The Privacy Tool That Thinks Like a Snoop, and the Catch Buried Inside It

European data-protection practice contains a small thought experiment. Imagine a stranger who is reasonably competent, has access to public records and search engines, and genuinely wants to work out who a document is about. Would they manage it? The figure has a name, the motivated intruder, and regulators use them as a yardstick: if the intruder could get there, the data is not really anonymous. The test has always been something a human performs in their head, slowly, over one document at a time.

Michael Maximilian Grötzner and Pascal Tippe decided to make it run automatically. Grötzner, a master's student, and Tippe, a doctoral candidate, work at FernUniversität in Hagen's chair of Parallelism and VLSI under Jörg Keller, and their paper appeared in the summer 2026 issue of the Proceedings on Privacy Enhancing Technologies, where Grötzner presented it at the PETS symposium. Their subject is what happens in the seconds before text leaves a laptop for someone else's model. The system they built, which they call a codebook-guided privacy gateway, sits in that gap and turns the motivated-intruder test into a chain of reasoning a language model can execute.

The tools currently doing this job work differently. A sanitiser such as Microsoft Presidio, the open-source baseline the paper benchmarks against, combines regular expressions with a trained named-entity recogniser: it looks for things that have the shape of a name, an email address, a credit-card number, a date. That works well on explicit identifiers. It has no way to notice that a job title, a regional office and a product launch window are individually innocuous and jointly point at one person, because none of the three looks like anything on the list.

The gateway approaches the same text from the other direction. Instead of matching patterns, it is given a codebook derived from the General Data Protection Regulation's categories and asked to reason through the document step by step: what can be deduced from this, what would a determined outsider combine with what, which combinations carry identifying weight. Only then does it decide what to alter. The authors describe the design as operationalising the motivated-intruder test into executable chain-of-thought logic, which is an accurate if graceless summary of what it does.

On the test set the difference is largest exactly where the argument predicts. For trade secrets that a reader would have to infer from a combination of details, the gateway neutralised 89.9% of cases and Presidio 3.1%. That pairing is like-for-like, both figures measured on the same inferential category, and it is the widest gap in the paper rather than a typical one. On trade secrets stated outright, the same conventional tool reaches 28.8%, against the gateway's 97.6%. On personal data of the kind the GDPR defines in Article 4, it reaches 52.6%, against the gateway's 100%. Anyone carrying away the impression that pattern-matching redaction catches under 5% of anything has the wrong number: it catches under 5% of the secrets that were never written down.

The test set is small and unusually carefully assembled. From a 227-prompt English corpus drawn from Quora question pairs, a public repository of ChatGPT prompts, the LMSYS-Chat-1M conversation dataset and synthetically generated high-PII text, the authors held out 127 prompts for evaluation and kept 100 for development, with a further 27-prompt adversarial partition reserved for stress-testing. Ground truth came from human annotation rather than model self-assessment; detection ran as a five-run majority vote that agreed unanimously 94.75% of the time, and two independent reviewers judged whether the sanitised text was still useful, agreeing at above 0.80 on the standard categories.

Redaction usually trades away meaning, and here the trade ran in the gateway's favour. Severe loss of usable content came to 18.11% for the gateway against 22.05% for Presidio, and on the adversarial partition the margin widened to 14.81% against 40.74%. What it costs instead is time. A document took the gateway a mean of 14.24 seconds to process; Presidio took 0.03.

Then there is the part that changes how the whole result should be read. The reasoning inside the gateway was not performed by a model on the user's machine. The authors used Gemini 2.5 Pro, a frontier commercial system reached over the network, as what they describe as a high-fidelity inference proxy, chosen deliberately to separate the logic of the approach from the hardware available to run it. They also tested models small enough for consumer hardware, under about 20 billion parameters, and those failed the semantic task outright, scoring an agreement of roughly zero on detecting sensitive personal data that had to be inferred. So the system as evaluated does not keep confidential text off third-party infrastructure. It reads that text with a cloud model in order to decide what to hide from a cloud model.

The authors do not hide this, and their university says so plainly in announcing the work: the privacy gateway is still a research prototype, and running it locally would only become realistic if capable language models can eventually be run on ordinary hardware. Tippe puts the underlying problem as the combination of apparently harmless details that allows conclusions to be drawn about someone's identity. The paper's own framing of the compute question is worth reading with care, though. Its abstract presents privacy as a compute-bound task on the strength of a near-perfect correlation, r = 0.985, but the coefficient the body actually computes runs between processing time and the number of reasoning tokens generated, not between reasoning and quality. The solid version of the compute claim is the categorical one: small models could not do this, a frontier model could.

A second limit is structural and the authors name it themselves. In technical domains, meaning often depends on exactly the link that identifies: an error code paired with a specific software version, a dosage paired with a condition. Break the link and the text stops being useful; keep it and the sanitiser has not sanitised anything. The paper calls this the semantic coupling limit and treats it as a hard boundary where robust privacy and high utility cannot both be had. The German announcement makes the same point about medical queries, where a great deal that might matter is lost.

On evidence, this item is stronger than most work in the area. The paper is peer-reviewed and open access, published in issue 3 of the Proceedings on Privacy Enhancing Technologies 2026. That is a genuine venue with genuine referees, which is not the norm for privacy tooling that mostly circulates as preprints and product pages. The constraints are the ones the authors list: 127 test prompts, English only, single-turn exchanges rather than conversations, no defence against writing-style fingerprinting, and knowledge frozen at the model's training cutoff. Both researchers are early-career and the numbers come from one group at one institution, with no independent replication of these specific figures. The direction, though, has been reported elsewhere: separate teams working on inference-guided text sanitisation have found the same failure mode in pattern-matching tools.

None of which settles what a company should install tomorrow. What the paper does establish, on a small but carefully built test set, is that the thing corporate policy currently relies on catches almost none of the exposure that comes from inference, and that a machine reasoning its way through a document catches most of it. The version of that machine which runs on your own laptop does not exist yet.