GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation

• The paper identifies gaps in prior systems: no operational risk signal linking live action context to anonymization strength, costly per-event LLM use, and escalation on attacker confidence that may be hallucinated.Source: §1 · pp. 1–2
• AMRSF combines policy-violation likelihood with sensitivity, recipient, purpose, contextual basis, and transparency to jointly determine the action decision and initial anonymization level.Source: §1 · p. 2
• GuardianAgent escalates its five-level rewriting hierarchy only when a verified adversarial guess is supported by the original text, avoiding distortion from hallucinated confidence.Source: §1 · p. 2
• An evidential fast path handles low-uncertainty policy matches, while only uncertain cases are routed to an LLM slow path to reduce latency.Source: §1 · p. 2
• Action-context stress tests show the same outgoing text receives different decisions and initial anonymization levels depending on recipient, purpose, action basis, and policy transparency.Source: §1 · p. 2
• GuardianAgent is the only method to reach ≥0.90 privacy across TAB, SynthPAI, and PII-Masking-300k, improves the privacy–utility trade-off over published baselines, and maintains gains under a backbone switch.Source: §1 · p. 2

Privacy-policy grounding

• Privacy-policy tools make policies machine-interpretable, but primarily support descriptive analysis rather than grounding live browser actions or choosing whether to allow, rewrite, or block outgoing content.Examples include Polisis (Harkous et al., 2018), PrivaSeer, PrivBERT (Srinath et al., 2021b), PolicyGPT (Tang et al., 2023), and Ahmad et al. (2021).Source: §2 · p. 2

Privacy-risk frameworks

• Existing risk frameworks and LLM systems mainly support explanation, auditing, or evaluation, whereas GuardianAgent uses risk factors as a runtime controller linking policy evidence and action context to mediation and anonymization strength.The related foundations include regulatory tiering, FAIR-style likelihood–impact products, contextual integrity, LLM-based assessment, and agent-oriented privacy-risk studies.Source: §2 · p. 2

LLM-based text anonymization

• Text anonymization methods extend protection beyond span detection, but adversarial rewriting loops can over-rewrite when plausible attacker confidence is not evidence that the original text supports the guess.Prior approaches include adversarial rewriting, its reinforcement-learning distillation in AgentStealth (Shao et al., 2025), prompt sanitization, contextual-integrity prompts, and on-device rewriting.Source: §2 · pp. 2–3

Dual-system inference and uncertainty gating

• Fast/slow inference and evidential uncertainty offer established ways to route hard cases to expensive models, but privacy fast paths must stay grounded in policy evidence and uncertain cases escalate conservatively to avoid exposure.Related foundations include FrugalGPT (Chen et al., 2023a), BranchyNet (Teerapittayanon et al., 2016), the dual-system view, and evidential deep learning (Sensoy et al., 2018).Source: §2 · p. 3

Positioning

• GuardianAgent unifies policy-conditioned risk assessment and action context to control both mediation decisions and anonymization strength, with rewriting escalation tied to verified residual leakage.Its adversarial feedback distinguishes leakage supported by the original text from attacker guesses based on world knowledge.Source: §2 · p. 3

3.1 Overview

• Each web action includes its destination, data categories, recipients, purposes, action basis, and outgoing text; policies are segmented into structured statements that provide evidence for an allow, transform, or deny decision.AMRSF sets the initial rewrite strength, while verified adversarial feedback can adjust it when residual leakage is supported by the original text.Source: §3.1 · p. 3

3.2 Efficient Policy Matching

• A shared retriever selects policy evidence, then a fast evidential classifier estimates violation likelihood and uncertainty; uncertain cases use an LLM to estimate likelihood only.The LLM does not determine the final risk score, action decision, or anonymization level.Source: §3.2 · pp. 3–4

3.3 Policy-Conditioned Risk Estimator

• AMRSF combines policy-violation likelihood with data sensitivity, recipient transmission, purpose legitimacy, action basis, and policy transparency to determine action-conditioned risk.The risk controller uses this score to make operational decisions; sensitive tiers have a wider transform region so uncertain high-risk actions are rewritten rather than released unchanged.Source: §3.3 · p. 4

