Paper deep dive

LLMs as Linguistic Chameleons: Decoupling Semantics and Structure for Privacy-Preserving Communication

Yuzhu Mao, Liang Zhao

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 111

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 89%

Last extracted: 9/22/2026, 5:58:08 AM

Summary

The paper introduces CROSS-MAP, a privacy-preserving framework for Large Language Models (LLMs) that decouples semantic content from structural patterns. Unlike existing methods that preserve semantics (leaving privacy risks), CROSS-MAP maps private inputs into a different semantic domain while preserving the syntactic structure required for LLM reasoning. This approach, implemented via local models trained with multi-objective optimization, reduces reconstruction attack success rates while maintaining high task utility.

Entities (7)

CROSS-MAP · framework · 98%Semantic Decoupling · concept · 92%Semantic-Preserving Mapping · method · 90%Direct Preference Optimization · algorithm · 88%Supervised Fine-tuning · algorithm · 88%Qwen-2.5-7B · model · 85%Information Bottleneck · theory · 80%

Relation Signals (6)

CROSS-MAP → implements → Semantic Decoupling

confidence 95% · Based on this idea, we propose CROSS-MAP, a bidirectional framework that maps private inputs into a different semantic domain before inference and recovers the corresponding outputs afterward.

CROSS-MAP → reduces → Reconstruction Success

confidence 92% · Experiments show that CROSS-MAP reduces reconstruction success across multiple attack settings

CROSS-MAP → trainsusing → Supervised Fine-tuning

confidence 90% · Stage 2: SFT. The goal is to train two instruction-following models... Both are initialized from the same base LLM and fine-tuned with parameter-efficient adapters.

CROSS-MAP → trainsusing → Direct Preference Optimization

confidence 90% · Stage 3: DPO. SFT establishes a strong base, but it does not directly optimize the multi-objective reward. DPO is therefore employed to refine the mapper

Semantic Decoupling → outperforms → Semantic-Preserving Mapping

confidence 88% · Experiments show that CROSS-MAP reduces reconstruction success across multiple attack settings while outperforming existing baselines in utility.

CROSS-MAP → uses → Qwen-2.5-7B

confidence 85% · compact local models such as Qwen-2.5-7B can be adapted to perform semantic decoupling through multi-objective optimization

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:As Large Language Model (LLM) APIs become increasingly integrated into privacy-sensitive workflows, ensuring inference-time privacy without compromising task utility remains a major challenge. Existing approaches preserve most of the original semantic content to maintain downstream performance, but this also leaves exploitable cues for reconstructing the original text. This work investigates semantic decoupling, which replaces original semantics with alternative content while preserving the structure needed for LLM reasoning. Based on this idea, we propose CROSS-MAP, a bidirectional framework that maps private inputs into a different semantic domain before inference and recovers the corresponding outputs afterward. Local models are trained with multi-objective optimization to maximize semantic divergence in the mapping stage while minimizing semantic inconsistency in the recovery stage. Experiments show that CROSS-MAP reduces reconstruction success across multiple attack settings while outperforming existing baselines in utility.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

108,202 characters extracted from source content.

