Active research · kicks off Nov 2026 Three-month build to v1.0 Client-side · privacy by design

RVP — Reversible
Vaulted Prompts

A client-side privacy layer for LLM dialogue. It detects sensitive entities in your prompts, swaps them for cryptographically sound surrogates before anything leaves your machine, and restores the originals on the way back — so the model keeps working with real structure, while no raw personal data ever reaches a third-party API.

you write My SSN is 123-45-6789, card 4532 1234 5678 9010
API sees My SSN is ⟨SSN·τ₄₁⟩, card 5827 9031 4462 7738
you read back My SSN is 123-45-6789, card 4532 1234 5678 9010 ✓ verified · ✓ restored
See the three-month plan Read the build log →
Why this work exists

Your prompt is the attack surface.

When an SSN, a card number, or a client's name goes into a cloud LLM, it travels in the clear. One-way redaction strips exactly the structure models need to reason — and some of what you lose is never coming back.

⚠︎

The privacy gap

Frontier models still memorize and can regurgitate prompt content. Research shows even state-of-the-art detectors miss a substantial share of sensitive mentions in long, multi-turn conversations — and most deployments have no way to verify what actually left the machine.

⌫

The utility tax of naive scrubbing

Blanking values destroys form validation, coreference ("…that SSN from before?"), and format reasoning. One-way masking trades privacy for a model that can no longer do the job you asked it to do.

◈

What RVP does differently

RVP treats sensitive data as entities, not tokens. "123-45-6789", "123 45 6789" and "123456789" are recognized as one identity before substitution, mapped through a session vault to stable, format-preserving surrogates — then authenticated back on the way out. The model gets valid structure; the provider sees nothing raw; the original returns intact.

Architecture

Every stage, all on your side of the boundary.

Everything sensitive happens locally. The only thing that crosses the wire is surrogate text — and a machine-checkable audit proves it.

01

Detect

Validity-checked patterns for SSNs, cards, IBANs, phones, dates — plus a compact on-device NER model for names and free-form mentions.

02

Canonicalize

Surface variants collapse to one canonical identity per entity, so coreference survives across turns and formats.

03

Vault

A session-scoped bijection: canonical entity ↔ surrogate. The vault is a secret that never leaves your device.

04

Substitute

Query-aware policy picks the right tier per entity — cryptographic format-preserving or typed opaque placeholder.

05

Infer

The LLM works on fully valid surrogate structure. No raw values, no broken formats, no lost coreference.

06

Rehydrate

HMAC-authenticated restoration with ambiguity rejection — the original returns, verified.

Tier 1 · Format-preserving cryptography

For identifiers where format matters (SSN, card, IBAN): FF1 per NIST SP 800-38G on large domains; PRF-based valid-surrogate generation where validators constrain the domain. Surrogates pass checksums and parsers — the model can still reason about them.

Tier 2 · Typed opaque placeholders

For entities where value is irrelevant (names, addresses): an authenticated handle with a type tag, so the model keeps the semantic class without learning the content. Strict mode and explicit-release mode control exactly what may surface.

Where the work stands

Not a slide deck. A running reference implementation.

Before the three-month build begins, every mechanism in the design already exists as working, tested code — so the roadmap below is an engineering and evaluation plan, not a research gamble.

Validated

Conformance-tested against official NIST FF1 sample vectors with a full property-based test suite.

Covered

End-to-end handling of SSNs, cards, IBANs, phones, emails, dates, names and addresses.

Controlled

Query-aware tier selection with strict and explicit-release modes.

Contained

Fully client-side — the vault, keys and session state never leave your machine.

How the work is organized

The work, broken into what has to be done.

RVP sits at the intersection of cryptography, machine learning and privacy law. Rather than a fixed org chart, the project is organized as a set of interlocking workstreams — each one a body of work with a clear definition of done, sequenced across the three-month plan.

/01

System & architecture

entity model · session lifecycle · invariants

The end-to-end design: entity model, session vault lifecycle, boundary invariants, and the sequencing of the three-month plan itself.

/02

Cryptography & conformance

FF1 · PRF · HMAC · key management

The substitution layer: NIST SP 800-38G conformance, HMAC authentication tags, HKDF session keys, and the no-replacement surrogate sampler.

/03

Detection & canonicalization

NER · multilingual · entity resolution

Integrating the compact on-device NER model, per-type canonicalizers, and honest recall measurement across languages and formats.

/04

Evaluation & benchmarks

PII-TRACE · PII-Bench · head-to-head

Multi-axis evaluation on public benchmarks, comparison harnesses, and publishing results — including the failures.

/05

Product & integration

proxy · SDK · developer experience

Wrapping the engine as a local proxy service and SDK with encrypted vault at rest, exportable audit logs, and sane defaults.

/06

Privacy & compliance

GDPR · EU AI Act · audit artifacts

Translating the system's guarantees into checkable evidence: data-residency posture, audit logs, and what we do not claim.

The plan

Three months, three milestones. Each one has an exit criterion.

We work in public increments: every milestone ends with something measurable, not something promised. The timeline assumes kickoff in November 2026 and a v1.0 by January 2027.

M1 · Nov 2026

Foundation, detection & policy

Replace the regex+gazetteer front-end with the compact on-device NER model (GLiNER / PII-Tracer style). Ship per-type canonicalizers for all supported entity classes and a CI pipeline with property-based crypto tests. Build the local relevance classifier that drives tier selection, harden strict and explicit-release modes, tune the paranoia dial, and add multilingual date/phone normalization.

