Privacy Gateway prototype filters data before chatbots

An email to a chatbot, a large document to analyze: For many people, artificial intelligence has long been a tool for saving time. Around one third of people in Germany use AI at least once a week. Pascal Tippe, a doctoral student at FernUniversität in Hagen, and master's student Michael Maximilian Grötzner are addressing precisely the risky point: Their prototype, Privacy Gateway, removes sensitive data before a request reaches an AI language model.

The filter acts as an intermediary between the user and the chatbot. It does not merely search for obvious names or sequences of numbers, but assesses the entire context of a request. To do this, Tippe and Grötzner translated the legal definitions in Articles 4 and 9 of the General Data Protection Regulation, as well as German trade-secret provisions, into a codebook of instructions. This is intended not only to help the system identify that information needs to be protected, but also to explain why.

The need does not arise only with users themselves. Inputs may contain information about colleagues, customers or family members who never agreed to its disclosure. According to Tippe, many individual pieces of information can be used to create personal profiles about interests and habits. If such data falls into the wrong hands, for example through a hacker attack, it can be misused; inputs may also be used for the further training of AI models.

So what does that mean in practice? Privacy Gateway could enable people and companies to continue using chatbots for emails or documents without having to manually search for and delete every sensitive detail. The prototype is not yet a risk-free solution, however: A study using an extensive dataset of everyday scenarios showed that sensitive information cannot always be removed without worsening the response.

The limitation is particularly clear with extensive medical diagnoses. The more personal information a prompt contains, the more information important to the response may be lost during anonymization, Tippe explained. Data protection and usability are therefore not fully compatible. The benchmark for the approach is consequently not maximum removal, but useful protection that preserves the chatbot's functionality as far as possible.