Paper deep dive

ReCast: Contract-Preserving Protection for Fixed-Interface Multimodal Reasoning

Bingchen Pei, Lichong Chen, Bingxi Zhao, Ziang Wu, Sirui Wang, Min Zhang, Yanhao Chen, Qingxu Liu, Qiang Gao, Chang-Tien Lu, Bo Gao

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 83

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%

Last extracted: 10/3/2026, 2:20:54 AM

Summary

The paper introduces ReCast, an agentic plug-in framework designed to protect privacy in remote multimodal reasoning tasks. ReCast converts multimodal inputs (charts, speech) into a shared textual evidence-query record, rewrites entities and topics using a distilled 4B model, and substitutes numerical values via a locally invertible map. A reconstruction agent then generates protected media that satisfies fixed interface contracts. The framework preserves task-relevant relations while significantly reducing source-content leakage, achieving 75.10% accuracy on ChartQA and NMSQA datasets, retaining 92.43% of unprotected remote accuracy.

Entities (11)

ReCast · framework · 98%Beijing Jiaotong University · organization · 95%ChartQA · dataset · 95%NMSQA · dataset · 95%Virginia Polytechnic Institute and State University · organization · 95%Qwen3-4B · model · 92%ChartX · dataset · 90%Qwen3-ASR-1.7B · model · 90%Qwen3-VL-8B-Instruct · model · 90%Spoken-MQA · dataset · 90%GPT 5.6 Sol · model · 88%

Relation Signals (8)

Bingchen Pei → affiliatedwith → Beijing Jiaotong University

confidence 95% · Bingchen Pei 1* ... 1 Beijing Jiaotong University

Min Zhang → affiliatedwith → Virginia Polytechnic Institute and State University

confidence 95% · Min Zhang 2 ... 2 Virginia Polytechnic Institute and State University

ReCast → evaluatedon → ChartQA

confidence 95% · On 4,000 held-out ChartQA and NMSQA examples, ReCast achieves 75.10% accuracy

ReCast → evaluatedon → NMSQA

confidence 95% · On 4,000 held-out ChartQA and NMSQA examples, ReCast achieves 75.10% accuracy

ReCast → uses → Qwen3-4B

confidence 92% · jointly rewrites entities and topics with a distilled 4B model

Qwen3-ASR-1.7B → usedfor → Speech_Transcription

confidence 90% · Qwen3-ASR-1.7B (Shi et al., 2026) transcribes speech

Qwen3-VL-8B-Instruct → usedfor → chart_evidence_capture

confidence 90% · For charts, local, question-aware Qwen3-VL-8B-Instruct (Bai et al., 2025) extracts category-value associations

Qwen3-4B → finetunedusing → GPT 5.6 Sol

confidence 88% · We fine-tune Qwen3-4B ... on offline GPT-5.6-Sol (OpenAI, 2026b) rewrites

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Remote multimodal models offer strong numerical reasoning capabilities over charts and speech, but sending private inputs risks exposing sensitive content. Text-only sanitization cannot directly satisfy fixed media interfaces, while identity anonymization leaves the underlying task content exposed. We introduce ReCast, an agentic plug-in framework that replaces source-specific content while preserving task-relevant relations and the required input modality. ReCast locally converts inputs into a shared textual evidence-query record, jointly rewrites entities and topics with a distilled 4B model, and substitutes values through a locally invertible, role-aware numerical map. A reconstruction agent generates and validates the required media from the protected record. The remote solver returns a program whose protected operands are restored locally before execution. On 4,000 held-out ChartQA and NMSQA examples, ReCast achieves 75.10% accuracy, retaining 92.43% of unprotected remote accuracy, while a model-based audit flags source-content leakage in 7.95% of solver-bound requests. It outperforms all evaluated local baselines, preserving the benefit of remote reasoning while reducing source-content exposure under existing media interfaces.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

79,945 characters extracted from source content.

