ProxyGPT: Enabling User Anonymity in LLM Chatbots via (Un)Trustworthy Volunteer Proxies

• URL: http://arxiv.org/abs/2407.08792v2
• Date: Wed, 11 Jun 2025 05:11:41 GMT
• Title: ProxyGPT: Enabling User Anonymity in LLM Chatbots via (Un)Trustworthy Volunteer Proxies
• Abstract summary: We propose ProxyGPT, a privacy-enhancing system for large language models (LLM)<n>Unlike traditional proxy systems, ProxyGPT operates at the "user" layer by proxying user interactions with the browser in identity-required environments.<n>We prevent malicious proxies by performing regular integrity audits using modern web proof protocols for TLS data provenance.
• Score: 12.552035175341894
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Popular large language model (LLM) chatbots such as ChatGPT and Claude require users to create an account with an email or a phone number before allowing full access to their services. This practice ties users' personally identifiable information (PII) to their sensitive conversational data, thus posing significant privacy risks. Unfortunately, existing private LLM solutions based on cryptography or trusted execution environments (TEEs) remain unpopular due to their prohibitive computational expense and platform restrictions. To enable practical user anonymity in LLM chatbots, we propose ProxyGPT, a privacy-enhancing system that leverages browser interaction proxies to submit user queries on their behalf. Unlike traditional proxy systems, ProxyGPT operates at the "user" layer by proxying user interactions with the browser in identity-required environments, thus easily supporting a wide range of chatbot services. We prevent malicious proxies by performing regular integrity audits using modern web proof protocols for TLS data provenance. We further utilize state-of-the-art LLM prompt guards on the proxy's side to mitigate unwanted user requests. Additionally, we incorporate a give-and-take economy based on Chaum's blind-signature e-cash to incentivize ProxyGPT users to proxy for others. Our system evaluation and user study demonstrate the practicality of our approach, as each chat request only takes a few additional seconds on average to fully complete. To the best of our knowledge, ProxyGPT is the first comprehensive proxy-based solution for privacy-preserving AI chatbots.

Related papers

• PromptPET: Privacy-Utility Optimized Prompt Obfuscation [6.5675177002666665]
  We aim to protect user privacy via a user-side mechanism that transforms sensitive information in a user prompt.<n>This approach faces an inherent tradeoff between protecting privacy and preserving utility.<n>We introduce PROMPTPET, an agent that selects the best obfuscation action for each sensitive part of the prompt.
  arXiv  Detail & Related papers  (2026-07-03T03:59:34Z)
• Large-scale online deanonymization with LLMs [58.46277616551135]
  We show that large language models can be used to perform at-scale deanonymization.<n>With full Internet access, our agent can re-identify Hacker News users and Anthropic Interviewer participants at high precision.
  arXiv  Detail & Related papers  (2026-02-18T19:02:50Z)
• Whistledown: Combining User-Level Privacy with Conversational Coherence in LLMs [0.0]
  We present Whistledown, a best-effort privacy layer that modifies prompts before they are sent to the large language models (LLMs)<n>Whistledown combines pseudonymization and $$-local differential privacy ($$-LDP) with transformation caching to provide best-effort privacy protection without sacrificing conversational utility.
  arXiv  Detail & Related papers  (2025-11-17T12:56:33Z)
• When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins [17.279238456399693]
  We present the first large-scale study of 17 third-party plugins used by over 10,000 public websites.<n>8 of these plugins fail to enforce the integrity of the conversation history transmitted in network requests.<n>We found that 13% of e-commerce websites have already exposed their chatbots to third-party content.
  arXiv  Detail & Related papers  (2025-11-08T02:02:24Z)
• Controlling What You Share: Assessing Language Model Adherence to Privacy Preferences [80.63946798650653]
  We explore how users can stay in control of their data by using privacy profiles.<n>We build a framework where a local model uses these instructions to rewrite queries.<n>To support this research, we introduce a multilingual dataset of real user queries to mark private content.
  arXiv  Detail & Related papers  (2025-07-07T18:22:55Z)
• SafeChat: A Framework for Building Trustworthy Collaborative Assistants and a Case Study of its Usefulness [4.896226014796392]
  We introduce SafeChat, a general architecture for building safe and trustworthy chatbots. Key features of SafeChat include: (a) safety, with a domain-agnostic design where responses are grounded and traceable to approved sources (provenance); (b) usability, with automatic extractive summarization of long responses, traceable to their sources; and (c) fast, scalable development, including a CSV-driven workflow, automated testing, and integration with various devices.
