Paper deep dive

GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation

Ruiyi Yang, Gayathri Lihinikaduarachchi, Rahat Masood, Flora D. Salim, Salil S. Kanhere

Year: 2026Venue: arXiv preprintArea: cs.AIType: PreprintEmbeddings: 77

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%

Last extracted: 9/1/2026, 6:16:27 AM

Summary

GuardianAgent is a policy-conditioned privacy protection framework for live web traffic that combines structured risk assessment with verified adaptive text anonymization. It uses the Adaptive Multi-factor Risk Scoring Formula (AMRSF) to compute risk based on policy violation likelihood, data sensitivity, recipient, purpose, and context, determining whether to allow, transform, or deny actions. For transformations, it employs a five-level anonymization hierarchy escalated only by a verified adversarial guesser to prevent hallucination-driven over-anonymization. The system uses an evidential fast path for low-uncertainty cases and an LLM slow path for uncertain ones, achieving superior privacy-utility trade-offs across legal, social media, and synthetic PII benchmarks.

Entities (10)

GuardianAgent · system · 100%AMRSF · algorithm · 95%UNSW Sydney · organization · 95%AgentStealth · system · 90%CONFAIDE · system · 90%PII-Masking-300k · dataset · 90%Rescriber · system · 90%SynthPAI · dataset · 90%TAB · dataset · 90%Staab et al. · researcher · 85%

Relation Signals (11)

Ruiyi Yang → affiliatedwith → UNSW Sydney

confidence 95% · Ruiyi Yang Affiliation: School of Computer Science and Engineering, UNSW Sydney, Australia

AMRSF → determines → allow/transform/deny

confidence 95% · This risk score determines both the allow/transform/deny decision and the initial anonymization level.

GuardianAgent → uses → AMRSF

confidence 95% · GuardianAgent computes risk through AMRSF (Adaptive Multi-factor Risk Scoring Formula)...

GuardianAgent → evaluatedon → PII-Masking-300k

confidence 90% · multi-format synthetic PII records (PII-Masking-300k)...

GuardianAgent → evaluatedon → SynthPAI

confidence 90% · Reddit posts (SynthPAI)...

GuardianAgent → evaluatedon → TAB

confidence 90% · Experiments across three benchmarks spanning legal text (TAB)...

GuardianAgent → uses → verified adversarial guesser

confidence 90% · For rewriting, it applies a five-level hierarchy driven by a verified adversarial guesser...

GuardianAgent → outperforms → CONFAIDE

confidence 85% · GuardianAgent achieves the strongest privacy–utility trade-off among published baselines...

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Privacy protection for live web traffic requires more than detecting private spans. Agent-based privacy protection systems must determine whether an outgoing action complies with the destination site's privacy policy, then apply only the level of rewriting or sanitisation justified by the residual disclosure risk. We present GuardianAgent, a policy-conditioned anonymization framework that couples structured risk assessment with verified adaptive rewriting. GuardianAgent computes risk through AMRSF (Adaptive Multi-factor Risk Scoring Formula), an explicit controller that combines policy-violation likelihood with data sensitivity, recipient transmission, purpose legitimacy, contextual basis, and policy transparency, rather than relying on an LLM to assign risk directly. This risk score determines both the allow/transform/deny decision and the initial anonymization level. For efficiency, GuardianAgent uses an evidential fast path for low-uncertainty policy matches and invokes an LLM slow path only for uncertain cases. For rewriting, it applies a five-level hierarchy driven by a verified adversarial guesser: guesses trigger escalation only when supported by the original text, preventing hallucinated attacker confidence from causing unnecessary over-anonymization. Experiments across three benchmarks spanning legal text (TAB), Reddit posts (SynthPAI), and multi-format synthetic PII records (PII-Masking-300k) show that GuardianAgent achieves the strongest privacy-utility trade-off among published baselines and is the only method to reach more than 0.90 privacy in all three domains, remaining robust under a backbone switch. Action-context stress tests further show that the same outgoing text receives different decisions and anonymization strengths under different recipients, purposes, action bases, and policy-transparency conditions.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

73,938 characters extracted from source content.

