GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation
Ruiyi Yang, Gayathri Lihinikaduarachchi, Rahat Masood, Flora D. Salim, Salil S. Kanhere
cs.AI, cs.HC, cs.MA
2026-08-29
GuardianAgent uses explicit risk scoring plus verified-guess escalation. It is the only method above 0.90 privacy on TAB, SynthPAI, and PII-Masking-300k.
A browser privacy agent has to finish two jobs before a request leaves the machine: check the outgoing action against the destination site's privacy policy, then rewrite only as hard as the leftover disclosure risk justifies. Those two jobs are usually studied apart.
Policy systems such as Polisis and PolicyGPT classify, retrieve, or summarize clauses. They do not emit an operational signal that says allow, rewrite, or block this live action. The same paste can take light masking when it goes to a first-party service for core functionality, and may need a heavy rewrite or a hard block when it goes to an ad network for profiling. On the anonymization side, Staab-style adversarial loops, AgentStealth, and HaS tend to call a large model on every browser event. They also treat a high-confidence attacker guess as proof of residual leakage. After "[PERSON] going to [LOCATION] this afternoon", a guesser may confidently say "coffee shop" even though the original was "school with Bob", and the loop keeps rewriting until the useful meaning is gone.
The missing piece is a controller that turns policy evidence plus action context into a rewrite strength, and a gate that refuses to escalate on hallucinated guesses.
GuardianAgent represents a web action as a six-tuple: destination domain, data categories, recipients, declared purposes, action basis (user-initiated, default, or background), and outgoing text. Privacy policies are split into atomic statements with structured fields. A hybrid retriever mixes field overlap with BM25Lite, structured weight α=0.6, and keeps the top 8 statements as evidence.
Violation likelihood L is estimated on two paths. The fast path is an evidential deep-learning classifier that returns both risky-class mass and epistemic uncertainty u. If u is below a threshold, that mass becomes L. Uncertain cases go to an LLM slow path. The LLM estimates L only. It does not pick the final risk score, the allow/transform/deny decision, or the rewrite level.
Risk is computed by AMRSF: R = clamp(L × Seff × MT), with Seff = min(1, Sd × Mtr × Mp × Mb). Sd is base data sensitivity (credentials 1.00, health/financial 0.95, precise location 0.85, cookies 0.20). Mtr, Mp, and Mb scale severity by recipient, purpose legitimacy, and action basis (first-party 0.20, ad network 0.80, data broker 0.90; functionality 0.15, advertising 0.80). MT discounts for policy transparency. R is then cut by tier-specific allow ceilings and deny floors. Sensitive tiers get a wider transform band, so borderline high-risk actions are rewritten rather than released unchanged.
Inside the transform band, the normalized position z sets the starting level: z<0.25 begins at L1 partial masking, then each 0.25 step climbs toward L4 minimal-edit rewriting. L5 semantic rewriting is an escalation ceiling, not a starting level. Escalation uses an adversarial guesser with a lexical check: a guess counts only if it is a substring of the original or shares a content word longer than two characters. Verified confidence ≥ 0.6 raises the level by one, for at most five rounds, stopping at L5. The original text stays local to the anonymizer and is never shown to the attacker.
The authors treat this lexical check as an anti-hallucination and cost control, not as a defence against contextual inference. High-risk flows start at L4 and get semantic rewriting without waiting for the verifier.
The main backbone is Llama-3.2-3B-Instruct, four random seeds. Privacy is 1 minus the fraction of gold sensitive spans still present in the output. Utility is token Jaccard on TAB and PII-Masking, BERTScore F1 on SynthPAI.
| Method | TAB priv / util | SynthPAI priv / util | PII-Masking priv / util |
| GuardianAgent | 0.945 / 0.696 | 0.944 / 0.888 | 0.901 / 0.488 |
| HaS | 0.926 / 0.669 | 0.811 / 0.841 | 0.809 / 0.586 |
| CONFAIDE | 0.913 / 0.638 | 0.842 / 0.810 | 0.776 / 0.533 |
| Staab | 0.695 / 0.564 | 0.975† / 0.257 | 0.850 / 0.384 |
†Staab's SynthPAI privacy is inflated by empty or placeholder outputs, which is why utility collapses to 0.257. GuardianAgent is the only method above 0.90 privacy on all three domains, and it sits above or beyond the baseline Pareto frontier on each. On TAB, Pissarra's utility is 0.701 versus GuardianAgent's 0.696, with privacy at 0.903.
The same 200 PII texts, with violation likelihood fixed at 0.7, change only recipient, purpose, basis, and policy transparency. First-party / functionality / paste / full policy: R=0.119, 100% allow. Provider / analytics / default / partial disclosure: R=0.413, 98% transform. Ad network / profiling / background / vague policy: R=0.909, 99.5% deny. Inside the transform band, mean starting level rises from 1.48 in the mild setting to 3.98 near deny; mean final level after verified escalation rises from 2.37 to 4.42.
On SynthPAI ablations, NER alone scores 0.483 privacy; adding a guesser reaches 0.569; adding single-level LLM rewrite reaches 0.910; the full L1–L5 stack reaches 0.944, with utility falling from 0.944 to 0.888. Turning verification off lifts the upgrade rate from 0.52 to 0.80 with no privacy gain (0.975 on both sides) and drops utility from 0.850 to 0.834; about 32% of those upgrades are unnecessary. The fast path on 6,392 OPP-115 pairs hits 0.928 accuracy and escalates only 3.47% of events, about a 28.6× cut in matcher cost versus always calling the LLM. Switching the backbone to Qwen3-8B keeps GuardianAgent first on privacy (TAB 0.976, SynthPAI 0.927).
End-to-end latency is not light: about 5.1 s per sample on TAB, 9.9 s on SynthPAI, 7.5 s on PII-Masking.
For anyone building an outbound gate in a browser or an agent, this paper wires policy matching and text anonymization to one explicit controller, instead of asking an LLM for a scalar risk. Action context changes the decision: the same resume should not be treated the same on a hiring site and on an ad pixel.
Verified adversarial escalation is the reusable engineering idea. Staab-style loops treat model world knowledge as leakage. Lexical overlap keeps hallucinated guesses from raising the rewrite level. Privacy holds in the ablation, and fewer useless upgrades run.
This is still an incremental stack, not a drop-in browser product. The 3B full pipeline is seconds per sample; the fast path only speeds policy matching. Privacy is span retention, not human re-identification. AMRSF's factor table is a fixed set of weights drawn from NIST, GDPR, and contextual-integrity literature. That makes it inspectable, and it also means a new jurisdiction or product shape needs a fresh calibration.
The evaluation is English-only on public or synthetic corpora: ECHR judgments, Reddit-style posts, and synthetic PII. There are no real browser traces, clinical dialogue, or multilingual tests. AMRSF is a mediation controller, not a compliance engine. Anonymization reduces re-identification risk and does not remove it. Deployments should process locally, disclose cloud escalation, and allow user override. Those limits are the authors' own.
The lexical verifier will not admit a correct inference that shares no surface words with the original. High-risk flows compensate by starting at L4. Low-risk flows that leave only indirect cues may slip through.
The privacy metric is generous: 1 minus remaining gold spans. Staab can inflate it with empty outputs, so "rewrite until nothing is left" games the number. Utility on PII-Masking is only 0.488; structured records lose usability quickly once rewritten. The latency sits badly next to the "live web traffic, browser-resident" framing, and the paper never reports an end-to-end browser intervention. Factor tables and thresholds (critical-data allow ceiling 0.10, deny floor 0.55) are hand-set, and the expert calibration set has 500 items.