  arXiv  Detail & Related papers  (2025-04-08T19:16:43Z)
• Defeating Prompt Injections by Design [79.00910871948787]
  CaMeL is a robust defense that creates a protective system layer around the Large Language Models.<n>To operate, CaMeL explicitly extracts the control and data flows from the (trusted) query.<n>To further improve security, CaMeL uses a notion of a capability to prevent the exfiltration of private data over unauthorized data flows.
  arXiv  Detail & Related papers  (2025-03-24T15:54:10Z)
• Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards [93.16294577018482]
  Arena, the most popular benchmark of this type, ranks models by asking users to select the better response between two randomly selected models. We show that an attacker can alter the leaderboard (to promote their favorite model or demote competitors) at the cost of roughly a thousand votes. Our attack consists of two steps: first, we show how an attacker can determine which model was used to generate a given reply with more than $95%$ accuracy; and then, the attacker can use this information to consistently vote against a target model.
  arXiv  Detail & Related papers  (2025-01-13T17:12:38Z)
• PrivAgent: Agentic-based Red-teaming for LLM Privacy Leakage [78.33839735526769]
  LLMs may be fooled into outputting private information under carefully crafted adversarial prompts.<n>PrivAgent is a novel black-box red-teaming framework for privacy leakage.
  arXiv  Detail & Related papers  (2024-12-07T20:09:01Z)
• SVIP: Towards Verifiable Inference of Open-source Large Language Models [33.910670775972335]
  We introduce SVIP, a secret-based verifiable Large Language Models inference protocol.<n>Our protocol requires the computing provider to return both the generated text and processed hidden representations from LLMs.<n>SVIP achieves false negative rates below 5% and false positive rates below 3%, while requiring less than 0.01 seconds per prompt query for verification.
  arXiv  Detail & Related papers  (2024-10-29T17:52:45Z)
• Bots can Snoop: Uncovering and Mitigating Privacy Risks of Bots in Group Chats [2.835537619294564]
  SnoopGuard is a group messaging protocol that ensures user privacy against chatbots while maintaining strong end-to-end security. Our prototype implementation shows that sending a message in a group of 50 users takes about 30 milliseconds when integrated with Message Layer Security (MLS)
  arXiv  Detail & Related papers  (2024-10-09T06:37:41Z)
• Confidential Prompting: Protecting User Prompts from Cloud LLM Providers [0.688204255655161]
  We tackle the challenge of securing user inputs in cloud-hosted large language model (LLM) serving.<n>We introduce Secure Partitioned Decoding (SPD), which uses confidential computing to confine user prompts to a trusted execution environment.<n>We also introduce a novel cryptographic method, Prompt Obfuscation (PO), to ensure robustness against reconstruction attacks on SPD.
  arXiv  Detail & Related papers  (2024-09-27T20:32:42Z)
• Are LLM-based methods good enough for detecting unfair terms of service? [67.49487557224415]
  Large language models (LLMs) are good at parsing long text-based documents. We build a dataset consisting of 12 questions applied individually to a set of privacy policies. Some open-source models are able to provide a higher accuracy compared to some commercial models.
  arXiv  Detail & Related papers  (2024-08-24T09:26:59Z)
• Prompt Tuning as User Inherent Profile Inference Machine [68.16976932088708]
  We propose UserIP-Tuning, which uses prompt-tuning to infer user profiles.<n>UserIP-Tuning outperforms state-of-the-art recommendation algorithms.<n>The presented solution has been deployed in Huawei AppGallery's Explore page since May 2025.
  arXiv  Detail & Related papers  (2024-08-13T02:25:46Z)
• WildChat: 1M ChatGPT Interaction Logs in the Wild [88.05964311416717]
  WildChat is a corpus of 1 million user-ChatGPT conversations, which consists of over 2.5 million interaction turns. In addition to timestamped chat transcripts, we enrich the dataset with demographic data, including state, country, and hashed IP addresses.
  arXiv  Detail & Related papers  (2024-05-02T17:00:02Z)
• User Privacy Harms and Risks in Conversational AI: A Proposed Framework [1.8416014644193066]
  This study identifies 9 privacy harms and 9 privacy risks in text-based interactions. The aim is to offer developers, policymakers, and researchers a tool for responsible and secure implementation of conversational AI.
  arXiv  Detail & Related papers  (2024-02-15T05:21:58Z)
• EmojiPrompt: Generative Prompt Obfuscation for Privacy-Preserving Communication with Cloud-based LLMs [34.77734655124251]
  EmojiPrompt performs generative transformation, obfuscating private data within prompts with linguistic and non-linguistic elements.<n>We evaluate EmojiPrompt's performance across 8 datasets from various domains.<n>EmojiPrompt's atomic-level obfuscation allows it to function exclusively with cloud-based LLMs.
