BinaryShield: Privacy-Preserving Threat Intelligence

• BinaryShield is a privacy-preserving cross-service threat intelligence system that generates binary attack fingerprints to detect prompt injections without sharing raw user data.
• It employs a pipeline of PII redaction, semantic embedding, binary quantization, and randomized response to ensure non-invertible and efficient similarity search in Hamming space.
• The system achieves near-dense embedding performance with significant reductions in storage and search time while maintaining local differential privacy under varied attack scenarios.

BinaryShield is a privacy-preserving cross-service threat intelligence system for LLM prompt injections that enables organizations to share actionable attack fingerprints across compliance boundaries without sharing raw prompts, embeddings, or other sensitive user content. It is built around privacy-preserving attack fingerprints generated through a pipeline of PII redaction, semantic embedding, binary quantization, and randomized response, with the goal of preserving the semantic “core” of an attack while making the shared representation computationally non-invertible, locally differentially private, and efficient for approximate similarity search in Hamming space (Gill et al., 6 Sep 2025).

1. Definition and security setting

BinaryShield addresses a setting in which large organizations operate many logically isolated LLM services—consumer chat, enterprise assistants, APIs, coding agents, and related systems—each with its own models, logs, and compliance boundary. These silos protect privacy, but they fragment security telemetry. The motivating risk is prompt injection, described in the source material as the single most important class of LLM security risk, with attacks that can override system prompts or alignment constraints, exfiltrate private data from context or tools, trigger harmful tool calls, and jailbreak safety policies via paraphrased, obfuscated, or multi-turn prompts (Gill et al., 6 Sep 2025).

The central problem is therefore not merely prompt classification inside one service, but cross-service propagation of threat intelligence under regulatory constraints. When an attack is detected in one service, the same threat may remain present in other services for extended periods because regulatory and compliance rules prevent sharing raw prompts or full logs across boundaries. BinaryShield is framed as the analogue of malware signatures for text prompts, but with the added requirements of semantic robustness, privacy preservation, and scalable approximate matching (Gill et al., 6 Sep 2025).

An attack fingerprint in BinaryShield is a compact binary vector derived from redacted text via an embedding model, quantized to signs, and randomized via bit-flipping to satisfy local differential privacy. For a redacted prompt $x$, the paper defines a dense embedding $\mathbf{e}(x) \in \mathbb{R}^d$, a binary code $\mathbf{b}(x) \in \{0,1\}^d$, and a noisy shared fingerprint $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$. These fingerprints are intended to be non-invertible, approximate-matching-friendly, and efficient in storage and search (Gill et al., 6 Sep 2025).

2. Fingerprint generation pipeline

BinaryShield’s fingerprint generation is executed entirely inside the originating service’s compliance boundary before anything is shared. The suspicious prompt $y$, optional system metadata $m$, privacy parameter $\alpha$, and embedding dimension $d$ define the pipeline inputs. The sequence is PII redaction, semantic embedding, binary quantization, randomized response, and concatenation with non-sensitive metadata (Gill et al., 6 Sep 2025).

The first stage uses Microsoft Presidio to detect PII entities, including structured identifiers such as SSNs, credit card numbers, account IDs, phone numbers, and emails, as well as named entities such as person names, organizations, and locations. These are replaced with typed placeholders preserving syntactic and semantic structure. The provided example transforms “Transfer $5000 from John Smith’s account 123456789.” into “Transfer [AMOUNT] from [PERSON]’s account [ACCOUNT].” This stage is described as one-way, with the original PII not retained, while preserving command structure and relational patterns needed for identifying injection behaviors (Gill et al., 6 Sep 2025).

The second stage computes a semantic embedding from the redacted prompt, using a transformer encoder such as ModernBERT or OpenAI text-embedding-3-large: $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$ The paper states that attacks with similar intent cluster closely in embedding space despite lexical variances, and that paraphrases and synonym substitutions yield nearby vectors. At the same time, dense embeddings are explicitly described as leaking substantial information through embedding inversion and as being expensive to store and search over at scale (Gill et al., 6 Sep 2025).

The third stage maps each embedding dimension to a single bit by sign: $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$ This produces $\mathbf{e}(x) \in \mathbb{R}^d$0. The stated effects are irreversibility, because magnitudes are discarded; semantic preservation, because the sign pattern still encodes coarse direction in vector space; and efficiency, because storage is reduced from 32 bits per float32 dimension to 1 bit per dimension and similarity can be computed via XOR and population count (Gill et al., 6 Sep 2025).

