arXiv: PromptGraph: Graph-Guided Prompt Sanitization for Balancing Privacy and Utility in LLM Inference

This paper, published on arXiv, introduces a novel technical framework called PromptGraph, which proposes a method for sanitizing user prompts sent to large language models (LLMs) to better balance privacy protection with model utility. The core change is a shift from simple keyword redaction to a graph-based approach that analyzes the structural relationships within a prompt, allowing for more targeted removal of sensitive data without degrading the quality of the LLM's response. This is not a regulatory mandate but a technical development that directly addresses a key compliance challenge under the EU AI Act and GDPR.

Organizations deploying or developing LLMs for customer-facing applications, particularly in regulated sectors like finance, healthcare, and legal services, are most affected. Any entity processing personal data through inference APIs or internal LLM systems should take note, as this technique offers a potential path to reduce data protection risks while maintaining high service performance. Compliance teams should evaluate whether their current prompt sanitization methods are overly aggressive, leading to poor utility, or too lax, creating privacy vulnerabilities.

As a next step, compliance teams should collaborate with data science and security teams to review this paper and assess its applicability to their existing prompt filtering pipelines. They should consider running a pilot to compare the privacy-utility trade-off of their current methods against a graph-based approach. Finally, document this evaluation in the context of your organization's risk management framework for high-risk AI systems, as adopting such techniques could strengthen your defense against regulatory scrutiny under Article 50 of the EU AI Act.