Expand or collapse full text

LLMs as Linguistic Chameleons: Decoupling Semantics and Structure for Privacy-Preserving Communication Yuzhu Mao Affiliation: Emory University Email: yuzhu.mao@emory.edu Liang Zhao †thanks: Corresponding author. Affiliation: Emory University Email: liang.zhao@emory.edu Abstract As Large Language Model (LLM) APIs become increasingly integrated into privacy-sensitive workflows, ensuring inference-time privacy without compromising task utility remains a major challenge. Existing approaches preserve most of the original semantic content to maintain downstream performance, but this also leaves exploitable cues for reconstructing the original text. This work investigates semantic decoupling, which replaces original semantics with alternative content while preserving the structure needed for LLM reasoning. Based on this idea, we propose CROSS-MAP, a bidirectional framework that maps private inputs into a different semantic domain before inference and recovers the corresponding outputs afterward. Local models are trained with multi-objective optimization to maximize semantic divergence in the mapping stage while minimizing semantic inconsistency in the recovery stage. Experiments show that CROSS-MAP reduces reconstruction success across multiple attack settings while outperforming existing baselines in utility. Code is available at https://anonymous.4open.science/r/CROSS-MAP-7B2C/. 1 Introduction As LLM APIs are increasingly integrated into private workflows, a growing amount of sensitive communication, from user queries to inter-agent instructions, is sent to third-party providers. Protecting textual information has therefore become a critical challenge in the era of LLMs Hong et al. (2024); Kan et al. (2023). A standard view in linguistics and natural language processing (NLP) is that text decomposes into semantics (meaning-bearing elements such as entities, events, and attributes) and structure (the syntactic organization of these elements, such as word order and dependency relations) Bloom and Lahey (1979); Hill et al. (2025). Many reasoning tasks in LLMs are largely driven by structural patterns, implying that logical relations among entities remain valid regardless of changes in semantic content Kim and Linzen (2020); Li et al. (2023a). Since sensitive information is encoded primarily in semantic content rather than abstract structural templates, privacy leakage typically arises from semantics Frikha et al. (2025); Staab et al. (2024), while structure remains largely benign. Existing privacy-preserving approaches for LLM interaction face a fundamental trade-off between privacy and utility. To maintain downstream task performance, these methods typically keep the transformed text semantically close to the original input, since inference is performed directly on the transmitted text. Methods such as differential privacy and anonymization obfuscate sensitive information by perturbing semantic content, often degrading utility for tasks that rely on fine-grained details (Wu et al., 2024c; Hong et al., 2024; Staab et al., 2025). Other approaches introduce recovery mechanisms to mitigate semantic drift Chowdhury et al. (2025); Kan et al. (2023); Shen et al. (2024); Chen et al. (2023b). However, since these methods operate in a semantic preserving regime, the semantic content is subject to only limited changes to retain utility, leaving exploitable cues that allow attackers to infer or reconstruct the original text (Tong et al., 2025a; Pang et al., 2025). For example, even after transformation, an LLM can still infer a user’s sensitive financial and medical circumstances from a statement such as Alice transferred $50,000\$50,000 from her savings account to pay medical debt after being diagnosed with serious disease. To address the dilemma inherent in semantic preserving approaches, we explore a new scenario, semantic decoupling, that allows LLMs to reason over preserved structural patterns while sensitive semantics remain local. Instead of transmitting sensitive content directly, the input is mapped into an insensitive semantic domain that preserves the structure but replaces the meaning. This allows the LLM to operate on a structure-preserving representation, where the original semantics is completely hidden and can only be restored locally afterward. For example, the thief robs the bank, the waiter wipes the table, and the programmer tests the software share the same noun + verb + determiner + noun structure despite expressing different meanings. Thus, for queries such as identifying who performs which action, the LLM can reason over the preserved structure, while only an authorized receiver with the mapping codebook (e.g., thief ↔ waiter, rob ↔ wipe, bank ↔ table) can recover the original text, leaving attackers observing the mapped text with little information about the sensitive content. Historically, this paradigm has been difficult to realize. Semantic decoupling requires discovering mappings across semantic domains that preserve structural reasoning while enabling reliable recovery, which in effect requires constructing a codebook that aligns concepts across domains. Identifying such mappings demands broad linguistic and conceptual knowledge, which was largely infeasible before the emergence of modern foundation models. Recent LLMs show a strong ability to model cross-domain semantic relationships, making automated mapping increasingly plausible. However, for privacy, this capability must run locally rather than through a third-party API, since sending sensitive inputs externally would defeat the purpose of semantic decoupling. Meanwhile, general foundation models are often too large for practical local deployment and are not trained for semantic-decoupling mapping and recovery. A practical solution must therefore meet three requirements simultaneously: efficient local deployment, strict locality to avoid external exposure of private inputs, and adaptability to semantic-decoupling tasks. This paper explores the extent to which semantic decoupling, which replaces sensitive semantic content while preserving structural reasoning patterns, can move beyond the privacy–utility dilemma inherent in semantics-preserving approaches. Specifically, we first formulate the semantics-preserving and semantic-decoupling paradigms and analyze their respective advantages from an information-theoretic perspective, characterizing when semantic decoupling offers a better privacy–utility trade-off. Second, we propose CROSS-MAP, a compact local framework for semantic-decoupling text mapping and recovery. With training objectives that encourage large semantic shifts while maintaining consistent recovery, compact local models such as Qwen-2.5-7B can be adapted to perform semantic decoupling through multi-objective optimization, achieving both stronger privacy and higher utility than semantics-preserving baselines. Finally, in addition to the defense-centric view, we adopt an attack-centric view of security by introducing an optimization-based attack to evaluate the robustness of semantic-decoupling systems against white-box adversaries, including scenarios with partial codebook leakage. 2 Related Work This section provides a brief overview of related work. A more detailed review is provided in Appendix A. 2.1 Differential Privacy Differential Privacy (DP) approaches for LLMs inject noise into data, gradients, or generation processes to avoid directly exposing the original private dataset to an external model (Abadi et al., 2016; Wu et al., 2024a; Yue et al., 2023; Wang et al., 2025; Wu et al., 2024c; Utpala et al., 2023; Flemings and Annavaram, 2024; Hong et al., 2024). However, DP noise can significantly degrade model performance. To preserve downstream utility, existing methods often either restrict DP protection to less critical components (Chowdhury et al., 2025; Tong et al., 2025b) or focus on tasks that are relatively insensitive to fine-grained details, such as sentiment analysis (Mattern et al., 2022; Kurakin et al., 2023). 2.2 Text Anonymization and Sanitization Text anonymization aims to transform text to reduce the risk of revealing personal information (e.g., identity or sensitive attributes) while preserving downstream utility (Pilán et al., 2022). Prior work demonstrates that modern LLMs have the potential to both anonymize and deanonymize text, highlighting risks of malicious re-identification attacks (Patsakis and Lykousas, 2023; Staab et al., 2024; Staab et al., 2025). Text sanitization extends beyond protecting personal identity information to broader sensitive content (Yue et al., 2021; Li et al., 2025; Chen et al., 2023a). To further improve downstream utility, some studies introduce an explicit desanitization step to form a bidirectional framework (Kan et al., 2023; Shen et al., 2024; Chen et al., 2023b; Chowdhury et al., 2025). This line of works share a consensus that the mapped text and original text must be within the same semantic space for more accurate LLM inference. 3 Preliminaries This section presents necessary knowledge for understanding the difference between the proposed method and related work. 3.1 Problem Formulation Framework that contains both mapping and recovery processes is termed as bidirectional privacy-preserving framework in this work. Let X be the space of original texts and Y the space of mapped texts. A mapping process ℳM produces a mapped output y∼ℳ⁡(x)y (x) from the original text x. A recovery process ℛR produces a recovered text x~∼ℛ⁡(y) x (y) from y. Privacy-preserving communication with LLMs aims to maintain the downstream task utility while protecting the original input x. Without protection, the LLM outputs a model response xa=ℒℒℳ(x)x_a=LLM(x) upon receiving the input x. But to prevent the LLM from directly observing the original input x, the mapping mechanism ℳM first conducts the mapping x↦yx y and then sends y∈y to the LLM. Given the mapped input y, the LLM outputs a model response ya=ℒℒℳ(y)y_a=LLM(y). After receiving the model response yay_a from the LLM, the recovery mechanism ℛR produces a recovered response x~a=ℛ⁡(ya) x_a=R(y_a).The downstream task utility requires the recovered response x~a x_a to be consistent with the ground-truth response xax_a: Sim⁡(xa,x~a)≥1−ϵ,Sim(x_a, x_a)≥ 1-ε, -6.0pt where Sim⁡(⋅,⋅)Sim(·,·) is a text similarity measure, e.g., embedding cosine, BERTScore, or an LLM-judge. The threshold ϵε is a measure for the drift in the model response induced by the mapping and recovery processes. 3.2 Two Mapping Paradigms According to linguistic research, language is comprised of three primary components: form, content, and use Bloom and Lahey (1979); Hill et al. (2025). Form covers syntax, morphology, and orthography. Content denotes semantics, while use refers to pragmatics, which relates to the context of communication. Consequently, any written text x itself can be decomposed into structural component xcx_c (e.g., sentence organization, word worder, and relationships between words) and semantic element xsx_s (e.g., entities, phrases, and key spans). Under such decomposition, we present the key difference between existing mapping mechanisms, which is summarized as semantic-preserving mapping, and the proposed semantic-decoupling mapping: The goal of semantic-preserving mapping can be formulated as solving the following optimization problem maxℳ,ℛ⁡Sim⁡(ℒℒℳ(x),ℛ⁡(ℒℒℳ(ℳ⁡(x)))), _M,R\;Sim\! (LLM(x),\;R\! (LLM(M(x)) ) ), -6.0pt subject to the semantic similarity constraint: Sim⁡(xs,ℳ⁡(xs))≥1−ϵs.Sim\! (x_s,\;M(x_s) )≥ 1- _s. In contrast, the goal of semantic-decoupling mapping can be formulated as subject to the structural similarity constraint: Sim⁡(xc,ℳ⁡(xc))≥1−ϵc.Sim\! (x_c,\;M(x_c) )≥ 1- _c. -6.0pt Briefly speaking, both mapping paradigms aim to maximize the similarity between the ground-truth LLM response xa=ℒℒℳ(x)x_a=LLM(x) and the recovered response x~a=ℛ⁡(ℒℒℳ(ℳ⁡(x))) x_a=R(LLM(M(x))). Semantic-preserving mapping requires the mapped text ℳ⁡(x)M(x) to remain semantically similar to the original text x. For example, the number increases rapidly ↦ the value rises quickly. However, the semantic-decoupling mapping removes this constraint on semantic similarity. Instead, it requires structure invariance between the original text x and the mapped text ℳ⁡(x)M(x). For example, The number increases rapidly ↦ The rain drops heavily. 