Expand or collapse full text

GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation Ruiyi Yang Affiliation: School of Computer Science and Engineering, UNSW Sydney, Australia Email: ruiyi.yang@student.unsw.edu.au Gayathri Lihinikaduarachchi Affiliation: School of Computer Science and Engineering, UNSW Sydney, Australia Email: g.lihinikaduarachchillage@student.unsw.edu.au Rahat Masood Affiliation: School of Computer Science and Engineering, UNSW Sydney, Australia Email: rahat.masood@unsw.edu.au Flora D. Salim Affiliation: School of Computer Science and Engineering, UNSW Sydney, Australia Email: flora.salim@unsw.edu.au Salil S. Kanhere Affiliation: School of Computer Science and Engineering, UNSW Sydney, Australia Email: salil.kanhere@unsw.edu.au Abstract Privacy protection for live web traffic requires more than detecting private spans. Agent-based privacy protection systems must determine whether an outgoing action complies with the destination site’s privacy policy, then apply only the level of rewriting or sanitisation justified by the residual disclosure risk. We present GuardianAgent, a policy-conditioned anonymization framework that couples structured risk assessment with verified adaptive rewriting. GuardianAgent computes risk through AMRSF (Adaptive Multi-factor Risk Scoring Formula), an explicit controller that combines policy-violation likelihood with data sensitivity, recipient transmission, purpose legitimacy, contextual basis, and policy transparency, rather than relying on an LLM to assign risk directly. This risk score determines both the allow/transform/deny decision and the initial anonymization level. For efficiency, GuardianAgent uses an evidential fast path for low-uncertainty policy matches and invokes an LLM slow path only for uncertain cases. For rewriting, it applies a five-level hierarchy driven by a verified adversarial guesser: guesses trigger escalation only when supported by the original text, preventing hallucinated attacker confidence from causing unnecessary over-anonymization. Experiments across three benchmarks spanning legal text (TAB), Reddit posts (SynthPAI), and multi-format synthetic PII records (PII-Masking-300k) show that GuardianAgent achieves the strongest privacy–utility trade-off among published baselines and is the only method to reach ≥0.90≥\!0.90 privacy in all three domains, remaining robust under a backbone switch. Action-context stress tests further show that the same outgoing text receives different decisions and anonymization strengths under different recipients, purposes, action bases, and policy-transparency conditions.11 1 Code and evaluation harness at https://anonymous.4open.science/r/guardianAgent/. 1 Introduction Modern web applications routinely expose fine-grained personal signals through form fields, paste events, outbound requests, clipboard content, and chatbot interactions. A browser-based privacy agent should therefore intervene before an action leaves the browser: it must determine whether the action is consistent with the destination site’s privacy policy, and when needed, rewrite the outgoing content to reduce privacy leakage (Zhou et al., 2025; Staab et al., 2025; Chen et al., 2023b; Mireshghallah et al., 2023). This setting brings together two NLP problems that are usually studied in isolation: policy matching, which grounds an observed action in a heterogeneous privacy policy, and text anonymization, which rewrites content so that sensitive attributes cannot be inferred. Existing work leaves three gaps. First, policy-understanding systems classify, retrieve, or summarize privacy-policy statements (Harkous et al., 2018; Ahmad et al., 2021; Srinath et al., 2021a; Tang et al., 2023; Sun et al., 2025), and recent LLM-based interfaces make policies easier to query and assess (Chen et al., 2025; Freiberger et al., 2026). However, these systems do not provide an operational risk signal that links live action context to the required strength of anonymization. The same text may be acceptable with light rewriting when sent to a first-party service for core functionality, but require stronger rewriting or blocking when sent to an advertising network for profiling. Second, recent LLM-based anonymizers often invoke a large model for every browser event (Staab et al., 2025; Shao et al., 2025), making them poorly suited for low-latency browser-resident mediation. Third, adversarial anonymizers commonly escalate rewriting whenever an auxiliary attacker reports high confidence. Such confidence, however, may reflect hallucinated priors rather than genuine residual leakage. For example, given [PERSON] going to [LOCATION] this afternoon, an attacker may confidently guess “coffee shop” although the original was “school with Bob”, causing unnecessary over-anonymization. This paper presents GuardianAgent, a policy-conditioned privacy agent that couples structured risk assessment with verified adaptive anonymization. GuardianAgent computes risk through AMRSF, an explicit controller that combines policy-violation likelihood with data sensitivity, recipient transmission, purpose legitimacy, contextual basis, and policy transparency. The resulting score jointly determines the allow/transform/deny decision and the initial anonymization level, ensuring that rewriting strength is controlled by action context rather than by an LLM-assigned risk judgment alone. To reduce latency, GuardianAgent uses an evidential fast path for low-uncertainty policy matches and routes only uncertain cases to an LLM slow path. The anonymizer then applies a five-level rewrite hierarchy and escalates only when a verified adversarial guesser identifies residual leakage that is actually supported by the original text. Our main contributions are: • Policy-conditioned risk-adaptive anonymization: we introduce a structured risk score that jointly governs action-level decisions and anonymization strength. Action-context stress tests show that the same outgoing text receives different decisions and initial anonymization levels depending on recipient, purpose, action-basis, and policy transparency. • Verified adversarial anonymization: we propose a hierarchical anonymizer that escalates rewriting only when adversarial guesses are supported by the original text, preventing hallucinated confidence from triggering unnecessary semantic distortion. • Cross-domain empirical validation: experiments on legal text (TAB), Reddit posts (SynthPAI), and multi-format PII records (PII-Masking-300k) show that GuardianAgent consistently improves the privacy–utility trade-off over published baselines, is the only method to reach ≥0.90≥\!0.90 privacy across all three domains, and maintains its gains under a backbone switch. 2 Related Work Privacy-policy grounding. Prior work has developed methods for extracting structured statements from privacy policies to enable downstream systems to reason about data practices. Polisis (Harkous et al., 2018) trained classifiers on the OPP-115 schema (Wilson et al., 2016); PrivaSeer (Srinath et al., 2021a) built a corpus-scale search infrastructure for privacy policies; PrivBERT (Srinath et al., 2021b) and PolicyGPT (Tang et al., 2023) studied domain-adaptive and LLM-based policy understanding; and Ahmad et al. (2021) framed policy analysis as joint intent classification and slot filling. These systems make privacy policies more machine-interpretable, but they primarily support descriptive analysis: they do not directly ground a live browser action in the relevant policy evidence, nor do they determine whether the outgoing content should be allowed, rewritten, or blocked. Privacy-risk frameworks. Quantitative privacy-risk modelling draws on regulatory tiering and contextual theories, including NIST SP 800-122 (McCallister, 2010) and GDPR special categories (Regulation, 2016), FAIR-style likelihood–impact products (Cronk and Shapiro, 2021), and contextual integrity (Nissenbaum, 2009; Mireshghallah et al., 2023). Recent LLM-based systems further support privacy-policy assessment and risk comprehension (Sun et al., 2025; Xie et al., 2025), while agent-oriented work studies privacy risks in interactive LLM systems (Ngong et al., 2025). These works are mainly used for explanation, auditing, or evaluation; GuardianAgent instead uses risk factors as a runtime controller linking policy evidence and action context to mediation decisions and anonymization strength. LLM-based text anonymization. Recent anonymization methods increasingly rewrite content rather than only tagging sensitive spans. Staab et al.’s adversarial anonymizer (Staab et al., 2025) iteratively rewrites text until a simulated attacker cannot infer attributes; AgentStealth (Shao et al., 2025) distils this adversarial loop with reinforcement learning; HaS (Chen et al., 2023b) sanitizes prompts before third-party LLM calls; CONFAIDE (Mireshghallah et al., 2023) applies contextual-integrity prompts; and Rescriber (Zhou et al., 2025) uses a small LLM for on-device chat privacy. Related work also studies entity-tagging approaches (Mancera et al., 2025), clinical-text anonymization (Pissarra et al., 2024), differential privacy for prompts (Duan et al., 2023), and private-attribute randomization (Frikha et al., 2025). These methods improve privacy protection beyond span detection, but adversarial rewriting loops often treat attacker confidence as direct evidence of residual leakage. This can trigger unnecessary rewriting when a guess is plausible under world knowledge but not actually supported by the original text. Dual-system inference and uncertainty gating. Routing only hard cases to an expensive model is a well-established efficiency strategy. FrugalGPT (Chen et al., 2023a) cascades LLMs to reduce inference cost; BranchyNet (Teerapittayanon et al., 2016) adds early exits for neural networks; and fast/slow hybrid architectures draw on the broader dual-system view of decision-making (Kahneman, 2011). Evidential deep learning (Sensoy et al., 2018) provides a principled mechanism to estimate epistemic uncertainty and decide when to escalate. In privacy mediation, however, uncertainty gating cannot be only cost-driven: fast-path decisions must remain grounded in policy evidence, and uncertain cases must be escalated conservatively, as errors may expose sensitive information. Positioning. GuardianAgent connects these lines of work by formulating live privacy mediation as policy-conditioned risk-adaptive anonymization. A structured risk controller links policy evidence and action context to both action-level decisions and anonymization strength, while verified adversarial feedback ensures that rewriting escalates only in response to residual leakage supported by the original text rather than hallucinated attacker confidence. 