  arXiv  Detail & Related papers  (2024-02-08T17:57:11Z)
• DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineer [57.04801796205638]
  Large Language Models (LLMs) have emerged as dominant tools for various tasks. However, concerns surrounding data privacy present obstacles due to the tuned prompts' dependency on sensitive private information. We present Differentially-Private Offsite Prompt Tuning (DP-OPT) to address this challenge.
  arXiv  Detail & Related papers  (2023-11-27T02:01:10Z)
• The Key to Deobfuscation is Pattern of Life, not Overcoming Encryption [0.7124736158080939]
  We present a novel methodology that is effective at deobfuscating sources by synthesizing measurements from key locations along protocol transaction paths. Our approach links online personas with their origin IP addresses based on a Pattern of Life (PoL) analysis. We show that, when monitoring in the correct places on the Internet, DNS over HTTPS (DoH) and DNS over TLS (DoT) can be deobfuscated with up to 100% accuracy.
  arXiv  Detail & Related papers  (2023-10-04T02:34:29Z)
• Evaluating Chatbots to Promote Users' Trust -- Practices and Open Problems [11.427175278545517]
  This paper reviews current practices for testing chatbots. It identifies gaps as open problems in pursuit of user trust. It outlines a path forward to mitigate issues of trust related to service or product performance, user satisfaction and long-term unintended consequences for society.
  arXiv  Detail & Related papers  (2023-09-09T22:40:30Z)
• ChatGPT for Us: Preserving Data Privacy in ChatGPT via Dialogue Text Ambiguation to Expand Mental Health Care Delivery [52.73936514734762]
  ChatGPT has gained popularity for its ability to generate human-like dialogue. Data-sensitive domains face challenges in using ChatGPT due to privacy and data-ownership concerns. We propose a text ambiguation framework that preserves user privacy.
  arXiv  Detail & Related papers  (2023-05-19T02:09:52Z)
• FedBot: Enhancing Privacy in Chatbots with Federated Learning [0.0]
  Federated Learning (FL) aims to protect data privacy through distributed learning methods that keep the data in its location. The POC combines Deep Bidirectional Transformer models and federated learning algorithms to protect customer data privacy during collaborative model training. The system is specifically designed to improve its performance and accuracy over time by leveraging its ability to learn from previous interactions.
  arXiv  Detail & Related papers  (2023-04-04T23:13:52Z)
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection [64.67495502772866]
  Large Language Models (LLMs) are increasingly being integrated into various applications. We show how attackers can override original instructions and employed controls using Prompt Injection attacks. We derive a comprehensive taxonomy from a computer security perspective to systematically investigate impacts and vulnerabilities.
  arXiv  Detail & Related papers  (2023-02-23T17:14:38Z)
• Cross-Network Social User Embedding with Hybrid Differential Privacy Guarantees [81.6471440778355]
  We propose a Cross-network Social User Embedding framework, namely DP-CroSUE, to learn the comprehensive representations of users in a privacy-preserving way. In particular, for each heterogeneous social network, we first introduce a hybrid differential privacy notion to capture the variation of privacy expectations for heterogeneous data types. To further enhance user embeddings, a novel cross-network GCN embedding model is designed to transfer knowledge across networks through those aligned users.
  arXiv  Detail & Related papers  (2022-09-04T06:22:37Z)
• CheerBots: Chatbots toward Empathy and Emotionusing Reinforcement Learning [60.348822346249854]
  This study presents a framework whereby several empathetic chatbots are based on understanding users' implied feelings and replying empathetically for multiple dialogue turns. We call these chatbots CheerBots. CheerBots can be retrieval-based or generative-based and were finetuned by deep reinforcement learning. To respond in an empathetic way, we develop a simulating agent, a Conceptual Human Model, as aids for CheerBots in training with considerations on changes in user's emotional states in the future to arouse sympathy.
  arXiv  Detail & Related papers  (2021-10-08T07:44:47Z)
• Put Chatbot into Its Interlocutor's Shoes: New Framework to Learn Chatbot Responding with Intention [55.77218465471519]
  This paper proposes an innovative framework to train chatbots to possess human-like intentions. Our framework included a guiding robot and an interlocutor model that plays the role of humans. We examined our framework using three experimental setups and evaluate the guiding robot with four different metrics to demonstrated flexibility and performance advantages.
  arXiv  Detail & Related papers  (2021-03-30T15:24:37Z)
• Personalized Chatbot Trustworthiness Ratings [19.537492400265577]
  We envision a personalized rating methodology for chatbots that relies on separate rating modules for each issue. The method is independent of the specific trust issues and is parametric to the aggregation procedure.
  arXiv  Detail & Related papers  (2020-05-13T22:42:45Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.