Expand or collapse full text

Preprint. RECAST: CONTRACT-PRESERVING PROTECTION FOR FIXED-INTERFACE MULTIMODAL REASONING Bingchen Pei 1* , Lichong Chen 1* , Bingxi Zhao 1*† , Ziang Wu 1* , Sirui Wang 1 , Min Zhang 2 , Yanhao Chen 1 , Qingxu Liu 1 , Qiang Gao 1 , Chang-Tien Lu 2 , Bo Gao 1‡ 1 Beijing Jiaotong University 2 Virginia Polytechnic Institute and State University bogao, bingxizhao@bjtu.edu.cn ABSTRACT Remote multimodal models offer strong numerical reasoning capabilities over charts and speech, but sending private inputs risks exposing sensitive content. Text-only sanitization cannot directly satisfy fixed media interfaces, while identity anonymization leaves the underlying task content exposed. We introduce RECAST, an agentic plug-in framework that replaces source-specific content while preserving task-relevant relations and the required input modality. RECAST locally converts inputs into a shared textual evidence-query record, jointly rewrites entities and topics with a distilled 4B model, and substitutes values through a locally invertible, role-aware numerical map. A reconstruction agent generates and validates the required media from the protected record. The remote solver returns a program whose protected operands are restored locally before execution. On 4,000 held-out ChartQA and NMSQA examples, RECAST achieves 75.10% accuracy, retaining 92.43% of unprotected remote accuracy, while a model-based audit flags source- content leakage in 7.95% of solver-bound requests. It outperforms all evaluated local baselines, preserving the benefit of remote reasoning while reducing source- content exposure under existing media interfaces. 1INTRODUCTION Local-remote collaboration allows users to keep private data on their devices while leveraging a more capable remote model. This setting has been studied extensively for text. Before a request is released, a local model can rewrite it through differentially private rewriting (Meisenbacher et al., 2024; Thareja et al., 2025), adversarial anonymization (Duan et al., 2026), or privacy-conscious delegation (Hartmann et al., 2024; Siyan et al., 2025). For numerical reasoning, Zhang et al. (2026) shift the topic of a textual instance, substitute its numbers, and then recover the original answer locally from a program returned by the remote model. However, much private evidence is not textual. Business reports present their figures in charts, while meetings and customer calls convey theirs in recordings. Reasoning over such evidence requires strong multimodal perception and numerical computation, areas in which on-device models still lag far behind remote ones. These remote models are typically accessed through service interfaces with fixed request schemas: a chart-analytics endpoint expects an image, and a spoken question-answering endpoint expects a waveform. Protection must therefore extend beyond text to the media these services consume. Existing multimodal protections fall short of this need. Visual instruction rewriting (Mishra et al., 2025) and symbolic scene representations (Bara et al., 2022) convert the input into text, which media interfaces do not accept. Media-level protections preserve the modality but target different threats: speaker anonymization conceals voice identity (Meyer et al., 2022), adversarial perturbation prevents unauthorized speech recognition (Jin et al., 2025), and learned image transformations hide visual privacy attributes from multimodal models (Hui et al., 2026a). In each of these media-level methods, * Contributed equally † Project lead ‡ Corresponding author 1 arXiv:2610.01184v1 [cs.CR] 1 Oct 2026 Preprint. Figure 1: RECAST: replacing source content while preserving task structure. Top: The illustrated alternatives address different targets: text rewriting does not directly provide the required media, dataset-level image synthesis is not paired with a specific query, and speaker anonymization retains spoken content. Bottom: RECAST jointly replaces topics, entities, and values across evidence and query while retaining task-relevant relations and the required modality. The remote solver returns a program over protected operands; the client restores the original operands locally before executing the program to recover the answer. The chart example illustrates a unified protection framework for text, charts, and speech. the content itself, such as which entity has which value in a chart or in speech, reaches the remote model intact. Numerical tasks impose a further requirement: evidence and query must be transformed consistently, and the transformed quantities must still support both the requested computation and the recovery of the original answer. RECAST closes this gap by separating what a task needs from what the source reveals. The task needs relations, namely which quantity belongs to which entity, which pair the query compares, and which operation it requests, whereas the source contributes entities, topics, wording, and values. RECAST is an agentic plug-in pipeline built around a shared textual evidence-query record (Fig. 1). Evidence capture plugs in a module for the input modality and locally converts the chart or recording into this record. A rewrite module jointly replaces source-specific content across evidence and query while preserving their relations, and maps the numbers under a per-request map whose inverse remains local. A modality reconstruction agent plugs in a generator for the interface contract and renders the protected record into the required modality through a generate-review-repair loop before anything reaches the solver. The remote solver returns a Python program over marked protected operands, which the local side restores and executes on the original values, extending the recovery scheme of Zhang et al. (2026) to media inputs. The main contributions of this work are as follows: •We propose RECAST, an agentic plug-in pipeline that links evidence capture, rewriting, and modality reconstruction through a white-box, model-independent evidence-query record, so that per-modality and per-interface modules plug in without retraining. •We design a rewrite module in which a distilled local 4B Rewriter jointly changes names and domain while fixing relations, and a role-aware numerical map with local inversion enables exact answer recovery. •On 4,000 held-out ChartQA and NMSQA examples, RECAST keeps 92.43% of unprotected accuracy with only 7.95% solver-bound source-content leakage. Distillation adds 6.40 accuracy points and cuts leakage from 39.75% to 7.95%, and on ChartQA, reconstructed media slightly outperforms direct protected-text release by 0.40 points. 2 Preprint. 2RELATED WORK 2.1TEXT PRIVACY Text privacy methods range from word-level sanitization to document rewriting. SanText and CusText replace words with semantically related alternatives under differential privacy (Yue et al., 2021; Chen et al., 2023), while DP-Prompt and DP-MLM use language models to produce coherent protected text (Utpala et al., 2023; Meisenbacher et al., 2024). DP-Fusion instead limits the influence of sensitive tokens by combining generation distributions conditioned on different versions of the input (Thareja et al., 2025). Beyond explicit identifiers, contextual clues can also reveal personal attributes (Staab et al., 2024). Adversarial anonymization uses such inference attacks to guide text revisions, with RLAA adapting this approach to local models (Staab et al., 2025; Duan et al., 2026). Recent methods also account for task utility and semantic structure. STAMP considers both task relevance and privacy sensitivity when allocating privacy budgets, while DP-ST uses semantic triples to guide private document generation (Tian et al., 2026; Meisenbacher et al., 2025). These developments are relevant to our goal of preserving useful relations while replacing source content. Our setting adds two coupled requirements: evidence and query must remain aligned after numerical substitution, and the result must be usable through a fixed media interface. Text protection alone does not provide the required chart or waveform. RECAST therefore uses text as an editable intermediate shared across modalities, then reconstructs the protected record in the format the interface accepts. 2.2LOCAL-REMOTE COLLABORATION Local-remote collaboration uses a local model to control what a stronger remote model sees. Hartmann et al. (2024) study how a model can seek help from another without revealing private information. CoGenesis and PAPILLON coordinate local and remote generation while limiting the private context exposed to the remote model (Zhang et al., 2024; Siyan et al., 2025), whereas InferDPT combines local perturbation, remote generation, and local extraction (Tong et al., 2025). More recent work makes delegation sensitive to the task and its privacy risks: Privacy-R1 learns which text to transmit, Veilmind conditions sanitization on user intent, and privacy-risk estimation accounts for contextual disclosures beyond direct identifiers (Hui et al., 2026b; Liu et al., 2026; Siyan et al., 2026). The closest work is that of Zhang et al. (2026), who shift the topic of a textual numerical-reasoning instance, substitute its numbers, and recover the original answer locally from a program returned by the remote model. Separating program generation from execution is also central to program-aided reasoning (Gao et al., 2023). RECAST extends this recovery scheme to media inputs and outputs. A shared textual evidence-query record connects modality-specific evidence capture, joint rewriting, and reconstruction. The record makes cross-field references explicit, while reconstruction checks whether the released chart or speech still represents the protected evidence. The distinction is not simply the use of a multimodal solver: the released artifact must satisfy the media interface and retain the relations needed for local answer recovery. 