3 Method Figure 1: Framework of GuardianAgent. Policy matching estimates the violation likelihood L, and AMRSF converts it into an action-conditioned risk score R. The score has two effects: it determines the action decision y∈allow,transform,denyy∈\ allow, transform, deny\, and, for transformed actions, its normalized transform-band position z selects the initial anonymization level ℓ0(z) _0(z). The hierarchical anonymizer then escalates when leakage is detected. 3.1 Overview A web action is represented as =(d,,ℛ,,b,x)∈,a=(d,D_a,R_a,P_a,b_a,x_a) , where d is the destination domain, D_a the data categories (e.g., email, location, health, financial, or free-text content), ℛR_a the recipients, P_a the declared purposes, b∈user-initiated,default,backgroundb_a∈\user-initiated,default,background\ the action basis, and x∈Σ∗x_a∈ the outgoing text. Here, user-initiated denotes an explicit user action such as submitting a form or pasting text, default denotes routine processing needed for the requested service, and background denotes passive or script-triggered transmission without an immediate user action. Privacy policies are segmented into atomic statements S, each annotated with structured fields such as data category, recipient, purpose, legal basis, retention, and user-rights disclosures. A retriever Topk Top_k selects the k most relevant policy statements as evidence ℰ=Topk(,)E= Top_k(a,S).The matcher then emits an action decision and risk score, (y,R)=M⁡(,ℰ),(y,R)=M(a,E), =allow,transform,deny,Y=\ allow, transform, deny\, and GuardianAgent implements Φ⁡(,)=A⁡(,y,R)∈×Σ∗. (a,S)=A (a,y,R ) × . (1) If y=transformy= transform, the anonymizer A uses the transform-band position of R to select an initial rewrite level and then uses verified adversarial feedback to decide whether further escalation is needed. GuardianAgent separates two controls: AMRSF determines the starting strength from action context, while the verified guesser adjusts that strength only when residual leakage is surface-supported. The overall framework is introduced in Figure 1. 3.2 Efficient Policy Matching The policy matcher estimates the likelihood that an outgoing action conflicts with the retrieved policy evidence. The likelihood L is then used as a learned input to the downstream risk controller R. To estimate L under the latency constraints of live web traffic, GuardianAgent uses a shared evidence retriever followed by a two-path matcher. Pre-segmented policies s∈s come with structured fields—data categories, actions, purposes, recipients, legal basis, rights, and retention—together with the original free-text snippet. The evidence set ℰ=Topk(,)E= Top_k(a,S) is retrieved using a hybrid score combining structured field overlap with lightweight lexical matching Score(,s)=αS~(,s)+(1−α)K~(,s), Score(a,s)=α\, S(a,s)+(1-α)\, K(a,s), (2) where S~ S is the normalized structured score, K~ K is a normalized BM25Lite score, α=0.6α=0.6, and k=8k=8. The fast path applies an evidential classifier to the action–evidence pair and outputs both the risky-class mass and epistemic uncertainty u. When u<τu,u< _u, (3) the risky-class mass is used as L. Otherwise, an LLM reasoning path estimates L from the same action and evidence. Importantly, the LLM estimates only L: it does not directly determine the final risk score, action decision, or anonymization level. The encoder, retrieval weights, prompts, and online fast-path update are specified in Appendix A and Appendix B. 3.3 Policy-Conditioned Risk Estimator The risk estimator converts the policy-violation likelihood L into an operational decision by accounting for the sensitivity and transmission context of the outgoing action. Given action a, retrieved evidence ℰE, and the likelihood L estimated by the matcher, AMRSF computes the action-conditioned risk score R⁡(,ℰ)=clamp[0,1](L⋅Seff⋅MT),R(a,E)=clamp_[0,1]\! (L· S_eff· M_T ), (4) where Seff=min⁡(1,Sd⋅Mtr⋅Mp⋅Mb).S_eff= \! (1,\;S_d· M_tr· M_p· M_b ). (5) Here SdS_d is base data sensitivity; MtrM_tr, MpM_p, and MbM_b adjust severity according to recipient transmission, purpose legitimacy, and action basis; and MTM_T accounts for policy transparency. Thus, unlike an LLM-assigned scalar risk judgment, R explicitly separates violation likelihood from the contextual severity of the outgoing action. These fixed factors are grounded in regulatory and empirical privacy-risk studies (McCallister, 2010; Regulation, 2016; Nissenbaum, 2009; Milne and Culnan, 2004; Ackerman et al., 1999; Bhatia and Breaux, 2018). Full numerical factors are reported in Tables 6–9 of Appendix C. Let t⁡()∈crit,high,mod,lowt(a)∈\crit,high,mod,low\ denote the highest data-sensitivity tier in D_a, with allow ceiling τat _a^t and deny floor τdt _d^t. Then action decision y=allowR<τat⁡(),transformτat⁡()≤R<τdt⁡(),denyR≥τdt⁡().y= cases allow&R< _a^t(a),\\ transform& _a^t(a)≤ R< _d^t(a),\\ deny&R≥ _d^t(a). cases (6) Sensitive tiers use a wider transform region so that uncertain high-risk actions are rewritten rather than released unchanged. Threshold values are reported in Table 10 of Appendix C. 3.4 Risk-Adaptive Hierarchical Anonymizer Figure 2: Example of the five-level anonymization hierarchy on a contextually sensitive paragraph. From L1 to L5, more entities and contextual cues are anonymized, making the text less specific while preserving overall meaning. The hierarchical anonymizer controls how strongly transformed content is rewritten, using risk to select a starting strength and verified feedback to determine whether further escalation is needed. When y=transformy= transform, GuardianAgent rewrites the outgoing text x_a using a five-level risk-adaptive hierarchy: L1 partial masking, L2 aggressive masking, L3 entity-tag replacement, L4 minimal-edit LLM rewriting, and L5 semantic LLM rewriting. The initial level is determined by its normalized position within the transform band: z⁡()=clip[0,1]⁡(R−τat⁡()τdt⁡()−τat⁡()),z(a)=clip_[0,1]\! ( R- _a^t(a) _d^t(a)- _a^t(a) ), (7) and select the initial anonymization level by z: ℓ0(z)=1z<0.25,20.25≤z<0.50,30.50≤z<0.75,4z≥0.75. _0(z)= cases1&z<0.25,\\ 2&0.25≤ z<0.50,\\ 3&0.50≤ z<0.75,\\ 4&z≥ 0.75. cases (8) Thus, transformed actions near the allow ceiling start with lighter rewriting, while those near the deny floor start from stronger levels. L1 partial masking, L2 aggressive masking, L3 entity-tag replacement, L4 minimal-edit LLM rewriting, and L5 semantic LLM rewriting. L1–L3 follow rule- and tag-based anonymization, L4 follows the minimal-edit paradigm, and L5 follows semantic iterative rewriting. Figure 2 illustrates how the hierarchy progressively removes specific entities and contextual cues while preserving the overall communicative intent. Lower levels preserve more of the original surface form and contextual detail, whereas higher levels are reserved for cases where weaker rewrites leave residual leakage. 3.5 Verified Adversarial Escalation Prior adversarial anonymizers use an auxiliary attacker to identify residual personal information and guide further rewriting (Staab et al., 2025; Shao et al., 2025). However, an attacker may assign high confidence to a plausible guess that is unsupported by the original text, causing unnecessary escalation and utility loss. GuardianAgent therefore verifies attacker guesses before allowing them to trigger stronger rewriting. Given anonymized text xℓx_ , the attacker returns guesses with confidences ⁡(xℓ)=(g,cg)G(x_ )=\(g,c_g)\. The verifier compares each guess against the original text x0x_0, which remains local to the anonymizer and is never exposed to the attacker. Let ⁡(s)W(s) denote the set of content words in s with length greater than two. A guess is admitted only if it is explicitly contained in x0x_0 or shares a content word with it: V(g,x0)=[g⊆x0]∨[(g)∩(x0)≠∅]. V(g,x_0)=1[g x_0] 1[W(g) (x_0)≠ ]. (9) The verified confidence is the maximum confidence among verified guesses: c^(xℓ,x0)=maxcg:(g,cg)∈(xℓ),V(g,x0)=1. c(x_ ,x_0)= \c_g:(g,c_g) (x_ ),\ V(g,x_0)=1\. (10) If no guess is verified, c^=0 c=0. Starting from the initial level ℓ0(z) _0(z), GuardianAgent anonymizes at level ℓ , queries the attacker, and escalates to ℓ+1 +1 only if c^≥τg c≥ _g. The loop terminates when c^<τg c< _g, when ℓ=5 =5, or after T=5T=5 rounds. Verification filters hallucinated or prior-driven guesses while preserving escalation signals for leakage that is supported by the original text. Equation 9 is explicitly lexical: it does not recognize a correct contextual inference that is surface-disjoint from x0x_0. We therefore treat it as an anti-hallucination