarra	$.881_{.026}$	$.712_{.019}$	$.790_{.055}$	$.875_{.023}$
I. Staab’25	$.667_{.052}$	$.586_{.048}$	$.986_{.018}^{\dagger}$	$.272_{.042}$

Appendix

Table 15: Four-seed variance (

n\!=\!50

per seed, mean with std as subscript, 5-level flagship). † Staab’s SynthPAI privacy still reflects

22\%

empty outputs. GuardianAgent is rank-1 privacy among methods with well-formed outputs at every seed.

	Llama-3.2-3B		Llama-3.1-8B
Method	Priv	Util	Priv	Util
GuardianAgent (full)	$0.975$	$0.855$	$\mathbf{1.000}$	$0.863$
Staab	$0.975$	$0.225$	$0.950$	$0.700$

Appendix

Table 16: Backbone sensitivity (SynthPAI,

n\!=\!50

). Privacy ranking preserved; Staab utility climbs at

8

B but GuardianAgent already saturates at

3

Class	SynthPAI	TAB
clean_success	$65.5\%$ $[58.7,71.7]$	$54.5\%$ $[47.6,61.3]$
cascade (L4 $\times\!3$ )	$16.5\%$	$22.0\%$
pii_retained	$3.5\%$	$0.5\%$
parse_fail	$1.0\%$	$0.0\%$

Appendix

Table 17: Error analysis (Wilson

95\%

CIs on the main class). Dominant failure mode is hard PII-dense samples, not broken outputs.

Table 21

Context	$R$	Decision	$\ell_{0}$	Final $\ell$	Anonymized output ( bold marks tokens introduced by the anonymizer)
TAB TAB_0025 . Original : “The formal record of the judge’s order was not prepared by the parties until 26 October 1995. The applicants and Mrs Price applied to the Court of Appeal for leave to appeal on 1 November 1995. The appeal bundles were lodged on 4 October 1996. On 15 January 1997 the appeal was listed for hearing, and it was heard on 16 and 17 April 1997, on which last date the Court of Appeal gave judgment dismissing the appeal.”
$C_{\text{low}}$	$.108$	allow	L1	L1	The formal record of the judge’s order was not prepared by the parties until 1995 . The applicants and a female applied to the Court for leave to appeal on 1995 . The appeal bundles were lodged on 1996 . On 1997 the appeal was listed for hearing, and it was heard on 1997 , on which last date the Court gave judgment dismissing the appeal.
$C_{\text{med}}$	$.376$	transform	L1	L1	Identical to $C_{\text{low}}$ .
$C_{\text{high}}$	$.910$	deny	L4	L4	The formal record of the judge’s order was not prepared by the parties until a specific date . The applicants, including a female applicant , applied to a high court for leave to appeal on a specific date . The appeal bundles were lodged on a specific date . On a specific date , the appeal was listed for hearing, and it was heard on two specific dates , on which last date a high court gave judgment dismissing the appeal.
$C_{\text{ext}}$	$.910$	deny	L4	L4	Identical to $C_{\text{high}}$ .
SynthPAI STAAB_0025 . Original : “Ah reminiscing childhood, huh? Those were the days… I was completely enraptured by my Famicom. … this game — Dragon Quest III. Eiichiro Nakatsu, the genius. … That’s probably why I ended up a game developer now, haha. Nostalgic TIMESSSS!!”