3.4 Risk-Adaptive Hierarchical Anonymizer

• Transformed actions use a five-level hierarchy from partial masking to semantic LLM rewriting, with initial strength set by position in the transform band.Actions nearer the allow ceiling start with lighter rewriting, while those nearer the deny floor start stronger; higher levels remove more entities and contextual cues while preserving overall communicative intent.Source: §3.4 · pp. 4–5, Figure 2 · p. 5

3.5 Verified Adversarial Escalation

• Guesses trigger escalation only when verified against the original text, which remains local; this lexical check filters unsupported guesses but misses surface-disjoint contextual inferences.GuardianAgent escalates when verified confidence reaches a threshold, stopping when it falls below threshold, level 5 is reached, or five rounds have run; higher-risk flows instead start at L4 with semantic rewriting.Source: §3.5 · pp. 5–6

4.1 Setup

• Evaluation spans legal, Reddit-style, and synthetic PII anonymization benchmarks, plus policy-matching and AMRSF-calibration data.The main LLM backbone is Llama-3.2-3B-Instruct.Source: §4.1 · p. 6

4.2 Main Comparison

• Only GuardianAgent exceeds 0.90 privacy on all three domains, lies above or beyond each baseline frontier, and has the smallest cross-domain spread.The comparison spans TAB, SynthPAI, and PII-Masking-300k.Source: §4.2 · p. 7, Figure 3 · p. 7
• With L = 0.7 fixed on the same 200 texts, riskier action contexts increase mean risk and shift decisions from allow through transform to deny.This shows that mediation decisions depend on recipient, purpose, action basis, and policy transparency, not text content alone.Source: §4.2 · p. 7, Table 2 · p. 7

4.3 Transform-Band Risk-to-Level Control

• The mean final anonymization level rises from 2.37 to 4.42 as transform-band position increases, with dominant starting levels shifting from L1 to L4.AMRSF sets initial strength from action context, while verified feedback escalates only when residual leakage remains.Source: §4.3 · p. 7, Table 3 · p. 8

4.4 Ablation

• The full verified L1–L5 stack achieves the best privacy across SynthPAI and TAB, while NER alone is less effective on implicit contextual attributes.L1–L3 remove explicit spans, L4 adds high-utility minimal edits, and L5 helps when weaker rewrites leave contextual leakage.Source: §4.4 · pp. 7–8, Table 5 · p. 8, Table 4 · p. 8

4.5 Calibration, Efficiency, and Robustness

• AMRSF aligns well with annotated risk, and the OPP-115 evidential fast path escalates only a small fraction of events to the LLM.Disabling verification causes more upgrades without improving privacy, while reducing utility and increasing latency; switching to Qwen3-8B preserves GuardianAgent’s strongest privacy–utility performance.Source: §4.5 · p. 8

5 Conclusion

• Across legal text, Reddit-style personal attributes, and multi-format PII records, GuardianAgent improved the privacy–utility trade-off over published baselines and remained robust under a backbone switch.It also adapted its rewriting strength across different action contexts.Source: §5 · p. 9
• AMRSF combines policy evidence and action context to determine both the allow/transform/deny decision and the initial anonymization level.GuardianAgent uses this explicit risk assessment rather than relying on an LLM to directly assign privacy risk.Source: §5 · p. 9
• A verified adversarial guesser escalates rewriting only when its attacker guesses are supported by the original text.Source: §5 · p. 9

Limitations

• Evaluation is limited to English public or synthetic corpora; real browser traces, clinical and dialogue data, and multilingual settings require further study.Source: Limitations · p. 9
• AMRSF is a mediation controller, not a legal compliance engine; deployments should prioritize local processing, disclose cloud escalation, allow user override, and communicate residual re-identification risk.Source: Limitations · p. 9

Ethical considerations

• GuardianAgent evaluations use public or synthetic datasets and public models or APIs, with no private browser traces.The work collects no new personal data and involves no human subjects.Source: Ethical considerations · p. 9
• GuardianAgent is intended to reduce unintended disclosure, not guarantee anonymity or legal compliance.Source: Ethical considerations · p. 9
• Deployments should disclose rewriting and cloud escalation, preserve user control over mediation decisions, and communicate residual re-identification and utility-loss risks.Source: Ethical considerations · p. 9