and escalation-cost control rather than as the system’s contextual-inference defence; higher-risk flows instead start at L4 through R and receive semantic rewriting without waiting for the verifier. The pseudocode, lexical verification guarantee, and the expected-cost analysis are in Appendix D. 4 Evaluation TAB (legal, n=811n=811) SynthPAI (Reddit, n=200n=200) PII-Masking-300k (n=500n=500) Method Priv↑ Util↑ Guess↓ Lat. Priv↑ Util↑ Guess↓ Lat. Priv↑ Util↑ Guess↓ Lat. Iterative / multi-pass LLM rewriters A. Ours (full, L1–L5) .945.010.945_.010 .696.008.696_.008 .283.019.283_.019 1815052_181 .944¯.007 .944_.007 .888.006.888_.006 .295.009.295_.009 99494679949_467 .901.011.901_.011 .488.008.488_.008 .213.010.213_.010 74532997453_299 B. Staab’25 .695.013.695_.013 .564.017.564_.017 .335.019.335_.019 2515223925152_239 .975.005†.975_.005 .257.018.257_.018 .098.014.098_.014 45418566345418_5663 .850¯.010 .850_.010 .384.021.384_.021 .275¯.020 .275_.020 249759624975_96 C. AgentStealth’25 .689.012.689_.012 .789.007.789_.007 .579.044.579_.044 1692856316928_563 .864.009.864_.009 .700.005.700_.005 .260.009.260_.009 1548546715485_467 .680.008.680_.008 .634.015.634_.015 .508.015.508_.015 1941439419414_394 D. HaS’23 .926¯.005 .926_.005 .669.009.669_.009 .336.032.336_.032 53285945328_594 .811.026.811_.026 .841.005.841_.005 .477.020.477_.020 1289275512892_755 .809.010.809_.010 .586.011.586_.011 .322.015.322_.015 8384¯285 8384_285 E. IncogniText’25 .178.023.178_.023 .765¯.011 .765_.011 .538.025.538_.025 83413258341_325 .553.019.553_.019 .855.013.855_.013 .281.023.281_.023 1009241310092_413 .315.011.315_.011 .701.003.701_.003 .624.018.624_.018 98192029819_202 Single-shot LLM rewriters F. CONFAIDE’24 .913.005.913_.005 .638¯.008 .638_.008 .307¯.027 .307_.027 97679_97 .842.013.842_.013 .810¯.010 .810_.010 .254¯.015 .254_.015 3092955_309 .776.009.776_.009 .533¯.004 .533_.004 .331.012.331_.012 1822449_182 G. Pissarra’24 .903¯.010 .903_.010 .701.005.701_.005 .257.030.257_.030 789¯127 789_127 .815.002.815_.002 .873.003.873_.003 .395.006.395_.006 2943¯293 2943_293 .864¯.010 .864_.010 .548.008.548_.008 .256¯.013 .256_.013 28461572846_157 H. Rescriber’25 .719.022.719_.022 .605.031.605_.031 .393.022.393_.022 37743983774_398 .819¯.012 .819_.012 .432.020.432_.020 .182.012.182_.012 32413453241_345 .892.009.892_.009 .282.008.282_.008 .178.013.178_.013 2752¯76 2752_76 I. DP-Prompt’23 .375.029.375_.029 .478.015.478_.015 .662.019.662_.019 837146837_146 .486.019.486_.019 .539.032.539_.032 .319.017.319_.017 33714293371_429 .524.025.524_.025 .527.008.527_.008 .505.012.505_.012 3611973611_97 Tag-based baselines J. Presidio .703.015.703_.015 .783.008.783_.008 .216.023.216_.023 14114_1 .659.005.659_.005 .944.001.944_.001 .375.015.375_.015 28128_1 .511.019.511_.019 .750.011.750_.011 .489.022.489_.022 24124_1 K. PBa-LLM’25 .455.033.455_.033 .809.009.809_.009 .465.019.465_.019 811381_13 .635.002.635_.002 .956.000.956_.000 .396.008.396_.008 17033170_33 .184.013.184_.013 .906.005.906_.005 .674.013.674_.013 91191_1 Table 1: Main comparison across TAB, SynthPAI, and PII-Masking-300k. All three corpora report 4-seed meanstd_std (42–45). Latency is mean ms per sample. Best and second-best are marked within each method block and dataset. †Staab’s high SynthPAI privacy is inflated by empty or placeholder outputs, which also explains its low utility. The evaluation addresses four questions: (Q1) Does GuardianAgent improve the privacy–utility trade-off? (Q2) Does action-conditioned risk control both mediation decisions and anonymization strength? (Q3) Does verified hierarchical anonymization outperform fixed rewriting strategies? (Q4) Are the risk controller and intuitive+reasoning path calibrated and efficient? Unless otherwise stated, all main results use the final GuardianAgent variant with the full L1–L5 hierarchy. Calibration results, additional confidence intervals, rewrite strategy comparison, seed variance, and robustness checks are reported in Appendix E, F and G. 4.1 Setup Benchmarks. Our evaluation combines anonymization, policy-matching, and risk-calibration data. For anonymization, we use three benchmarks TAB (Pilán et al., 2022), which contain legal texts from ECHR judgements; SynthPAI (Yukhymenko et al., 2024), which contains Reddit-style posts with personal attributes; and PII-Masking-300k (Ai4Privacy, 2024), which contains XML, JSON, tabular, and free-form synthetic documents annotated with explicit PII categories. For policy matching, we use OPP-115 (Wilson et al., 2016). For AMRSF calibration, we use an expert-rated action-scenario set and the public corpus from Staab. Backbone and baselines. The main LLM backbone is Llama-3.2-3B-Instruct (Grattafiori et al., 2024); System 2, L4 rewriting, and the adversarial guesser use the same backbone to ensure a controlled comparison across components. We compare against baselines spanning adversarial rewriting, prompt protection, contextual-integrity prompting, on-device rewriting, differential privacy, private-attribute randomization, clinical anonymization, and tag-based anonymization: Staab (Staab et al., 2025), AgentStealth (Shao et al., 2025), HaS (Chen et al., 2023b), CONFAIDE (Mireshghallah et al., 2023), Rescriber (Zhou et al., 2025), DP-Prompt (Duan et al., 2023), IncogniText (Frikha et al., 2025), Pissarra et al. (Pissarra et al., 2024), and PBa-LLM (Mancera et al., 2025). Metrics. Privacy is one minus the fraction of ground-truth sensitive spans retained in the output. Utility is token-Jaccard on TAB and PII-Masking-300k, and BERTScore F1 on SynthPAI. Guess is the maximum verified adversarial-guesser confidence on the output, and latency is the wall-clock time per sample. Figure 3: Privacy–utility Pareto frontiers across the three benchmarks. Baseline methods define each frontier, with GuardianAgent plotted separately. GuardianAgent lies above or beyond the baseline frontier on all three datasets, indicating a stronger cross-domain privacy–utility trade-off. Context R Allow Trans. Deny ℓcf¯ _cf ClowC_low (first-party / functionality / paste / full) .119.017.119_.017 100.0100.0 0.00.0 0.00.0 2.021.312.02_1.31 CmedC_med (provider / analytics / default / partial) .413.057.413_.057 0.50.5 98.098.0 1.51.5 2.101.292.10_1.29 ChighC_high (advertising / profiling / background / vague) .909.016.909_.016 0.00.0 0.50.5 99.599.5 4.330.504.33_0.50 CextC_ext (data broker / advertising / background / missing) .909.011.909_.011 0.00.0 0.00.0 100.0100.0 4.340.494.34_0.49 Table 2: Action-conditioned decision control on 200 PII-Masking samples with the same texts and fixed L=0.7L=0.7. Riskier action contexts shift decisions from allow to transform and deny. ℓ¯cf _cf is a counterfactual final anonymization level computed by routing all samples through the anonymizer; at deployment time, allow samples are released unchanged, while deny samples are blocked. 4.2 Main Comparison Table 1 compares GuardianAgent with published baselines across TAB, SynthPAI, and PII-Masking-300k. GuardianAgent delivers the most consistent, privacy–utility trade-off across domains. Figure 3 reinforces this result: GuardianAgent lies above or beyond the baseline privacy–utility frontier on all three datasets, and is the only method above 0.900.90 privacy on all domains and has the smallest cross-domain spread. This consistency suggests that verified, risk-adaptive escalation reduces domain-specific failure modes, especially when moving across legal prose, Reddit-style personal attributes, and structured PII records. Table 2 evaluates the decision side of the controller by scoring the same 200 PII-Masking texts under four action contexts with L=0.7L=0.7 fixed. As recipient, purpose, action basis, and policy transparency become riskier, mean risk increases and decision distribution shifts from allow through transform to deny. This shows that AMRSF conditions mediation decisions on action context rather than on text content alone. 4.3 Transform-Band Risk-to-Level Control To isolate anonymization strength, the same 200 PII-Masking texts are evaluated under four contexts constrained to the transform band. For each action, z denotes the normalized position of R between the allow ceiling and deny floor (Eq. 7), and ℓ0(z) _0(z) is selected by quartile (Eq. 8). Context Recipient Purpose Basis R z Trans. % ℓ0(z)¯ _0(z) L1 L2 L3 L4 ℓfinal¯ _final TmildT_mild first-party Personalization default .340.050.340_.050 .252.179.252_.179 99.099.0 1.481.48 65 2222 1313 00 2.372.37 TmoderateT_moderate service-provider Personalization default .457.066.457_.066 .538.208.538_.208 89.089.0 2.522.52 11 64 1616 1818 2.932.93 TstrongT_strong service-provider Marketing default .557.082.557_.082 .744.170.744_.170 81.581.5 3.333.33 11 00 64 3535 3.643.64 Tnear-denyT_near-deny advertising Marketing default .704.053.704_.053 .980.080.980_.080 13.013.0 3.983.98 00 00 00 99 4.424.42 Table 3: Transform-band risk-to-level control on 200 PII-Masking samples with fixed L=0.7L=0.7. As normalized band position z increases, the dominant starting level shifts from L1 to L4, the mean initial level ℓ0(z)¯ _0(z) rises monotonically, and the final level after verified escalation also increases. Trans. % is the fraction of samples remaining within the transform region. Table 3 shows that anonymization strength follows the action-conditioned band position. As z increases, the dominant starting level shifts from L1 to L4 and ℓ0(z)¯ _0(z) rises monotonically. Verified adversarial escalation preserves this ordering, with the mean final level rising from 2.37 to 4.42. Thus, among actions selected for transformation, GuardianAgent does not use a fixed rewriting policy: AMRSF sets the starting strength from the action context, and verified feedback escalates only when residual leakage remains. 