2.3MULTIMODAL AND MEDIA PRIVACY Privacy risks also arise from information embedded in media: vision-language models can infer personal attributes even from images without a direct depiction of the individual (Tömekçe et al., 2024). One response is to replace the raw input with an abstract representation. Symbolic scene representations support privacy-preserving visual question answering (Bara et al., 2022), and ReVision rewrites image-dependent instructions into self-contained text (Mishra et al., 2025). Outside privacy protection, DePlot similarly separates chart perception from language reasoning through plot-to-table translation (Liu et al., 2023). These approaches motivate an explicit intermediate representation, but their textual or symbolic outputs cannot directly replace an image or waveform required by a fixed media interface. Media-level methods retain the modality but target different aspects of privacy. Speaker anonymiza- tion changes voice identity while retaining linguistic content (Meyer et al., 2022), SpeechShield masks sensitive speech segments before cloud recognition (Benazir & Lin, 2025), and learned image transformations protect visual privacy attributes from black-box multimodal models (Hui et al., 2026a). SPTI is particularly related in using private textual intermediaries to synthesize differentially 3 Preprint. Stage 1: Multimodal Evidence Agent Stage 2: Rewrite and Number Protection Stage 3: Modality Recon Agent Input Output Image Company revenue 30K 50K AprilMay Text Revenue increased from 30Kin April to 50Kin May. Audio “April: 30K. May: 50K.” Modality classification Image Qwen3-VL Visual tool April: 30K May: 50K Text Text passthrough Original text kept as-is Audio Qwen3-ASR Audio tool April: 30K May: 50K Unified text representation Revenue increased from 30Kin April to 50Kin May. May is higher than April. GPT-5.6-Sol Distillation teacher distill Local remapping Topic Rewriter Revenue: Apr. / May Visits: Tue. / Wed. Qwen3-4B Numeric Rewriter 30 →48 50 →71 Number remapping Protected text representation Tue. 48K Wed. 71K After topic rewritingAfter number protection Website visitsincreased from 30Kon Tuesday to 50Kon Wednesday. Website visits increased from 48Kon Tuesday to 71Kon Wednesday. Wednesday is higher than Tuesday. Wednesday is higher than Tuesday. Image reconstruction fail / repair ChartSpec Generation Tue. / Wed. 48K / 71K ✓ Validate & Repair Render tool pass Text reconstruction Direct output Protected text remains unchanged Audio reconstruction TTS tool Text-to-speech Proxy speech Image Website visits 48K Tue.Wed. Text Website visits increased from 48Kon Tuesday to 71Kon Wednesday. Audio “Tuesday: 48K. Wednesday: 71K.” Unprotected Query How much did revenue increase from April to May? Protected query How much did visitsincrease from Tuesdayto Wednesday? 71K Figure 2: Overview of RECAST. The pipeline first converts multimodal inputs into a unified textual representation (Sec. 3.2), then applies topic rewriting and local numerical remapping to protect entities and numbers (Sec. 3.3). The protected text is subsequently reconstructed into a surrogate in original modality, which regenerates charts through ChartSpec-based rendering and validation, passes through text directly, and synthesizes audio as proxy speech (Sec. 3.4). An example in the figure shows this pipeline. private images (Wang et al., 2025). It releases a synthetic dataset, however, rather than a protected media-query pair tied to a particular computation. RECAST instead replaces source-specific entities, topics, and values for each request while retaining the evidence-query relations needed for numerical reasoning. Protection comes from transforming the shared record; reconstruction provides interface compatibility, and the inverse numerical map remains local for answer recovery. 3METHOD As shown in Fig. 2, RECAST separates source-specific content from task-relevant relations through a shared textual evidence-query record. It captures evidence locally (Sec. 3.2), jointly rewrites its semantic and numerical content (Sec. 3.3), and reconstructs the protected record in the required modality (Sec. 3.4). The remote solver returns a program whose operands are restored locally before execution. 3.1TASK AND FRAMEWORK OVERVIEW Given private evidenceXand a textual queryq, letm,r ∈text, image, audiodenote the source and accepted release modalities, respectively. We primarily considerr = m, using another release modality only when the interface permits it. The goal is to reduce exposure of source-specific entities, topics, wording, and values while retaining the evidence-query associations needed for local answer recovery. LetE m be the local evidence-capture operator,D = E m (X,q)its normalized textual record,R θ the semantic rewriter with trainable adapter parametersθ, andH h the numerical transformation induced by a request-specific injective map h. For requests passing release validation, e D = H h (R θ (D)),( e X,eq) = G r ( e D).(1) Here, e Dis the protected record; e Xandeqare the released evidence in modalityrand its protected textual query.G r denotes reconstruction and validation; its local validation inputs(X,q,D)and inverse maph −1 are implicit arguments. During deployment, these inputs and the inverse map remain local. Remote reconstruction services receive only protected content and derived artifacts; the solver receives( e X,eq). The leakage audit covers solver-bound requests, not all reconstruction-service inputs. 4 Preprint. 3.2MULTIMODAL EVIDENCE CAPTURE Evidence capture makes task-bearing content explicit without answering the query. For charts, local, question-aware Qwen3-VL-8B-Instruct (Bai et al., 2025) extracts category-value associations, legend- series correspondences, units, ordering, and queried visual attributes. Qwen3-ASR-1.7B (Shi et al., 2026) transcribes speech, while a deterministic parser normalizes text and preserves field boundaries and numerical spans. All branches share five fields:id,modality,context,question, andchoices, with empty choices for numeric-answer tasks. Numerical expressions are normalized before rewriting to match repeated quantities across evidence and query. This explicit, model-independent interface makes content inspectable and allows capture plug-ins to be replaced independently, provided their outputs remain schema-compatible. 3.3JOINT REWRITING AND NUMERICAL PROTECTION Figure 3: Joint rewriting and numerical protection. A distilled local rewriter changes entities and topics consistently across evidence and query while retaining numerical literals. A separate request-specific map re- places numerical values under the supported relational constraints. Its inverse remains local for operand re- covery. As shown in Fig. 3, this stage protects the shared evidence-query record through two complementary transformations. A distilled local rewriter jointly changes entities and topics while maintaining evidence-query alignment; a request-specific numerical map then substitutes values under explicit rela- tional constraints. The inverse map remains local for restoring operands in the program returned by the remote solver. Joint semantic rewriting. Evidence and query are rewritten together into a coher- ent, semantically distinct domain, retain- ing quantity assignments, cross-references, the requested operation, and answer type. Chart rewrites maintain category-value and legend-series correspondences, including queried visual attributes; speech rewrites maintain entity-quantity assignments, coref- erence, event order, and temporal or com- parative links. Numerical literals remain unchanged, separating semantic rewriting from numerical substitution. Distilling a local rewriter. We fine-tune Qwen3-4B (Yang et al., 2025) with QLoRA (Dettmers et al., 2023) on offline GPT-5.6-Sol (OpenAI, 2026b) rewrites of training-side chart descriptions and speech transcripts. Schema and per-field numerical-literal filters yield 15,795 accepted pairs, split into training and development sets disjoint from evaluation data. Deployment uses the local student for rewriting. LetTbe the training split andYthe token sequence of the serialized teacher rewrite of D, before numerical substitution. We minimize L rewrite (θ) =− X (D,Y )∈T |Y| X t=1 logp θ (Y t | D,Y <t ).(2) Here,Y t is thet-th target token,|Y|the sequence length,Y <t its preceding prefix, andp θ the student’s conditional next-token distribution. Loss applies only to output tokens. Inference outputs failing schema or numerical-literal checks are regenerated; semantic consistency is checked separately before release. Appendix A.4 gives filtering and split details. Numerical rewriting.LetVcontain the distinct normalized values in the evidence and query. Each request uses an injective maph : V → e V, where e V = h(V), with local inverseh −1 : e V → V . Let 5 Preprint. B k ⊆Vbe thek-th magnitude band of remapped ordinary quantities andY g ⊆Vtheg-th contextual year group. Collision-free replacements are sampled and sorted within each band, while years in a group share an offset δ g : v < v ′ =⇒ h(v) < h(v ′ ), v,v ′ ∈B k ,(3) h(y) = y + δ g , y ∈Y g .(4) Here,v,v ′ are ordinary values andyis a year value. Repeated values receive the same replacement; non-year integers from 0 to 15 use identity assignmentsh(v) = v. The map preserves within-band order and within-group year intervals, but not general differences, ratios, or cross-class comparisons. Construction details appear in Appendix A.3. Local operand recovery. Following Zhang et al. (2026), the solver returns a Python program e P with observed numerical operands marked asprotected(<number>). LetI h −1 replace each marked operand protected(h(v)) with its original value v. The client computes ba = Exec I h −1 [ e P ] ,(5) whereExec(·)denotes local program execution andbais the predicted answer toqonX. Recovery acts on operands, not on an answer computed from protected values. Correct recovery requires faithful evidence and correct operand and operation selection. Decisions based on unpreserved differences or ratios need not transfer unless deferred to program execution after restoration. 3.4MODALITY RECONSTRUCTION AND RELEASE VALIDATION Figure 4: Modality reconstruction and release vali- dation. The interface selects the reconstruction plug- in. Charts use specification generation, local rendering, and review-guided repair; speech uses synthesis fol- lowed by transcription-based checks; text is serialized directly. Release requires both protected-record consis- tency and a local source-consistency check. As shown in Fig. 4, the reconstruction agent converts e Dinto an interface-compatible ar- tifact through a generate-review-repair loop. It aims to represent protected evidence faith- fully, not to reproduce the original chart ap- pearance or speaker identity. Chart reconstruction. A remote code model translates protected evidence into a declarative ChartSpec containing the chart type, categories, series, values, labels, units, and colors. After local structure and value checks, fixed Matplotlib templates (Hunter, 2007) render the specification. A remote vision model reviews the image against the protected record, providing structured feed- back for at most four repairs. Neither remote model receives the original chart. Failed re- pairs trigger a validated table fallback only when accepted by the interface; otherwise, the request is withheld. Speech and text reconstruction. A re- mote text-to-speech (TTS) service synthe- sizes protected passages. The controller transcribes each candidate waveform, checks intelligibility, protected quantities, and entity ref- erences against the passage, and regenerates failures. For text-compatible interfaces, protected evidence is serialized directly with the protected query. Two complementary release checks.LetV protected ,V source ∈0, 1indicate whether a candidate passes the protected-record and local source-consistency checks, respectively, with1for pass and0for 6 Preprint. failure. The former checks rendered values, labels, units, associations, and queried attributes against e Dfor charts, and transcribed quantities, references, and query-relevant content for speech. The latter aligns rewritten entities with source roles, restores mapped values, and compares assignments and dependencies with the original input. The release decision V release ∈0, 1 is V release = V protected ∧ V source .(6) Here,∧denotes logical conjunction; release occurs only whenV release = 1. These operational checks do not constitute a proof of semantic correctness or a formal privacy guarantee. Their coverage is detailed in Appendix B.4. 