4 An Information-Theoretic View The difference between semantic-preserving and semantic-decoupling mappings can be understood from an information-theoretic perspective. Recall the mapping pipeline (xc,xs)→ℳ(yc,ys)→ℒℒℳz(x_c,x_s) M(y_c,y_s) LLMz, where xcx_c and xsx_s are the structural and semantic components of the original text x, ycy_c and ysy_s are the structural and semantic components of the mapped text y, and z is the LLM response on y. Information bottleneck objective. Searching for the optimal mapping mechanism ℳM is equivalent to solving the following optimization problem: ⁡(ℳ)=minℳ⁡I⁡(x,y)−βI(y,z),G(M)= _MI(x;y)-β I(y;z), -6.0pt (1) where I⁡(x,y)I(x;y) quantifies the amount of information from the original text retained within the mapped text, and I⁡(y,z)I(y;z) measures the task-relevant information preserved in the mapped text for the downstream LLM. For readability, Table 1 summarizes the core notation used in the main text. Symbol Meaning x,y,zx,y,z original text, mapped text, and LLM response xs,xcx_s,x_c semantic and structural components of x λs,λc _s, _c task dependence on semantic and structural information, respectively ℳSD,ℳSPM_SD,M_SP semantic-decoupling /semantic-preserving mapping mechanisms Δρs,Δρc _s, _c how much less semantic and structural information from the original text is preserved by ℳSDM_SD than by ℳSPM_SP in the mapped text (i.e., ℳSDM_SD’s compression gain) Δηs,Δηc _s, _c how much less task-relevant semantic and structural information is preserved by ℳSDM_SD than by ℳSPM_SP in the mapped text (i.e., ℳSDM_SD’s task-relevant information loss) Table 1: Core notation used in the main text. Other notations used in the proof are defined in Appendix B. Theorem 1. Let ℳSPM_SP and ℳSDM_SD denote semantic-preserving and semantic-decoupling mappings respectively under the same task distribution over inputs x. Assume semantic and structural information is indepdent in any text. Then, the information bottleneck objective satisfies ⁡(ℳSD)<⁡(ℳSP),G(M_SD)<G(M_SP), -5.0pt i.e., ℳSDM_SD achieves a lower information bottleneck objective than ℳSPM_SP, if the downstream task’s semantic-dependence coefficient λs _s is smaller than this threshold: λs<r⋅Δρs+(1−r)Δρc−β′⋅Δηcβ′(Δηs−Δηc), _s< r· _s+(1-r) _c-β · _cβ ( _s- _c), -5.0pt (2) where β′β and r are some constants. The detailed definitions of involved quantities and a full derivation are provided in Appendix B. Corollary 1. ℳSDM_SD achieves a lower information bottleneck objective than ℳSPM_SP, if its gains in compression outweigh its task-relevant information loss in the following way: r⋅Δρs+(1−r)Δρc>β′(Δηs⋅λs+Δηc⋅λc).r· _s+(1-r) _c>β ( _s· _s+ _c· _c). -5.0pt Remark 1. Eq. (2) formalizes an intuitive trade-off that ℳSDM_SD is advantageous when it brings substantial compression gains while only mildly harming the task-relevant information needed by the downstream task: In the numerator, larger Δρs _s or Δρc _c means that ℳSDM_SD removes more semantic or structural information from the original text than ℳSPM_SP, leading to a stronger compression and privacy advantage. This enlarges the threshold, so ℳSDM_SD remains preferable for a wider range of tasks. The weight r reflects where most of the entropy in the original input lies. When r is larger, the information carried by the original text is dominated by its semantic content. By contrast, larger Δηs _s means that semantic decoupling discards more task-relevant semantic information, which increases the denominator and thus lowers the threshold. Larger Δηc _c has a similar effect through the term −β′Δηc-β _c in the numerator. Finally, a larger β′β implies that downstream utility is weighted more heavily relative to compression, so the threshold becomes more stringent. Privacy benefits with compression. According to the variational information bottleneck (VIB) framework, the mutual information terms in Equation (1) can be bounded as follows: I(x;y)=y∼p⁡(y)[KL(p(x|y)∥p(x))],I(x;y)=E_y p(y) [KL(p(x|y) p(x)) ], -5.0pt and I⁡(y,z)≥y,z[log⁡q⁡(z|y)],I(y;z) _y,z [ q(z|y) ], -4.0pt where q⁡(z|y)q(z|y) is an auxiliary variational distribution used to approximate the posterior p⁡(z|y)p(z|y). On one hand, ℳSDM_SD reduces I⁡(x,y)I(x;y) by decoupling the semantic information of x and y, which encourages smaller KL divergence between p⁡(y|x)p(y|x) and p⁡(y)p(y). Equivalently, the attacker posterior p⁡(x|y)p(x|y) becomes closer to the true prior p⁡(x)p(x) on average, implying that the mapped output y reveals less usable information about the original text x. Therefore, this compression directly enhances privacy against attackers observing y. 11 1 An in-depth analysis of the connection between KL divergence and posterior-based attack success rate is provided in Appendix C. On the other hand, such privacy benefits of ℳSDM_SD come at the cost of dropping more task-relevant semantic information compared to ℳSPM_SP, which might impact the q⁡(z|y)q(z|y) modelled by the downstream LLM. As implied by Equation (2), if the downstream task’s dependence on semantic information can tolerate such loss, ℳSDM_SD dominates ℳSPM_SP with compression benefits outweighing the task information loss. 5 CROSS-MAP This section presents CROSS-MAP, a semantic-decoupling framework designed for cross-domain mapping and recovery. Figure 1: Illustration of inference-time protection with CROSS-MAP. 5.1 Key Components To address the challenges of highly-unstructured text inputs, two key designs are needed: (i) a structured mapping and a recovery module, and (i) a verifiable reward and metric design. Structured mapping and recovery. Given an original input x, the mapper ℳϕM_φ produces a cross-domain representation (τ,D,y)∼ℳϕ(x)(τ,D,y) _φ(x) consisting of a target-domain theme τ, a dictionary D, and a mapped text y. Here D=(si,s^i)i=1mD=\(s_i, s_i)\_i=1^m maps each original span sis_i to a target-domain span s^i s_i. The recoverer ℛψR_ψ reconstructs the restored text x~∼ℛψ(τ,D,y) x _ψ(τ,D,y) from (τ,D,y)(τ,D,y). Both ℳϕM_φ and ℛψR_ψ are implemented as instruction-following LLMs with structured outputs (e.g., JSON). Verifiable reward. A compact set of score metrics is needed to guide the training of the mapper and the recoverer: • Dictionary coverage cdict(x,D)c_dict(x,D). Let x=(x1,…,xn)x=(x_1,…,x_n) be the token sequence of length n. Each original span sis_i in D corresponds to a contiguous index interval Ii⊆1,…,nI_i \1,…,n\ in x. Define the set of covered token positions as ℐ⁡(D):=⋃i=1mIiI(D):= _i=1^mI_i. The dictionary coverage is the fraction of tokens in x that are covered by a dictionary span: cdict(x,D)=|ℐ⁡(D)|/nc_dict(x,D)=|I(D)|/n. Intuitively, higher cdictc_dict means a larger portion of the original text x is explicitly handled by the mapper through D. • Dictionary distance ddict(D)d_dict(D). Using a cosine similarity measure Sim⁡(⋅,⋅)Sim(·,·) that takes in span embeddings, the distance between spans in D is measured as ddict(D)=1−1m∑i=1mSim⁡(si,s^i)d_dict(D)=1- 1m _i=1^mSim(s_i, s_i). • Text distance dtext(x,y)d_text(x,y). Using a cosine similarity measure that takes in sentence embeddings, the text distance between x and y is measured as dtext(x,y)=1−1L∑j=1LSim⁡(xj,yj)d_text(x,y)=1- 1L _j=1^LSim(x_j,y_j), where xjj=1L\x_j\_j=1^L and yjj=1L\y_j\_j=1^L are sentence splits of x and y. • Fluency ftext(y)f_text(y). Let (y1,…,yT)(y_1,…,y_T) be the token sequence of the mapped text y. The fluency score is set to the negative log-perplexity −1T∑t=1TlogpLM(yt|y<t)- 1T _t=1^T p_LM\! (y_t|y_<t ), where pLMp_LM represents the output distribution of a reference language model. Finally, the above metrics are aggregated into a single scalar reward: r⁡(x,τ,D,y,x~) r(x,τ,D,y, x) =w1cdict(x,D)+w2ddict(D) =w_1\,c_dict(x,D)+w_2\,d_dict(D) +w3dtext(x,y)+w4ftext(y) +w_3\,d_text(x,y)+w_4\,f_text(y) +w5(1−dtext(x,x~)), +w_5\,(1-d_text(x, x)), with nonnegative weights w1,w2,w3,w4,w5\w_1,w_2,w_3,w_4,w_5\. The last term measures the consistency between the original text x and recovered text x~ x 5.2 Training: SFT to DPO The training pipeline has three stages: (i) seed data synthesis, (i) supervised fine-tuning (SFT) for structured mapping/recovery, and (i) direct preference optimization (DPO) for multi-objective alignment. Stage 1: Data synthesis. We first use GPT-5.2 to synthesize a small subset22 2 These instances are available in the provided GitHub repository. of training instances synth=(x→ℳ(τ,D,y)),((τ,D,y)→ℛx~)D_synth=\(x M(τ,D,y)),\;((τ,D,y) R x)\. Stage 2: SFT. The goal is to train two instruction-following models: a private mapper ℳϕM_φ and a recoverer ℛψR_ψ. Both are initialized from the same base LLM and fine-tuned with parameter-efficient adapters. The mapper learns to generate (τ,D,y)(τ,D,y) from x, while the recoverer learns to generate x~ x from (τ,D,y)(τ,D,y). Stage 3: DPO. SFT establishes a strong base, but it does not directly optimize the multi-objective reward. DPO is therefore employed to refine the mapper with preference pairs obtained by sampling and scoring. During preference construction, for each x, we sample K mapped candidates (τ(k),D(k),y(k))∼pϕ(⋅∣x),k=1,…,K(τ^(k),D^(k),y^(k)) p_φ(· x), k=1,…,K, and obtain a recovery for each candidate as x~(k)∼pψ(⋅∣τ(k),D(k),y(k)) x^(k) p_ψ(· τ^(k),D^(k),y^(k)). The scalar reward is computed as r(k):=r⁡(x,τ(k),D(k),y(k),x~(k))r^(k):=r(x,τ^(k),D^(k),y^(k), x^(k)), and a preference pair (k+,k−)(k^+,k^-) is selected such that r(k+)≥r(k−)+γr^(k^+)≥ r^(k^-)+γ for a margin γ>0γ>0. Let o+:=o(k+)o^+:=o^(k^+) and o−:=o(k−)o^-:=o^(k^-) denote the preferred and dispreferred mapper outputs, and pϕ0p_ _0 be the frozen reference model (typically the SFT checkpoint). DPO optimizes the mapper parameters ϕφ by increasing the relative likelihood of high-reward mapped outputs over low-reward ones. 5.3 Workflow with LLMs as Third-Party API Figure 1 illustrates the workflow of the proposed CROSS-MAP with the trained mapper and recoverer. After training, the private mapper ℳϕM_φ and the private recoverer ℛψR_ψ are deployed locally (e.g., on the user side), while the downstream LLM is accessed as a third-party API. Before the transmission, ℳϕM_φ first maps the original input x to a mapped version y. The LLM then produces a response yay_a and transmits it back to the recoverer. The private recoverer can subsequently recover the original-domain answer x~a x_a by reasoning jointly over the dictionary and the LLM response yay_a. Therefore, users can interact with external APIs or proprietary services under the protection of the local mapper and recoverer via CROSS-MAP. It allows the external model to operate on an alternative semantic domain while keeping the original sensitive content local. Algorithm 1 in Appendix D summarizes this workflow. 5.4 Adversarial Attacks To evaluate the security of CROSS-MAP, we simulate a white-box attacking scenario where the attacker has access to the mapper ℳϕM_φ and even to a partially leaked dictionary. Assume the attacker observes a mapped output y and attempts to recover the original input x using a parametric attack policy pθ(⋅|y)p_θ(·|y). Attack objective and reward. Given a candidate reconstruction x^∼pθ(⋅|y) x p_θ(·|y), the attacker can evaluate how well it explains the observation by passing x x through the mapper to obtain o^:=(τ^,D^,y^)∼ℳϕ(x^) o:=( τ, D, y) _φ( x). A successful x x should be mapped to y y that is close to the observed y. The attack reward is therefore defined as the similarity between y y and y: r^(x^,y)=1−dtext(y^,y) r( x;y)=1-d_text( y,y). The attacker aims to find a reconstruction x x that maximizes r^(x^,y) r( x;y). DPO-based attacker. An optimization-based attacker can align pθ(⋅|y)p_θ(·|y) to the reward r^(x^,y) r( x;y) via DPO. For each observed y, multiple candidate reconstructions x^(k)k=1K\ x^(k)\_k=1^K are sampled from pθ(⋅|y)p_θ(·|y), then mapped by ℳϕM_φ to obtain y^(k) y^(k), and finally scored by r^(k)=1−dtext(y^(k),y) r^(k)=1-d_text( y^(k),y). A preference pair (x^+,x^−)( x^+, x^-) is then constructed by selecting two candidates with a reward gap r^(x^+,y)≥r^(x^−,y)+γatk r( x^+;y)\ ≥\ r( x^-;y)+ _atk for a margin γatk>0 _atk>0. A detailed theoretical analysis of the attacker in the presence of dictionary leakage is provided in Appendix E. 6 Experiments CROSS-MAP is evaluated along two dimensions: (i) utility on question answering (QA), summarization, and generation tasks; and (i) security against de-anonymization, black-box span restoration, and optimization-based white-box attacks. Experiments are conducted on datasets from multiple semantic domains, including medicine, finance, news, and daily life. A full description of the experimental setup, including the datasets and models used, is provided in Appendix F.1. 6.1 Utility and Privacy Figure 2: Privacy-utility trade-offs across methods and datasets. The round points denote the median of subpoints representing individual datasets. Figure 2 plots utility against privacy. It visualizes each method as a point in the plane of downstream QA accuracy and text distance dtext(x,y)d_text(x,y) between original text x and mapped text y as described in Section 5.1. Across datasets, Prε ε (Chowdhury et al., 2025) clusters near the upper-utility but low-privacy corner with Plain QA, indicating Prε ε , which primarily targets numerical values, leaves the original text largely unchanged. InferDPT (Tong et al., 2025b) typically shifts upward in privacy but drifts leftward in utility due to its lack of an explicit recovery process. HAS (Chen et al., 2023b) provides a better trade-off compared to InferDPT and Prε ε . However, it is still inferior to CROSS-MAP, which consistently lies closest to the upper-right corner, achieving larger dtext(x,y)d_text(x,y) than other baselines, and meanwhile maintains downstream QA performance very close to Plain QA. Table 4 in Appendix F.2 reports the concrete numbers. For example, on SQuAD, CROSS-MAP increases dtext(x,y)d_text(x,y) from 0.2380.238 for HAS to 0.7520.752, while increasing QA accuracy from 91.8491.84 for HAS to 92.9892.98. Similar trends are observed on other datasets. We also report sensitive-span retention rate (the fraction of original sensitive spans retained in the mapped text) as a more direct privacy metric. Averaged across SQuAD, BioASQ, FinCausal, and NarrativeQA, CROSS-MAP retains only 3.1%3.1\% of sensitive spans, compared to 63.1%63.1\% for HAS and 100.0%100.0\% for Plain QA. Table 17 in Appendix F.2 provides examples of different mapping methods. To broaden the evaluation beyond QA, the SQuAD-trained mapper and recoverer are also evaluated on two non-QA task families without extra in-domain training. Table 2 summarizes the results. On CNN/DailyMail summarization, CROSS-MAP preserves summary quality, yielding a BERTScore of 0.8770.877 compared to 0.8820.882 for direct Plain LLM inference, while reducing the sensitive-span retention from 100.0%100.0\% to 7.3%7.3\%. On CommonGen open-ended generation, CROSS-MAP preserves high concept coverage (0.8910.891) while reducing retention from 98.3%98.3\% to 18.9%18.9\%. These results support Theorem 1: semantic decoupling is strongest when the task-relevant structure is sufficient, but it can still provide a superior privacy-utility trade-off for semantic-dependent generation when the mapper performs domain-level dictionary construction and the recoverer performs soft semantic recovery instead of string replacement. Task Method ROUGE-L BERT/Cov. Retention CNN/DM Plain LLM 0.240 0.882 100.0% CNN/DM CROSS-MAP 0.285 0.877 7.3% CommonGen Plain LLM 0.587 0.932 98.3% CommonGen CROSS-MAP 0.414 0.891 18.9% Table 2: Generalization on summarization and generation tasks. The BERT/Cov. metric denotes BERTScore for summarization and concept coverage for generation. Retention represents the sensitive-span retention rate. 6.2 Security Against Attacks This subsection reports and compares the security of different methods in three attack scenarios. 