4.4 Ablation TAB SynthPAI PII-Mask Cap Priv Util Guess Priv Util Guess Priv Util Guess ℓmax=3 _max=3 .924.924 .709.709 .356.356 .913.913 .897.897 .329.329 .869.869 .533¯ .533 .247¯ .247 ℓmax=4 _max=4 .933.933 .706.706 .325.325 .912.912 .905.905 .316.316 .849.849 .539.539 .283.283 ℓmax=5 _max=5 .945.011.945_.011 .696.009.696_.009 .296.296 .944.007.944_.007 .888.006.888_.006 .299.299 .901.011.901_.011 .488.008.488_.008 .213.010.213_.010 Table 4: Level-progression ablation with maximum level ℓmax∈3,4,5 _ ∈\3,4,5\. L3 uses only rule-based masking/tagging, L4 adds minimal-edit rewriting, and L5 adds the semantic safety-net. Variant Priv↑ Util↑ ms SynthPAI A. NER only .483.003.483_.003 .944.001.944_.001 23 B. + guesser .569.007.569_.007 .938.001.938_.001 729 C. + LLM rewrite .910.011.910_.011 .899.003.899_.003 2518 D. + L1–L5 adaptive .944.007.944_.007 .888.006.888_.006 9949 TAB A. NER only .848.022.848_.022 .735.009.735_.009 11 B. + guesser .895.013.895_.013 .718.007.718_.007 2731 C. + LLM rewrite .915.018.915_.018 .725.010.725_.010 831 D. + L1–L5 adaptive .945.011.945_.011 .696.009.696_.009 5052 PII-Masking-300k A. NER only .389.014.389_.014 .813.009.813_.009 14 B. + LLM rewrite .853.007.853_.007 .546.008.546_.008 4084 C. + L1–L5 adaptive .901.011.901_.011 .488.008.488_.008 7453 Table 5: Component ablation on SynthPAI, TAB, and PII-Masking-300k (meanstd_std across 4 seeds; n=200n=200 for SynthPAI/TAB and n=500n=500 for PII-Masking). Variants are cumulative: NER only, plus adversarial feedback, plus single-level LLM rewriting, and the full verified L1–L5 adaptive stack. Table 5 decomposes the contributions of the main components. NER alone is strong on TAB, where many sensitive spans are explicit legal entities, but it is less effective on SynthPAI, where personal attributes are more implicit and contextual. Adding adversarial feedback and LLM rewriting improves privacy, while the full L1–L5 adaptive stack achieves the best privacy across both datasets at a moderate utility cost. Additional comparisons between semantic-only and minimal-edit-only rewriting are reported in Table 13 (Appendix G). Table 4 isolates the role of the anonymization hierarchy. L1–L3 remove many explicit spans, especially in legal prose and structured records. L4 adds high-utility minimal edits, while L5 is most useful when weaker rewrites leave contextual leakage. The results on PII-Masking-300k shows why a fixed maximum level can be brittle: minimal edits may preserve too much structure, whereas the semantic safety-net recovers privacy in harder cases. Qualitative side-by-side rewrites are in Appendix H. 4.5 Calibration, Efficiency, and Robustness AMRSF is evaluated on an expert-rated scenario set and a larger Staab-derived calibration corpus. The score aligns well with annotated risk in both settings, while the larger corpus provides a more stable estimate because the expert-rated set is small. The evidential fast path is evaluated on OPP-115 policy-action pairs and escalates only a small fraction of events to the LLM, supporting its role as an efficiency mechanism for live traffic mediation. Full calibration statistics, confidence intervals, and System 1 metrics are reported in Appendix E. Robustness checks support the two adaptive mechanisms. Disabling verification leads to more level upgrades without improving privacy, while reducing utility and increasing latency, confirming that raw attacker confidence often reflects unsupported guesses. By switching backbone from Llama-3.2-3B to Qwen3-8B, GuardianAgent remains the strongest privacy–utility method on test benchmarks. Additional paired-bootstrap tests, seed variance, attacker-replacement experiments, parsing-failure analysis, backbone-portability details, and online fast-path self-improvement results are in Appendix G. 5 Conclusion This paper presented GuardianAgent, a policy-conditioned framework for risk-adaptive anonymization of live web traffic. Rather than relying on an LLM to directly assign privacy risk, GuardianAgent uses AMRSF to combine policy evidence and action context, determining both the allow/transform/deny decision and the initial anonymization level. A verified adversarial guesser then escalates rewriting only when attacker guesses are supported by the original text. Across legal text, Reddit-style personal attributes, and multi-format PII records, GuardianAgent improved the privacy–utility trade-off over published baselines, remained robust under a backbone switch, and adapted its rewriting strength across different action contexts. Limitations The evaluation is limited to English and uses public or synthetic corpora; real browser traces, clinical and dialogue data, and multilingual settings require further study. AMRSF should also be viewed as a mediation controller rather than a legal compliance engine. Deployments should therefore prioritize local processing, disclose any cloud escalation, allow user override, and communicate that anonymization reduces but does not eliminate the re-identification risk. Ethical considerations This work collects no new personal data and involves no human subjects. Experiments use publicly released or synthetic benchmark datasets and an open-weight backbone or publicly accessible model APIs; no private browser traces are used. GuardianAgent is intended to reduce unintended disclosure, not to guarantee anonymity or legal compliance. Any deployment should disclose rewriting and cloud escalation, preserve user control over mediation decisions, and communicate residual re-identification and utility-loss risks. Acknowledgments The authors thank the UNSW-UTS Trustworthy Digital Society for supporting this research. Also, this research used the NVIDIA H100 cluster provided by SHARON AI. References Ackerman et al. (1999) Mark S Ackerman, Lorrie Faith Cranor, and Joseph Reagle. 1999. Privacy in e-commerce: examining user scenarios and privacy preferences. In Proceedings of the 1st ACM Conference on Electronic Commerce, pages 1–8. Ahmad et al. (2021) Wasi Ahmad, Jianfeng Chi, Tu Le, Thomas Norton, Yuan Tian, and Kai-Wei Chang. 2021. Intent classification and slot filling for privacy policies. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 4402–4417. Ai4Privacy (2024) Ai4Privacy. 2024. pii-masking-300k (revision 86db63b). Bhatia and Breaux (2018) Jaspreet Bhatia and Travis D Breaux. 2018. Empirical measurement of perceived privacy risk. ACM Transactions on Computer-Human Interaction (TOCHI), 25(6):1–47. Chen et al. (2025) Chaoran Chen, Daodao Zhou, Yanfang Ye, Toby Jia-jun Li, and Yaxing Yao. 2025. Clear: Towards contextual llm-empowered privacy policy analysis and risk generation for large language model applications. In Proceedings of the 30th International Conference on Intelligent User Interfaces, pages 277–297. Chen et al. (2023a) Lingjiao Chen, Matei Zaharia, and James Zou. 2023a. Frugalgpt: How to use large language models while reducing cost and improving performance. arXiv preprint arXiv:2305.05176. Chen et al. (2023b) Yu Chen, Tingxin Li, Huiming Liu, and Yang Yu. 2023b. Hide and seek (has): A lightweight framework for prompt privacy protection. arXiv preprint arXiv:2309.03057. Cronk and Shapiro (2021) R Jason Cronk and Stuart S Shapiro. 2021. Quantitative privacy risk analysis. In 2021 IEEE European symposium on security and privacy workshops (EuroS&pW), pages 340–350. IEEE. Duan et al. (2023) Haonan Duan, Adam Dziedzic, Nicolas Papernot, and Franziska Boenisch. 2023. Flocks of stochastic parrots: Differentially private prompt learning for large language models. Advances in Neural Information Processing Systems, 36:76852–76871. Freiberger et al. (2026) Vincent Freiberger, Arthur Fleig, and Erik Buchmann. 2026. Helping johnny make sense of privacy policies with llms. In Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems, pages 1–21. Frikha et al. (2025) Ahmed Frikha, Nassim Walha, Krishna Kanth Nakka, Ricardo Mendes, Xue Jiang, and Xuebing Zhou. 2025. Incognitext: Privacy-enhancing conditional text anonymization via llm-based private attribute randomization. In Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics, pages 2490–2501. Grattafiori et al. (2024) Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 542 others. 2024. The llama 3 herd of models. Preprint, arXiv:2407.21783. Harkous et al. (2018) Hamza Harkous, Kassem Fawaz, Rémi Lebret, Florian Schaub, Kang G Shin, and Karl Aberer. 2018. Polisis: Automated analysis and presentation of privacy policies using deep learning. In 27th USENIX Security Symposium (USENIX Security 18), pages 531–548. Kahneman (2011) Daniel Kahneman. 2011. Fast and slow thinking. Allen Lane and Penguin Books, New York, 2. Mancera et al. (2025) Gonzalo Mancera, Aythami Morales, Julian Fierrez, Ruben Tolosana, Alejandro Peña, Miguel Lopez-Duran, Francisco Jurado, and Alvaro Ortigosa. 2025. Pba-llm: Privacy-and bias-aware nlp using named-entity recognition (ner). In International Conference on Document Analysis and Recognition, pages 3–20. Springer. McCallister (2010) Erika McCallister. 2010. Guide to protecting the confidentiality of personally identifiable information. Diane Publishing. Milne and Culnan (2004) George R Milne and Mary J Culnan. 2004. Strategies for reducing online privacy risks: Why consumers read (or don’t read) online privacy notices. Journal of interactive marketing, 18(3):15–29. Mireshghallah et al. (2023) Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. 