The final privacy stage applies classic randomized response independently to each bit. Given privacy budget $\mathbf{e}(x) \in \mathbb{R}^d$1,

$\mathbf{e}(x) \in \mathbb{R}^d$2

and

$\mathbf{e}(x) \in \mathbb{R}^d$3

The resulting $\mathbf{e}(x) \in \mathbb{R}^d$4 is the privatized binary fingerprint. BinaryShield then forms a composite fingerprint

$\mathbf{e}(x) \in \mathbb{R}^d$5

where $\mathbf{e}(x) \in \mathbb{R}^d$6 can include non-sensitive metadata such as tools invoked or region (Gill et al., 6 Sep 2025).

3. Cross-service operation and similarity search

BinaryShield is designed as a cross-service correlation mechanism rather than a standalone detector. A service’s own prompt-injection defense—described in the source as a classifier, TaskTracker, guard LLM, or similar mechanism—flags a suspicious prompt. BinaryShield then generates the binary fingerprint inside that service’s compliance boundary, optionally concatenates non-private system metadata, and broadcasts the resulting opaque bitstring-plus-metadata artifact to peer services. Recipient services compute fingerprints for their own historical and live prompts using the same pipeline and perform similarity search in Hamming space. When matches are found within a calibrated distance threshold, local policy actions such as alerting, blocking, or retraining may be triggered (Gill et al., 6 Sep 2025).

Similarity between fingerprints is measured by Hamming distance: $\mathbf{e}(x) \in \mathbb{R}^d$7 For a query fingerprint $\mathbf{e}(x) \in \mathbb{R}^d$8 and a service $\mathbf{e}(x) \in \mathbb{R}^d$9 with fingerprint log $\mathbf{b}(x) \in \{0,1\}^d$0, BinaryShield defines the match set as

$\mathbf{b}(x) \in \{0,1\}^d$1

where $\mathbf{b}(x) \in \{0,1\}^d$2 is a calibrated Hamming threshold. Lower Hamming distance is interpreted as higher semantic similarity of the underlying prompts, subject to quantization and DP noise (Gill et al., 6 Sep 2025).

This architecture yields a specific form of threat-intelligence sharing: knowledge of “this pattern of attack” is propagated without readable text. Only aggregate match statistics or similarly high-level signals need be fed back across boundaries; the source material explicitly states that no raw content is exchanged (Gill et al., 6 Sep 2025).

A concise summary of the system’s operational artifacts is as follows.

Component	Representation	Role
Dense embedding	$\mathbf{b}(x) \in \{0,1\}^d$3	Semantic encoding of redacted prompt
Binary code	$\mathbf{b}(x) \in \{0,1\}^d$4	Sign-quantized embedding
Shared fingerprint	$\mathbf{b}(x) \in \{0,1\}^d$5	Locally privatized attack fingerprint

This design suggests a division of labor in which detection remains local, while BinaryShield provides a privacy-preserving substrate for retrospective hunting and cross-service correlation (Gill et al., 6 Sep 2025).

4. Privacy model and security properties

BinaryShield’s privacy model is centered on local differential privacy at the bit level. Each shared bit $\mathbf{b}(x) \in \{0,1\}^d$6 is produced by an $\mathbf{b}(x) \in \{0,1\}^d$7-LDP mechanism, and because the randomization is applied before the fingerprint leaves the compliance boundary, no trusted aggregator is required. The paper’s stated security goal is to resist reconstruction, membership inference, and sensitive-attribute inference even under a white-box adversary who knows the entire pipeline, including models, quantization method, and DP parameters, and who has access to all shared fingerprints across services (Gill et al., 6 Sep 2025).

The privacy stack has three layers. PII redaction removes direct identifiers before embedding. Binary quantization discards magnitudes, which the paper argues makes embedding inversion substantially harder even without randomized response. Randomized response then adds formal local differential privacy to the binary representation. The source material does not claim a full formal theorem of non-invertibility for the composite pipeline. Instead, it argues that quantization alone makes reconstruction exponentially difficult in high dimension because each bit corresponds to one half-space in $\mathbf{b}(x) \in \{0,1\}^d$8, and that randomized response further obfuscates bits such that reconstruction from $\mathbf{b}(x) \in \{0,1\}^d$9 is not feasible beyond what is allowed by LDP (Gill et al., 6 Sep 2025).

