PaperlayerView exact revision on arXiv

Source-linked AI summary

A Human-LLM Teaming Framework for Privacy Risk Analysis: An Illustration with CBDC-Based Welfare Schemes

Sourya Joyee De, Abdessamad Imine

arXiv:2608.16461v1cs.ETcs.AIcs.CEcs.CY

TL;DR

CBDC-based welfare schemes process extensive beneficiary data and pose privacy risks, while PRIAM assessments require cognitively demanding information gathering and reasoning. The paper proposes an iterative human–LLM framework for PRIAM and illustrates data characterization, where human experts evaluate initial LLM outputs and direct their refinement.

  • Problem

    Privacy risk assessment for CBDC welfare schemes involves potentially severe harms, while applying PRIAM requires cognitively demanding expert work gathering and reasoning over heterogeneous information.

    Source: §1 · p. 1, §3.1 · p. 3

  • Method

    The framework has an LLM generate initial outputs from documentary evidence, which human experts evaluate and guide through refinement before exercising final judgment.

    Source: §3.2 · pp. 4–5, §6 · p. 8

  • Results

    In the data-characterization illustration, the LLM generated data categories and attributes, while human review challenged classifications and directed refinement.

    Source: §4 · p. 6, §6 · p. 8

  • Takeaways & Limitations

    The work provides a foundation for human–LLM teaming in privacy risk analysis.

    Source: §6 · p. 9

    The illustration covers only PRIAM data characterization; future work should apply the framework across all PRIAM activities and empirically compare team performance with expert-only analysis.

    Source: §6 · p. 9

Abstract

from arXiv · show

Central Bank Digital Currency (CBDC)-based welfare schemes may be potentially privacy invasive as they process significant volumes of beneficiary personal data and lead to privacy harms such as surveillance, discrimination and stigmatization. Such welfare delivery schemes involve complex digital ecosystems and large number of stakeholders. Consequently, to examine their privacy risks, privacy risk assessments require extensive information gathering and synthesis, complex reasoning, scenario explorations, contextual evaluation and human judgement. Thus, they present ideal scenarios for human-LLM teaming, where effective integration of complementary human and LLM capabilities can yield an outcome far superior to either human-only or LLM-only assessments. In this paper, we propose a first human-LLM teaming framework for the systematic privacy risk analysis methodology called PRIAM. The framework specifies an iterative collaborative process in which the LLM processes large-scale documentary evidence to produce initial outputs, which are then interpreted and evaluated by human experts who direct their further refinement by the LLM and exercise their judgement to finalize the output. We illustrate the framework on the data characterization activity of PRIAM using a CBDC-based welfare scheme use case. The illustration demonstrates that while LLMs generate the initial data categories and assign initial values to data attributes, human experts evaluate and provide feedback to refine them, distinguishing documented evidence from inferences, identifying information gaps, and flagging unsupported or ambiguous outputs. This framework serves as a foundational contribution towards human-AI teaming for privacy risk assessments.

1. Introduction

CBDC-based welfare schemes can improve targeting and accountability, but traceability, programmability, and detailed transaction records also create serious privacy risks. The paper proposes a human-LLM framework for PRIAM and illustrates it through data characterization in a welfare-scheme case study.

1. Introduction

  • eRupee welfare features can enable profiling, surveillance, stigmatization, and discrimination even as they support targeted and accountable subsidy delivery.Programmability can help prevent misuse while also enabling reconstruction of transaction histories and inferences about beneficiaries’ economic circumstances.Source: §1 · pp. 1–2
  • Privacy risk assessment in complex CBDC welfare ecosystems requires extensive information gathering, synthesis, scenario exploration, and expert judgment, making it resource-intensive and error-prone.LLMs can support evidence synthesis, relational reasoning, and risk and mitigation exploration, but human oversight remains necessary given the human-rights and legal implications.Source: §1 · p. 2
  • The paper contributes a framework in which LLMs generate initial analyses and human experts evaluate them, direct refinement, and make final judgments, then demonstrates the approach through PRIAM data characterization for a CBDC welfare scheme.The illustration presents LLMs as augmenting rather than replacing human expertise while maintaining human oversight.Source: §1 · p. 2

2. Privacy Risks of CBDC-based Welfare Schemes

The case study’s eRupee welfare scheme connects beneficiary payments to a broad digital ecosystem of government, financial, identity, and service actors. Recorded transaction details could be linked to beneficiaries and combined into profiles that create privacy risks without appropriate protections.

Case study and ecosystem

  • Beneficiaries receive annual eRupee payouts in digital wallets and can spend them by QR code, transfer funds to a bank account, or withdraw cash.The scheme involves administrators, government eligibility agencies, banks and payment intermediaries, identity infrastructure, digital service providers, and enrolment and verification intermediaries.Source: §2 · pp. 2–3

Data and privacy risks

  • Transaction records may include value, time, location, recipient, merchant, and purpose, and can be linked to beneficiary identities to build longitudinal profiles and draw inferences.The infrastructure spans identity verification and scheme management applications and databases, government eligibility systems, and banking, direct benefit transfer, and CBDC systems.Source: §2 · p. 3
  • Without appropriate privacy and data protection measures, profiles may be accessed by stakeholders without a need to process them or by unauthorized parties, and used beyond the welfare objective.Source: §2 · p. 3

3. A Framework for Human-LLM Teaming for PRIAM

The framework pairs LLMs’ broad information processing and scenario exploration with human experts’ contextual evaluation, iterative feedback, and final judgment across PRIAM. The collaboration aims to produce evidence-supported outputs for privacy risk analysis.