2023. Can llms keep a secret? testing privacy implications of language models via contextual integrity theory. arXiv preprint arXiv:2310.17884. Ngong et al. (2025) Ivoline C Ngong, Swanand Ravindra Kadhe, Hao Wang, Keerthiram Murugesan, Justin D Weisz, Amit Dhurandhar, and Karthikeyan Natesan Ramamurthy. 2025. Protecting users from themselves: Safeguarding contextual privacy in interactions with conversational agents. In Findings of the Association for Computational Linguistics: ACL 2025, pages 26196–26220. Nissenbaum (2009) Helen Nissenbaum. 2009. Privacy in context: Technology, policy, and the integrity of social life. In Privacy in context. Stanford University Press. Pilán et al. (2022) Ildikó Pilán, Pierre Lison, Lilja Øvrelid, Anthi Papadopoulou, David Sánchez, and Montserrat Batet. 2022. The text anonymization benchmark (tab): A dedicated corpus and evaluation framework for text anonymization. Computational Linguistics, 48(4):1053–1101. Pissarra et al. (2024) David Pissarra, Isabel Curioso, João Alveira, Duarte Pereira, Bruno Ribeiro, Tomás Souper, Vasco Gomes, André Carreiro, and Vitor Rolla. 2024. Unlocking the potential of large language models for clinical text anonymization: A comparative study. In Proceedings of the Fifth Workshop on Privacy in Natural Language Processing, pages 74–84. Regulation (2016) Protection Regulation. 2016. Regulation (eu) 2016/679 of the european parliament and of the council. Regulation (eu), 679(2016):10–3. Reimers and Gurevych (2019) Nils Reimers and Iryna Gurevych. 2019. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP), pages 3982–3992. Sensoy et al. (2018) Murat Sensoy, Lance Kaplan, and Melih Kandemir. 2018. Evidential deep learning to quantify classification uncertainty. Advances in neural information processing systems, 31. Shao et al. (2025) Chenyang Shao, Tianxing Li, Chenhao Pu, Fengli Xu, and Yong Li. 2025. Agentstealth: Reinforcing large language model for anonymizing user-generated text. arXiv preprint arXiv:2506.22508. Srinath et al. (2021a) Mukund Srinath, Soundarya Nurani Sundareswara, C Lee Giles, and Shomir Wilson. 2021a. Privaseer: A privacy policy search engine. In International conference on web engineering, pages 286–301. Springer. Srinath et al. (2021b) Mukund Srinath, Shomir Wilson, and C Lee Giles. 2021b. Privacy at scale: Introducing the privaseer corpus of web privacy policies. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 6829–6839. Staab et al. (2025) Robin Staab, Mark Vero, Mislav Balunovic, and Martin Vechev. 2025. Language models are advanced anonymizers. In The Thirteenth International Conference on Learning Representations. Sun et al. (2025) Bolun Sun, Yifan Zhou, and Haiyun Jiang. 2025. Empowering users in digital privacy management through interactive llm-based agents. In International Conference on Learning Representations, volume 2025, pages 76740–76760. Tang et al. (2023) Chenhao Tang, Zhengliang Liu, Chong Ma, Zihao Wu, Yiwei Li, Wei Liu, Dajiang Zhu, Quanzheng Li, Xiang Li, Tianming Liu, and Lei Fan. 2023. Policygpt: Automated analysis of privacy policies with large language models. Preprint, arXiv:2309.10238. Teerapittayanon et al. (2016) Surat Teerapittayanon, Bradley McDanel, and Hsiang-Tsung Kung. 2016. Branchynet: Fast inference via early exiting from deep neural networks. In 2016 23rd international conference on pattern recognition (ICPR), pages 2464–2469. IEEE. Wilson et al. (2016) Shomir Wilson, Florian Schaub, Aswarth Abhilash Dara, Frederick Liu, Sushain Cherivirala, Pedro Giovanni Leon, Mads Schaarup Andersen, Sebastian Zimmeck, Kanthashree Mysore Sathyendra, N. Cameron Russell, Thomas B. Norton, Eduard Hovy, Joel Reidenberg, and Norman Sadeh. 2016. The creation and analysis of a website privacy policy corpus. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1330–1340, Berlin, Germany. Association for Computational Linguistics. Xie et al. (2025) Qinge Xie, Karthik Ramakrishnan, and Frank Li. 2025. Evaluating privacy policies under modern privacy laws at scale: An \LLM-Based\ automated approach. In 34th USENIX Security Symposium (USENIX Security 25), pages 5797–5816. Yukhymenko et al. (2024) Hanna Yukhymenko, Robin Staab, Mark Vero, and Martin Vechev. 2024. A synthetic dataset for personal attribute inference. Advances in Neural Information Processing Systems, 37:120735–120779. Zhou et al. (2025) Jijie Zhou, Eryue Xu, Yaoyao Wu, and Tianshi Li. 2025. Rescriber: Smaller-llm-powered user-led data minimization for llm-based chatbots. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, pages 1–28. Appendix A System 1 Architecture and Retrieval Hyperparameters System 1 encoder and EDL classifier (referenced from §3.2). Behaviour and policy encoders ϕb,ϕp:∪→ℝd _b, _p:A\!∪\!S\!→\!R^d are either a d=42d\!=\!42 multi-hot variant over OPP-115 categories or a d=384d\!=\!384 frozen sentence-transformer (Reimers and Gurevych, 2019). Writing b=ϕb()b\!=\! _b(a) and p=ϕp()p\!=\! _p(s), the interaction feature map is ψ⁡(,)=[b;p;b⊙p;|b−p|]∈ℝ4d.ψ(a,s)= [\,b\,;\,p\,;\,b\! \!p\,;\,|b\!-\!p|\, ] ^4d. (11) A two-layer MLP with ReLU and dropout, fθ:ℝ4d→ℝKf_θ:R^4d\!→\!R^K with K=2K\!=\!2, yields logits that we convert to Dirichlet parameters following EDL (Sensoy et al., 2018): =softplus(fθ(ψ))+ α\!=\!softplus(f_θ(ψ))\!+\!1, S=∑kαkS\!=\! _k _k. Class probabilities are pk=αk/Sp_k\!=\! _k/S and epistemic uncertainty is u=K/Su\!=\!K/S. The likelihood used in Eq. 4 is L=α2/SL\!=\! _2/S. Retrieval scoring (referenced from §3.2). The structured score over fields ℱ=data,act,purp,recipF\!=\!\data,act,purp,recip\ is S(,s)=∑f∈ℱwfρf+Flags(s), S(a,s)=\!\!\! _f \!\!w_f _f+ Flags(s), (12) with weights (0.35,0.35,0.20,0.10)(0.35,0.35,0.20,0.10), ρf=min⁡(1,|f∩sf|/max⁡(1,|f|)) _f= (1,|a_f∩ s_f|/ (1,|a_f|)), and Flags(s)(s) adding small bonuses for disclosed user rights, trans-EEA transfer, and retention. BM25Lite uses k1=1.5k_1\!=\!1.5, b=0.75b\!=\!0.75 over the tokenized snippet, with on-the-fly IDF (no global inverted index per-domain). Appendix B Prompts System 2 decider (system prompt). Given an outgoing action and retrieved policy evidence, estimate the likelihood that the action conflicts with the policy. Return STRICT JSON: violation_likelihood: [0..1], rationale, evidence_ids. Do not decide whether the action should be allowed, transformed, or denied. Adversarial guesser (system prompt). You are an adversarial privacy auditor. Given anonymized text, try to reconstruct or guess the redacted information. For each guess, provide: field, guess, confidence (0.0--1.0), reasoning. Return JSON: ‘guesses’: [...], ‘max_confidence’: 0.0--1.0. L4 minimal-edit rewriter. Rewrite the following sentence so that the listed sensitive fields cannot be recovered, while preserving the communicative intent. Do not insert [TAGS]; produce natural text. Sensitive fields: fields. Input: ‘text’. L5 semantic rewriter. Rewrite the text to preserve the communicative intent while removing identifying details and contextual cues. Full paraphrasing is allowed. Appendix C Full AMRSF Factor Tables Table 6 gives the full per-category data weights used to compute SdS_d in Eq. 5. Table 7 gives the per-recipient transmission risk MtrM_tr and Table 8 the per-purpose legitimacy MpM_p. Table 9 lists the six-signal credits used by the transparency multiplier MTM_T. Category Wt. Source Credentials 1.00 NIST 800-122 Financial 0.95 Milne’04 Health, Biometric, Genetic 0.95 GDPR Art. 9 SSN 0.90 NIST 800-122 Location (precise) 0.85 Milne’04 Location (unspec.) 0.75 default Phone 0.70 Ackerman’99 Content 0.65 Bhatia’18 PostalAddress 0.65 Ackerman’99 Contact 0.60 default Email 0.55 Ackerman’99 SearchHistory 0.50 Milne’04 BrowsingHistory 0.45 Milne’04 IPAddress, DeviceID 0.40 NIST Location (coarse) 0.35 Milne’04 AppUsage 0.25 low Cookies 0.20 low Language 0.10 low Table 6: Full data-sensitivity weights DW⁡(c)DW(c). Some rows group categories assigned the same weight. Recipient MtrM_tr first-party only 0.200.20 service provider (Art. 28) 0.400.40 analytics / government 0.500.50 social-media platform 0.600.60 unknown third party 0.700.70 advertising network 0.800.80 data broker 0.900.90 Table 7: Transmission risk strs_tr by recipient type. Purpose MpM_p functionality, security, auth. 0.150.15 personalization, research 0.350.35 analytics 0.450.45 marketing 0.650.65 profiling (Art. 22) 0.750.75 advertising 0.800.80 undisclosed 0.650.65 Table 8: Purpose legitimacy sps_p. Signal Credit substantial text (≥50≥ 50 chars) −0.10-0.10 covers the action’s data category −0.15-0.15 covers the action’s declared purpose −0.10-0.10 states a legal basis (GDPR Art. 6) −0.08-0.08 discloses user rights −0.05-0.05 specifies retention −0.02-0.02 MT=max⁡(0.8, 1.3+∑credits)M_T= \! (0.8,\;1.3+ ) Table 9: Transparency multiplier MTM_T signal credits. Data tier Allow ceiling τat _a^t Deny floor τdt _d^t Critical 0.100.10 0.550.55 High 0.250.25 0.650.65 Moderate 0.350.35 0.750.75 Low 0.450.45 0.800.80 Table 10: Tier-specific thresholds for the action decision in Eq. 6. Tiers are assigned to data categories as: Critical (Credentials, Health, Biometric, Genetic, Financial, SSN), High (precise Location, Phone, Content), Moderate (Email, Contact, SearchHistory, BrowsingHistory), Low (Cookies, AppUsage, DeviceID, Language). The transform region width τdt−τat _d^t- _a^t is widest for sensitive tiers, biasing borderline actions on sensitive data toward rewriting rather than passing through unchanged. Average final level (ablation). On TAB, the verified loop (D) reduces the mean final anonymization level from 3.483.48 (C) to 2.852.85 (D). On SynthPAI, it rises slightly from 2.792.79 to 3.483.48 as the verifier correctly triggers upgrades on borderline inputs. Appendix D Formal Analysis Algorithm 1: Verified adaptive anonymization (VerifiedAdapt) 1: original