A System 1 Architecture and Retrieval Hyperparameters

• System 1 uses OPP-115 multi-hot or frozen sentence-transformer encoders, followed by a two-layer MLP that produces Dirichlet class probabilities and epistemic uncertainty.The encoder dimensions are d=42 or d=384, respectively; the MLP uses ReLU and dropout.Source: A System 1 Architecture and Retrieval… · p. 11
• Retrieval scores data, action, purpose, and recipient matches with weights (0.35, 0.35, 0.20, 0.10), adds policy-flag bonuses, and uses BM25Lite.BM25Lite uses k1=1.5 and b=0.75 with on-the-fly IDF and no per-domain global inverted index.Source: A System 1 Architecture and Retrieval… · p. 11

B Prompts

• The System 2 prompt requests a JSON violation-likelihood estimate with rationale and evidence IDs, while the adversarial auditor returns guesses, confidence, and reasoning as JSON.System 2 is instructed not to decide whether to allow, transform, or deny the action.Source: B Prompts · p. 11
• The L4 minimal-edit prompt asks for natural text that blocks recovery of listed sensitive fields while preserving intent; a second prompt permits full paraphrasing to remove identifying details and contextual cues.The L4 prompt specifically prohibits inserting tags.Source: B Prompts · p. 11

C Full AMRSF Factor Tables

• Tables 6–9 provide per-category data weights, recipient transmission risk, purpose legitimacy, and six signal credits for the transparency multiplier.These factors are used in the AMRSF equations for data sensitivity, transmission risk, purpose legitimacy, and transparency.Source: C Full AMRSF Factor Tables · p. 11
• On TAB, the verified loop reduces mean final anonymization level from 3.48 to 2.85; on SynthPAI, it raises the mean from 2.79 to 3.48.The increase on SynthPAI reflects verifier-triggered upgrades on borderline inputs.Source: C Full AMRSF Factor Tables · p. 11

D Formal Analysis

• Under the stated lexical-support assumption, every guess identified by the guesser is verified, so verified confidence is at least the maximum confidence among those guesses.The assumption requires a guessed attribute to appear as a substring of the original text or share a content word longer than two characters with it.Source: D Formal Analysis · pp. 11–12
• The formal-analysis tables specify data-sensitivity weights, transmission risk by recipient type, purpose-legitimacy values, and transparency-multiplier credits.Source: Table 6 · p. 12, Table 7 · p. 12, Table 8 · p. 12
• With escalation probability 0.035 and System 2 cost about 104 times System 1, expected matcher cost is 28.6× lower than an always-LLM pipeline.The expected cost is E[C] = C1 + peC2.Source: D Formal Analysis · p. 12
• Algorithm 1 halts within five rounds and makes at most one anonymizer and one guesser call per round, bounding worst-case LLM cost independently of the original text.The explicit cap is T = 5, with the rewrite level capped at ℓmax = 5.Source: D Formal Analysis · p. 12

E Calibration Details

• The full AMRSF controller is compared with three single-factor ablations, a NIST Likelihood×Impact baseline, and a learned binary classifier on expert-rated scenarios and the Staab public corpus.Table 12 reports the System 1 evidential fast-path classifier on OPP-115 held-out test pairs; no outcome values are supplied here.Source: E Calibration Details · p. 12

F Rewrite-strategy comparison

• Table 13 contrasts semantic-only and minimal-edit-only rewriting with GuardianAgent’s full adaptive L1–L5 stack to isolate the effect of mixing strategies under the verified-guesser loop.No comparative outcome values are supplied here.Source: F Rewrite-strategy comparison · p. 12