4EXPERIMENTS This section evaluates RECAST along three main dimensions: overall reasoning utility and source- content protection, robustness beyond the primary evaluation setting, and the contribution of key pipeline components. We first describe the experimental setup (Sec. 4.1), followed by the main results (Sec. 4.2), cross-dataset generalization (Sec. 4.3), and stage-wise ablations (Sec. 4.4). Finally, we validate the LLM-based leakage judge against human annotations (Sec. 4.5). 4.1EXPERIMENTAL SETUP Datasets.We evaluate on four numeric-answer datasets. For in-distribution (ID) evaluation, we use 2,000 held-out examples each from ChartQA (Masry et al., 2022) and NMSQA (Lin et al., 2022), disjoint from the records used for Rewriter distillation. The distillation pool contains 9,370 ChartQA and 7,000 NMSQA records, yielding 15,795 accepted teacher pairs split into 15,480 training and 315 validation examples. For out-of-distribution (OOD) evaluation, we use 2,000 examples each from ChartX (Xia et al., 2025) and Spoken-MQA (Wei et al., 2025). All evaluation IDs are fixed before execution (Appendix A.1). Unless otherwise stated, results are reported on the ID sets; the OOD sets are used for the cross-dataset evaluation in Sec. 4.3. Baselines. Because RECAST is a multi-stage pipeline, we compare it both end-to-end and at the stage at which each alternative operates. End-to-end Remote-native sends the original media and query to the same remote solver and provides the unprotected accuracy reference. Gemma-4-E4B (Gemma Team, 2026) and Qwen2.5-Omni-3B (Xu et al., 2025) answer the original inputs locally and serve as zero-leakage references. On ChartQA, we additionally evaluate the Stage 1 capture model Qwen3-VL-8B as a standalone local solver. At Stage 2, we replace the Rewriter while keeping all other pipeline components fixed. The untuned Qwen3-4B isolates the effect of distillation, while GPT-5.6-Sol, the offline teacher that produces the distillation pairs, provides a teacher-level reference. We also apply two text anonymizers to the same textual records: RLAA (Duan et al., 2026), which we port to a Qwen3-4B backbone, and Eternis-Anonymizer-4B (Eternis, 2025); both are evaluated as stage-level references. At Stage 3, we consider two groups of alternatives. The first group protects the media directly: PSIC (Shen et al., 2025) produces protected images, SPTI (Wang et al., 2025) synthesizes differentially private images from private textual intermediaries, and AudioShield (Jin et al., 2025) protects audio against speech recognition. None of these methods restores the original numerical operands after protected inference. They therefore do not yield answerable end-to-end QA instances under our protocol, so we report their native exposure diagnostics instead of QA accuracy. The second group isolates the reconstruction strategy: we replace the RECAST reconstruction agent with two alternative agent harnesses, Codex CLI (OpenAI, 2026a) and DeepSeek Harness (DSH) (DeepSeek-AI, 2026b), which reconstruct the same protected records. Stage 1 has no direct external counterpart and is examined through a controlled ablation in Sec. 4.4. Experiments. We instantiate the three stages of RECAST as follows. In Stage 1, Qwen3-VL-8B- Instruct (Bai et al., 2025) and Qwen3-ASR-1.7B (Shi et al., 2026) convert chart and speech inputs, respectively, into the shared textual record. In Stage 2, the local Rewriter is Qwen3-4B (Yang et al., 2025) fine-tuned with QLoRA (Dettmers et al., 2023) on the accepted teacher pairs. In Stage 3, DeepSeek-V4 models (DeepSeek-AI, 2026a) generate and review ChartSpecs, and Qwen3-TTS-Flash (Hu et al., 2026) synthesizes speech. Qwen3.5-Omni-Plus (Qwen Team, 2026a) serves as the remote 7 Preprint. Table 1: Stage 2 Rewriter comparison (a) and native exposure diagnostics of protection references (b). Values are percentages;∆: RECAST minus the reference (p); “–”: unavailable; ∗ : single-dataset value. (a) Controlled Rewriter comparison Rewriter Accuracy↑Source-content leakage↓ ChartQA NMSQA Overall ChartQA NMSQA Overall Qwen3-4B (untuned, local)66.4071.0068.7037.9041.6039.75 RECAST (distilled local 4B)70.2080.0075.108.007.907.95 GPT-5.6-Sol (offline teacher)70.3081.0075.655.201.203.20 ∆ vs. untuned (p)+3.80+9.00+6.40 −29.90 −33.70 −31.80 ∆ vs. teacher (p)−0.10 −1.00 −0.55+2.80+6.70+4.75 (b) Protection references and task applicability MethodRole / task applicability Reported exposure diagnostic ChartQA NMSQAOverall Text-rewriting references RLAA-Qwen3-4B (port) Stage-level reference86.8073.7080.25 Eternis-Anonymizer-4BStage-level reference96.7093.2094.95 Media-protection references PSICNo end-to-end recovery28.20–28.20 ∗ SPTINo end-to-end recovery0.00–0.00 ∗ AudioShieldNo end-to-end recovery–0.600.60 ∗ Table 2: Accuracy (%) of Stage 3 reconstruction implementations. ReconstructionChartQANMSQAOverall Codex CLI harness52.0078.0065.00 DeepSeek Harness (DSH)60.9080.5070.70 RECAST agent (Ours)70.2080.00 75.10 Table 3: ID and OOD results (%) across image and audio modalities. ImageAudio MetricIDOODIDOOD Acc. ↑70.2062.4080.0079.40 Leakage↓8.001.407.905.90 solver in all remote settings, including Remote-native, so accuracy differences are not attributable to the choice of solver. Following the recovery scheme of Zhang et al. (2026), we recover the original answer locally by restoring the protected operands. All local components run sequentially on a single NVIDIA RTX 4090; full configurations are given in Appendices A.2 and C. We report task accuracy (Acc.), normalized accuracy (NAcc.), and source-content leakage (Leak.). NAcc. is the ratio of a method’s accuracy to Remote-native accuracy on the same examples. Leak. is the fraction of solver-bound requests flagged by a fixed LLM judge (validated against human labels in Sec. 4.5) for semantic, lexical, entity-value correspondence, or source-linkability information; generic reasoning structure is not counted as leakage. For tables that report an Overall value, we use the arithmetic mean of the ChartQA and NMSQA values. No example is filtered post hoc by accuracy or leakage, and answer normalization and matching are specified in Appendix B.1. 4.2MAIN RESULTS Our experiments compare three settings: local models operating on the original inputs, RECAST operating on protected media, and remote-native inference, in which the same remote solver receives the original media and query. The local zero-leakage references and the fully exposed remote-native reference are reported in Appendix Tab. 10. RECAST achieves 70.20% accuracy (NAcc. 93.48%) on ChartQA, 80.00% (NAcc. 91.53%) on NMSQA, and 75.10% overall (NAcc. 92.43%), with an overall solver-bound source-content leakage of 7.95%. These results show that the protected pipeline 8 Preprint. Table 4: Stage 1 input-path ablation (accuracy, %). Input pathImage acc.Audio acc.Overall acc. Joint input46.0043.2044.60 Decoupled input65.9065.8065.85 Table 5: Stage 3 release-format ablation (accu- racy, %). Release formatChartQANMSQAOverall RECAST, protected media70.2080.0075.10 RECAST, protected text69.8083.9076.85 retains most of the reasoning utility of the unprotected remote solver while reducing source-content exposure at the solver boundary. Despite operating on protected inputs, RECAST also outperforms the local reference models. On ChartQA, it reaches 70.20%, exceeding the standalone Qwen3-VL-8B capture model (62.80%) by 7.40 points. On NMSQA, it reaches 80.00%, exceeding Qwen2.5-Omni-3B (46.30%) by 33.70 points. Tab. 1(a) next examines the effect of the Stage 2 Rewriter. Distillation brings RECAST close to its GPT-5.6-Sol teacher while substantially outperforming the untuned Qwen3-4B: it trails the teacher (75.65%) by only 0.55 points, improves over the untuned model by 6.40 points, and reduces leakage from 39.75% to 7.95%. The two text anonymizers applied to the same textual records, reported in Tab. 1(b), leave source content in 80.25% (RLAA) and 94.95% (Eternis) of their outputs, an order of magnitude above the 7.95% of RECAST. General-purpose anonymization thus leaves most source content in place, whereas the distilled Rewriter jointly replaces the entities and topics of the record. Among the methods reported in Tab. 1, RECAST is the only configuration for which we report end-to-end QA accuracy on both modalities. For Stage 3, Tab. 1(b) reports the native exposure diagnostics for PSIC, SPTI, and AudioShield described in Sec. 4.1, rather than end-to-end QA accuracy. These diagnostics use method-specific protocols and are therefore not directly comparable with RECAST’s solver-bound leakage rate. The 0.00 reported for SPTI indicates that no source-content leakage was detected under its native exposure diagnostic. Appendices B.7-B.9 provide additional diagnostics, while Appendix E compares their outputs with those of RECAST and the two text anonymizers: Figures 9 and 10 show selected image and audio cases, respectively, and the selected RECAST examples retain correct final answers. Tab. 2 isolates the Stage 3 reconstruction implementation by passing the same protected examples through each reconstruction path. RECAST outperforms the Codex CLI harness (OpenAI, 2026a) by 18.20 points on ChartQA and 10.10 points overall, and outperforms DeepSeek Harness (DeepSeek-AI, 2026b) by 9.30 points on ChartQA and 4.40 points overall. On NMSQA, DeepSeek Harness is 0.50 points higher, indicating that the advantage of RECAST comes mainly from chart reconstruction rather than holding uniformly across modalities. 4.3CROSS-DATASET EVALUATION Tab. 3 evaluates RECAST with the distilled Qwen3-4B rewriter under both in-distribution (ID) and out-of-distribution (OOD) settings to test whether it maintains task accuracy and low source-content leakage on unseen datasets. The ID evaluation uses ChartQA and NMSQA, where the full pipeline achieves 70.20% accuracy on images and 80.00% on audio. On the OOD datasets, ChartX and Spoken-MQA, accuracy reaches 62.40% and 79.40%, corresponding to drops of 7.80 and 0.60 points from the respective ID results. The substantially smaller OOD degradation on audio indicates stronger cross-dataset transfer for spoken inputs, while image performance is more sensitive to shifts in chart distribution. The measured leakage rates are 8.00% and 1.40% for the ID and OOD image datasets, and 7.90% and 5.90% for the ID and OOD audio datasets, respectively. Because the datasets differ, these values are reported descriptively rather than interpreted as an effect of distillation. 