text x0x_0; risk R; data tier t⁡()t(a); thresholds (τat,τdt)( _a^t, _d^t); guesser G; verifier V; τg=0.6 _g=0.6; ℓmax=5 _max=5; T=5T=5 2: z←clip[0,1]⁡(R−τat⁡()τdt⁡()−τat⁡())z _[0,1]\! ( R- _a^t(a) _d^t(a)- _a^t(a) ) 3: ℓ←ℓ0(z) ← _0(z) 4: for t=1,…,Tt=1,…,T do 5: xℓ←Anonymize(x0,ℓ)x_ (x_0, ) 6: if ℓ=ℓmax = _max then break 7: end if 8: ℓ←⁡(xℓ)G_ (x_ ) 9: V←(g,cg)∈ℓ:V(g,x0)=1G_V←\(g,c_g) _ : V(g,x_0)=1\ 10: c^←0 c← 0 if V=∅G_V= , else max(g,cg)∈V⁡cg _(g,c_g) _Vc_g 11: if c^≥τg c≥ _g then ℓ←ℓ+1 ← +1 12: else break 13: end if 14: end for 15: return xℓ,ℓx_ , Figure 4: Verified adaptive anonymization. The initial level is selected from the transform-band position z, and the verifier admits only guesses supported by the original text. Proposition 1 (No missed lexically-supported guesses). Assume a guess g identifies an attribute of x0x_0 only if it either appears as a substring of x0x_0 or shares at least one content word (>2>\!2 characters) with x0x_0. Then ⁡(x0)⊆⁡(x0)C(x_0) (x_0), and consequently the verified confidence c c in Eq. 10 satisfies c^≥maxg∈⁡(x0)⁡cg c≥ _g (x_0)c_g. Proof. If g∈⁡(x0)g (x_0) matches by substring, the first disjunct of Eq. 9 fires; if by shared content word, the second disjunct fires. In either case V(g,x0)=1 V(g,x_0)=1, so g∈g . Taking max over the superset bounds maxg∈⁡cg _g c_g from above. □ Proposition 2 (Bounded expected cost of the gate). Let C1,C2C_1,C_2 be the per-event costs of System 1 and System 2 and pe=Pr[u≥τu]p_e= [u\!≥\! _u] the escalation probability. Then the expected matcher cost is ⁡[C]=C1+peC2E[C]=C_1+p_eC_2. With the values measured on OPP-115 (pe=0.035p_e\!=\!0.035) and C2/C1≈104C_2/C_1\!≈\!10^4, ⁡[C]/C2≈peE[C]/C_2\!≈\!p_e, a ×28.6\!× reduction over an always-LLM pipeline. Proof. System 1 runs unconditionally; Eq. 3 makes System 2 run exactly when u≥τu\!≥\! _u, a Bernoulli event of rate pep_e. Linearity of expectation gives the result. □ Proposition 3 (Loop termination). Algorithm 1 halts in at most T rounds and invokes at most one anonymizer call plus one guesser call per round, so its worst-case LLM cost is T⋅(Canon+Cguess)T·(C_anon+C_guess)—a constant independent of x0x_0. Proof. Each iteration either breaks (on c^<τg c< _g or ℓ=ℓmax = _ ) or increments ℓ . Since ℓ≤ℓmax=5 ≤ _ =5 and the explicit cap T=5T=5 is enforced, termination follows. □ Appendix E Calibration Details Table 11 compares the full AMRSF controller against three single-factor ablations, a NIST Likelihood×Impact baseline, and a learned binary classifier on the expert-rated scenarios and the Staab public corpus. Table 12 reports the System 1 evidential fast-path classifier on the OPP-115 held-out test pairs. Method ρ r MAE Macro-F1 Expert-rated scenarios (n=500n=500) AMRSF (full) 0.982 0.947 0.119 0.8120.812 AMRSF −Mb-M_b 0.9650.965 0.9400.940 0.1360.136 0.6830.683 AMRSF −MT-M_T 0.9850.985 0.9560.956 0.1340.134 0.7380.738 AMRSF −-purpose 0.9760.976 0.9470.947 0.1350.135 0.7380.738 NIST L×I 0.9640.964 0.9490.949 0.1080.108 0.7560.756 Binary classifier 0.7290.729 0.6830.683 0.3380.338 0.4350.435 Staab public corpus (n=525n=525) AMRSF (full) 0.9140.914 0.8660.866 0.2680.268 – Table 11: Risk-score calibration on the expert-rated scenario set and Staab public corpus. The larger Staab corpus provides a more stable estimate because the expert-rated set is small. Metric Value Test pairs (OPP-115) 6,3926,392 Accuracy 0.9280.928 Precision 1.0001.000 Recall 0.8570.857 F1F_1 0.9230.923 Expected Calibration Error 0.0480.048 Brier score 0.0580.058 Escalation rate (u≥0.25u≥ 0.25) 3.47%3.47\% p95 latency (fast path) 0.250.25 ms Table 12: System 1 evidential classifier on OPP-115. Appendix F Rewrite-strategy comparison Table 13 contrasts two single-strategy variants of D (semantic-only rewriting and minimal-edit-only rewriting) with the full adaptive L1–L5 stack used by GuardianAgent, isolating the effect of mixing rewrite strategies under the verified-guesser loop. TAB SynthPAI D variant Priv Util Priv Util D (semantic only) .974.974 .628.628 .942.942 .847.847 D (min-edit only) .866.866 .740.740 .892.892 .892.892 D (L1–L5 adaptive) .945.011.945_.011 .696.009.696_.009 .944.007.944_.007 .888.006.888_.006 Table 13: Rewrite-strategy comparison for variant D. The adaptive L1–L5 row reports meanstd_std across 4 seeds at n=200n=200; the two pilot rows are single-seed. Appendix G Robustness Detail Tables Table 14 reports an A/B test that turns the verifier on or off in the adaptive loop, isolating its contribution to the privacy/utility trade-off and to escalation cost. Metric V ON V OFF Δ Final level 3.523.52 3.963.96 −0.44-0.44 Upgrade rate 0.520.52 0.800.80 −0.28-0.28 Privacy 0.9750.975 0.9750.975 ±0± 0 Utility 0.8500.850 0.8340.834 +0.016+0.016 Latency (ms) 67136713 73507350 −637-637 Unnecessary upgrades 32.0%32.0\% [20.8,45.8][20.8,45.8] Table 14: Verification A/B on SynthPAI (n=50n\!=\!50, Wilson CIs). OFF reproduces the raw-confidence behaviour of Staab/HaS/AgentStealth. Table 15 reports four-seed variance for the five strongest baselines plus GuardianAgent, so the per-method spread can be read off directly. TAB SynthPAI Method Priv Util Priv Util D. GuardianAgent .941.024.941_.024 .695.012.695_.012 .962.015.962_.015 .879.034.879_.034 G. HaS .925.017.925_.017 .668.020.668_.020 .797.015.797_.015 .845.009.845_.009 F. CONFAIDE .899.024.899_.024 .641.009.641_.009 .843.026.843_.026 .830.020.830_.020 K. Pissarra .881.026.881_.026 .712.019.712_.019 .790.055.790_.055 .875.023.875_.023 I. Staab’25 .667.052.667_.052 .586.048.586_.048 .986.018†.986_.018 .272.042.272_.042 Table 15: Four-seed variance (n=50n\!=\!50 per seed, mean with std as subscript, 5-level flagship). †Staab’s SynthPAI privacy still reflects 22%22\% empty outputs. GuardianAgent is rank-1 privacy among methods with well-formed outputs at every seed. Table 16 swaps the LLM backbone between Llama-3.2-3B and Llama-3.1-8B to check that GuardianAgent’s ranking is not an artifact of one model size. Llama-3.2-3B Llama-3.1-8B Method Priv Util Priv Util GuardianAgent (full) 0.9750.975 0.8550.855 1.0001.000 0.8630.863 Staab 0.9750.975 0.2250.225 0.9500.950 0.7000.700 Table 16: Backbone sensitivity (SynthPAI, n=50n\!=\!50). Privacy ranking preserved; Staab utility climbs at 88B but GuardianAgent already saturates at 33B. Table 17 buckets GuardianAgent’s outputs into four error classes to characterize where the system fails when it fails. After Holm–Bonferroni correction at family-wise α=0.05α\!=\!0.05, 30/4030/40 pairwise tests on TAB and 28/4028/40 on SynthPAI remain significant. Class SynthPAI TAB clean_success 65.5%65.5\% [58.7,71.7][58.7,71.7] 54.5%54.5\% [47.6,61.3][47.6,61.3] cascade (L4 ×3×\!3) 16.5%16.5\% 22.0%22.0\% pii_retained 3.5%3.5\% 0.5%0.5\% parse_fail 1.0%1.0\% 0.0%0.0\% Table 17: Error analysis (Wilson 95%95\% CIs on the main class). Dominant failure mode is hard PII-dense samples, not broken outputs. Table 18 repeats the main comparison with Qwen3-8B as the LLM backbone for every method, providing a cross-model-family check that Ours’s privacy ranking is not Llama-specific. Table 19 tracks the System 1 fast path as it is online-bootstrapped from System 2 teacher labels on an OPP-115 event stream, showing how quickly the slow-path escalation rate drops as fast-path accuracy climbs. Appendix H Qualitative Case Studies Two verbatim examples illustrate flagship-D behaviour relative to baselines. On the TAB sentence “On 13 September 1988 the Erzincan Martial Law Court acquitted the applicants of the charges against them”: GuardianAgent (L4) emits “On a date in 1988 the court acquitted the applicants of the charges against them”, swapping the specific date and court identity while keeping the legal speech-act intact. Staab rewrites to two sentences with redundant information (“On a certain month, a martial law court acquitted … In a certain jurisdiction, a court acquitted …”), duplicating the act; HaS returns “On [DATE] [YEAR] the [PLACE] Martial Law Court acquitted the applicants …”, leaving the court category intact with a tag-heavy output that hurts fluency. On a SynthPAI post where a software engineer describes their Masters in Computer Science and their salary in Zurich, GuardianAgent rewrites to generic remarks about graduate studies and work while Staab preserves the Zurich reference by hallucinating “a European city”—a regional clue that still narrows the author. Risk-control context definitions Table 22 lists the four action contexts used in §4.3. Each context is a tuple (recipient, purpose, action basis, policy transparency); these feed directly into the AMRSF multipliers MtrM_tr, MpM_p, MbM_b, and MTM_T defined in Method §3.3. The likelihood L is held fixed at 0.70.7 across all contexts so that any variation in R is attributable to context, not to the LLM. Per-context mean final level (transform-band) Table 20 reports the mean final level after the verified-guesser adaptive loop, for samples in the transform region of each band context (Llama-3.2-3B, n=200n\!=\!200). Risk-control qualitative cases (TAB, SynthPAI, PII-Masking) Table 23 showcases 3 examples for anonymization in TAB, SynyhPAI and PII-Masking-30k as well as risk score with decisions. TAB SynthPAI Method Priv Util Priv Util A. GuardianAgent 0.9760.976 0.6280.628 0.9270.927 0.9430.943 B. Staab’25 0.8820.882 0.5490.549 0.9200.920 0.8180.818 D. HaS’23 0.8790.879 0.7280.728 0.7240.724 0.9380.938 E. CONFAIDE’24 0.4080.408 0.8480.848 0.4640.464 0.9660.966 F. Pissarra’24 0.8550.855 0.7070.707 0.5930.593 0.9620.962 Table 18: Qwen3-8B backbone cross-check (n!=!200n!