BV-PRGA: inside the privacy gateway

Every prompt that leaves for an external model is a data export. Most of the time, it exports more than the task needs: the client's name when a client was enough, the full IBAN when the model only had to draft a reminder, an API key pasted by accident. BV-PRGA is the gate placed before that exit — as a browser extension for people, as a self-hosted gateway for teams — and it guarantees a property that is simple to state: the sensitive stays in your system; only what the task needs travels out.

The round trip, formalized

The heart of BV-PRGA is a reversible masking whose key never leaves. On the way out, the request $x$ is transformed into a pair

where $\tilde{x}$ is the protected version that travels to the provider and $\kappa$ is the correspondence map — which token substitutes which value — that stays in your environment. Each detected value is replaced by a stable marker of the form [BV:PERSON:a1b2c3], [BV:IBAN:2e5d8c]: consistent within the request (the model can reason about "the same person") and opaque outside it. On the way back, the provider's response $\tilde{r}$ is reconstructed locally:

The key property is where each piece lives: the external provider only sees $\tilde{x}$ and produces $\tilde{r}$; the pair $(\kappa, r)$ never leaves your infrastructure at any point in the cycle. Reversibility is local by construction, not by promise.

Secrets: block, don't pseudonymize

Not everything sensitive admits the same treatment. A pseudonymized name or IBAN still lets the task be solved; an API key has no business in a prompt in any form — neither in the clear nor masked, because a reversible marker of a secret is still a secret with one step of indirection. That is why the policy distinguishes two verbs:

• Pseudonymize what the task needs to reference: people, identifiers, accounts, emails.
• Block what should never travel: credentials, keys, session tokens. The request stops with an explicit decision — DENY — and the gate's meter records it: what was pseudonymized, what was blocked, and why the request didn't leave.

Fail-closed: the gate fails shut

Detection is a sequence-labeling problem, and no detector is perfect. The honest design question is not "how often is it right?" but "what happens when it doubts?". In BV-PRGA the answer is structural: in doubt, the gate closes. If the analysis of a request cannot complete with confidence — the classifier doesn't converge, the gateway doesn't respond, the format exceeds what is expected — the default is not to send. Formally, the policy is a lattice where DENY dominates: no component failure can silently degrade toward "send in the clear".

That bias has a price (sometimes it over-blocks) and it is a price we choose gladly: the cost of a false positive is a retry; the cost of a false negative is a data export that can no longer be undone.

What this gate is not

Honesty is part of the specification. BV-PRGA reduces exposure and compliance surface — less personal data traveling to third parties, fewer copies outside your perimeter — but it is not a substitute for your data-protection legal framework: legal bases, processor agreements and impact assessments remain yours. The gate gives you a verifiable technical fact to rest that framework on: the sensitive did not leave.

Where it sits in the literature

PII detection as sequence labeling has a long lineage, and it comes from the clinic: the 2014 i2b2/UTHealth shared task set the experimental mold — annotated corpus, precision/recall, hybrid systems — and its key result: the best systems hovered around F1 0.90, and none achieved perfect detection (Stubbs et al., 2015). That technology was industrialized in tools like Presidio, whose own documentation warns there is no guarantee of finding all sensitive information (Microsoft / Data Privacy Stack community, 2026). The academic critique came later: labeling entities is not measuring disclosure risk (Lison et al., 2021), and the TAB benchmark turned that critique into an evaluation program, with separate metrics for protection and utility (Pilán et al., 2022). BV-PRGA slots in here without claiming a better detector: what it changes is the semantics of the error — if the detector is in doubt, the text does not leave. The price is paid in utility, which is the cheap currency under the very asymmetry TAB formalizes.

The threat motivating all of this is quantified. What goes into a model can come out: verbatim extraction of training data is demonstrated (Carlini et al., 2021), and memorization grows with model scale — "likely to get worse", in its authors' words (Carlini et al., 2022). And the easy exits are closed by the literature itself: asking the model for discretion does not work — GPT-4 reveals information in contexts where a human would not 39% of the time, and the leakage persists under privacy prompts and chain-of-thought (Mireshghallah et al., 2024) — and stripping identifiers is not enough either, because LLMs infer personal attributes from the remaining text with up to 85% top-1 accuracy (Staab et al., 2024). The shared conclusion is structural: protection has to happen before the provider, inside the client's environment.