G Robustness Detail Tables

• The verifier A/B test compares adaptive-loop behavior with verification on versus off, isolating its contribution to privacy-utility trade-offs and escalation cost.The SynthPAI Table 14 caption specifies n=50 with Wilson confidence intervals and says OFF reproduces raw-confidence behavior.Source: G Robustness Detail Tables · p. 12, Table 14 · p. 14
• The appendix reports four-seed spread for five strong baselines and GuardianAgent, and classifies GuardianAgent’s errors; 30/40 TAB and 28/40 SynthPAI pairwise tests remain significant after correction.The significance counts use Holm–Bonferroni correction at family-wise α=0.05.Source: G Robustness Detail Tables · pp. 12–13
• GuardianAgent’s privacy ranking is reported as not Llama-specific, with a Qwen3-8B comparison checking performance across model families.Table 18 repeats the main comparison using Qwen3-8B for every method.Source: G Robustness Detail Tables · p. 13
• Table 19 tracks online bootstrapping of the System 1 fast path from System 2 teacher labels on an OPP-115 event stream, relating escalation-rate decline to rising fast-path accuracy.The passage describes the tracked relationship but provides no numerical trajectory.Source: G Robustness Detail Tables · p. 13

H Qualitative Case Studies

• In the TAB example, GuardianAgent generalizes the date and court identity while preserving the legal act; its SynthPAI rewrite removes a Zurich clue that Staab retains.Staab duplicates the legal act in its TAB rewrite, while HaS leaves the court category intact with tag-heavy output; in SynthPAI, Staab hallucinates “a European city.”Source: H Qualitative Case Studies · p. 13

Risk-control context definitions

• The four action contexts vary recipient, purpose, action basis, and policy transparency while holding likelihood L at 0.7 to isolate contextual effects on risk.These context variables feed the AMRSF multipliers Mtr, Mp, Mb, and MT.Source: Risk-control context definitions · p. 14

Per-context mean final level (transform-band)

• Table 20 reports mean final anonymization levels for transform-region samples in each band context after the verified-guesser loop.The reported setup uses Llama-3.2-3B and n=200.Source: Per-context mean final level… · p. 14

Risk-control qualitative cases (TAB, SynthPAI, PII-Masking)

• Table 23 presents three anonymization examples across TAB, SynthPAI, and PII-Masking alongside risk scores and decisions.The passage identifies the examples’ scope but does not provide their individual scores or decisions.Source: Risk-control qualitative cases (TAB,… · p. 14

I LLM Evaluation Protocol

• The preregistered human study collected 1,200 ratings from three independent raters evaluating 50 SynthPAI samples across eight methods.Raters scored Privacy, Utility, and Fluency on 1–5 Likert scales, with methods shuffled and anonymized on worksheets.Source: I LLM Evaluation Protocol · p. 14
• GuardianAgent ranked first in privacy among methods with well-formed outputs at every seed in the four-seed SynthPAI evaluation.Table 15 reports four seeds with n = 50 per seed.Source: Table 15 · p. 14
• Claude-rater agreement met the preregistered α target on all three dimensions: privacy 0.68, utility 0.74, and fluency 0.75.The simulation used Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5, and its privacy rubric penalized destructive over-rewriting.Source: I LLM Evaluation Protocol · p. 14, Table 21 · p. 16

K Use of AI Assistants

• The authors used a conversational AI assistant for grammar polishing and table layout, and state that it generated no scientific claims.Source: K Use of AI Assistants · p. 15
• Privacy ranking was preserved across the reported backbone checks, with GuardianAgent rank-1 on both corpora under Qwen3-8B.On SynthPAI, Staab utility rose at 8B while GuardianAgent was already saturated at 3B.Source: Table 16 · p. 14, Table 18 · p. 16
• Twenty-four teacher labels reduced escalation by 93% relative while raising held-out accuracy to perfect in the reported OPP-115 stream experiment.The experiment bootstrapped System 1 from System 2 labels over 2,000 events and evaluated on a held-out 400-event test set.Source: Table 19 · p. 16
• Action context shifts starting anonymization levels, while verified surface-supported leakage can trigger further escalation across the three corpora.Examples include escalation from L1 to L2 for a leaking profession in SynthPAI and from L1 to L4 for a recoverable recipient identifier in PII-Masking; the TAB example remained at L1 in low/medium contexts but used L4 in high/extreme contexts.Source: Table 20 · p. 16, Table 22 · p. 16, Table 23 · p. 17