The expected self-distortion introduced by randomized response is given explicitly: $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$0 For $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$1 and $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$2, the reported observed Hamming distances between $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$3 and $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$4 match the theoretical curve and approach the random baseline of approximately $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$5 differing bits at low $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$6. The evaluation on $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$7 prompts is therefore framed as a calibration of privacy noise rather than as a direct reconstruction benchmark (Gill et al., 6 Sep 2025).

A recurrent misconception is that BinaryShield provides a formal proof of end-to-end non-invertibility. The paper does not make that claim. It explicitly notes that no explicit reconstruction attack evaluation is presented, and that privacy arguments rest on known DP theory plus the qualitative hardness of inversion after redaction and sign quantization. Another misconception is that the system shares embeddings; in fact, the stated objective is precisely to avoid sharing raw prompts, embeddings, or other sensitive user content across compliance boundaries (Gill et al., 6 Sep 2025).

5. Empirical performance, baselines, and trade-offs

BinaryShield is evaluated on a prompt injection dataset from Shen et al. (“Do Anything Now”), on synthetic attack variants generated via GPT-4o, and on benign pairs of semantically unrelated benign prompts. Synthetic attack variants include word-flipping variants in which $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$8 words longer than four characters are replaced with synonyms while preserving attack intent, and full paraphrase variants preserving malicious intent. For scalability analysis, paraphrased attacks are injected into large corpora of benign interactions from WildChat, described as $\tilde{\mathbf{b}}(x) \in \{0,1\}^d$9 million real ChatGPT logs, producing hybrid corpora from $y$0K to $y$1K entries (Gill et al., 6 Sep 2025).

The main privacy-preserving baseline is SimHash, described as standard locality-sensitive hashing over tokens with a 64-bit code and Hamming distance for similarity. Dense embeddings without DP are also used in some analyses as a non-private upper-bound baseline. BinaryShield’s embedding back end is either ModernBERT or OpenAI text-embedding-3-large, with 768-dimensional binaries in the ModernBERT case (Gill et al., 6 Sep 2025).

The core quantitative results are summarized below.

Evaluation	BinaryShield	Comparator
Paraphrased attacks	F1 = 0.94, precision 0.92, recall 0.95 at $y$2	SimHash: F1 = 0.77, precision 0.75, recall 0.80
Storage at 100K entries	36.97 MB	Dense embeddings: 2,366.25 MB
Search time at 100K entries	0.38 s	Dense embeddings: 14.52 s

Across simple word-flip attacks, both BinaryShield and SimHash perform near-perfectly, with F1 approximately $y$3. Under heavier modification $y$4-20, BinaryShield attains F1 $y$5 with precision $y$6 and recall $y$7, compared with SimHash F1 $y$8, precision $y$9, recall $m$0. On paraphrased attacks—the reported hardest case—BinaryShield reaches F1 $m$1 at $m$2, whereas SimHash reaches F1 $m$3, a $m$4-point F1 advantage attributed to embedding-based semantic robustness under structural paraphrasing (Gill et al., 6 Sep 2025).

Against dense embeddings on hybrid corpora, BinaryShield with $m$5 achieves Accuracy@1 of $m$6 at $m$7K and $m$8 at $m$9K, while dense embeddings yield $\alpha$0 and $\alpha$1, respectively. The gap is reported as roughly $\alpha$2 to $\alpha$3 percentage points, meaning BinaryShield retains approximately $\alpha$4 of dense baseline top-1 accuracy. At $\alpha$5K, the dense baseline yields $\alpha$6 Accuracy@3 and $\alpha$7 Accuracy@5, while BinaryShield yields $\alpha$8 and $\alpha$9; the gap narrows to approximately $d$0 to $d$1 points (Gill et al., 6 Sep 2025).