✓ Exit: entity-level precision/recall on PII-TRACE and query-aware masking accuracy on PII-Bench, both vs. a naive redaction baseline
M2 · Dec 2026

Real-model evaluation & productization

Run the full multi-axis evaluation against real LLMs: detection, canonicalization, utility on scrubbing-sensitive tasks, restoration fidelity, and cross-surface-form consistency — with head-to-head comparison against Presidio, Prεmpt and SurrogateShield where runnable code exists. In parallel, wrap the engine as a local proxy service and SDK (Python + TypeScript) with an encrypted vault at rest, exportable audit logs, and a strict latency budget on the sanitize/rehydrate path.

✓ Exit: evaluation report v1 published with raw numbers — including the failures — and SDK v0.9 running in an internal pilot workflow
M3 · Jan 2027

Pilot, compliance & open release

A closed pilot with a small group of partners in high-PII domains (legal, finance, health), independent review of the cryptographic layer, GDPR alignment documentation, and data-residency verification on Swiss infrastructure. Then ship RVP 1.0: the code released open-source, complete documentation, and the full benchmark record published alongside.

✓ Exit: RVP 1.0 tagged, documented, released open-source, with results published against standard benchmarks
Research directions

Where this goes next

The current build evaluates RVP exactly as designed, and the code will be open-sourced with test results reported against standard benchmarks. The following are the threads that grow out of it — each to be measured first, and shipped only when it earns its place.

01

A detector that knows your corner of the world

General-purpose detectors are near-saturated on common PII — the real gaps live in the long tail: non-US ID formats (Aadhaar, PAN), Indian addresses and phone forms, transliterated and code-switched text, employer-internal reference codes. The direction is to adapt an open, MIT-licensed detector for these cases, publish a special-case evaluation set that the field currently lacks, and score it end-to-end on residual leakage through RVP — not just span accuracy. Long term, the adaptation runs on your own machine and the weights never leave it: personalization as a privacy feature.

Separate study · evaluation set first
02

PII in images

Every current protection layer — RVP included — is text-only: a photo of a letter or a screenshot bypasses it entirely, and document attachments are where real exposure concentrates. The direction: a small local vision model transcribes the image verbatim on your device; the measured detection pipeline decides what is sensitive; RVP substitutes; only sanitized text crosses the boundary. The pixels never leave the machine — and RVP's validity checks (Luhn, mod-97) double as an alarm for transcription errors, routing doubtful values to a human decision rather than through.

Product feature + research
03

Wherever you talk to an LLM

The mechanism is already independent of any single chat interface; what's missing are front-ends for where people actually use models. In order: an OpenAI-compatible local proxy endpoint that any client with a custom API address can point at; a browser extension that sanitizes before send and restores in the rendered reply; and a clipboard helper as a universal fallback. The shared hard problem underneath all three: correctly restoring substitutes that arrive split across streamed response chunks.

Deployment surface
04

Under the hood

Three threads that everything above inherits. Measuring detector recall on long conversations — published recall degrades past roughly 10K characters, and mitigation is unmeasured in our pipeline. Replacing v1's honest rule-based policy with a learned query-awareness classifier, evaluated as a separate piece. And re-running the core consistency evaluation against real models on standard benchmarks — the credibility of every other direction rests on it.

Evaluation & hardening

Progress on the current build will be written up as regular articles after kick-off. The full research directions document lives in the repository.

Read the directions on GitHub →
Development references

The work RVP stands on.

Every component of RVP has antecedents. These are the papers, standards and open-source projects the design draws on — linked so every claim can be verified.

Reversible proxies & prior art

  • Prεmpt — sanitizing sensitive prompts for LLMs · Roy Chowdhury et al., NDSS 2026
  • SurrogateShield — beyond redaction for high-utility LLM interactions · Jathanna, 2026
  • Microsoft Presidio — PII detection & masking with reversible mode
  • HaS — Hide and Seek, lightweight prompt privacy · Chen et al., 2023
  • LOPSIDED — semantically-aware privacy agent · Serenari & Lee, IEEE Big Data 2025
  • LLM Guard (Protect AI) — open-source guardrails with local vault

Detection, benchmarks & tooling

  • GLiNER — general NER with arbitrary entity types · compact on-device NER style
  • PII-TRACE — context-aware PII detection benchmark · Zhang et al., 2026
  • PII-Bench — query-aware privacy protection evaluation · Shen et al., ACL 2026
  • OpenAI Privacy Filter — MoE PII filter model card
  • DataFog — offline PII firewall for LLM apps
  • EmojiCrypt — prompt encryption for LLMs · Lin et al., 2024

Cryptographic standards

  • NIST SP 800-38G — FF1 format-preserving encryption · basis of Tier-1 substitution
  • NIST FF1 sample vectors — official test vectors in our test suite
  • RFC 5869 — HKDF key derivation · session-key derivation from the vault secret

Threat model & surrogation precedent

  • Carlini et al. — extracting training data from LLMs · USENIX Security 2021
  • AirGapAgent — privacy-conscious conversational agents · ACM CCS 2024
  • Azure Health Data Services — consistent surrogation note · clinical precedent
Follow the work

We build in public, and we publish what we find.

This is where the intellectual property is being developed — not a storefront. Progress is reported as it happens, and the end state is open: code released for anyone to inspect, and results published against standard benchmarks so they can be checked, reproduced, and challenged.