6.2.1 De-anonymization Attacks LLM attribute inference is a strong way for de-anonymization. The goal is to use an LLM to infer private attributes (e.g., gender, age, and location) from the mapped text. This subsection reports the success rate of LLM attribute inference on SynthPAI (Yukhymenko et al., 2024) using GPT-4 as the attacker as in GPT-A (Staab et al., 2025). Figure 3 shows that CROSS-MAP yields the lowest inference accuracy and certainty among all compared methods. The concrete numbers for each method are reported in Table 6 in Appendix F.2. Figure 3: De-anonymization results via LLM attribute inference on SynthPAI (Yukhymenko et al., 2024), comparing attacker inference accuracy and certainty across methods. Dataset Method k=10k=10 k=30k=30 k=50k=50 ASR Post. Mass ASR Post. Mass ASR Post. Mass FinCausal 2025 Moreno-Sandoval et al. (2025) CROSS-MAP 0.37%\% 0.006 0.84%\% 0.003 1.19%\% 0.002 HAS 5.88%\% 0.116 35.29%\% 0.026 35.29%\% 0.026 Plain QA 7.86%\% 0.181 41.43%\% 0.088 41.43%\% 0.088 BioASQ Tsatsaronis et al. (2015) CROSS-MAP 1.05%\% 0.004 1.05%\% 0.004 1.05%\% 0.004 HAS 12.73%\% 0.279 28.14%\% 0.164 34.66%\% 0.135 Plain QA 16.29%\% 0.316 32.81%\% 0.239 36.12%\% 0.208 SQuAD Rajpurkar et al. (2016) CROSS-MAP 0.68%\% 0.068 1.22%\% 0.042 1.49%\% 0.023 HAS 4.95%\% 0.164 12.10%\% 0.145 14.57%\% 0.124 Plain QA 5.33%\% 0.209 15.70%\% 0.171 15.70%\% 0.171 Table 3: Black-box span restoration results across datasets, reporting span restoration accuracy as ASR and the attacker’s posterior mass on the ground-truth span at different candidate list sizes k. 6.2.2 Black-box Span Restoration Attacks Span restoration attacks aim to reconstruct the exact protected spans from the mapped text. The Attack Success Rate (ASR) is defined as the span restoration accuracy, calculated as the ratio of correctly restored spans to the total number of protected spans. Table 3 shows that span restoration becomes easier as the candidate list size k increases. Plain QA consistently yields the highest ASR, while HAS offers only limited improvement. In contrast, CROSS-MAP substantially reduces restoration success across all datasets and all values of k. This suggests that preserving semantic anchors makes posterior-based restoration easier for the attacker. The table also reports posterior mass on the ground-truth span, which is defined in Appendix C. Across datasets and different k, methods with lower posterior mass exhibit lower ASR. For instance, on FinCausal 2025 at k=50k=50, CROSS-MAP assigns the lowest posterior mass (0.0020.002) together with the lowest ASR (1.19%1.19\%), whereas HAS and Plain QA show higher posterior mass (0.0260.026 and 0.0880.088) and correspondingly higher ASR (35.29%35.29\% and 41.43%41.43\%). Figure 5 in Appendix F.2 visualizes such trend across datasets as k varies. 6.2.3 White-box Optimization-based Attacks The attacker is initialized from the trained mapper and then optimized using DPO algorithm as described in Section 5.4. ASR here refers to the similarity score 1−dtext(x^,x)1-d_text( x,x) between the restored text x x and the original text x. Table 14 and Table 15 in Appendix F.2 show that restoration becomes easier as the dictionary leakage ratio ρ increases for both datasets, and that the DPO-based attacker consistently outperforms the base attacker without optimization at every ρ. Figure 6 in Appendix F.2 shows that higher leakage also helps DPO-based attacker to achieve larger gains over the base attacker. However, it is noticeable that even under this optimization-based white-box attacker, the improvement brought by optimization under CROSS-MAP remains bounded. Across both datasets and all leakage ratios ρ, the maximum relative gain of the DPO attacker over the base attacker is 29.4%29.4\%, achieved on NarrativeQA at ρ=0.1ρ=0.1 (where the DPO attacker’s ASR is still only 24.2%24.2\%). On SQuAD, the maximum relative gain is 13.6%13.6\% (achieved at ρ=0.1ρ=0.1, with the DPO attacker’s ASR still only 32.6%32.6\%). This bounded improvement suggests that, even when the mapper’s parameters are exposed and the attacker is allowed to optimize based on extra knowledge, e.g., some pairs from the mapping dictionary, the restoration advantage that can be extracted by optimization is still limited, supporting the robustness of CROSS-MAP against optimization-driven white-box restoration. 6.3 Ablation Study The ablation studies in this paper systematically evaluate the key factors impacting model deployment, including input complexity, paraphrase robustness, target-domain selection, dictionary coverage, training scale, external LLM capabilities, mapper/recoverer architecture, and training strategies. These findings offer empirical guidelines for optimal experimental configurations. Detailed tables and extended analyses are provided in Appendix F.2. 7 Conclusion This paper proposes CROSS-MAP, a semantic-decoupling framework for inference-time text protection. By replacing semantic content while preserving the structural patterns needed for downstream LLM reasoning, CROSS-MAP addresses the privacy–utility dilemma inherent in semantics-preserving approaches. An information-theoretic analysis characterizes how and when semantic decoupling provides a better privacy–utility trade-off. Experiments on QA, summarization, and generation tasks validate the analysis and demonstrate that CROSS-MAP outperforms existing baselines in both privacy and utility. These findings highlight the potential of semantic decoupling as a practical direction for privacy-preserving LLM inference. 8 Limitations The utility of CROSS-MAP depends on the extent to which a downstream task can be supported by preserved structure, discourse roles, and recoverable relational information. The summarization and generation results show that the method is not restricted to extractive QA. However, the utility drop on CommonGen also confirms that highly semantic-dependent tasks remain more challenging. One promising direction for future work is to augment CROSS-MAP with external relational knowledge sources, such as ConceptNet or related knowledge graphs, to better preserve entity-level relationships during mapping. This may be especially useful for downstream tasks that depend not only on abstract structural patterns but also on relational coherence among entities. Extending this framework to complex real-world tasks, including contract review, sensitive email drafting, and multi-turn reasoning, represents a critical next step. In addition, CROSS-MAP does not guarantee that mapped text will remain consistent with real-world facts or commonsense knowledge. Like other model-based text obfuscation methods, it may generate content that is factually implausible or inconsistent with external knowledge. Such artifacts can make obfuscated text easier to detect and may create opportunities for fact-based inference attacks, in which attackers use real-world constraints to narrow down the possible original meanings. Improving factual consistency under model-based text obfuscation remains an important direction for future work. A further limitation is the potential dual-use risk of semantic decoupling. By replacing sensitive semantics while preserving structural patterns, the method could also be used to obscure malicious intent from external oversight while retaining enough structure for downstream reasoning. This creates a potential safety risk: harmful requests or plans may become less interpretable to LLM service providers even when their functional structure is preserved. Although CROSS-MAP is intended for privacy protection, its practical deployment should therefore incorporate safeguards against misuse. References Abadi et al. (2016) M. Abadi, A. Chu, I. Goodfellow, B. McMahan, I. Mironov, K. Talwar, and L. Zhang Deep learning with differential privacy. In Proceedings of the ACM Conference on Computer and Communications Security, p. 308–318. External Links: Document Cited by: §A.2, §2.1. Bloom and Lahey (1979) L. Bloom and M. Lahey Language development and language disorders. Language 55, p. 945. External Links: Link Cited by: §1, §3.2. Chen et al. (2023a) S. Chen, F. Mo, Y. Wang, C. Chen, J. Nie, C. Wang, and J. Cui A customized text sanitization mechanism with differential privacy. In Proceedings of the Annual Meeting of the Association for Computational Linguistics, p. 5747–5758. External Links: Document, Link Cited by: §A.3, §2.2. Chen et al. (2023b) Y. Chen, T. Li, H. Liu, and Y. Yu Hide and seek (HaS): a lightweight framework for prompt privacy protection. External Links: 2309.03057, Link Cited by: §A.3, §F.1, Table 17, Table 4, §1, §2.2, §6.1. Chen et al. (2024) Z. Chen, Y. Li, S. Zhang, J. Zhou, J. Zhou, C. Bao, and D. Yu A framework for cost-effective and self-adaptive LLM shaking and recovery mechanism. External Links: 2403.07283, Link Cited by: §A.1. Chowdhury et al. (2025) A. R. Chowdhury, D. Glukhov, D. Anshumaan, P. Chalasani, N. Papernot, S. Jha, and M. Bellare Prε ε : sanitizing sensitive prompts for LLMs. External Links: 2504.05147, Link Cited by: §A.2, §A.3, §F.1, Table 17, Table 4, §1, §2.1, §2.2, §6.1. Flemings and Annavaram (2024) J. Flemings and M. Annavaram Differentially private knowledge distillation via synthetic text generation. In Proceedings of the Annual Meeting of the Association for Computational Linguistics, p. 12957–12968. External Links: Document, Link Cited by: §A.2, §2.1. Frikha et al. (2025) A. Frikha, N. Walha, K. K. Nakka, R. Mendes, X. Jiang, and X. Zhou IncogniText: privacy-enhancing conditional text anonymization via LLM-based private attribute randomization. In Proceedings of the International Joint Conference on Natural Language Processing and the Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics, p. 2490–2501. External Links: Link Cited by: §A.3, §1. Hill et al. (2025) E. Hill, K. Tonta, M. Boyes, C. F. Norbury, S. Griffiths, S. Goh, and B. Ryan Why would someone like me with DLD want to sit in a room and talk? How would that make me feel better?!: developmental language disorder and the language demands of cognitive behaviour therapy. International Journal of Cognitive Behavioral Therapy 18, p. 405–424. External Links: Document, Link Cited by: §1, §3.2. Hong et al. (2024) J. Hong, J. T. Wang, C. Zhang, Z. Li, B. Li, and Z. Wang DP-OPT: make large language model your privacy-preserving prompt engineer. In Proceedings of the International Conference on Learning Representations, External Links: Link Cited by: §A.2, §1, §1, §2.1. Hou et al. (2026) X. Hou, J. Liu, J. Li, Y. Li, J. Zhang, W. Lu, C. Hong, and K. Ren CipherGPT: secure two-party GPT inference. IEEE Transactions on Dependable and Secure Computing, p. 1–16. External Links: Document Cited by: §A.1. Kakouros et al. (2023) S. Kakouros, J. Šimko, M. Vainio, and A. Suni Investigating the utility of surprisal from large language models for speech synthesis prosody. External Links: 2306.09814, Link Cited by: Appendix C. Kan et al. (2023) Z. Kan, L. Qiao, H. Yu, L. Peng, Y. Gao, and D. Li Protecting user privacy in remote conversational systems: a privacy-preserving framework based on text sanitization. External Links: 2306.08223, Link Cited by: §A.3, §1, §1, §2.2. Kim and Linzen (2020) N. Kim and T. Linzen COGS: a compositional generalization challenge based on semantic interpretation. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, p. 9087–9105. External Links: Link, Document Cited by: §1. Kočiskỳ et al. (2018) T. Kočiskỳ, J. Schwarz, P. Blunsom, C. Dyer, K. M. Hermann, G. Melis, and E. Grefenstette The NarrativeQA reading comprehension challenge. Transactions of the Association for Computational Linguistics 6, p. 317–328. External Links: Document Cited by: §F.1. Kurakin et al. (2023) A. Kurakin, N. Ponomareva, U. Syed, L. MacDermed, and A. Terzis Harnessing large-language models to generate private synthetic text. External Links: 2306.01684, Link Cited by: §A.2, §2.1. Li et al. (2023a) B. Li, L. Donatelli, A. Koller, T. Linzen, Y. Yao, and N. Kim SLOG: a structural generalization benchmark for semantic parsing. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, H. Bouamor, J. Pino, and K. Bali (Eds.), p. 3213–3232. External Links: Link, Document Cited by: §1. Li et al. (2023b) D. Li, H. Wang, R. Shao, H. Guo, E. Xing, and H. Zhang MPCFORMER: fast, performant and private transformer inference with MPC. In Proceedings of the International Conference on Learning Representations, External Links: Link Cited by: §A.1. Li et al. (2025) S. Li, V. C. Raghuram, O. Khattab, J. Hirschberg, and Z. Yu PAPILLON: privacy preservation from internet-based and local language model ensembles. In Proceedings of the Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 3371–3390. External Links: Document, Link Cited by: §A.3, §2.2. Mattern et al. (2022) J. Mattern, Z. Jin, B. Weggenmann, B. Schölkopf, and M. Sachan Differentially private language models for secure data sharing. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, p. 4860–4873. External Links: Document, Link Cited by: §A.2, §2.1. Moreno-Sandoval et al. (2025) A. Moreno-Sandoval, B. Carbajo-Coronado, J. P. Zamorano, Y. A. T. Orta, and D. Samy The financial document causality detection shared task (FinCausal 2025). In Proceedings of the Joint Workshop of the Financial Technology and Natural Language Processing, the Financial Narrative Processing, and the Workshop on Large Language Models for Finance and Legal, p. 214–221. External Links: Link Cited by: §F.1, Table 3. Pang et al. (2025) S. Pang, Z. Lu, H. Wang, P. Fu, Y. Zhou, and M. Xue Reconstruction of differentially private text sanitization via large language models. In International Symposium on Research in Attacks, Intrusions and Defenses, p. 1–17. External Links: Document Cited by: §1. Patsakis and Lykousas (2023) C. Patsakis and N. Lykousas Man vs the machine in the struggle for effective text anonymisation in the age of large language models. Scientific Reports 13 (1), p. 16026. External Links: Document Cited by: §A.3, §2.2. Pilán et al. (2022) I. Pilán, P. Lison, L. Øvrelid, A. Papadopoulou, D. Sánchez, and M. Batet The text anonymization benchmark (TAB): a dedicated corpus and evaluation framework for text anonymization. Computational Linguistics 48 (4), p. 1053–1101. External Links: Document Cited by: §A.3, §2.2. Pilán et al. (2025) I. Pilán, B. Manzanares-Salor, D. Sánchez, and P. Lison Truthful text sanitization guided by inference attacks. Applied Soft Computing, p. 114013. External Links: Document Cited by: §A.3. Qwen et al. (2025) Qwen, A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Li, D. Liu, F. Huang, H. Wei, H. Lin, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Lin, K. Dang, K. Lu, K. Bao, K. Yang, L. Yu, M. Li, M. Xue, P. Zhang, Q. Zhu, R. Men, R. Lin, T. Li, T. Tang, T. Xia, X. Ren, X. Ren, Y. Fan, Y. Su, Y. Zhang, Y. Wan, Y. Liu, Z. Cui, Z. Zhang, and Z. Qiu Qwen2.5 technical report. External Links: 2412.15115, Link Cited by: §F.1. Rajpurkar et al. (2016) P. Rajpurkar, J. Zhang, K. Lopyrev, and P. Liang SQuAD: 100,000+ questions for machine comprehension of text. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, p. 2383–2392. External Links: Document, Link Cited by: §F.1, Table 3. Romanov et al. (2019) A. Romanov, A. Kurtukova, A. Fedotova, and R. Meshcheryakov Natural text anonymization using universal transformer with a self-attention. In Proceedings of the International Conference on Language Engineering and Applied Linguistics, p. 22–37. External Links: Link Cited by: §A.3. Shen et al. (2024) Z. Shen, Z. Xi, Y. He, W. Tong, J. Hua, and S. Zhong The fire thief is also the keeper: balancing usability and privacy in prompts. External Links: 2406.14318, Link Cited by: §A.3, §1, §2.2. Shetty et al. (2018) R. Shetty, B. Schiele, and M. Fritz A4NT: author attribute anonymity by adversarial training of neural machine translation. In Proceedings of the USENIX Conference on Security Symposium, p. 1633–1650. External Links: Link Cited by: §A.3. Staab et al. (2024) R. Staab, M. Vero, M. Balunović, and M. Vechev Beyond memorization: violating privacy via inference with large language models. In Proceedings of the International Conference on Learning Representations, External Links: Link Cited by: §A.3, §1, §2.2. Staab et al. (2025) R. Staab, M. Vero, M. Balunović, and M. Vechev Large language models are advanced anonymizers. In Proceedings of the International Conference on Learning Representations, External Links: Link Cited by: §A.3, §F.1, §1, §2.2, §6.2.1. Tong et al. (2025a) M. Tong, K. Chen, X. Yuan, J. Liu, W. Zhang, N. Yu, and J. Zhang On the vulnerability of text sanitization. In Proceedings of the Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 5150–5164. External Links: Document, Link Cited by: §1. Tong et al. (2025b) M. Tong, K. Chen, J. Zhang, Y. Qi, W. Zhang, N. Yu, T. Zhang, T. Zhang, and Z. Zhang InferDPT: privacy-preserving inference for black-box large language models. IEEE Transactions on Dependable and Secure Computing, p. 4625 – 4640. External Links: Document Cited by: §A.2, §F.1, Table 17, Table 4, §2.1, §6.1. Tsatsaronis et al. (2015) G. Tsatsaronis, G. Balikas, P. Malakasiotis, I. Partalas, M. Zschunke, M. R. Alvers, D. Weissenborn, A. Krithara, S. Petridis, D. Polychronopoulos, Y. Almirantis, J. Pavlopoulos, N. Baskiotis, P. Gallinari, T. Artiéres, A. Ngonga Ngomo, N. Heino, E. Gaussier, L. Barrio-Alvers, M. Schroeder, I. Androutsopoulos, and G. Paliouras An overview of the BioASQ large-scale biomedical semantic indexing and question answering competition. BMC Bioinformatics 16 (1), p. 138. External Links: Document Cited by: §F.1, Table 3. Utpala et al. (2023) S. Utpala, S. Hooker, and P. Chen Locally differentially private document generation using zero shot prompting. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, p. 8442–8457. External Links: Document, Link Cited by: §A.2, §2.1. Wang et al. (2025) J. Wang, C. Shi, J. Yang, H. Li, Q. Ma, H. Zhuang, C. Chen, and Z. Zeng RewardDS: privacy-preserving fine-tuning for large language models via reward driven data synthesis. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, p. 4479–4500. External Links: Document, Link Cited by: §A.2, §2.1. Wu et al. (2024a) F. Wu, H. A. Inan, A. Backurs, V. Chandrasekaran, J. Kulkarni, and R. Sim Privately aligning language models with reinforcement learning. In Proceedings of the International Conference on Learning Representations, External Links: Link Cited by: §A.2, §2.1. Wu et al. (2024b) H. Wu, W. Fang, Y. Zheng, J. Ma, J. Tan, and L. Wang Ditto: quantization-aware secure inference of transformers upon MPC. In Proceedings of the International Conference on Machine Learning, p. 53346–53365. External Links: Link Cited by: §A.1. Wu et al. (2024c) T. Wu, A. Panda, J. T. Wang, and P. Mittal Privacy-preserving in-context learning for large language models. In Proceedings of the International Conference on Learning Representations, External Links: Link Cited by: §A.2, §1, §2.1. Yang et al. (2025a) A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv, C. Zheng, D. Liu, F. Zhou, F. Huang, F. Hu, H. Ge, H. Wei, H. Lin, J. Tang, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Zhou, J. Lin, K. Dang, K. Bao, K. Yang, L. Yu, L. Deng, M. Li, M. Xue, M. Li, P. Zhang, P. Wang, Q. Zhu, R. Men, R. Gao, S. Liu, S. Luo, T. Li, T. Tang, W. Yin, X. Ren, X. Wang, X. Zhang, X. Ren, Y. Fan, Y. Su, Y. Zhang, Y. Zhang, Y. Wan, Y. Liu, Z. Wang, Z. Cui, Z. Zhang, Z. Zhou, and Z. Qiu Qwen3 technical report. External Links: 2505.09388, Link Cited by: §F.1. Yang et al. (2025b) T. Yang, X. Zhu, and I. Gurevych Robust utility-preserving text anonymization based on large language models. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 28922–28941. External Links: Document, Link Cited by: §A.3. Yuan et al. (2023) M. Yuan, L. Zhang, and X. Li Secure transformer inference protocol. External Links: 2312.00025, Link Cited by: §A.1. Yubeaton et al. (2024) P. Yubeaton, J. C. Mo, K. Garimella, N. K. Jha, B. Reagen, C. Hegde, and S. Garg TruncFormer: private LLM inference using only truncations. External Links: 2412.01042, Link Cited by: §A.1. Yue et al. (2021) X. Yue, M. Du, T. Wang, Y. Li, H. Sun, and S. S. M. Chow Differential privacy for text analytics via natural text sanitization. In Findings of the Association for Computational Linguistics: Annual Meeting of the Association for Computational Linguistics and International Joint Conference on Natural Language Processing, p. 3853–3866. External Links: Document, Link Cited by: §A.3, §2.2. Yue et al. (2023) X. Yue, H. Inan, X. Li, G. Kumar, J. McAnallen, H. Shajari, H. Sun, D. Levitan, and R. Sim Synthetic text generation with differential privacy: a simple and practical recipe. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 1321–1342. External Links: Document, Link Cited by: §A.2, §2.1. Yukhymenko et al. (2024) H. Yukhymenko, R. Staab, M. Vero, and M. Vechev A synthetic dataset for personal attribute inference. Advances in Neural Information Processing Systems 37, p. 120735–120779. External Links: Link Cited by: §F.1, Table 6, Figure 3, §6.2.1. Zhang et al. (2025) R. Zhang, Z. Zheng, and W. Bao Practical secure inference algorithm for a fine-tuned large language model based on fully homomorphic encryption. IEEE Transactions on Information Forensics and Security 21, p. 17–29. External Links: Document Cited by: §A.1. Appendix A Appendix A: Full Literature Review This section provides a comprehensive review of related work. A.1 Cryptography This line of work studies text encryption for privacy protection (Zhang et al., 2025; Wu et al., 2024b; Li et al., 2023b). Many systems for agent-to-agent communication also provide support for standard encryption primitives (Yuan et al., 2023). While these techniques offer lossless protection that allows complete recovery, they induce nontrivial computational overhead and additional communication latency. Even when optimizations are applied (Chen et al., 2024; Hou et al., 2026; Yubeaton et al., 2024), the cost and engineering complexity remain substantial in interactive inference pipelines, particularly in long-context and latency-sensitive settings, which limits the practicality of cryptography as a general-purpose solution for inference-time text protection. A.2 Differential Privacy Differential Privacy (DP) achieves privacy protection by perturbing data-dependent computations with randomness. As LLMs progress, there are growing concerns about their capacity to memorize sensitive information from their input data. Existing approaches include applying DP during model training, such as using DP variants of stochastic optimization when fine-tuning on private datasets (Abadi et al., 2016; Wu et al., 2024a). Another line of DP research focuses on training private generative models locally under DP constraints to synthesize data, which is then utilized for downstream fine-tuning or inference with larger models (Yue et al., 2023; Wang et al., 2025; Wu et al., 2024c; Utpala et al., 2023; Flemings and Annavaram, 2024; Hong et al., 2024). These DP-based approaches share the core principle of injecting noise into data, gradients, or generation processes to avoid directly exposing the original private dataset to an external model. However, DP noise can significantly degrade model performance by perturbing information essential for reasoning and prediction. To preserve downstream utility, existing methods often either restrict DP protection to less critical components (Chowdhury et al., 2025; Tong et al., 2025b), or focus on tasks that are relatively insensitive to exact factual and entity-level details, such as sentiment analysis (Mattern et al., 2022; Kurakin et al., 2023). A.3 Text Anonymization and Sanitization Text anonymization aims to transform text to reduce the risk of revealing personal information (e.g., identity or sensitive attributes) while preserving downstream utility (Pilán et al., 2022). Early neural rewriting approaches combined feature-guided edits, such as dictionary-based synonym substitution, with sequence-to-sequence generation for anonymization (Romanov et al., 2019; Shetty et al., 2018). Prior work demonstrates that modern LLMs have the potential to both anonymize and deanonymize text, highlighting risks of malicious re-identification attacks (Patsakis and Lykousas, 2023; Staab et al., 2024). Following research further proposes an LLM-based adversarial anonymization framework against LLM-driven re-identification (Staab et al., 2025). Related attempts include multi-objective optimization for utility-preserving anonymization (Yang et al., 2025b), misleading adversaries into predicting incorrect private attributes (Frikha et al., 2025), and span-level truthful anonymization via semantic generalization (Pilán et al., 2025). Compared to text anonymization, text sanitization extends beyond protecting personal identity information to broader sensitive content (Yue et al., 2021; Li et al., 2025; Chen et al., 2023a). To further improve text utility for downstream tasks, some studies introduce an explicit desanitization step. Existing methods include approaches based on predefined plaintext–ciphertext mappings (Kan et al., 2023), methods that use a language model to generate span replacements and internalize transformation rules in a local model (Shen et al., 2024; Chen et al., 2023b), and designs that protect only specific sensitive types, e.g. numerical values, to preserve most of the original semantics (Chowdhury et al., 2025). This line of works share a consensus that the mapped text and original text must be within the same semantic space for more accurate LLM inference. Appendix B Appendix B: Proof of Theorem 1 The formal proof of Theorem 1 begins with the following definitions. Preservation ratios ρs _s and ρc _c. These ratios measure the amount of semantic and structural information from the original text that is preserved in the mapped text y: ρs=I⁡(ys,xs)H⁡(xs),ρc=I⁡(yc,xc)H⁡(xc), _s= I(y_s;x_s)H(x_s), _c= I(y_c;x_c)H(x_c), where I⁡(ys,xs)I(y_s;x_s) and I⁡(yc,xc)I(y_c;x_c) denote the mutual information between the semantic and structural components of the mapped text and those of the original text. H⁡(xs)H(x_s) and H⁡(xc)H(x_c) denote the entropy of the semantic and structural components of the original text. Task-relevant preservation ratios ηs _s and ηc _c. These ratios quantify how much task-relevant semantic and structural information is transferred from the original text to the mapped text: ηs=I⁡(ys,z)I⁡(xs,z),ηc=I⁡(yc,z)I⁡(xc,z), _s= I(y_s;z)I(x_s;z), _c= I(y_c;z)I(x_c;z), where I⁡(ys,z)I(y_s;z) and I⁡(yc,z)I(y_c;z) denote the mutual information between the semantic and structural components of the mapped text and the downstream task output z. I⁡(xs,z)I(x_s;z) and I⁡(xc,z)I(x_c;z) denote the mutual information between the semantic and structural components of the original text and the downstream task. These ratios characterize the fraction of task-relevant information preserved in the mapped text. Task dependence coefficients λs _s and λc _c. These coefficients describe the relative importance of semantic and structural information in the original text for the downstream task: λs=I⁡(xs,z)I⁡(x,z),λc=I⁡(xc,z)I⁡(x,z), _s= I(x_s;z)I(x;z), _c= I(x_c;z)I(x;z), where I⁡(xs,z)I(x_s;z) and I⁡(xc,z)I(x_c;z) denote the mutual information between the semantic and structural components of the original text and the downstream task output z, and I⁡(x,z)I(x;z) denotes the mutual information between the entire input text and the task output. Since I⁡(x,z)=I⁡(xs,z)+I⁡(xc,z),I(x;z)=I(x_s;z)+I(x_c;z), it follows