Reversible gateways already exist, and they must be cited. Hide and Seek (HaS) explicitly proposes the pattern: anonymize the prompt locally, query the remote LLM, de-anonymize the answer locally (Chen et al., 2023); PAPILLON is the modern local/remote-ensemble variant, with the trade-off quantified — 85.5% of quality kept while restricting leakage to 7.5% (Siyan et al., 2025). Against both, BV-PRGA's difference is threefold: deterministic reconstruction $r=\kappa^{-1}(\tilde{r})$ via a map of stable markers — not a second local model that reintroduces probabilistic error on the way back —, the pseudonymize-vs-block distinction — a secret is not substituted: it is denied — and fail-closed semantics, absent from both precedents, which treat residual leakage as a metric to optimize rather than an event to prevent. Differential privacy for text is the opposite methodological pole (Feyisetan et al., 2020): a formal $\epsilon$ guarantee against arbitrary adversaries, at the price of fidelity — the field itself admits its sanitization mechanisms "still provide low utility" (Yue et al., 2021) — and of exact reversibility, which DP excludes by construction.

The regulatory anchor closes the circle with a remarkable symmetry. The GDPR's Article 4(5) definition of pseudonymisation describes $m(x)=(\tilde{x},\kappa)$ almost literally: data that can no longer be attributed to a data subject "without the use of additional information", provided that information is "kept separately" under technical and organisational measures (European Parliament and Council of the European Union, 2016). The EDPB's Guidelines 01/2025 specifically bless pseudonymisation designed to be reversed, with pseudonym-to-value tables or cryptographic keys as that additional information (European Data Protection Board, 2025) — the regulatory description of $\kappa$ — and ENISA supplies the engineering of pseudonyms and their attacks: stable random markers (not hashes of the substituted value) dodge precisely the dictionary attacks its report analyzes (ENISA (European Union Agency for Cybersecurity), 2019). The honest reminder comes from the EDPB itself: pseudonymised data is still personal data; BV-PRGA reduces the risk vis-a-vis the provider, it does not exempt you from the GDPR.

Open problems

1. From labeling to disclosure risk. The field lacks methods that build explicit re-identification risk measures into the process (Lison et al., 2021); how a gateway estimates that risk online remains open.
2. Attribute inference defeats current anonymization. With common mitigations declared "currently ineffective" and up to 85% accuracy inferring attributes from the residual text (Staab et al., 2024), how to protect the contextual and stylistic signal that no entity substituter touches remains open. It is this gate's declared frontier.
3. Contextual leakage is not fixed by prompting. Leakage persists even under privacy instructions and chain-of-thought (Mireshghallah et al., 2024); until models respect an operational notion of contextual integrity, only structural solutions hold.
4. Growing memorization without active mitigation. Memorization will grow with scale "at least without active mitigations" (Carlini et al., 2022) — and those mitigations are exogenous to any customer of the provider.
5. Gateway-specific evaluation. TAB exists because standard metrics do not capture protection and utility at once (Pilán et al., 2022); consensus metrics — and non-clinical, non-legal corpora — capturing the irreversible-false-negative vs cheap-false-positive asymmetry in gateway scenarios are missing.
6. Formal guarantee + fidelity + reversibility. DP delivers the first by giving up the other two (Feyisetan et al., 2020; Yue et al., 2021); reversible gateways deliver the latter two by giving up the first (Chen et al., 2023; Siyan et al., 2025). Reconciling all three remains the field's open problem.

Note: the figures in this section (shared-task F1, 39%/57%, 85%, 85.5%/7.5%...) come from the cited literature and describe those works, not BV-PRGA measurements.

Where this is today

BV-PRGA is productized as an independent product at privacy.bivelio.com, in two forms: a free browser extension (Chrome, Edge and Brave) protecting people in ChatGPT and Claude before text leaves the device, and a self-hosted gateway for developers and teams, published on PyPI, applying the same policy in front of any AI API — OpenAI, Anthropic, DeepSeek and many others. Inside BiVelio it is the Protect layer: the same gate, in front of every interaction with a model.

References