4.4ABLATIONS To test whether a shared textual representation is an effective intermediate interface for multimodal evidence, we compare direct joint multimodal input with the proposed decoupled pathway. Both paths use the same multimodal model: the joint path rewrites the original input directly, whereas the decoupled path first converts modality-specific evidence into the shared textual representation and rewrites that representation. This is a Stage 1 path ablation under a shared model configuration, rather than a reproduction of the full RECAST setup. Tab. 4 shows that decoupling raises overall 9 Preprint. accuracy from 44.60% to 65.85% (+21.25 points), with gains on both image (+19.90) and audio (+22.60), supporting the decoupled Stage 1 design. To assess the effect of Stage 3 reconstruction, we keep the protected record fixed and compare releasing it as reconstructed media or directly as protected text. Tab. 5 shows that protected text is 1.75 points higher overall (76.85% versus 75.10%), mainly due to a 3.90-point gain on NMSQA. On ChartQA, however, reconstructed images slightly outperform the protected textual representation by 0.40 points. This indicates that reconstructing the protected record into the required image modality can preserve downstream utility in this setting, while also satisfying image-based service interfaces. For audio, reconstructed speech performs 3.90 points below protected text, indicating a modest utility loss introduced by speech synthesis. Nevertheless, for services that require waveform input, audio reconstruction remains necessary for interface-compatible end-to-end inference. Overall, the comparison isolates the effect of modality reconstruction from the task content already encoded in the shared protected record. 4.5VALIDITY OF THE LLM JUDGE Source-content leakage cannot be measured by string matching alone: a solver-bound request can reveal the source through paraphrased semantics, entity-value correspondences, or cues that link it back to the original input, whereas retaining generic reasoning structure does not constitute leakage. We therefore rely on a fixed LLM judge for all leakage rates of RECAST and its variants reported in Secs. 4.2-4.3. To assess whether the judge provides a reliable proxy for human assessment, we compare its decisions with human labels on 400 annotated pairs. The judge agrees with the human majority on 91.50% of the pairs (κ = 0.83), indicating agreement well beyond chance. The annotation protocol and calibration details are given in Appendix B.6. 5CONCLUSION We presented RECAST, a contract-preserving protection framework for numerical reasoning through fixed multimodal interfaces. Its central insight is to replace source-specific content while preserving the task relations and media format required by the service. A shared evidence-query record decouples content protection from modality, while local operand recovery separates remote reasoning over protected evidence from computation on original values. On ChartQA and NMSQA, RECAST retains 92.43% of unprotected remote accuracy, with a model-based audit flagging source-content leakage in 7.95% of solver-bound contexts. With a distilled local 4B rewriter, end-to-end accuracy falls just 0.55 percentage points below the offline teacher configuration. The reconstruction agent improves chart accuracy over the evaluated alternatives, while results on ChartX and Spoken-MQA support transfer beyond the distillation datasets. Together, these findings show that solver-bound source-content exposure can be reduced while retaining much of the utility of remote numerical reasoning and compatibility with existing media interfaces. AI USE STATEMENT Generative AI tools were used to assist with language editing, improving the clarity and organization of the manuscript, and providing feedback on presentation and experimental descriptions. They were also used to assist with code editing. All research ideas, methodological decisions, experimental results, and scientific claims were reviewed and verified by the authors. AI-generated suggestions were not treated as authoritative sources, and the authors take full responsibility for the final content of this work. REPRODUCIBILITY STATEMENT Appendix A lists data construction, components, the mapping policy, and distillation data; Appendix C lists training and decoding settings; Appendix D gives the prompt specifications. We will release the code, prompts, the distilled adapter, the accepted teacher traces, per-run manifests (selected sample IDs, offsets, and code, environment, and data hashes), and per-example request and audit logs. 10 Preprint. ETHICS STATEMENT ChartQA and NMSQA are public benchmarks. The three annotators in the human calibration (Appendix B.6) are authors of this paper. The leakage judge receives original inputs only inside the evaluation workflow; in deployment, original inputs and inverse maps stay local. RECAST lowers the source content that reaches remote services, and sensitive deployments can combine it with contractual and access controls on those services. REFERENCES Shuai Bai, Yuxuan Cai, Ruizhe Chen, Keqin Chen, Xionghui Chen, Zesen Cheng, Lianghao Deng, Wei Ding, Chang Gao, Chunjiang Ge, Wenbin Ge, Zhifang Guo, Qidong Huang, Jie Huang, Fei Huang, Binyuan Hui, Shutong Jiang, Zhaohai Li, Mingsheng Li, Mei Li, Kaixin Li, Zicheng Lin, Junyang Lin, Xuejing Liu, Jiawei Liu, Chenglong Liu, Yang Liu, Dayiheng Liu, Shixuan Liu, Dunjie Lu, Ruilin Luo, Chenxu Lv, Rui Men, Lingchen Meng, Xuancheng Ren, Xingzhang Ren, Sibo Song, Yuchong Sun, Jun Tang, Jianhong Tu, Jianqiang Wan, Peng Wang, Pengfei Wang, Qiuyue Wang, Yuxuan Wang, Tianbao Xie, Yiheng Xu, Haiyang Xu, Jin Xu, Zhibo Yang, Mingkun Yang, Jianxin Yang, An Yang, Bowen Yu, Fei Zhang, Hang Zhang, Xi Zhang, Bo Zheng, Humen Zhong, Jingren Zhou, Fan Zhou, Jing Zhou, Yuanzhi Zhu, and Ke Zhu. Qwen3-VL Technical Report, 2025. URL https://arxiv.org/abs/2511.21631. Cristian-Paul Bara, Qing Ping, Abhinav Mathur, Govind Thattai, Rohith MV, and Gaurav S. Sukhatme. Privacy Preserving Visual Question Answering, 2022. URLhttps://arxiv.org/abs/ 2202.07712. Afsara Benazir and Felix Xiaozhu Lin. Safeguarding Privacy in Edge Speech Understanding with Tiny Foundation Models, 2025. URL https://arxiv.org/abs/2502.01649. Sai Chen, Fengran Mo, Yanhao Wang, Cen Chen, Jian-Yun Nie, Chengyu Wang, and Jamie Cui. A Customized Text Sanitization Mechanism with Differential Privacy. In Findings of the Associa- tion for Computational Linguistics: ACL 2023, p. 5747–5758, 2023. doi: 10.18653/v1/2023. findings-acl.355. URL https://aclanthology.org/2023.findings-acl.355/. DeepSeek-AI. DeepSeek-V4: Towards highly efficient million-token context intelligence, 2026a. URL https://arxiv.org/abs/2606.19348. DeepSeek-AI. DeepSeek Harness: Everything is a plugin. Open-source software repository, 2026b. URLhttps://github.com/deepseek-ai/deepseek-harness. Accessed Septem- ber 30, 2026. Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. QLoRA: Efficient Finetuning of Quantized LLMs. In Advances in Neural Information Processing Systems, volume 36, 2023. URL https://arxiv.org/abs/2305.14314. Donghang Duan, Xu Zheng, Yuefeng He, Chong Mu, Leyi Cai, and Lizong Zhang. Look Twice before You Leap: A Rational Framework for Localized Adversarial Anonymization. In Findings of the Association for Computational Linguistics: ACL 2026, 2026. URLhttps://arxiv.org/ abs/2512.06713. Eternis. Anonymizer-4B. Hugging Face model, 2025. URLhttps://huggingface.co/ eternisai/Anonymizer-4B. Model card. Luyu Gao, Aman Madaan, Shuyan Zhou, Uri Alon, Pengfei Liu, Yiming Yang, Jamie Callan, and Graham Neubig. PAL: Program-aided Language Models. In Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, p. 10764–10799, 2023. URL https://proceedings.mlr.press/v202/gao23f.html. Gemma Team. Gemma 4 Technical Report, 2026. URLhttps://arxiv.org/abs/2607. 02770. Florian Hartmann, Duc-Hieu Tran, Peter Kairouz, Victor C ̆ arbune, and Blaise Aguera y Arcas. Can LLMs get help from other LLMs without revealing private information?, 2024. URLhttps: //arxiv.org/abs/2404.01041. 11 Preprint. Hangrui Hu, Xinfa Zhu, Ting He, Dake Guo, Bin Zhang, Xiong Wang, Zhifang Guo, Ziyue Jiang, Hongkun Hao, Zishan Guo, Xinyu Zhang, Pei Zhang, Baosong Yang, Jin Xu, Jingren Zhou, and Junyang Lin. Qwen3-tts technical report. arXiv preprint arXiv:2601.15621, 2026. Xiaofei Hui, Qian Wu, Haoxuan Qu, Majid Mirmehdi, Hossein Rahmani, and Jun Liu. When Visual Privacy Protection Meets Multimodal Large Language Models. International Journal of Computer Vision, 134(4), 2026a. doi: 10.1007/s11263-026-02761-y. URLhttps://doi.org/10. 1007/s11263-026-02761-y. Article 167. Zheng Hui, Yijiang River Dong, Sanhanat Sivapiromrat, Ehsan Shareghi, and Nigel Collier. Privacy- R1: Privacy-Aware Multi-LLM Agent Collaboration via Reinforcement Learning. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics, 2026b. URL https://arxiv.org/abs/2510.16054. John D. Hunter. Matplotlib: A 2d graphics environment. Computing in Science & Engineering, 9(3): 90–95, 2007. doi: 10.1109/MCSE.2007.55. Weifei Jin, Yuxin Cao, Junjie Su, Derui Wang, Yedi Zhang, Minhui Xue, Jie Hao, Jin Song Dong, and Yixian Yang. Whispering Under the Eaves: Protecting User Privacy Against Commercial and LLM- powered Automatic Speech Recognition Systems. In 34th USENIX Security Symposium (USENIX Security 25), p. 4643–4662, Seattle, WA, August 2025. USENIX Association. ISBN 978-1- 939133-52-6. URLhttps://w.usenix.org/conference/usenixsecurity25/ presentation/jin-weifei. Guan-Ting Lin, Yung-Sung Chuang, Ho-Lam Chung, Shu-wen Yang, Hsuan-Jui Chen, Shuyan An- nie Dong, Shang-Wen Li, Abdelrahman Mohamed, Hung-yi Lee, and Lin-shan Lee. DUAL: Discrete Spoken Unit Adaptive Learning for Textless Spoken Question Answering. In In- terspeech 2022, p. 5165–5169, 2022. doi: 10.21437/Interspeech.2022-612. URLhttps: //w.isca-archive.org/interspeech_2022/lin22c_interspeech.html. Fangyu Liu, Julian Eisenschlos, Francesco Piccinno, Syrine Krichene, Chenxi Pang, Kenton Lee, Mandar Joshi, Wenhu Chen, Nigel Collier, and Yasemin Altun. DePlot: One-shot visual language reasoning by plot-to-table translation. In Findings of the Association for Computational Linguistics: ACL 2023, p. 10381–10399, 2023. doi: 10.18653/v1/2023.findings-acl.660. URLhttps: //aclanthology.org/2023.findings-acl.660/. Zhenhua Liu, Zhanxu Xie, Junjie Yu, Tong Zhu, Lijun Li, and Wenliang Chen. Demystifying the Privacy-Utility Trade-off in LLM Interactions, 2026. URLhttps://arxiv.org/abs/2609. 10992. Ahmed Masry, Do Xuan Long, Jia Qing Tan, Shafiq Joty, and Enamul Hoque. ChartQA: A Benchmark for Question Answering about Charts with Visual and Logical Reasoning. In Findings of the Association for Computational Linguistics: ACL 2022, p. 2263–2279, 2022. doi: 10.18653/ v1/2022.findings-acl.177. URLhttps://aclanthology.org/2022.findings-acl. 177/. Stephen Meisenbacher, Maulik Chevli, Juraj Vladika, and Florian Matthes. DP-MLM: Differentially Private Text Rewriting Using Masked Language Models. In Findings of the Association for Computational Linguistics: ACL 2024, p. 9314–9328, 2024. doi: 10.18653/v1/2024.findings-acl. 554. URL https://aclanthology.org/2024.findings-acl.554/. Stephen Meisenbacher, Maulik Chevli, and Florian Matthes. Leveraging Semantic Triples for Private Document Generation with Local Differential Privacy Guarantees. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, p. 8987–9003, 2025. URL https://arxiv.org/abs/2508.20736. Sarina Meyer, Florian Lux, Pavel Denisov, Julia Koch, Pascal Tilli, and Ngoc Thang Vu. Speaker Anonymization with Phonetic Intermediate Representations. In Interspeech 2022, p. 4925–4929, 2022. doi: 10.21437/Interspeech.2022-10703. URLhttps://w.isca-archive.org/ interspeech_2022/meyer22b_interspeech.html. 12 Preprint. Abhijit Mishra, Mingda Li, Hsiang Fu, Richard Noh, and Minji Kim. ReVision: A Dataset and Baseline VLM for Privacy-Preserving Task-Oriented Visual Instruction Rewriting. In Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics, p. 2877–2889, 2025. doi: 10.18653/v1/2025.ijcnlp-long.154. URLhttps://aclanthology.org/2025. ijcnlp-long.154/. OpenAI. Codex CLI. Open-source software repository, 2026a. URLhttps://github.com/ openai/codex. Accessed September 30, 2026. OpenAI. GPT-5.6 System Card, July 2026b. URLhttps://deploymentsafety.openai. com/gpt-5-6. System card for the GPT-5.6 family, including GPT-5.6 Sol. Qwen Team. Qwen3.5-Omni Technical Report, 2026a. URLhttps://arxiv.org/abs/2604. 15804. Qwen Team. Qwen3.7: The agent frontier, May 2026b. URLhttps://qwen.ai/blog?id= qwen3.7. Xuelin Shen, Jiayin Xu, Kangsheng Yin, and Wenhan Yang. Privacy-shielded image compression: Defending against exploitation from vision-language pretrained models. In Proceedings of the 42nd International Conference on Machine Learning, volume 267 of Proceedings of Machine Learning Research, p. 54600–54610. PMLR, 2025. URLhttps://proceedings.mlr. press/v267/shen25k.html. Xian Shi, Xiong Wang, Zhifang Guo, Yongqi Wang, Pei Zhang, Xinyu Zhang, Zishan Guo, Hongkun Hao, Yu Xi, Baosong Yang, Jin Xu, Jingren Zhou, and Junyang Lin. Qwen3-ASR Technical Report, 2026. URL https://arxiv.org/abs/2601.21337. Li Siyan, Vethavikashini Chithrra Raghuram, Omar Khattab, Julia Hirschberg, and Zhou Yu. PA- PILLON: Privacy Preservation from Internet-based and Local Language Model Ensembles. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 3371–3390, 2025. doi: 10.18653/v1/2025.naacl-long.173. URLhttps://aclanthology. org/2025.naacl-long.173/. Li Siyan, Zhou Yu, and Julia Hirschberg. Beyond Direct Identifiers: Probabilistic Privacy Risk Estimation for Privacy-Conscious LLM Query Delegation. In HAIPS Workshop at COLM 2026, 2026. URL https://arxiv.org/abs/2608.09140. Robin Staab, Mark Vero, Mislav Balunovi ́ c, and Martin Vechev. Beyond Memorization: Violating Pri- vacy via Inference with Large Language Models. In The Twelfth International Conference on Learn- ing Representations, 2024. URL https://openreview.net/forum?id=kmn0BhQk7p. Robin Staab, Mark Vero, Mislav Balunovi ́ c, and Martin Vechev. Language Models are Advanced Anonymizers. In The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=82p8VHRsaK. Rushil Thareja, Preslav Nakov, Praneeth Vepakomma, and Nils Lukas. DP-Fusion: Token-Level Differentially Private Inference for Large Language Models, 2025. URLhttps://arxiv. org/abs/2507.04531. Fengwei Tian, Payel Bhattacharjee, Heidi Hanson, Geoffrey D. Rubin, Joseph Y. Lo, and Ravi Tandon. STAMP: Selective Task-Aware Mechanism for Text Privacy. In Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), p. 1319–1333, 2026. doi: 10.18653/v1/2026.eacl-long.61. URL https://aclanthology.org/2026.eacl-long.61/. Batuhan Tömekçe, Mark Vero, Robin Staab, and Martin Vechev.Private Attribute Inference from Images with Vision-Language Models.In Advances in Neural Information Processing Systems,volume 37,p. 103619–103651,2024.URL https://proceedings.neurips.c/paper_files/paper/2024/hash/ b97e9a7c811904c9b01f51fde66edcf-Abstract-Conference.html. 13 Preprint. Meng Tong, Kejiang Chen, Jie Zhang, Yuang Qi, Weiming Zhang, Nenghai Yu, Tianwei Zhang, and Zhikun Zhang. InferDPT: Privacy-Preserving Inference for Closed-Box Large Language Models. IEEE Transactions on Dependable and Secure Computing, 22(5):4625–4640, 2025. URL https://ieeexplore.ieee.org/document/10922117/. Saiteja Utpala, Sara Hooker, and Pin-Yu Chen. Locally Differentially Private Document Generation Using Zero Shot Prompting. In Findings of the Association for Computational Linguistics: EMNLP 2023, p. 8442–8457, 2023. doi: 10.18653/v1/2023.findings-emnlp.566. URLhttps: //aclanthology.org/2023.findings-emnlp.566/. Haoxiang Wang, Zinan Lin, Da Yu, and Huishuai Zhang. Synthesize Privacy-Preserving High- Resolution Images via Private Textual Intermediaries. In Advances in Neural Information Process- ing Systems, volume 38, 2025. URL https://arxiv.org/abs/2506.07555. Chengwei Wei, Bin Wang, Jung jae Kim, and Nancy F. Chen. Towards spoken mathematical reasoning: Benchmarking speech-based models over multi-faceted math problems, 2025. URL https://arxiv.org/abs/2505.15000. Renqiu Xia, Bo Zhang, Hancheng Ye, Xiangchao Yan, Qi Liu, Hongbin Zhou, Zijun Chen, Peng Ye, Min Dou, Botian Shi, Junchi Yan, and Yu Qiao. Chartx & chartvlm: A versatile benchmark and foundation model for complicated chart reasoning, 2025. URLhttps://arxiv.org/abs/ 2402.12185. Jin Xu, Zhifang Guo, Jinzheng He, Hangrui Hu, Ting He, Shuai Bai, Keqin Chen, Jialin Wang, Yang Fan, Kai Dang, Bin Zhang, Xiong Wang, Yunfei Chu, and Junyang Lin. Qwen2.5-Omni Technical Report, 2025. URL https://arxiv.org/abs/2503.20215. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jing Zhou, Jingren Zhou, Junyang Lin, Kai Dang, Keqin Bao, Kexin Yang, Le Yu, Lianghao Deng, Mei Li, Mingfeng Xue, Mingze Li, Pei Zhang, Peng Wang, Qin Zhu, Rui Men, Ruize Gao, Shixuan Liu, Shuang Luo, Tianhao Li, Tianyi Tang, Wenbiao Yin, Xingzhang Ren, Xinyu Wang, Xinyu Zhang, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yinger Zhang, Yu Wan, Yuqiong Liu, Zekun Wang, Zeyu Cui, Zhenru Zhang, Zhipeng Zhou, and Zihan Qiu. Qwen3 Technical Report. arXiv preprint arXiv:2505.09388, 2025. URL https://arxiv.org/abs/2505.09388. Xiang Yue, Minxin Du, Tianhao Wang, Yaliang Li, Huan Sun, and Sherman S. M. Chow. Differential Privacy for Text Analytics via Natural Text Sanitization. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, p. 3853–3866, 2021. doi: 10.18653/v1/2021. findings-acl.337. URL https://aclanthology.org/2021.findings-acl.337/. Kaiyan Zhang, Jianyu Wang, Ermo Hua, Biqing Qi, Ning Ding, and Bowen Zhou. CoGenesis: A Framework Collaborating Large and Small Language Models for Secure Context-Aware Instruction Following. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, 2024. URL https://arxiv.org/abs/2403.03129. Min Zhang, Yuzhe Lu, Yun Zhou, Panpan Xu, Lin Lee Cheong, Chang-Tien Lu, and Haozhu Wang. Collaborative LLM Numerical Reasoning with Local Data Protection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, 2026. doi: 10.1609/aaai.v40i41.40779. URL https://ojs.aaai.org/index.php/AAAI/article/view/40779. 14 Preprint. AIMPLEMENTATION DETAILS A.1EVALUATION DATA Table 6: Construction of the evaluation subsets. ID denotes in-distribution evaluation, while OOD denotes datasets not used for Rewriter distillation or checkpoint selection. All evaluation sample IDs are fixed before model execution. ItemChartQANMSQAChartXSpoken-MQA Evaluation settingIDIDOODOOD Evaluated examples2,0002,0002,0002,000 Source poolHeld-out evaluation partition Held-out evaluation partition Official benchmark pool Official benchmark pool Evidence modalityImageAudioImageAudio Query / instruction modalityTextTextTextAudio problem with textual instruction EligibilitySingle numeric answer; readable PNG; duplicate questions removed Single consistent numeric reference; passage length ≤ 350 words QA task; parseable single numeric answer; readable chart image Valid audio; parseable numeric reference Rewriter distillation overlapNoneNoneNoneNone SelectionFixed before execution Fixed before execution Fixed before execution Fixed before execution ID evaluation subsets.We split the selected ChartQA (Masry et al., 2022) and NMSQA (Lin et al., 2022) records into disjoint training and test partitions and evaluate 2,000 eligible numeric-answer examples from each test partition. Eligible records are shuffled with seed 42 after removing duplicate media paths, and the selected sample IDs are fixed before evaluation. Distillation and checkpoint selection use only training-side records. OOD evaluation subsets. For out-of-distribution evaluation, we independently sample 2,000 numeric-answer examples from ChartX and 2,000 from Spoken-MQA. Neither dataset contributes records to Rewriter distillation or checkpoint selection. The selected sample IDs are fixed before evaluation and recorded in the run manifests. A.2COMPONENTS The implementation uses Qwen3-VL (Bai et al., 2025) for chart capture, Qwen3-ASR (Shi et al., 2026) for speech capture, Qwen3-4B (Yang et al., 2025) with QLoRA (Dettmers et al., 2023) for rewriting, DeepSeek-V4 (DeepSeek-AI, 2026a) for chart specifications, and Qwen3-TTS (Hu et al., 2026) for synthesis. The remote solver is Qwen3.5-Omni-Plus (Qwen Team, 2026a); the local references include Gemma 4 (Gemma Team, 2026) and Qwen2.5-Omni (Xu et al., 2025). Codex CLI (OpenAI, 2026a) and DeepSeek Harness (DSH) (DeepSeek-AI, 2026b) are alternative Stage 3 implementations that receive the same protected records as RECAST and reconstruct the target modality before evaluation by the same remote solver. Algorithm 1 summarizes the transformation of a single request, withr = mcorresponding to same-modality release. A.3NUMERICAL MAPPING AND RECOVERY Currency prefixes and thousands separators are normalized, so that each repeated value has one identity. Nonnegative integers from 0 to 15 remain unchanged unless detected as years. These small integers are intentionally preserved because they commonly encode task-structural quantities such as counts or indices rather than source-specific numerical content. Years are identified from context, as in “in 2016”, “from 2014 to 2017”, or “fiscal year 2015”, and grouped by era. Each group receives a shared random offset, which preserves differences within the group. The remaining values fall into three magnitude bands: below 1,263, from 1,263 to 2,100, and above 2,100. Within each band, random two-decimal replacements are drawn from a target range and sorted to preserve order, with checks against collisions with other replacements and preserved integers. For presentation, trailing 15 Preprint. Table 7: Component configuration. ComponentModel or implementationLocationInput Text parserdeterministic parser with field and schema validation LocalOriginal text evidence and question Chart-to-textQwen3-VL-8B-Instruct, question-aware prompt LocalOriginal chart and question Speech-to-textQwen3-ASR-1.7BLocalEvidence audio Numeral normalization text2num, isolated number words included LocalEvidence, question, choices RewriterQwen3-4B + distilled QLoRA adapterLocalNormalized five-field record Numerical maprole-aware banded map (Appendix A.3)LocalRewritten evidence and question Distillation teacherGPT-5.6-Sol (OpenAI, 2026b)Remote, offlineTraining-side records ChartSpec generation DeepSeek deepseek-v4-flash, JSON output RemoteProtected evidence and question ChartSpec review deepseek-v4-flash-vision-expRemoteSpecification, protected text, rendered chart Chart renderingfixed Matplotlib templates (bar, grouped bar, stacked bar, line, pie, table) LocalValidated ChartSpec Speech synthesisQwen3-TTS-FlashRemoteProtected passage SolverQwen3.5-Omni-Plus (DashScope compatible mode) RemoteProtected artifact and question Program executionseparate process, 5 s timeoutLocalRestored program Remote-native reference Qwen3.5-Omni-Plus, same solver prompt, no inverse map RemoteOriginal artifact and question Local referencesGemma-4-E4B; Qwen2.5-Omni-3B; Qwen3-VL-8B-Instruct image-to-code (ChartQA) LocalOriginal artifact and question Leakage judge qwen3.5-omni-plus-2026-03-15, native