that λs+λc=1. _s+ _c=1. Compression gains Δρs _s and Δρc _c. These quantities measure the difference in preserved information between the semantic-preserving and semantic-decoupling mappings: Δρs=ρsSP−ρsSD,Δρc=ρcSP−ρcSD, _s= _s^SP- _s^SD, _c= _c^SP- _c^SD, where ρsSP _s^SP and ρcSP _c^SP denote the preservation ratios under the semantic-preserving mapping, and ρsSD _s^SD and ρcSD _c^SD denote the preservation ratios under the semantic-decoupling mapping. Task-relevant preservation differences Δηs _s and Δηc _c. These quantities measure the difference in task-relevant information retained by the two mappings: Δηs=ηsSP−ηsSD,Δηc=ηcSP−ηcSD, _s= _s^SP- _s^SD, _c= _c^SP- _c^SD, where ηsSP _s^SP and ηcSP _c^SP denote the task-relevant preservation ratios under the semantic-preserving mapping, while ηsSD _s^SD and ηcSD _c^SD denote those under the semantic-decoupling mapping. Proof of Theorem 1. Consider the information bottleneck objective of a mapping ℳM: ⁡(ℳ)=I⁡(x,y)−βI(y,z),G(M)=I(x;y)-β I(y;z), where x denotes the original text, y the mapped text, and z the downstream task variable. Let the difference between the objectives of the semantic-decoupling mapping and the semantic-preserving mapping be Δ=⁡(ℳSD)−⁡(ℳSP). =G(M_SD)-G(M_SP). Expanding the definition yields Δ =(ISD(x,y)−ISP(x,y)) = (I^SD(x;y)-I^SP(x;y) ) −β⁡(ISD(y,z)−ISP(y,z)). -β (I^SD(y;z)-I^SP(y;z) ). Define the compression gain ΔC=ISP(x,y)−ISD(x,y), C=I^SP(x;y)-I^SD(x;y), and the task-information difference ΔT=ISP(y,z)−ISD(y,z). T=I^SP(y;z)-I^SD(y;z). Then Δ=−ΔC+βΔT. =- C+β T. Therefore, ⁡(ℳSD)<⁡(ℳSP)G(M_SD)<G(M_SP) holds whenever ΔC>βΔT. C>β T. Compression term. Assume that the semantic and structural components of the text are independent, x=(xs,xc),xs⟂xc.x=(x_s,x_c), x_s x_c. Under this assumption, I⁡(x,y)=I⁡(xs,ys)+I⁡(xc,yc).I(x;y)=I(x_s;y_s)+I(x_c;y_c). Using the definitions of preservation ratios, I⁡(x,y)=ρsH(xs)+ρcH(xc).I(x;y)= _sH(x_s)+ _cH(x_c). The compression term is therefore ΔC=(ρsSP−ρsSD)H(xs) C=( _s^SP- _s^SD)H(x_s) +(ρcSP−ρcSD)H(xc). +( _c^SP- _c^SD)H(x_c). Using the definitions Δρs=ρsSP−ρsSD,Δρc=ρcSP−ρcSD, _s= _s^SP- _s^SD,\, _c= _c^SP- _c^SD, this becomes ΔC=ΔρsH(xs)+ΔρcH(xc). C= _sH(x_s)+ _cH(x_c). Under the independence assumption, there is H⁡(x)=H⁡(xs)+H⁡(xc).H(x)=H(x_s)+H(x_c). Define the semantic information ratio r=H⁡(xs)H⁡(x).r= H(x_s)H(x). Then H⁡(xs)H⁡(x)=r,H⁡(xc)H⁡(x)=1−r. H(x_s)H(x)=r, H(x_c)H(x)=1-r. Thus ΔC=H⁡(x)(rΔρs+(1−r)Δρc). C=H(x) (r _s+(1-r) _c ). Task-information term. The mutual information between the mapped text and the downstream task can be decomposed as I⁡(y,z)=I⁡(ys,z)+I⁡(yc,z).I(y;z)=I(y_s;z)+I(y_c;z). From the definitions of the task-relevant preservation ratios, I⁡(y,z)=ηsI(xs,z)+ηcI(xc,z).I(y;z)= _sI(x_s;z)+ _cI(x_c;z). Using the task dependence coefficients λs=I⁡(xs,z)I⁡(x,z),λc=I⁡(xc,z)I⁡(x,z), _s= I(x_s;z)I(x;z), _c= I(x_c;z)I(x;z), there is I⁡(y,z)=(ηsλs+ηcλc)I(x,z).I(y;z)=( _s _s+ _c _c)I(x;z). Therefore ΔT T =(ηsSPλs+ηcSPλc)I(x,z) =( _s^SP _s+ _c^SP _c)I(x;z) −(ηsSDλs+ηcSDλc)I(x,z) -( _s^SD _s+ _c^SD _c)I(x;z) =(Δηsλs+Δηcλc)I(x,z), =( _s _s+ _c _c)I(x;z), where Δηs=ηsSP−ηsSD,Δηc=ηcSP−ηcSD. _s= _s^SP- _s^SD, _c= _c^SP- _c^SD. Combining the two terms. The condition ΔC>βΔT, C>β T, becomes H⁡(x)(rΔρs+(1−r)Δρc) H(x) (r _s+(1-r) _c ) >β⁡(Δηsλs+Δηcλc)I(x,z). >β( _s _s+ _c _c)I(x;z). Let β′=β⋅I⁡(x,z)H⁡(x).β =β· I(x;z)H(x). Dividing both sides by H⁡(x)H(x) gives rΔρs+(1−r)Δρc>β′(Δηsλs+Δηcλc).r _s+(1-r) _c>β ( _s _s+ _c _c). Since λc=1−λs, _c=1- _s, the right-hand side becomes β′(Δηsλs+Δηc(1−λs)).β ( _s _s+ _c(1- _s)). Solving the inequality for λs _s yields λs<rΔρs+(1−r)Δρc−β′Δηcβ′(Δηs−Δηc). _s< r _s+(1-r) _c-β _cβ ( _s- _c). Whenever this condition holds, the inequality ⁡(ℳSD)<⁡(ℳSP),G(M_SD)<G(M_SP), is satisfied. This completes the proof. Appendix C Appendix C: Analysis of Attack Success Rate This section supplements the analysis of the relationship between KL divergence and attack success rate in Section 4. Figure 4: Examples of semantic-preserving and semantic-decoupling mappings under posterior sampling attacks. Semantic decoupling prevents correct inferences by stripping contextual cues from the source domain. Posterior-based span inference attack. Let x be the original text, and let s⋆:=(s1⋆,…,sm⋆)s :=(s_1 ,…,s_m ) denote the m sensitive spans in x protected by the mapping mechanism. Given the attacker-observed output y=ℳ⁡(x)y=M(x), the attacker aims to recover each hidden span si⋆s_i from y. Let qθ(si|y)q_θ(s_i|y) denote the attacker model, e.g., an LLM posterior over the i-th span conditioned on y. For each span i∈1,…,mi∈\1,…,m\, the attacker outputs K guesses s^i(1),…,s^i(K)∼qθ(si|y). s_i^(1),…, s_i^(K) q_θ(s_i|y). Equivalently, the attacker forms a candidate set ^iK(y):=s^i(1),…,s^i(K). C_i^K(y):=\ s_i^(1),…, s_i^(K)\. A span is said to be successfully recovered if the ground-truth span appears in the candidate set, i.e., si⋆∈^iK(y).s_i ∈ C_i^K(y). Attack success rate at top-K. We define the per-example attack success rate at top-K as the fraction of sensitive spans successfully recovered: ASR@K(x,y):=1m∑i=1msi⋆∈^iK(y).ASR@K(x,y):= 1m _i=1^m1\! \s_i ∈ C_i^K(y) \. Taking expectation over the data distribution and mapping randomness gives ASR@K(ℳ):=x∼p⁡(x),y∼ℳ⁡(x)[ASR@K(x,y)].ASR@K(M):=E_x p(x),\,y (x) [ASR@K(x,y) ]. Thus, ASR@K(ℳ)ASR@K(M) measures the expected proportion of sensitive spans that can be recovered by the attacker using K guesses per span. Proposition 1 (ASR@KASR@K under posterior sampling). Assume that for each sensitive span i, the attacker draws K i.i.d. guesses from the posterior qθ(si|y)q_θ(s_i|y). Then ASR@K(ℳ)=x,y[1m∑i=1m(1−(1−qθ(si⋆∣y))K)].ASR@K(M)=E_x,y [ 1m _i=1^m (1- (1-q_θ(s_i y) )^K ) ]. Proof. For a fixed (x,y)(x,y) and a fixed span i, let pi(y):=qθ(si⋆∣y).p_i(y):=q_θ(s_i y). Since the attacker draws K i.i.d. guesses from qθ(si|y)q_θ(s_i|y), the probability that none of the K guesses equals the true span si⋆s_i is (1−pi(y))K.(1-p_i(y))^K. Therefore, the probability that the true span is recovered at least once is 1−(1−pi(y))K=1−(1−qθ(si⋆∣y))K.1-(1-p_i(y))^K=1- (1-q_θ(s_i y) )^K. Taking the average over the m spans gives [ASR@K(x,y)∣x,y]=1m∑i=1m(1−(1−qθ(si⋆∣y))K).E\! [ASR@K(x,y) x,y ]= 1m _i=1^m (1- (1-q_θ(s_i y) )^K ). Finally, taking expectation over (x,y)(x,y) yields the result. ∎ Connection to KL divergence. For each sensitive span si⋆s_i , define its surprisal Kakouros et al. (2023) under the attacker posterior as i(y):=−log2⁡qθ(si⋆∣y).S_i(y):=- _2q_θ(s_i y). Taking expectation over the data distribution [i()] [S_i(Y) ] =H(i()∣) =H(S_i(Y) ) =H⁡(i())−I⁡(i(),), =H(S_i(Y))-I(S_i(Y);Y), where I(i();)=y[KL(p(si∣y)∥p(si))].I(S_i(Y);Y)=E_y\! [KL\! (p(s_i y)\,\|\,p(s_i) ) ]. Therefore, smaller KL divergence implies larger expected surprisal. Furthermore, since qθ(si⋆∣y)=2−i(y),q_θ(s_i y)=2^-S_i(y), then Proposition 1 can be rewritten as ASR@K(ℳ)=x,y[1m∑i=1m(1−(1−2−i(y))K)].ASR@K(M)=E_x,y [ 1m _i=1^m (1- (1-2^-S_i(y) )^K ) ]. Therefore, ASR@KASR@K is a monotonically decreasing function of the span surprisal. Lower surprisal assigns larger posterior mass to the ground-truth span, which increases the probability that the true span appears among the attacker’s K guesses. Consequently, a larger posterior-to-prior KL divergence leads to smaller expected surprisal and hence higher ASR@KASR@K. This aligns with the qualitative conclusion of this section: semantic-preserving mappings tend to be more vulnerable because they preserve cues in y that concentrate the posterior around s⋆s . Figure 4 provides an example of such pattern. Appendix D Appendix D: Algorithm The details of the inference workflow with CROSS-MAP described in Section 5.3 are summarized in Algorithm 1. Algorithm 1 Cross-domain Mapping and Recovery 0: Trained mapper ℳϕM_φ; trained recoverer ℛψR_ψ; downstream ℒℒℳLLM. 1: for each input x do 2: (τ,D,y)∼ℳϕ(x)(τ,D,y) _φ(x). 3: ya←ℒℒℳ(y)y_a (y). 4: (x~,x~a)∼ℛψ(τ,D,concat⁡(y,ya))( x, x_a) _ψ\! (τ,D,concat(y,y_a) ). 5: return x~a x_a. 6: end for Appendix E Appendix E: Security Analysis of CROSS-MAP This section analyzes the security of CROSS-MAP against posterior-based attackers under dictionary leakage, when the attacker additionally observes or infers a subset of the mapper dictionary. As discussed in Appendix C, the security of a mapping mechanism can be characterized through the posterior mass assigned to the ground-truth sensitive spans. In particular, under posterior-based attacks with K guesses per span, the attack success rate ASR@KASR@K is determined by the posterior probabilities of the true spans, equivalently by their surprisal. We now analyze how these quantities change when part of the dictionary is leaked to the attacker. Leakage model. Let s⋆=(s1⋆,…,sm⋆)s =(s_1 ,…,s_m ) denote the m sensitive spans in the original text x, and let s^=(s^1,…,s^m) s=( s_1,…, s_m) be their mapped-domain counterparts produced by CROSS-MAP. The full mapper dictionary for this example is D=(si⋆,s^i)i=1m.D=\(s_i , s_i)\_i=1^m. Assume the attacker additionally learns a leaked subset Dleak⊆D_leak D containing ℓ revealed pairs, with leakage rate ρ=ℓ/mρ= /m. Let ℐleak⊆1,…,mI_leak \1,…,m\ denote the indices of leaked spans, and let ℐhid:=1,…,m∖ℐleakI_hid:=\1,…,m\ _leak be the indices of the still-hidden spans. Given the attacker-observed mapped output y=ℳ⁡(x)y=M(x), dictionary leakage enriches the attacker-visible information from y to (y,Dleak)(y,D_leak). Accordingly, for each hidden span i∈ℐhidi _hid, the attacker posterior changes from qθ(si∣y)q_θ(s_i y) to the leakage-conditioned posterior qθρ(si∣y,Dleak)q_θ^ρ(s_i y,D_leak). For leaked spans i∈ℐleaki _leak, recovery is trivial once the corresponding dictionary pair is known. Attack success rate under leakage. Under the same attack protocol as in Appendix C, the attacker outputs K guesses for each span. For leaked spans, the correct value is directly recovered from DleakD_leak. For hidden spans, the attacker draws K guesses from the leakage-conditioned posterior qθρ(si|y,Dleak)q_θ^ρ(s_i|y,D_leak). Define the per-example success rate under leakage as ASR@Kρ(x,y):=1m(∑i∈ℐleak1+∑i∈ℐhidsi⋆∈^i,ρK(y)),ASR@K_ρ(x,y):= 1m ( _i _leak1+ _i _hid1\! \s_i ∈ S_i,ρ^K(y) \ ), where ^i,ρK(y) S_i,ρ^K(y) denotes the attacker’s K guesses for span i under leakage. Taking expectation over the data distribution and mapping randomness gives ASR@Kρ(ℳ):=x,y[ASR@Kρ(x,y)].ASR@K_ρ(M):=E_x,y\! [ASR@K_ρ(x,y) ]. Proposition 2 (ASR@KρASR@K_ρ under dictionary leakage). Assume that for each hidden span i∈ℐhidi _hid, the attacker draws K i.i.d. guesses from qθρ(si|y,Dleak)q_θ^ρ(s_i|y,D_leak). Then ASR@Kρ(ℳ)=x,y[1m(|ℐleak| @K_ρ(M)=E_x,y\! [ 1m (|I_leak| . . +∑i∈ℐhid(1−(1−qθρ(si⋆∣y,Dleak))K))]. . .+ _i _hid (1- (1-q_θ^ρ(s_i y,D_leak) )^K ) ) ]. Proof. For each leaked span i∈ℐleaki _leak, the true span is directly revealed by the leaked dictionary pair, so its contribution to the success rate is 11. For each hidden span i∈ℐhidi _hid, let piρ(y):=qθρ(si⋆∣y,Dleak).p_i^ρ(y):=q_θ^ρ(s_i y,D_leak). Since the attacker draws K i.i.d. guesses from the leakage-conditioned posterior, the probability that none of the K guesses equals the ground-truth span is (1−piρ(y))K.(1-p_i^ρ(y))^K. Therefore, the probability that the true span is recovered at least once is 1−(1−piρ(y))K=1−(1−qθρ(si⋆∣y,Dleak))K.1-(1-p_i^ρ(y))^K=1- (1-q_θ^ρ(s_i y,D_leak) )^K. Averaging over all m spans yields the conditional per-example success rate, and taking expectation over (x,y)(x,y) gives the result. ∎ Connection to surprisal under leakage. For each hidden span i∈ℐhidi _hid, define its leakage-conditioned surprisal as iρ(y):=−log2⁡qθρ(si⋆∣y,Dleak).S_i^ρ(y):=- _2q_θ^ρ(s_i y,D_leak). Then Proposition 2 can be rewritten as ASR@Kρ(ℳ) @K_ρ(M) =x,y[1m(|ℐleak|+ =E_x,y\! [ 1m (|I_leak|+ . . ∑i∈ℐhid(1−(1−2−iρ(y))K))]. . . _i _hid (1- (1-2^-S_i^ρ(y) )^K ) ) ]. Hence, for the unrevealed spans, dictionary leakage increases attack success exactly when it decreases the surprisal of the ground-truth spans under the attacker’s posterior. Effect 1: Search-space reduction for hidden spans. Dictionary leakage reduces the effective search space for the remaining hidden spans. Intuitively, once some span–mapping pairs are known, candidates inconsistent with the leaked dictionary can be eliminated, which increases the relative posterior mass assigned to the feasible values of the unrevealed spans. To make this precise, suppose that for each hidden span i, the attacker originally considers a feasible candidate set i(y)C_i(y), while under leakage the feasible set shrinks to iρ(y,Dleak)⊆i(y).C_i^ρ(y,D_leak) _i(y). If the posterior over the feasible set is approximately uniform, then qθ(si⋆∣y)≈1|i(y)|,q_θ(s_i y)≈ 1|C_i(y)|, qθρ(si⋆∣y,Dleak)≈1|iρ(y,Dleak)|.q_θ^ρ(s_i y,D_leak)≈ 1|C_i^ρ(y,D_leak)|. Since |iρ(y,Dleak)|≤|i(y)|,|C_i^ρ(y,D_leak)|≤|C_i(y)|, the posterior mass of the true span increases after leakage, which lowers surprisal and raises ASR@KASR@K. Effect 2: Posterior concentration via cross-span dependence. Beyond search-space reduction, leaked spans can provide additional semantic or structural clues about the remaining hidden spans. Let shids_hid and sleaks_leak denote the collections of hidden and leaked spans, respectively. Conditioning on the leaked dictionary cannot increase uncertainty: H⁡(shid∣y,Dleak)≤H⁡(shid∣y).H(s_hid y,D_leak)≤ H(s_hid y). Equivalently, I⁡(shid;Dleak∣y) I(s_hid;D_leak y) =H⁡(shid∣y)−H⁡(shid∣y,Dleak)≥0. =H(s_hid y)-H(s_hid y,D_leak)≥ 0. Thus, leaked dictionary entries provide additional information about the unrevealed spans beyond what is already contained in y. At the per-span level, for each hidden span sis_i this implies H⁡(si∣y,Dleak)≤H⁡(si∣y).H(s_i y,D_leak)≤ H(s_i y). If the attacker posterior is well calibrated to the true posterior, then the expected leakage-conditioned surprisal satisfies ⁡[iρ()]=H⁡(si∣,Dleak) [S_i^ρ(Y)]=H(s_i ,D_leak) ≤H⁡(si∣)=⁡[i()]. ≤ H(s_i )=E[S_i(Y)]. Therefore, dictionary leakage reduces the expected surprisal of the