LLMs as Linguistic Chameleons: Decoupling Semantics and Structure for Privacy-Preserving Communication
cs.CR · cs.AI · cs.CL
Quick verdict
CROSS-MAP replaces semantics but keeps structure for private LLM API use; strong empirical gains, yet single-run stats and near-tautological theory.
Summary
The paper proposes CROSS-MAP, a bidirectional privacy framework for using third-party LLM APIs. Rather than anonymizing text while keeping its meaning (the semantics-preserving regime of DP and sanitization methods), it performs 'semantic decoupling': a locally deployed, fine-tuned mapper (Qwen-2.5-3B/7B/14B, trained with SFT then DPO on GPT-5.2-synthesized data) rewrites private input into a different semantic domain while preserving syntactic structure, together with a span-level dictionary; a local recoverer later restores the LLM's answer. An information-bottleneck analysis (Theorem 1) argues when decoupling beats preservation, under a strong independence assumption between semantics and structure. Across SQuAD/BioASQ/FinCausal/NarrativeQA QA, CNN/DailyMail summarization and CommonGen generation, CROSS-MAP increases text distance (0.752 vs 0.238 for HAS on SQuAD) while keeping QA accuracy close to unprotected inference (92.98 vs 94.73), cuts sensitive-span retention to 3.1% (HAS: 63.1%), and lowers SynthPAI attribute-inference accuracy to 0.082 (plain: 0.713). However, a white-box DPO attacker with 90% dictionary leakage reconstructs SQuAD text at 0.867 similarity. Key limitations: single-run experiments without significance testing, a near-definitional theory, occasional verbatim preservation of numerals, and degraded open-generation quality (CommonGen ROUGE-L 0.587 to 0.414).
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 3
● low 1
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Semantic decoupling, i.e., replacing meaning while preserving structure, achieves a better privacy-utility trade-off than semantics-preserving defenses (Theorem 1; Fig. 2).
- Compact local models (Qwen-2.5-3B/7B/14B) adapted via SFT plus DPO on roughly 700-1,500 synthetic examples perform reliable cross-domain mapping and recovery (Tables 12, 16).
- CROSS-MAP keeps QA accuracy within about 2 points of unprotected inference while cutting sensitive-span retention to 3.1% (vs 63.1% for HAS) and SynthPAI attribute-inference accuracy to 0.082 (vs 0.713 unprotected).
- Security degrades with dictionary leakage: a DPO-based white-box attacker reaches 0.867 reconstruction similarity on SQuAD at leakage rate 0.9 (Table 14).
Strengths
Frontier-shifting empirical results
Fig. 2 and Tables 4/16 show CROSS-MAP raising mapped-text distance to 0.752 on SQuAD (HAS: 0.238) while QA accuracy stays at 92.98 vs 94.73 unprotected; sensitive-span retention falls to 3.1% vs 63.1% for HAS.
Attack-centric honesty
Three attack families including a novel DPO-optimized white-box attacker with a formal dictionary-leakage model (Sec. 5.4, Props. 1-2, App. E); the paper reports its own failure mode (0.867 reconstruction similarity at leakage 0.9, Table 14) rather than hiding it.
Practical training recipe
Reasoned recovery design
Weaknesses
Single-run statistics
Near-tautological theory
Numeric-attribute leakage
Generation cost and anomalies understated
Deployment cost unquantified
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a method paper in LLM privacy (cs.CR/cs.CL) proposing CROSS-MAP, a bidirectional inference-time protection framework. The central claim is that 'semantic decoupling' — replacing a text's meaning while preserving syntactic structure — dominates the semantics-preserving regime (DP, sanitization, anonymization with recovery) on the privacy-utility frontier (Sections 1-4). Supporting claims: (i) an information-bottleneck argument (Theorem 1, Appendix B) identifies when decoupling wins; (ii) compact local models (Qwen-2.5-3B/7B/14B) trained with SFT then DPO on GPT-5.2-synthesized seed data perform reliable mapping and recovery; (iii) empirically, CROSS-MAP cuts reconstruction and attribute-inference success while keeping QA accuracy near unprotected inference (Section 6). Scope is inference-time text exposure, not training-time leakage or side channels.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What does CROSS-MAP do?
It protects text you send to third-party LLM APIs by rewriting it into a completely different subject domain (e.g., medical to equipment operations) while keeping the grammatical structure, so the API never sees the real content; a local model then restores the answer using a private span-level dictionary.
How is semantic decoupling different from anonymization or differential privacy for LLM prompts?
Anonymization and DP keep the original meaning mostly intact, which preserves utility but leaves clues an LLM can use to infer private attributes. CROSS-MAP replaces the meaning entirely and preserves only sentence structure, removing those cues; recovery is possible because a local model holds a private mapping dictionary.
Is CROSS-MAP secure against strong attackers?
Partially. Against black-box attacks it is strong: attribute-inference accuracy on SynthPAI falls to 0.082 and span restoration to about 1% on FinCausal. But if an attacker obtains most of the mapping dictionary (90% leakage), a DPO-optimized white-box attack reconstructs text at 0.867 similarity on SQuAD, which is near-complete recovery.
Does CROSS-MAP reduce answer quality?
Modestly for question answering: 92.98 versus 94.73 accuracy on SQuAD compared with unprotected inference. Open-ended generation costs more: CommonGen ROUGE-L drops from 0.587 to 0.414, and mapped text is somewhat easier to detect as obfuscated (LLM-judge 1.72 vs 1.06 for original text).
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Text extraction truncated parts of Sections 4/6.2.3 and Appendix F.1-F.2 (including Table 4 and baseline configurations); several numbers are cited from narrative text only.
- Figures 2/3/5/6/7 could not be analyzed visually; only captions and in-text values were used.
- Appendix B definitions of the preservation-ratio quantities were partially truncated; assessment of Theorem 1 relies on the proof sketch present.
- The paper itself reports a single run per dataset, so all numbers quoted here carry that unresolved variance.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.