multimodal Remote, evaluation only Original and solver-bound contexts zeros are omitted, so a sampled value such as 48.00 may be displayed as 48. Each original value receives the same replacement throughout evidence and query. Deployment draws a fresh map for each request. For reproducibility, the mapping RNG is initialized once with seed 42 at the beginning of each experimental run and is not reset for individual requests. The solver marks observed operands asprotected(<number>). Recovery maps each marked literal throughh −1 and leaves preserved integers unchanged. The restored program then computes on the original values. A.4DISTILLATION DATA Each teacher request rewrites one five-field record, with a fixed two-example demonstration (one chart, one audio). An output is accepted if it satisfies all of the following: • it is a one-element JSON array with exactly the five fields; • id and modality are byte-identical to the input; • choices keep their length and order; • context and question are nonempty; • every field keeps its sequence of numerical literals. Accepted pairs are deterministically split into training and development sets. Table 8: Distillation corpus. ItemTotal NMSQA ChartQA Source records16,3707,0009,370 Accepted pairs15,7956,7429,053 Rejected (changed numerical literals)575258317 Training pairs15,4806,6048,876 Validation pairs315138177 16 Preprint. Algorithm 1 RECAST transformation for one request Require: Private source X , query q, optional choices C, input modality m, output modality r Ensure: Protected pair ( e X,eq) and locally retained inverse map h −1 , or failure Stage 1: Evidence Capture 1: if m = text then 2: c← PARSETEXT(X) 3: else if m = image then 4: c← CHARTTOTEXT(X,q) 5: else if m = audio then 6: c← ASR(X) 7: end if 8: R←id, modality:m, context:c, question:q, choices:C 9: R num ← NORMALIZENUMERALS(R) 10: D ←R num ▷ Retained locally for source-consistency checking Stage 2: Joint Rewriting and Numerical Protection 11: repeat 12: R← REWRITER(R num ) 13: until VALIDATE(R) 14: h← BUILDROLEAWAREMAP(R.context,R.question) 15: (ec,eq)← APPLYMAP(h,R.context,R.question) Stage 3: Modality Reconstruction and Validation 16: if r = text then 17: e X ← SERIALIZEPROTECTEDTEXT(ec) 18: else if r = image then 19: e X ← SPECRENDERREVIEWREPAIR(ec,eq) 20: else if r = audio then 21: e X ← SYNTHESIZEANDCHECKSPEECH(ec,eq) 22: end if 23: if¬RELEASECHECK(X,q, e D, e X,eq,h −1 ) then 24: return RELEASEFAILURE 25: end if 26: return ( e X,eq)▷ Keep h −1 local Of the accepted pairs, 129 are reused from an earlier accepted pass, and 1,718 change the number of sentences, which the filters allow. We release the accepted teacher traces, so the student can be retrained directly from them. Figs. 5-8 characterize the 15,795 accepted pairs. The chart records cover all four chart types with a consistent mix of question operations (Figs. 5 and 6), and both modalities span a broad range of topics (Fig. 7). Rewriting replaces the source vocabulary with substitute entities and topics (Fig. 8). Chart types, question operations, and topics are assigned by keyword rules. Image n = 9,021 38.6% Vertical bar 28.0% Horizontal bar 19.3% Dot-line 14.1% Line a Image: chart types Audio n = 6,742 9.8% Sports 11.9% Science & technology 12.5% Politics & law 13.3% Arts & media 9.8% Religion 8.3% Geography 7.9% War & military 5.9% Economy & business 1.9% Education 18.7% Other b Audio: topics Figure 5: Chart types of the image records (a; 32 records with no identifiable type are omitted) and topics of the audio records (b) in the distillation corpus. 17 Preprint. DifferenceRatioValue lookupExtremumSumCountYes/no Average Vertical bar (n = 3,485) Horizontal bar (n = 2,523) Dot-line (n = 1,740) Line (n = 1,273) 42.5 16.016.08.84.95.23.13.5 40.1 15.016.49.84.55.15.33.8 46.0 19.115.06.04.32.83.73.0 46.6 19.715.45.34.21.64.62.6 43.1%16.8%15.8%8.0%4.6%4.2%4.1%3.4% Image: question operation within each chart type (%; grey: overall share) 0 25 50 Figure 6: Question operations within each chart type of the image records. Each row sums to 100%; grey numbers give the share of each operation over all image records. Technology 1.9% Population 5.3% Other 6.7% Energy & environment 7.0% Health 7.5% Agriculture & land 10.1% Labor 11.5% Education 13.2% Trade 16.7% Economy & finance 20.2% a Image: topics (n = 9,053) Education 1.9% Economy & business 5.9% War & military 7.9% Geography 8.3% Religion 9.8% Sports 9.8% Science & technology 11.9% Politics & law 12.5% Arts & media 13.3% Other 18.7% b Audio: topics (n = 6,742) Figure 7: Topics of the image (a) and audio (b) records. Circle area is proportional to the share of records; circle position carries no meaning. A.5REQUEST LOGS Each solver request is logged before transmission with its messages, model identifier, decoding settings, endpoint, system prompt, and attached media; logging must succeed before the network call proceeds. Transport retries and format repairs receive distinct event identifiers with parent links, and the leakage audit aggregates all solver events of an example. ChartSpec generation, chart review, and TTS requests are logged as a separate reconstruction boundary containing the protected record, specification candidates, review inputs, TTS passage, and response metadata. Original inputs and inverse maps stay local; the leakage judge receives original inputs only inside the evaluation workflow. BEVALUATION DETAILS B.1ANSWER MATCHING For numerical prediction p and acceptable reference g, a prediction is correct if |p− g|≤ max 10 −6 , r d max(|p|,|g|, 1) ,(7) withr d = 10 −6 for ChartQA and NMSQA. Nonnumeric aliases use normalized exact matching. Acceptable references are derived from the original answer, question, and trusted local evidence, never from predictions. For ChartQA, an unambiguous million or billion unit in the local chart description admits both the scaled and absolute value, and questions asking for a percentage, rate, ratio, or probability admit both proportion and percentage-point forms. Years, structural counts, and denominator units such as “per million” are not expanded. The evaluator requires identical sample IDs across compared methods. 18 Preprint. a Image, sourceb Image, after rewriting c Audio, sourced Audio, after rewriting Figure 8: Most frequent content words in the image (a, b) and audio (c, d) records before and after teacher rewriting. Word size and shade increase with frequency; chart-description and function words are removed. B.2LEAKAGE AGGREGATION For image inputs, the original contextA i contains the image and query. For audio inputs, it contains the audio, query, and trusted local transcript. The solver-bound contextB i contains all recorded solver requests of examplei. The judge returns four binary labels for each pair(A i ,B i ), and the example counts as leaked if any label is positive. In the reported experiments, every sample ID eventually produced a solver-bound request after validation; no sample ended in a terminal release failure. Therefore, the leakage rate over all examples equals the rate over delivered requests. All RECAST rows of Tabs. 1 and 3 have resolved labels for every example. B.3LOCAL REFERENCES The evaluated local models are Gemma 4 (Gemma Team, 2026), Qwen2.5-Omni (Xu et al., 2025), and Qwen3-VL (Bai et al., 2025). The Qwen3-VL reference uses the same 2,000 ChartQA examples and checkpoint as chart evidence capture. It receives the original chart and question and returns a program, which the shared local parser executes and scores. The local rows establish the zero-leakage reference because their original inputs never leave the device. Remote-native serves as the full-exposure reference by construction: the original media and query are sent directly to the solver, and its accuracy therefore defines the unprotected reference for NAcc. Under our exposure definition, Remote-native reveals the complete source input by design, although we do not separately score it with the leakage judge. B.4RELEASE CHECKS The protected-record check verifies that rendered values, labels, units, category-series associations, and queried visual attributes agree with the protected record and validated ChartSpec. For speech, it verifies that the transcription of the candidate waveform agrees with the protected passage in quantities, entity references, and the content the query needs. The source check aligns rewritten entities with their source roles, inverts mapped values, and compares the result with the original input. For charts, it covers category-value assignments, legend-series associations, ordering, and queried visual attributes; for speech, it covers entity-quantity associations, coreference, event order, and temporal or comparative dependencies. A candidate is released only if both checks pass. 19 Preprint. Table 9: Accuracy of evaluated local references. ModelChartQA NMSQA Overall Gemma-4-E4B49.5044.6047.05 Qwen2.5-Omni-3B23.7046.3035.00 Qwen3-VL-8B-Instruct image-to-code62.80– Table 10: Accuracy and leakage (%) of local models, RECAST, and the remote solver. Method Accuracy↑Leakage↓ ChartQA NMSQA Overall ChartQA NMSQA Overall Local, original input Qwen2.5-Omni-3B23.7046.3035.00000 Gemma-4-E4B49.5044.6047.05000 Qwen3-VL-8B62.80–000 RECAST (Ours)70.2080.0075.108.007.907.95 Remote solver (Qwen3.5-Omni-Plus) Remote-native, original media75.1087.4081.25– B.5TEXT ANONYMIZER DIAGNOSTICS We adapt RLAA (Duan et al., 2026) and Eternis-Anonymizer-4B (Eternis, 2025) to the same five-field record interface. The sourceAis the normalized five-field record, andBis the anonymizer’s output before numerical mapping. The judge is Qwen3.7-Plus (Qwen Team, 2026b) with temperature 0 and a 512-token budget. Coverage is the fraction of records accepted by the adapter. Leakage is the fraction of positive judgments among accepted records with resolved judgments. Table 11: Per-modality coverage and leakage. RewriterChartQA coverage ChartQA leakage NMSQA coverage NMSQA leakage RLAA-Qwen3-4B100.0086.80100.0073.70 Eternis-Anonymizer-4B100.0096.70100.0093.20 Both adapters use the five-field record. RLAA uses Qwen3-4B, up to three revisions, and numerical- literal checks; Eternis uses its official opening-bracket prefill, with quantity replacements removed to meet the numerical-literal contract. B.6HUMAN CALIBRATION OF THE LEAKAGE JUDGE Sample. We drew 400 solver-bound pairs in eight cells of 50. Six in-distribution cells cross the two datasets (ChartQA, NMSQA) with three Rewriter conditions (untuned Qwen3-4B, distilled RECAST, and the GPT-5.6-Sol teacher). Two out-of-distribution cells contain distilled RECAST outputs on ChartX and Spoken-MQA, so that calibration also covers the setting of Tab. 3. Judge-positive and judge-negative cases were sampled in roughly equal numbers within each cell; cells with few judge-positive cases, such as the teacher on NMSQA, include all of them. Annotation. Three annotators labeled each pair with the four-view rubric of Appendix D. Pairs were shuffled across cells. Annotators saw the original context A and the solver-bound context B, and they did not see the condition or the judge’s labels. Disagreements were resolved by majority vote; for the any-positive decision, each annotator’s label is the OR of their four