unrevealed spans and increases their recovery probability under posterior-based attacks. The above analysis shows that dictionary leakage harms security through two coupled mechanisms: it directly reveals the leaked spans themselves, and it indirectly increases the recoverability of the remaining spans by concentrating the attacker posterior. In terms of the CROSS-MAP framework developed in this paper, both effects increase the posterior mass on the ground-truth spans, reduce their surprisal, and therefore raise ASR@KASR@K. This motivates evaluating security as a function of the leakage rate ρ and reporting robustness against strong attackers with partial dictionary knowledge inferred from historical observations. Appendix F Appendix F: Supplementary Experimental Results This section provides supplementary details on the experimental setup and results. F.1 Experimental Setup This subsection reports the experimental setup, including datasets, baselines, models, and evaluation metrics. Datasets. SQuAD Rajpurkar et al. (2016), BioASQ Tsatsaronis et al. (2015), FinCausal 2025 Moreno-Sandoval et al. (2025), and NarrativeQA Kočiskỳ et al. (2018) are used for QA-style evaluation across general, biomedical, financial, and narrative domains. CNN/DailyMail is used for summarization, and CommonGen is used for constrained open-ended generation. SynthPAI (Yukhymenko et al., 2024) is used for evaluation against de-anonymization attacks. Model optimization involves a subset of SQuAD comprising 754 instances for SFT and 1,502 instances for DPO. For QA evaluation, 500 test instances are sampled from each dataset. The additional summarization and open-ended generation experiments use 200 CNN/DailyMail instances and 100 CommonGen instances, respectively. All reported results are averaged across the corresponding test subset in a single run for each dataset. Baselines. State-of-the-art methods for inference-time privacy protection are used as baselines, including the sanitization method InferDPT Tong et al. (2025b), and bidirectional frameworks HAS Chen et al. (2023b) and Prε ε Chowdhury et al. (2025). For evaluation against de-anonymization attacks, the adversarial anonymization framework GPT-A Staab et al. (2025) is also included as a baseline. Metrics. The evaluation focuses on the trade-off between utility and privacy across tasks. For QA, utility is assessed with EM/F1/ACC. For summarization, utility is assessed with ROUGE-L and BERTScore. For CommonGen, utility is assessed with ROUGE-L and concept coverage. The utility-oriented training objectives introduced in Section 5, including fluency and recovery quality, are also reported where applicable. Privacy is measured using dictionary-/text-level distance, dictionary coverage, sensitive-span retention, and the posterior-mass quantity derived from surprisal in Appendix E. Beyond these intrinsic metrics, attack success rate (ASR) is reported under different attackers to reflect effective privacy under each threat model. Models. Qwen-2.5-3B/7B/14B Qwen et al. (2025) and Qwen3-4B Yang et al. (2025a) are used as the base models for the mapper and the recoverer. LLAMA-8B is used as the downstream model for the main experiments, and the additional deployment ablation also evaluates stronger external LLM access through CROSS-MAP. LoRA is used for parameter-efficient fine-tuning with r=16r=16, α=32α=32, and a learning rate of 1×10−51× 10^-5 for all runs. Prompts. Figure 8 and 9 show the mapper and recoverer prompts, respectively. F.2 Supplementary Experimental Results This section provides a full description of experimental results, including tables and figures, as a supplement to Section 6. F.2.1 Utility and Privacy Downstream QA utility Recovered text utility Mapped text privacy Dataset Method EM↑ F1↑ ACC↑ Flu. Loss↓ Sim.↑ BLEU↑ R-1↑ cdict↑c_dict ddict↑d_dict dtext↑d_text SQuAD Plain QA 76.42 84.10 94.73 4.202 1.000 1.000 1.000 0.000 0.000 0.000 Prε ε 75.78 84.02 94.70 4.365 1.000 1.000 1.000 0.006 0.142 0.006 InferDPT 68.21 74.04 81.34 5.597 0.737 0.520 0.710 0.172 0.289 0.263 HAS 72.97 82.10 91.84 4.212 0.973 0.939 0.975 0.181 0.408 0.238 CROSS-MAP 74.94 83.22 92.98 4.703 0.826 0.586 0.800 0.413 0.753 0.752 BioASQ Plain QA 13.48 32.02 96.84 4.313 1.000 1.000 1.000 0.000 0.000 0.000 Prε ε 13.44 31.99 96.81 4.156 1.000 1.000 1.000 0.041 0.497 0.151 InferDPT 8.97 19.88 77.44 4.117 0.709 0.540 0.730 0.094 0.375 0.291 HAS 11.91 28.45 95.21 4.346 0.998 0.958 0.977 0.103 0.553 0.203 CROSS-MAP 12.73 30.90 96.10 5.128 0.879 0.610 0.805 0.604 0.858 0.919 FinCausal Plain QA 59.27 77.61 81.20 4.712 1.000 1.000 1.000 0.000 0.000 0.000 Prε ε 59.20 77.54 81.15 4.722 1.000 1.000 1.000 0.016 0.150 0.037 InferDPT 58.63 77.10 79.06 4.824 0.964 0.893 0.949 0.054 0.238 0.036 HAS 57.40 75.89 79.24 4.645 0.968 0.921 0.956 0.092 0.294 0.139 CROSS-MAP 58.99 77.33 80.61 4.970 0.860 0.733 0.877 0.540 0.710 0.678 NarrativeQA Plain QA 21.12 44.21 90.68 4.518 1.000 1.000 1.000 0.000 0.000 0.000 Prε ε 21.07 44.15 90.65 4.681 1.000 1.000 1.000 0.011 0.516 0.117 InferDPT 15.20 38.74 72.12 4.545 0.846 0.910 0.955 0.014 0.251 0.154 HAS 19.61 41.92 87.80 4.512 0.943 0.897 0.954 0.094 0.541 0.341 CROSS-MAP 20.49 43.22 89.67 5.138 0.829 0.689 0.863 0.313 0.796 0.880 Table 4: Privacy and utility results across datasets for Plain QA, Prε ε (Chowdhury et al., 2025), InferDPT (Tong et al., 2025b), HAS (Chen et al., 2023b), and CROSS-MAP. The results are reported using Qwen2.5-14B as the base model for both the mapper and the recoverer in CROSS-MAP. An LLAMA-8B model is used for downstream QA. In Table 4, the ACC metric calculates the proportion of recovered LLM responses that contain the ground-truth answer span. The similarity (Sim.) metric for recovered text is defined as 1−dtext(x,x~)1-d_text(x, x). The BLEU and ROUGE-1 (R-1) metrics are also computed by comparing x with x~ x. Fluency Loss (Flu. Loss) is the token-level negative log-likelihood under the reference LM, i.e., the negative of the fluency score ftextf_text in Section 5.1. Other metrics are consistent with the definitions in Section 5.1. Among all methods, Plain QA and Prε ε retain the highest downstream utility but provide negligible or weak privacy. For Prε ε , the mapped-text privacy scores remain low overall, reflecting its minimal perturbation on the original text. InferDPT delivers only partial privacy gains while causing a substantial utility collapse (e.g., on SQuAD, F1 drops from 84.10 to 74.04), highlighting that perturbation without an explicit recovery mechanism distorts answer-critical semantics. As a bidirectional framework, HAS attains higher utility than InferDPT, but its privacy remains below CROSS-MAP, suggesting that residual semantic cues are still preserved in the mapped text and thus remain exposable to external LLMs. Across all datasets, CROSS-MAP consistently achieves the strongest mapped-text privacy while largely preserving downstream QA utility relative to other baselines. For example, on SQuAD, the distance between mapped text and original text increases from HAS’s 0.238 to 0.752 while QA accuracy increases from HAS’s 91.84 to 92.98. Similar trends are observed on other datasets. These consistent gains indicate that high downstream utility does not require high similarity between mapped and original text. In summary, the consistent privacy gains and the near-preserved downstream utility achieved by CROSS-MAP demonstrate that a bidirectional framework with semantic decoupling yields the best privacy-utility trade-off among the compared methods. Table 5 reports LLM-as-a-judge ratings across different methods. The judge rates all metrics on a 1–5 scale, where higher scores in the first two columns indicate better plausibility (Plaus.) and fluency (Flu.), whereas lower scores in the last column indicate fewer conspicuous obfuscation artifacts for detectability (Detect.). Method Plaus. ↑ Fluency ↑ Detect. ↓ Original text 4.93 4.91 1.06 Prε ε 4.82 4.86 1.18 HAS 4.54 4.61 1.58 InferDPT 3.71 3.94 2.47 CROSS-MAP 4.45 4.52 1.72 Table 5: LLM-as-a-judge ratings across methods. F.2.2 De-anonymization Attacks Compared to Plain Text, Prε ε achieves only a marginal reduction in attack success (−1.7%-1.7\%) and confidence (−6.4%-6.4\%), indicating that limited edits remain insufficient to remove attribute cues. In contrast, HAS reduces inference accuracy by 34.1%34.1\%, and GPT-A further reduces it by 40.7%40.7\%, accompanied by lowered certainty. The strongest defense is achieved by CROSS-MAP, where inference accuracy drops significantly by 88.5%88.5\%. This pattern suggests that the semantic decoupling in CROSS-MAP suppresses attribute cues more thoroughly, leading to both lower attacker accuracy and lower confidence. Method Inference Accuracy Inference Certainty Plain Text 0.713 3.366 Prε ε 0.701 3.152 HAS 0.470 2.196 GPT-A 0.423 2.073 CROSS-MAP 0.082 1.063 Table 6: De-anonymization results via LLM attribute inference on SynthPAI (Yukhymenko et al., 2024), reporting attacker inference accuracy and confidence (0-5). Figure 5: Correlation between span restoration accuracy and the attacker’s posterior mass on protected spans. Figure 6: Optimization-based attacker’s restoration rate under different dictionary leakage ratios ρ. F.2.3 Span Restoration Attacks Figure 5 provides direct empirical evidence that posterior sampling succeeds when the protected span remains a high-probability continuation under the attacker’s token-level posterior. The privacy advantage of CROSS-MAP is therefore attributed to its semantic-decoupling mapping, where direct lexical and semantic anchoring between mapped text and the original protected spans is systematically weakened. As a result, the attacker’s posterior over the protected spans is flattened. The true span no longer concentrates probability mass among top-k candidates, yielding lower posterior mass, equivalently higher surprisal, and lower ASR consistently across datasets. F.2.4 Optimization-based Attacks Table 14 and Table 15 show that restoration becomes easier as ρ increases for both datasets, and that the DPO-based attacker consistently outperforms the base attacker without DPO optimization at every ρ. For example, on SQuAD, the DPO-based attacker’s mean similarity score increases from 0.3260.326 to 0.8670.867 as ρ goes from 0.10.1 to 0.90.9, with absolute mean gains over the base attacker ranging from 0.0390.039 to 0.0940.094. This systematic improvement suggests that optimization reliably pushes generations toward better reconstruction, rather than merely benefiting from occasional lucky samples. Qwen2.5-3B is used for both attackers in these two tables. From Figure 6, it can be clearly observed that the restoration similarity rises monotonically with ρ. Furthermore, higher leakage is also accompanied by larger absolute gains. A possible reason is that higher ρ reveals more dictionary information, sharpening the attacker’s posterior, while DPO further concentrates probability mass on outputs that yield higher restoration similarity. F.2.5 Ablation Studies This section details an ablation analysis of key model and deployment factors from multiple perspectives: input complexity, paraphrase robustness, target-domain selection, dictionary coverage, training scale, external LLM capabilities, mapper/recoverer size, and training strategies. Input complexity. Three parse-based metrics are used to measure syntactic complexity: mean dependency distance (MDD), maximum dependency-tree depth (max depth), and clauses per sentence (clauses/sent.). NarrativeQA has an average MDD, max depth, and clauses per sentence of 2.402.40, 12.812.8, and 2.952.95, respectively. SQuAD has 2.40/10.6/2.262.40/10.6/2.26, BioASQ has 2.41/7.6/2.032.41/7.6/2.03, and FinCausal has 1.98/7.7/1.931.98/7.7/1.93. Compared to the example sentence, “Although the defendant had no prior convictions, the judge imposed a harsher sentence because the minor victim suffered irreversible harm” (MDD =3.00=3.00, max depth =6=6, and clauses/sent. =4.00=4.00), the datasets used for evaluation in this paper include multi-clause and long-distance syntactic structures. Split MDD Max depth Clauses/sent. ACC ↑ Flu. Loss ↓ Q1 2.16 11.11 2.27 93.62% 4.722 Q2 2.40 10.75 2.34 90.52% 4.687 Q3 2.65 9.85 2.53 93.36% 4.715 Q4 3.24 10.11 2.90 94.42% 4.688 Table 7: SQuAD complexity-quartile robustness. Examples are sorted by MDD and split into Q1–Q4, where Q4 is most complex. Table 7 reports the evaluation of complexity on the SQuAD dataset. The results show that increasing syntactic complexity does not monotonically degrade utility or fluency. Q4, the most complex quartile, reaches 94.42%94.42\% ACC and a Fluency Loss of 4.6884.688. This suggests that CROSS-MAP is robust to complex structures. Paraphrasing Robustness. Table 8 evaluates CROSS-MAP’s recovery robustness against the paraphrasing of mapped text. The results show that the ACC for SQuAD drops mildly from 0.9290.929 to 0.8770.877 under WordNet synonym substitution (p=0.30p=0.30) and to 0.8960.896 under T5 paraphrasing. Such robustness to paraphrasing is important for third-party LLM APIs, where downstream generation cannot be forced to copy the mapper’s terms exactly. Setting ACC Drop Original output 0.929 – WordNet synonyms 0.877 5.2% T5 paraphrase 0.896 3.3% Table 8: Paraphrase robustness of the recoverer on SQuAD. The recoverer reasons over the dictionary and response jointly, rather than relying on exact string matching. Domain selection. To investigate the interplay between semantic domain distance, privacy preservation, and task utility, we conduct an ablation analysis in Table 9. The within-cluster row averages dtextd_text and ACC over samples mapped between source-target domain pairs in the same cluster. The across-cluster row averages over samples mapped between pairs from different clusters. The results indicate that across-cluster mappings significantly augment dtextd_text from 0.6420.642 to 0.7970.797, confirming that increased domain divergence strengthens