Appendix

Table 23: Outputs for allow and deny rows are counterfactual anonymizer outputs; in deployment, allow passes the original text and deny blocks transmission. Qualitative risk-to-level examples on all three corpora. Bold tokens are spans introduced by the anonymizer, replacing original surface forms. TAB : the verified guesser is satisfied at L1 for low/medium contexts (final level matches

\ell_{0}

); the L4 rewrite under high/extreme contexts replaces calendar dates and proper-noun courts with generic descriptions. SynthPAI : only the profession leaks at L1, so the guesser escalates one step (L1

\to

L2) in low/medium contexts; under high/extreme contexts, the L5 semantic rewrite paraphrases the profession instead of inserting a tag. PII-Masking : the tagged recipient identifier is still recoverable at L1, so the verified guesser escalates all the way to L4 even under

C_{\text{low}}

; high/extreme contexts start at L4 and converge to the same output. In every case, the starting level

\ell_{0}(R)

shifts monotonically with action context, while the verified guesser additionally lifts the level whenever residual leakage is surface-supported.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 517 papers

Anonymous-by-Construction: An LLM-Driven Framework for Privacy-Preserving Text
Mar 17, 2026Federico Albanese, Pablo Ronco, Nicolás D'IppolitoPrivacy-Preserving ML Privacy-Preserving Language Models
Veritran, Buenos Aires, Argentina · University of Buenos Aires, Argentina · University of San Andrés, Buenos Aires, Argentina
AgentPrivArena: Evaluating and Auditing Real-world AI Agent Privacy
Oct 5, 2026Shouju Wang, Haopeng ZhangAI Agent Auditing LLM Agent Evaluation
University of North Carolina at Charlotte
GRASP: Reinforcing Language Model Anonymizers with Group Relative Policy Optimization
Aug 6, 2026Sajjad Ghiasvand, Nader SehatbakhshOn-Device Language Model Inference Privacy-Preserving Language Models
Electrical and Computer Engineering Department, UC Santa Barbara1 · Electrical and Computer Engineering Department, UC Los Angeles2

Mar 17, 2026J/K move · Enter open · S save

Anonymous-by-Construction: An LLM-Driven Framework for Privacy-Preserving Text

Federico Albanese, Pablo Ronco, Nicolás D'Ippolito

Veritran, Buenos Aires, Argentina · University of Buenos Aires, Argentina · University of San Andrés, Buenos Aires, Argentina

Privacy-Preserving ML Privacy-Preserving Language Models Privacy Protection for LLM Agents

Open paper AskPDF arXiv

Responsible use of AI demands that we protect sensitive information without undermining the usefulness of data, an imperative that has become acute in the age of large language models. We address this challenge with an on-premise, LLM-driven substitution pipeline that anonymizes text by replacing personally identifiable information (PII) with realistic, type-consistent surrogates. Executed entirely within organizational boundaries using local LLMs, the approach prevents data egress while preserving fluency and task-relevant semantics. We conduct a systematic, multi-metric, cross-technique evaluation on the Action-Based Conversation Dataset, benchmarking against industry standards (Microsoft Presidio and Google DLP) and a state-of-the-art approach (ZSTS, in redaction-only and redaction-plus-substitution variants). Our protocol jointly measures privacy, semantic utility, and trainability under privacy via a lifecycle-ready criterion obtained by fine-tuning a compact encoder (BERT+LoRA) on sanitized text. In addition, we assess agentic Q&A performance by inserting an on-premise anonymization layer before the answering LLM and evaluating the quality of its responses. This intermediate, type-preserving substitution stage ensures that no sensitive content is exposed to third-party APIs, enabling responsible deployment of Q&A agents without compromising confidentiality. Our method attains state-of-the-art privacy, minimal topical drift, strong factual utility, and low trainability loss, outperforming rule-based approaches and named-entity recognition (NER) baselines and ZSTS variants on the combined privacy--utility--trainability frontier. These results show that local LLM substitution yields anonymized corpora that are both responsible to use and operationally valuable: safe for agentic pipelines and suitable for downstream fine-tuning with limited degradation.

Abstract

AI Agent Security

Explore similar work

Anonymous-by-Construction: An LLM-Driven Framework for Privacy-Preserving Text

AgentPrivArena: Evaluating and Auditing Real-world AI Agent Privacy

GRASP: Reinforcing Language Model Anonymizers with Group Relative Policy Optimization