The privacy–utility trade-off is governed by $d$2. On the paraphrase variant, F1 is approximately $d$3 at $d$4, improves significantly around $d$5, reaches approximately $d$6 to $d$7 for $d$8, and approximately $d$9 at $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$0. On a $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$1K corpus, Accuracy@1 is $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$2 at $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$3, approximately $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$4 at $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$5, $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$6 at $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$7, $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$8 at $$\mathbf{e} = \mathbf{e}(y_{\text{redacted}}) \in \mathbb{R}^d.$$9, and $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$0 at $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$1, with higher $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$2 approaching the dense baseline. The paper characterizes this as a clear phase transition: extremely strong privacy kills utility, whereas moderate $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$3 yields high utility with still-non-zero noise (Gill et al., 6 Sep 2025).

The storage and search results are central to BinaryShield’s systems claim. For 768-dimensional embeddings, dense storage is $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$4 MB at $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$5K entries and $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$6 MB at $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$7K; BinaryShield storage is $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$8 MB and $$b_i = \begin{cases} 1 & \text{if } e_i > 0, \ 0 & \text{otherwise}, \end{cases} \qquad i = 1,\ldots,d.$$9 MB, for an effective $\mathbf{e}(x) \in \mathbb{R}^d$00 reduction. For querying $\mathbf{e}(x) \in \mathbb{R}^d$01 attack prompts, dense embeddings require $\mathbf{e}(x) \in \mathbb{R}^d$02 s at $\mathbf{e}(x) \in \mathbb{R}^d$03K and $\mathbf{e}(x) \in \mathbb{R}^d$04 s at $\mathbf{e}(x) \in \mathbb{R}^d$05K, while BinaryShield requires $\mathbf{e}(x) \in \mathbb{R}^d$06 s and $\mathbf{e}(x) \in \mathbb{R}^d$07 s, corresponding to approximately $\mathbf{e}(x) \in \mathbb{R}^d$08 and $\mathbf{e}(x) \in \mathbb{R}^d$09 speedups (Gill et al., 6 Sep 2025).

6. Limitations, related methods, and broader usage of the name

BinaryShield’s limitations are stated explicitly. PII redaction is imperfect, so detection errors may leave residual identifiers. No explicit reconstruction attack evaluation is presented. Embedding choice affects performance, and results shown for ModernBERT and OpenAI embeddings may not generalize perfectly. Thresholds such as $\mathbf{e}(x) \in \mathbb{R}^d$10 and retrieval cutoffs are tuned on specific datasets and require calibration in deployment. Current experiments use English, so multilingual or domain-specific prompts require further study. Proposed future directions include evaluating more DP mechanisms beyond randomized response, exploring global DP settings, formal optimization of the privacy–utility trade-off, extending evaluation to adversarial reconstruction attacks and membership inference, and addressing multilingual and domain-specific semantics (Gill et al., 6 Sep 2025).

Relative to other hashing and fingerprinting methods, BinaryShield is positioned against SimHash and, by implication, MinHash-like locality-sensitive hashing schemes. SimHash is described as deterministic, token-level, and lacking formal DP, which makes it compact but brittle under semantic paraphrasing. Dense embedding approaches offer strong clustering quality but are stated to be vulnerable to embedding inversion, to leak more information than expected, and to incur high storage and search cost. BinaryShield’s novelty is the combination of SOTA semantic embeddings, sign-only quantization, and local DP randomized response in an operational threat-intelligence pipeline intended for online, per-prompt, per-service sharing (Gill et al., 6 Sep 2025).

The name “BinaryShield” also appears in later literature as a conceptual extension rather than as the title of a distinct, formalized method. In the AmbShield paper, “BinaryShield” is introduced only as a possible generalization of AmbShield’s philosophy to protecting binary data through passive or low-power environmental mechanisms; the paper itself remains about ambient-backscatter-assisted physical-layer security and does not define a concrete BinaryShield system (Zhang et al., 14 Jan 2026). In the SHIELD and ByteShield materials, “BinaryShield” is used as a design placeholder for frameworks inspired by resource-exhaustion defense or masking-based malware detection, again without establishing a standalone method under that name (Sivaroopan et al., 27 Jan 2026, Gibert et al., 10 Dec 2025).

This broader usage suggests that “BinaryShield” functions in two distinct senses. In the strict sense, it denotes the privacy-preserving fingerprinting architecture for cross-service LLM prompt-injection intelligence introduced in 2025 (Gill et al., 6 Sep 2025). In a looser, analogical sense, it has been used to denote possible future systems that combine compact binary representations, distributed defense, and privacy or robustness mechanisms across other security domains (Zhang et al., 14 Jan 2026).