PromptPET: Privacy-Utility Optimized Prompt Obfuscation

2026-07-02

AI Summary

This work addresses the inherent trade-off between privacy preservation and response utility in user interactions with AI chat systems. The authors propose PromptPET, a novel framework that dynamically obfuscates sensitive information within user prompts on the client side to protect privacy while preserving semantic utility. PromptPET introduces a data-type-based taxonomy for sensitive information and incorporates, for the first time, a reinforcement learning–inspired rule optimizer that adaptively selects among obfuscation strategies—including redaction, abstraction, substitution, and a new noise injection/denoising mechanism. Experimental results on real-world conversational data demonstrate that PromptPET significantly outperforms existing approaches, achieving state-of-the-art performance in balancing privacy and utility under a single obfuscation paradigm.

Abstract

Privacy is an important challenge when users interact with AI chatbots, since users may share sensitive information, explicitly or implicitly, and AI chatbots can use this information for user profiling. In this paper, we aim to protect user privacy via a user-side mechanism that transforms sensitive information in a user prompt, while preserving enough information to elicit a useful response from the chatbot. This approach faces an inherent tradeoff between protecting privacy (i.e., avoiding profiling) and preserving utility (i.e., getting personalized and task-specific responses). To that end, we consider, evaluate, and compare four different obfuscation actions, namely redaction, abstraction, replacement, and a novel noising/denoising scheme that we introduce. Additional novel insights include: utilizing a data type taxonomy to both identify and obfuscate sensitive information and explicitly taking into account the utility of chat responses in making the obfuscation decision. First, we systematically optimize and evaluate each obfuscation action independently in terms of the privacy-utility tradeoff it achieves. Second, we propose PROMPTPET, an LLM-based agent that selects the best obfuscation action for each sensitive part of the prompt, using a reinforcement-learning inspired rule optimizer, applied for the first time in this context. Using a real-world chat dataset, we show that PROMPTPET matches the best privacy-utility tradeoff attainable by any single obfuscation action and significantly outperforms prior state-of-the-art approaches.

Problem

• privacy
• utility
• prompt obfuscation
• user profiling
• privacy-utility tradeoff

Innovation

• prompt obfuscation
• privacy-utility tradeoff
• reinforcement-learning inspired optimization
• LLM-based privacy agent
• sensitive information redaction