3.1 Human-LLM Complementarity in PRIAM

  • LLMs synthesize evidence and explore candidate risks, while human experts challenge assumptions, address omissions, refine outputs, and remain accountable for the final assessment.The complementary capabilities are presented as mutually reinforcing and able to produce an outcome superior to either team member working alone.Source: §3.1 · pp. 3–4

3.2 Information Gathering

  • For each information-gathering activity, an LLM analyzes documentary evidence, and a human evaluates accuracy, completeness, consistency, and evidence sufficiency before directing iterative refinement and finalization.The information-gathering phase characterizes seven components: system, stakeholders, data, risk sources, privacy weaknesses, feared events, and privacy harms; the finalized system specification informs later activities.Source: §3.2 · pp. 4–5

3.3 Risk Assessment Phase

  • In risk assessment, LLMs generate harm trees and preliminary likelihood and severity values, while human experts evaluate branches, evidence, assumptions, scoring, and final risk assignments.Experts direct refinements and make the final judgment on assigned likelihood and severity.Source: §3.3 · pp. 5–6

4. Illustration using CBDC-based Welfare Schemes

The illustration applies PRIAM data characterization to a hypothetical CBDC-based women’s welfare scheme through iterative human-LLM collaboration. The LLM proposes data categories and attributes from available documentation; a human expert evaluates and refines the outputs before finalizing them.

4. Illustration using CBDC-based Welfare Schemes

  • The human expert reviews the LLM’s preliminary characterization for accuracy and completeness, challenges unsupported values, identifies missing information, and directs refinement before finalizing outputs.The LLM then reassesses attributes, organizes supporting evidence, revises the characterization, and flags unresolved gaps.Source: §4 · p. 6
  • Transaction records are sensitive because their value, location, recipient, merchant, and purpose can reveal economic circumstances and behaviour; transaction history is treated as a separate data category.The expert asks the LLM to justify the sensitivity assessment and distinguish individual transaction records from the combined history.Source: §4 · p. 6
  • For a hypothetical CBDC-based welfare scheme, an LLM may identify data categories and attributes from available documentation, distinguish documented facts from inferences and unknowns, and note that retention duration cannot be established from available evidence.Source: §4 · p. 6

5. Related Works

Prior work frames human–AI teaming as complementary, while PIA research remains early: AI supports discrete tasks, but comprehensive collaboration frameworks and CBDC-welfare applications are largely missing.

Related works

  • PIAs are multidisciplinary assessments of privacy implications, making them suited to teaming AI knowledge support with human contextual reasoning, regulatory judgment, and accountability.PIAs involve legal interpretation, technical analysis, domain expertise, and stakeholder engagement (De & Le Metayer, 2016; Oetzel & Spiekermann, 2014).Source: §5 · p. 8
  • AI has supported discrete privacy-engineering tasks, including DFD generation, threat modeling, attack trees, and risk categorization, but may lack human experts’ depth and reliability.Source: §5 · p. 8
  • Human-AI collaboration research for PIAs remains nascent: Privy and related work address privacy risks in AI products, not comprehensive PIA frameworks (Lee et al., 2026; Lee, 2026).Challenges such as identifying complementarity across PIA steps and orchestrating collaboration also remain unresolved.Source: §5 · p. 8
  • PIA studies address fitness tracking, social networks, and contact tracing, while CBDCs and welfare delivery remain understudied despite potential novel privacy harms (De & Le Metayer, 2022; De & Imine, 2020; Mollaeefar et al., 2025).Source: §5 · p. 8

6. Conclusion and Future Work

The paper proposes an iterative human–LLM framework for PRIAM that pairs LLM-generated initial analysis with expert evaluation and refinement. Its CBDC welfare-scheme illustration shows how this process can refine data characterization, while the authors call for evaluation across PRIAM activities and against expert-only analysis.

6. Conclusion and Future Work

  • The framework allocates PRIAM tasks between LLMs that generate initial outputs and human experts who evaluate evidence, direct refinements, and retain final judgement.LLMs synthesize large volumes of information, while experts assess accuracy, assumptions, completeness, and supporting evidence.Source: §6 · p. 8
  • In the CBDC welfare-scheme data-characterization illustration, iterative expert feedback refined LLM-generated data categories and attribute values, sharpening evidence-based justification and exposing unresolved gaps.Source: §6 · p. 8
  • The authors argue that the framework can extend privacy risk analysis depth and efficiency by combining LLM information synthesis with experts’ contextual evaluations and feedback.Source: §6 · pp. 8–9
  • Future work can illustrate the framework across all PRIAM activities and empirically compare human–LLM teams with human expert-only privacy risk analysis.Source: §6 · p. 9
Loading 2608.16461v1…