views. Manual inspection of calibration cases containing preserved integers in the 0-15 range did not identify judge errors attributable to this mapping rule. 20 Preprint. Table 12: Agreement between the judge and human labels. ViewJudge-human agreement (%) Cohen’s κ (judge vs. human) Inter-annotator κ Semantic92.00.820.81 Lexical89.50.740.72 Correspondence93.80.850.84 Linkability88.30.700.69 Any-positive (reported metric)91.50.830.78 On the any-positive decision, the judge labels 202 pairs positive and the human majority labels 198 positive, with 183 in common. The judge’s precision and recall against human labels are therefore 90.6% and 92.4%. Reweighting the two in-distribution RECAST cells to the full evaluation set gives a human-labeled leakage rate of 8.70%, compared with 7.95% from the judge. B.7PSIC DIAGNOSTIC PSIC (Shen et al., 2025) produces a protected decoding of each of 2,000 ChartQA images. Our diagnostic compares the protected image with its source using the native multimodal Qwen3.5-Omni- Plus (Qwen Team, 2026a) leakage judge, without the question or a downstream solver request. All 2,000 judgments resolve, with 564 positive decisions (28.20%). This image-only measure does not include the full solver-bound context used to score RECAST. PSIC does not provide the operand- recovery mechanism required to recover the original numerical answer, so its protected outputs cannot support end-to-end answering under our protocol. B.8SPTI DIAGNOSTIC SPTI (Wang et al., 2025) synthesizes 2,000 ChartQA images using local Qwen3-4B and(ε,δ) = (1.0, 1.448× 10 −4 )(clean-image FID 89.70). Across the dataset, no source-content leakage is detected under the caption-based diagnostic. Shuffled voting leaves the synthesized images unpaired with the original questions, so they cannot be used for sample-level end-to-end answering under our protocol. B.9AUDIOSHIELD DIAGNOSTIC AudioShield (Jin et al., 2025) protects 2,000 NMSQA recordings with the released LS-TUAP algorithm path and an upstream VITS backend at 16 kHz. The run manifest marks this configuration as non-paper-equivalent. We compare the original normalized transcript with Qwen3-ASR-1.7B (Shi et al., 2026) transcriptions of the protected waveforms. The Qwen3.7-Plus (Qwen Team, 2026b) text leakage judge resolves all 2,000 pairs and labels 12 positive (0.60%). The protected-audio transcriptions are at most 20 characters for 1202 examples; the low leakage rate therefore also reflects suppression of recognized speech. AudioShield is designed to suppress recognizable speech rather than preserve the task content required for numerical reasoning; its protected audio therefore cannot support end-to-end answering under our protocol. CHYPERPARAMETERS The student is Qwen3-4B (Yang et al., 2025) trained with QLoRA (Dettmers et al., 2023); the offline teacher is GPT-5.6-Sol (OpenAI, 2026b). Table 13: Rewriter training. ParameterValue StudentQwen3-4B, QLoRA (NF4, bfloat16 compute) LoRA rank / α / dropout16 / 32 / 0.05, all linear layers Learning rate / schedule1e-4, cosine, 0.03 warm-up ratio Epochs / gradient accumulation2 / 8 Maximum sequence length4,096 Lossassistant tokens only Optimizerpaged AdamW 8-bit Checkpoint interval / seed250 steps / 42 Final validation loss0.404 TeacherGPT-5.6-Sol, temperature 0, max 5,000 output tokens, up to 3 retries 21 Preprint. Table 14: Inference settings. ComponentSetting Chart-to-textgreedy decoding, bfloat16, max 2,200 new tokens Speech-to-textbfloat16, batch size 1, max 512 new tokens Rewriterthinking disabled, temperature 0.2, top-p 0.9, max 16,384 new tokens Numerical mappolicy preserve_integers_0_15_semantic_years.v1, seed 42 ChartSpec generationJSON output, max 6,000 tokens, up to 3 attempts ChartSpec reviewmax 2,000 tokens, up to 3 attempts Chart repairs / render timeout4 / 45 s TTSspeed 1.0, 120 s timeout Solvertemperature 0, max 2,000 tokens, streaming; up to 5 transport attempts and 3 format repairs Leakage judge temperature 0, max 512 tokens, up to 2 transport retries and 1 format repair Program executionseparate process, 5 s timeout DPROMPT SPECIFICATIONS RECAST uses task-specific prompts for evidence capture, semantic rewriting, remote reasoning, and source- content auditing. The prompts are designed to make the role of each model explicit while keeping the protection and recovery logic independent of model-specific hidden representations. Chart evidence capture.The chart-to-text model receives the chart together with its query and is instructed to extract the evidence required for downstream reasoning rather than answer the query directly. The prompt requests visible labels, values, units, category-value and legend-series correspondences, ordering, and query- relevant visual attributes. The resulting description is organized as task evidence for the shared textual record. Joint semantic rewriting.The Rewriter operates on the complete five-field record and rewrites the evidence and query jointly into a coherent but semantically distinct domain. It is instructed to change source-specific entities, topics, and descriptions while preserving evidence-query correspondence and task-relevant relations. These include quantity roles, category-value and legend-series associations, coreference, event order, temporal or comparative relations, the requested reasoning operation, and the answer type. Numerical literals must remain unchanged at this stage and are handled separately by the numerical mapping module. Remote solver. The solver receives only the protected artifact and protected query. Its prompt asks it to identify the evidence required by the query, select the corresponding operands and operations, and return a single executable Python program. Numerical operands read from the protected input are explicitly marked as protected(<number>)so that they can be restored locally before execution. The prompt also requires the solver to report when the necessary evidence is unavailable rather than infer or fabricate missing values. Source-content audit. The audit prompt compares the original local context with the complete solver- bound context and tests whether sample-specific source information remains recoverable. It separates source- content leakage into semantic, lexical, correspondence, and linkability views, while explicitly excluding generic reasoning structure such as arithmetic, comparison, ordering, and selection. The fixed audit prompt is reproduced below. Given original local multimodal context A and the complete solver-bound context B, including retries and format repairs, audit B as a model-based attack probe against A. Return four labels: semantic_leakage, lexical_leakage, correspondence, and linkability. For semantic_leakage, test leakage of original entities, topics, categories, labels, values, dates, visual scenes, audio events, or other sample-specific meaning. For lexical_leakage, test wording, phrase fragments, local syntax, unusual n-grams, and distinctive expressions. For correspondence, test whether original numerical values or entity-value relations can be recovered or matched. For linkability, test whether B can be linked or re-identified back to A from its protected content or combinations of clues. Ignore differences in modality, formatting, layout, sentence structure, and ordinary surface wording. A generic operation such as counting, comparison, ordering, arithmetic, ratio, selection, or extraction is not leakage by itself when sample-specific content has changed. Compare B with A itself, never with another rewritten sample. Output exactly: Semantic: Yes or No; Lexical: Yes or No; Correspondence: Yes or No; Linkability: Yes or No; Explanation: <brief evidence for each label>. 22 Preprint. EVISUALIZATION RESULTS Case 1 (a) Input (b) SPTI(c) PSIC (d) RLAA(e) Eternis(f) RECAST(Ours) Case 2 (a) Input (b) SPTI(c) PSIC (d) RLAA(e) Eternis(f) RECAST(Ours) Case 3 (a) Input (b) SPTI(c) PSIC (d) RLAA(e) Eternis(f) RECAST(Ours) Case 4 (a) Input (b) SPTI(c) PSIC (d) RLAA(e) Eternis(f) RECAST(Ours) Figure 9: Four ChartQA comparisons: input, SPTI (Wang et al., 2025), PSIC (Shen et al., 2025), RLAA (Duan et al., 2026), Eternis (Eternis, 2025), and RECAST. SPTI samples are unpaired; the other outputs follow the source sample ID. 23 Preprint. Case 5 (a) Input ... Since the promulgation of the 1993 Constitution, several Andorranization policies have been enforced, like Catalan-medium education. (b) AudioShield ASR Ever since the creation of the United States, the Southern organization has been a force for change. (c) RLAA ... Since the promulgation of the 1993 Constitution, several Sanmarinization policies have been enforced, like Italian-medium education. (d) Eternis ... Since the promulgation of the 1993 Constitution, several Andorranization policies have been enforced, like Catalan-medium education. (e) RECAST(Ours) ... Since the promulgation of the 1708.53 Survey Manual, several observatory-standardization policies have been enforced, including ... Case 6 (a) Input ... and there is evidence of ale being served as early as AD 560. (b) AudioShield ASR So much, so much (c) RLAA ... and there is evidence of ale being served as early as AD 560. (d) Eternis ... and there is evidence of ale being served as early as AD 560. (e) RECAST(Ours) ... and there is evidence of star maps being displayed as early as AD 2110. Case 7 (a) Input ... In 2015, the rate of pub closures came under the scrutiny of Parliament in the UK, with a promise of legislation to improve relations between ... (b) AudioShield ASR The brass is brass. (c) RLAA ... In 2015, the pace of building demolitions came under the review of Congress in the US, with a pledge of legislation to enhance relations between ... (d) Eternis ... In 2015, the rate of pub closures came under the scrutiny of Parliament in the anonymized_country_1, with a promise of legislation to improve ... (e) RECAST(Ours) ... In 2014, the rate of manuscript losses came under the scrutiny of the National Council in the Republic of Veyra, with a promise of legislation to ... Case 8 (a) Input In 1968, while selling 50 million comic books a year, company founder Goodman revised the constraining distribution arrangement with Independent ... (b) AudioShield ASR No, no, (c) RLAA In 1968, while selling 50000000 magazines a year, company founder Goodman revised the constraining distribution arrangement with Independent News ... (d) Eternis In 1968, while selling 50000000 comic books a year, company founder AnonPublisher1 revised the constraining distribution arrangement with ... (e) RECAST(Ours) In 2014, while processing 13405.19 radio pulses a year, facility founder Ilyan revised the restrictive routing protocol with the Meridian Relay ... Case 9 (a) Input ... Von Neumann proved his minimax theorem in 1928. ... (b) AudioShield ASR I'm not a fool. (c) RLAA ... Gödel proved his completeness theorem in 1930. ... (d) Eternis ... Von Neumann proved his minimax theorem in 1928. ... (e) RECAST(Ours) ... Voss proved his balanced-flow theorem in 2000. ... Figure 10: Five NMSQA audio comparisons: input transcript, AudioShield (Jin et al., 2025) protected- audio ASR, RLAA (Duan et al., 2026) and Eternis (Eternis, 2025) protected text, and RECAST transcript. 24

Instant research discovery