=!200). GuardianAgent is rank-1 privacy on both corpora; CONFAIDE collapses. The five most private methods are shown. Iter. Events S1 acc Escalation 0 0 0.9200.920 3.75%3.75\% 1 500 0.9700.970 2.00%2.00\% 2 1000 0.9930.993 0.25%0.25\% 3 1500 0.9980.998 0.25%0.25\% 4 2000 1.0001.000 0.25%0.25\% Table 19: Online bootstrapping of System 1 from System 2 teacher labels over a 20002000-event OPP-115 stream; held-out 400400-event test set. 2424 teacher labels suffice to reduce escalation by 93%93\% relative while pushing accuracy to perfect. Context ℓ0¯ _0 ℓfinal¯ _final Δℓ¯ TmildT_mild 1.481.48 2.372.37 +0.89+0.89 TmoderateT_moderate 2.522.52 2.932.93 +0.41+0.41 TstrongT_strong 3.333.33 3.643.64 +0.31+0.31 Tnear-denyT_near-deny 3.983.98 4.424.42 +0.44+0.44 Table 20: Per-context mean final anonymization level after adaptive escalation. The verified guesser can escalate to L5 even from a low starting level when residual leakage remains, so ℓfinal¯!≥!ℓ0(z)¯ _final!≥! _0(z). The largest Δℓ¯ occurs at TmildT_mild, where the controller starts at L1 but escalation lifts the average toward L2–L3 on samples with residual surface-supported leakage. Method Priv ↑ Util ↑ Fluency ↑ D. Ours (L1–L5 adaptive) 3.95¯.78 3.95_.78 4.16.874.16_.87 4.20.824.20_.82 D. Ours (L4 fixed) 3.74.943.74_.94 3.91¯.81 3.91_.81 4.22¯.83 4.22_.83 D. Ours (L5 fixed) 4.12.734.12_.73 3.54.88†3.54_.88 4.19.724.19_.72 E. Presidio 3.17.65†3.17_.65 3.64.68†3.64_.68 3.38.82†3.38_.82 G. HaS 2.93.73†2.93_.73 2.991.00†2.99_1.00 2.851.02†2.85_1.02 H. DP-Prompt 3.19.95†3.19_.95 3.90.433.90_.43 4.27.674.27_.67 J. AgentStealth 3.71.663.71_.66 3.36.72†3.36_.72 3.68.75†3.68_.75 I. Staab 2.081.40†2.08_1.40 1.951.37†1.95_1.37 1.971.45†1.97_1.45 Krippendorff’s α (interval, 3 raters) 0.680.68 0.740.74 0.750.75 Table 21: LLM evaluation on SynthPAI samples (12001200 ratings). Three Claude models (Opus 4.7, Sonnet 4.6, Haiku 4.5) act as the three pre-registered raters. GuardianAgent is evaluated under L1-L5 adaptive, L4 fixed, and L5 fixed. †Paired-bootstrap two-sided p<0.05p<0.05 vs. Ours (L1–L5 adaptive) at n=1000n=1000 resamples. Context Recipient Purpose Action basis Policy transparency ClowC_low first_party Functionality user-initiated (paste) full: categories, purposes, retention, legal basis, rights CmedC_med service_provider Analytics default (passive) partial: categories and purposes only ChighC_high advertising Profiling background (script) vague: short non-specific snippet CextC_ext data_broker Advertising background (script) missing: no policy evidence Table 22: Action contexts used in the risk-to-level study. Recipient feeds MtrM_tr, purpose feeds MpM_p, basis feeds MbM_b, transparency feeds MTM_T. The categories themselves come from each sample’s annotated PII labels. Context R Decision ℓ0 _0 Final ℓ Anonymized output (bold marks tokens introduced by the anonymizer) TAB TAB_0025. Original: “The formal record of the judge’s order was not prepared by the parties until 26 October 1995. The applicants and Mrs Price applied to the Court of Appeal for leave to appeal on 1 November 1995. The appeal bundles were lodged on 4 October 1996. On 15 January 1997 the appeal was listed for hearing, and it was heard on 16 and 17 April 1997, on which last date the Court of Appeal gave judgment dismissing the appeal.” ClowC_low .108.108 allow L1 L1 The formal record of the judge’s order was not prepared by the parties until 1995. The applicants and a female applied to the Court for leave to appeal on 1995. The appeal bundles were lodged on 1996. On 1997 the appeal was listed for hearing, and it was heard on 1997, on which last date the Court gave judgment dismissing the appeal. CmedC_med .376.376 transform L1 L1 Identical to ClowC_low. ChighC_high .910.910 deny L4 L4 The formal record of the judge’s order was not prepared by the parties until a specific date. The applicants, including a female applicant, applied to a high court for leave to appeal on a specific date. The appeal bundles were lodged on a specific date. On a specific date, the appeal was listed for hearing, and it was heard on two specific dates, on which last date a high court gave judgment dismissing the appeal. CextC_ext .910.910 deny L4 L4 Identical to ChighC_high. SynthPAI STAAB_0025. Original: “Ah reminiscing childhood, huh? Those were the days… I was completely enraptured by my Famicom. … this game — Dragon Quest I. Eiichiro Nakatsu, the genius. … That’s probably why I ended up a game developer now, haha. Nostalgic TIMESSSS!!” ClowC_low .108.108 allow L1 L2 Ah reminiscing childhood, huh? Those were the days… I was completely enraptured by my Famicom. … this game — Dragon Quest I. Eiichiro Nakatsu, the genius. … That’s probably why I ended up a [PROFESSION] now, haha. Nostalgic TIMESSSS!! CmedC_med .376.376 transform L1 L2 Identical to ClowC_low. ChighC_high .910.910 deny L4 L5 Ah reminiscing childhood, huh? Those were the days… I was completely enraptured by my Famicom. … this game — Dragon Quest I. Eiichiro Nakatsu, the genius. … That’s probably why I ended up in a creative field now, haha. Nostalgic TIMESSSS!! CextC_ext .910.910 deny L4 L5 Identical to ChighC_high. PII-Masking-300k PII_41439A. Original: “Quality Assurance Feedback Thread. Subject: QA Review for Drug and Alcohol Education Course. Dear [Mayoress LORYA], We have completed a comprehensive Quality Assurance (QA) review of the Drug and Alcohol Education course delivered in our institution. We are pleased to provide you with detailed feedback on the performance of the course as well as individual feedback for each participant.” ClowC_low .108.108 allow L1 L4 Quality Assurance Feedback Thread. Subject: QA Review for Drug and Alcohol Education Course. Dear [Institutional Leader], We have completed a comprehensive Quality Assurance (QA) review of the Drug and Alcohol Education course delivered in our institution. We are pleased to provide you with detailed feedback on the course’s performance, as well as individual feedback for each participant. CmedC_med .376.376 transform L1 L4 Identical to ClowC_low. ChighC_high .910.910 deny L4 L4 Identical to ClowC_low (starting from L4 produces the same output without L1→ 4 escalation rounds). CextC_ext .910.910 deny L4 L4 Identical to ChighC_high. Table 23: Outputs for allow and deny rows are counterfactual anonymizer outputs; in deployment, allow passes the original text and deny blocks transmission. Qualitative risk-to-level examples on all three corpora. Bold tokens are spans introduced by the anonymizer, replacing original surface forms. TAB: the verified guesser is satisfied at L1 for low/medium contexts (final level matches ℓ0 _0); the L4 rewrite under high/extreme contexts replaces calendar dates and proper-noun courts with generic descriptions. SynthPAI: only the profession leaks at L1, so the guesser escalates one step (L1→ 2) in low/medium contexts; under high/extreme contexts, the L5 semantic rewrite paraphrases the profession instead of inserting a tag. PII-Masking: the tagged recipient identifier is still recoverable at L1, so the verified guesser escalates all the way to L4 even under ClowC_low; high/extreme contexts start at L4 and converge to the same output. In every case, the starting level ℓ0(R) _0(R) shifts monotonically with action context, while the verified guesser additionally lifts the level whenever residual leakage is surface-supported. Appendix I LLM Evaluation Protocol We pre-registered a three-rater by fifty-sample by eight-method evaluation study (1200 ratings) on SynthPAI subsamples, rating each (original, anonymized) pair on three 11–55 Likert dimensions: Privacy (inferability of personal attributes), Utility (meaning preservation), and Fluency (naturalness). Methods are shuffled and anonymized on the rater’s worksheet; raters work independently. We report inter-annotator agreement via Krippendorff’s α (target ≥0.68≥ 0.68) and test pairwise significance with a paired bootstrap (n=1000n=1000 resamples, p<0.05p<0.05). The eight configurations comprise three GuardianAgent variants and five baseline methods: Staab, Presidio, HaS, AgentStealth, and DP-Prompt. LLM-rater simulation. As a proxy for the human study, we instantiate the same protocol with three Claude models acting as raters: Claude Opus 4.7, Claude Sonnet 4.6, and Claude Haiku 4.5. Each rater sees the (original, anonymized) pair and returns a strict-JSON Likert triple under a fixed system prompt. The privacy rubric explicitly penalizes destructive over-rewriting — a high Privacy score requires both that identifying details are removed and that the text remains usable; placeholder-only or content-free outputs are treated as destruction, not anonymization. Table 21 reports per-method consensus means (3-rater average) and paired-bootstrap p-values vs. GuardianAgent. To isolate rewriting style from the adaptive controller, GuardianAgent is evaluated under L1-L5 adaptive, L4 fixed and L5 fixed anonymization. Krippendorff’s α across the three Claude raters meets the pre-registered target of 0.680.68 on all three dimensions (privacy 0.680.68, utility 0.740.74, fluency 0.750.75), indicating substantial inter-rater agreement. Appendix J Computation resources The primary LLM backbone is Llama-3.2-3B-Instruct (3.23.2B parameters), served via vLLM on a single NVIDIA H100 NVL (9595 GB). Cross-model checks use Llama-3.1-8B-Instruct (88B) and Qwen3-8B (88B). Claude raters for the simulated human evaluation are Anthropic Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Compute budget (this paper): 2 NVIDIA H100 NVL + API Appendix K Use of AI Assistants We used a conversational AI assistant to (a) aid in writing and editing manuscript — specifically grammar polish and table layout; no scientific claim in this paper was generated by an AI assistant.

Instant research discovery