semantic separation. Notably, this substantial privacy gain is achieved with only a minor reduction in utility (a 3.5%3.5\% decrease in accuracy, shifting from 90.4%90.4\% to 86.9%86.9\%). This desirable trade-off suggests that the mapping can be executed with high quality despite a large semantic distance, provided that there is sufficient structural and relational alignment between the source and target domains to preserve the underlying discourse mechanics. Pairing dtextd_text ACC Within-cluster 0.642 90.4% Across-cluster 0.797 86.9% Table 9: Target-domain distance ablation over 260 source-target pairs. Source and target domains are embedded with Sentence-BERT and grouped into semantic-domain clusters. Table 10 further provides a qualitative case study for domain selection. The same cognitive-development source text is mapped to a far equipment-operations domain and a nearer medical-training domain. Both mappings preserve the key discourse functions: a long-range temporal frame, causal connective, contrastive predication, multi-clause explanation, and comparative grounding. However, the far-domain mapping needs more local reordering to remain natural, while the near-domain mapping can preserve more surface structure. This explains the quantitative pattern in Table 9: larger semantic distance can improve privacy, but the target domain needs enough compatible relational roles to support a fluent mapped passage and ensure accurate recovery. Mapping Text Original: cognitive development Wisdom, or the capacity for insight and judgment that is developed through experience, increases between the ages of fourteen and twenty-five, then levels off. Thus, it is during the adolescence-adulthood transition that individuals acquire the type of wisdom typically associated with age. Wisdom is not the same as intelligence: adolescents do not improve substantially on IQ tests because their scores are relative to others in their same age group, and relative standing usually does not change — everyone matures at approximately the same rate in this way. Far domain: equipment operations Diagnostic maturity, or the ability to interpret sensor patterns and make maintenance decisions refined through operating hours, improves between 300 and 1,800 operating hours, then plateaus. Thus, units tend to develop the level of diagnostic maturity typically attributed to long service life during the transition from commissioning to routine operation. Diagnostic maturity is not the same as rated capacity: newly commissioned units do not show large gains on standardized bench tests because their results are normalized against comparable models from the same production batch, and relative ranking typically remains stable — most units stabilize at roughly similar rates under similar duty cycles on that metric. Near domain: medical training Professional judgment, or the capacity for clinical insight and decision-making that is developed through supervised practice, increases between the first and final years of training, then levels off. Thus, it is during the trainee-practitioner transition that clinicians acquire the type of professional judgment typically associated with seniority. Professional judgment is not the same as medical knowledge: trainees do not improve substantially on standardized exams because their scores are relative to others in their same training cohort, and relative standing usually does not change — everyone advances at approximately the same rate in this way. Table 10: Domain-selection case study. Bold spans mark key source entities and their mapped counterparts. Dictionary coverage. Table 11 ablates recovery behavior as dictionary coverage decreases. Recovery similarity decreases from 0.8600.860 at approximately 0.80.8 coverage to 0.8160.816 at approximately 0.50.5 coverage, and remains 0.7880.788 at approximately 0.20.2 coverage. The trend is smooth rather than catastrophic because the recoverer can use the mapped response and task context to infer some missing links. However, the ACC drop from 91.2%91.2\% to 86.2%86.2\% also shows that the dictionary is not optional. It is the mechanism that keeps semantic decoupling recoverable for downstream use. Dictionary coverage Recovery Sim. ACC cdict≈0.8c_dict≈ 0.8 0.860 91.2% cdict≈0.5c_dict≈ 0.5 0.816 88.7% cdict≈0.2c_dict≈ 0.2 0.788 86.2% Table 11: Dictionary-coverage ablation on SQuAD. Training scale. Table 12 ablates SFT data size for the 14B model. Moving from the base model to 200 and 500 SFT examples already improves both privacy distance and utility, indicating that the desired behavior can be learned from a relatively small synthetic set. The largest utility gain appears by 700 examples, where ACC reaches 94.5994.59 and recovery similarity reaches 0.9450.945. Additional data from 1000 to 2000 examples yields only marginal changes in dtextd_text and slightly lower recovery similarity, suggesting that later gains are dominated by DPO and sampling strategy rather than by simply scaling SFT data. Checkpoint # samples dtextd_text Sim. / ACC Base 0 0.541 0.901 / 88.96 SFT-200 200 0.634 0.912 / 90.38 SFT-500 500 0.651 0.933 / 92.57 SFT-700 700 0.663 0.945 / 94.59 SFT-1000 1000 0.667 0.943 / 94.34 SFT-1500 1500 0.670 0.940 / 94.35 SFT-2000 2000 0.673 0.937 / 94.51 Table 12: SFT training-data scaling study. Gains largely saturate around 700–1000 samples. External LLMs. Table 13 compares local-only inference, unprotected external-LLM access, and external-LLM access through CROSS-MAP. The SQuAD rows use a 3B local mapper/recoverer and a Qwen-2.5-14B model as the external LLM, showing that CROSS-MAP remains useful even when the external model is a local open-weight model rather than a commercial API. The remaining rows use GPT-5 as the external LLM. In both regimes, CROSS-MAP retains most of the external model’s utility while keeping original-domain sensitive content local. Figure 7: Ablation study of model scale and training objectives on utility–privacy trade-off. Dashed lines connect checkpoints within the same model size. DPO_3DPO\_3, DPO_2DPO\_2, and DPO_1DPO\_1 denote DPO checkpoints from epochs 1, 3, and 5, respectively, showing increasingly aggressive preference optimization toward privacy-oriented mapping. Model Size and Training Strategy. Table 16 ablates training strategy (SFT-only vs. DPO) and mapper / recoverer size. Different DPO variants provide adjustable privacy-utility trade-offs for each model size. For the 14B model, as the DPO variant moves from DPO3→DPO2→DPO1DPO_3 _2 _1, privacy distances increase substantially, at the cost of slightly reduced QA utility. The strongest privacy setting DPO1DPO_1 (14B) raises dtextd_text to 0.7520.752 while keeping ACC at 92.9892.98, i.e., only a −1.85%-1.85\% drop from Plain QA (94.7394.73). The SFT-only model provides weaker privacy than DPO1DPO_1 and a closer approximation of the plain QA quality. However, SFT-only exhibits substantially worse JSON-structure validity rjsonr_json than DPO variants, indicating that preference optimization also stabilizes format consistency, which is critical for reliable mapping and recovery. Figure 7 visualizes the same model-size and training-stage trade-off, with DPO checkpoints moving toward stronger privacy at small utility cost. Setting Dataset Model / pipeline EM F1 Local only SQuAD Qwen-2.5-3B local 33.82 42.77 External, no protection SQuAD Qwen-2.5-14B external 54.28 62.51 CROSS-MAP SQuAD 3B mapper/recoverer + 14B external 47.71 55.96 Local only BioASQ Qwen-2.5-14B local 12.63 23.35 External, no protection BioASQ GPT-5 external 24.98 46.43 CROSS-MAP BioASQ 14B mapper/recoverer + GPT-5 external 22.36 44.57 Local only FinCausal Qwen-2.5-14B local 48.69 60.99 External, no protection FinCausal GPT-5 external 82.32 91.74 CROSS-MAP FinCausal 14B mapper/recoverer + GPT-5 external 81.57 90.26 Local only NarrativeQA Qwen-2.5-14B local 16.72 39.91 External, no protection NarrativeQA GPT-5 external 48.75 72.94 CROSS-MAP NarrativeQA 14B mapper/recoverer + GPT-5 external 47.12 71.27 Table 13: External-LLM ablation. CROSS-MAP preserves most of the stronger external model’s utility while keeping original-domain sensitive content local. ρ Base attacker (mean) DPO attacker (mean) Gain (mean) DPO attacker (best) Std. (mean) 0.1 0.287 0.326 0.039 0.397 0.033 0.3 0.373 0.423 0.050 0.494 0.036 0.5 0.536 0.606 0.070 0.679 0.040 0.7 0.673 0.758 0.085 0.831 0.043 0.9 0.773 0.867 0.094 0.935 0.046 Table 14: Performance of optimization-based white-box attacker on SQuAD, measuring similarity between reconstructed text and original text across leakage ratios ρ. ρ Base attacker (mean) DPO attacker (mean) Gain (mean) DPO attacker (best) Std. (mean) 0.1 0.187 0.242 0.055 0.295 0.039 0.3 0.286 0.351 0.065 0.418 0.045 0.5 0.447 0.525 0.078 0.607 0.049 0.7 0.602 0.687 0.085 0.772 0.051 0.9 0.694 0.783 0.089 0.832 0.046 Table 15: Performance of optimization-based white-box attack on NarrativeQA, measuring similarity between reconstructed text and original text across leakage ratios ρ. Downstream QA utility Mapping quality Method EM F1 ACC Sim. ddictd_dict dtextd_text rjsonr_json Plain QA 76.4 84.10 94.73 1.000 0.000 0.000 1.000 DPO_1 (14B) 74.94 83.22 92.98 0.826 0.753 0.752 1.000 DPO_2 (14B) 75.30 83.31 94.21 0.892 0.711 0.735 1.000 DPO_3 (14B) 75.72 83.75 94.34 0.898 0.704 0.698 1.000 SFT-only (14B) 75.88 83.82 94.62 0.948 0.612 0.668 0.936 Base Model (14B) 69.85 78.90 88.96 0.901 0.566 0.541 0.988 DPO_1 (7B) 70.21 81.88 84.20 0.829 0.758 0.748 1.000 DPO_2 (7B) 70.74 82.31 84.98 0.844 0.736 0.719 1.000 DPO_3 (7B) 71.86 83.05 85.65 0.861 0.708 0.668 1.000 SFT-only (7B) 71.20 82.74 86.08 0.901 0.604 0.582 0.918 Base Model (7B) 62.14 76.82 73.44 0.872 0.522 0.446 0.972 DPO_1 (3B) 54.21 69.35 68.95 0.775 0.624 0.616 1.000 DPO_2 (3B) 54.88 69.87 69.88 0.788 0.603 0.586 1.000 DPO_3 (3B) 56.42 70.96 70.58 0.803 0.575 0.535 1.000 SFT-only (3B) 55.69 70.34 71.14 0.846 0.401 0.472 0.782 Base Model (3B) 46.10 64.88 60.73 0.781 0.365 0.322 0.958 Table 16: Ablation study on SQuAD, comparing DPO-tuned and SFT-only models of different sizes in terms of QA utility, privacy distances, and JSON-structure validity. LLAMA-8B model is used for downstream QA. Figure 8: Mapper prompt. Figure 9: Recoverer prompt. Method Original text Mapped text Recovered text CROSS-MAP Fiscal pressures on Government as a result of reduced revenues due to lower oil prices is evident in the increasing number of audits being undertaken to identify areas of non-compliance. The Group remains committed to maintaining the highest levels of compliance and works closely with local regulatory authorities. Operational strain on the hospital network as a result of declining patient volume due to reduced insurance reimbursements is evident in the increasing number of quality assurance reviews being undertaken to identify deviations from clinical protocols. The hospital network remains committed to adhering strictly to regulatory standards and works closely with health department oversight bodies. Fiscal pressures on the Government as a result of reduced revenues due to lower oil prices is evident in the increasing number of audits being undertaken to identify non-compliance with regulatory standards. The Government remains committed to maintaining the highest levels of compliance and works closely with local regulatory authorities. HAS (Chen et al., 2023b) Fiscal pressures on Government as a result of reduced revenues due to lower oil prices is evident in the increasing number of audits being undertaken to identify areas of non-compliance. The Group remains committed to maintaining the highest levels of compliance and works closely with local regulatory authorities. Fiscal pressures on Administration as a result of reduced revenues due to lower oil prices is evident in the increasing number of audits being undertaken to identify areas of non-compliance. The Committee remains committed to maintaining the highest levels of compliance and works closely with local regulatory authorities. Fiscal pressures on Government as a result of reduced revenues due to lower oil prices is evident in the increasing number of audits being undertaken to identify areas of non-compliance. The Committee remains committed to maintaining the highest levels of compliance and works closely with local regulatory authorities. InferDPT (Tong et al., 2025b) In 2018 the majority of employees across the Group have received average salary increases ranging from 2.0%\%–3.25%\%, dependent on geographical location with the principal exception being those employees based in Brazil, Latin America and China where, due to inflation, current market salary increases are higher. In 2019 the majority of employees across the Company have received average salary rises ranging from 2.0%\%–3.25%\%, dependent on geographical location with the principal exception being those employees based in Brazil, Latin America and China where, due to inflation, current market salary rises are higher. In 2019 the majority of employees across the Company have received average salary rises ranging from 2.0%\%–3.25%\%, dependent on geographical location with the principal exception being those employees based in Brazil, Latin America and China where, due to inflation, current market salary rises are higher. Prε ε (Chowdhury et al., 2025) The Committee also reviewed the impact of the reduction in US federal tax rates as a result of tax reform in the US, which resulted in a reduction of deferred tax balances of 617617 million. The Committee also reviewed the impact of the reduction in US federal tax rates as a result of tax reform in the US, which resulted in a reduction of deferred tax balances of 593593 million. The Committee also reviewed the impact of the reduction in US federal tax rates as a result of tax reform in the US, which resulted in a reduction of deferred tax balances of 617617 million. Table 17: Examples of different mapping methods.

Instant research discovery