Research map / Large language models / Reasoning and chain of thought
Portcullis: A Scalable and Verifiable Privacy Gateway for Third-Party LLM Inference
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Presents Portcullis, a TEE-based (Intel TDX) privacy gateway that masks sensitive entities in prompts to third-party LLMs with multi-level detectors, restores them in responses, and is attested for verifiability.
Problem
Businesses using third-party LLM APIs risk exposing sensitive information in prompts; existing privacy methods either require modifying closed-source LLMs, hurt accuracy, or add latency and deployment overhead.
Approach
A verifiable gateway that combines a cascade of pattern matching, Presidio, BERT-NER and an in-house context-aware NER (with counting bloom-filter caching) to substitute placeholders, stores mappings in an encrypted Redis, and runs everything inside Intel TDX confidential containers with tenant-defined execution policies embedded in attestation reports.
Key results
- Portcullis masking/unmasking is reported as 96x faster than Hide-and-Seek, with end-to-end overhead of about 1.33% relative to third-party LLM inference.
- On the Enron dataset with GPT-4o mini, Portcullis exceeds Hide-and-Seek response accuracy (TF-IDF cosine similarity) by more than 0.1.
- With the most complex mask on PII data, Portcullis reports a false negative rate of 0.11, false positive rate of 0.02, and full match rate of 0.82; startup latency grows linearly from 1 to 24 pods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use BERT-NER masking instead of Hide-and-Seek (ablation) | Portcullis · PII | full match: 0.663 -> 0.824 | Helped |
| use BERT-NER masking instead of Hide-and-Seek (ablation) | Portcullis · PII | false negative rate: 0.2176 -> 0.1103 | Helped |
| use in-house NER masking instead of Hide-and-Seek (ablation) | Portcullis · Enron | false positive rate: 0.0998 -> 1.78e−6 | Helped |
| use in-house NER masking instead of Hide-and-Seek (ablation) | Portcullis · Enron | full match: 0.009 -> 0.987 | Helped |
| use in-house NER masking instead of Hide-and-Seek (ablation) | Portcullis · Enron | false negative rate: 0.4461 -> 0.0089 | Helped |
| use Presidio masking instead of Hide-and-Seek (ablation) | Portcullis · PII | full match: 0.663 -> 0.650 | No clear effect |
| use Portcullis instead of Hide-and-Seek | Portcullis with GPT-4o mini · Enron | response accuracy (cosine similarity): +0.1 | Helped |
| use Portcullis instead of Hide-and-Seek | Portcullis with Mistral · Enron | response accuracy (cosine similarity) | Hurt |
| use Portcullis instead of Hide-and-Seek | Portcullis · PII | response accuracy (cosine similarity) | No clear effect |
Surprising findings
- InferDPT response accuracy is very low because the added noise prevents LLMs from understanding queries.
- On Enron with Mistral, Portcullis accuracy is less satisfactory, which the authors attribute to Mistral's limited comprehension of complex data.
Limitations
- Accuracy evaluated with TF-IDF cosine similarity rather than task-level correctness metrics
- Performance on Mistral for Enron is weaker than GPT-4o mini
- Still vulnerable to differential privacy attacks and side channels; relies on Bandit static analysis which depends on plugin coverage
Experimental setup
Datasets: PII masking-43K (ai4Privacy) Enron Email dataset
Benchmarks: PII masking-43K Enron Email dataset
Metrics: false negative rate false positive rate full match rate cosine similarity (TF-IDF) startup latency end-to-end latency
Baselines: Hide-and-Seek InferDPT
Builds on: Hide-and-Seek InferDPT Intel TDX Presidio CoCo
Closest papers by meaning
- Open LLMs are Necessary for Current Private Adaptations and Outperform their Closed Alternatives (NeurIPS 2024 · similarity 0.87)
- Hidden No More: Attacking and Defending Private Third-Party LLM Inference (ICML 2025 · similarity 0.87)
- Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theory (ICLR 2024 · similarity 0.86)
- The Canary’s Echo: Auditing Privacy Risks of LLM-Generated Synthetic Text (ICML 2025 · similarity 0.86)
- Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024 · similarity 0.85)
- HARMONIC: Harnessing LLMs for Tabular Data Synthesis and Privacy Protection (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.