Data Anonymizer Agent for Secure Data Transformations

• Data Anonymizer Agent is a software component that transforms sensitive data through techniques like redaction, masking, and pseudonymization to ensure robust privacy.
• It is strategically positioned before untrusted processing layers in varied architectures, safeguarding downstream analytics while preserving data utility.
• The design leverages multi-agent orchestration and modality-specific methods to optimize privacy-utility trade-offs through active policy and transformation enforcement.

A Data Anonymizer Agent denotes an agentic software component that transforms sensitive data before later storage, sharing, reasoning, or inference. In one explicit formulation it is the privacy gatekeeper of an end-to-end clinical ML pipeline, positioned after file-type detection and before feature extraction (Shimgekar et al., 24 Jul 2025). Related work places analogous functionality at a node’s outbound interface under strict data locality (Vaughan et al., 20 Nov 2025), inside a browser-level overlay that performs local entity anonymization before prompts reach a cloud LLM (Holschneider et al., 26 Mar 2026), or within a trusted local layer that exposes only an anonymized “Virtual UI” to a cloud GUI agent (Zhao et al., 8 Feb 2026). Across this literature, the term covers heterogeneous mechanisms—redaction, masking, pseudonymization, substitution, controlled disclosure, and encrypted-policy enforcement—and the distinctions among these mechanisms are fundamental to both privacy guarantees and downstream utility.

1. Conceptual scope and terminology

A central distinction in the literature is between anonymization proper and weaker disclosure-limiting mechanisms. In the agent-based cloud architecture of “Handling Confidential Data on the Untrusted Cloud: An Agent-based Approach,” the owner-specific function generatePurgedDossier4Receiver(idReceiver) creates a receiver-specific reduced dossier “by removing information that the receiver should not have access to,” but the paper is explicit that this is not formal anonymization in the sense of $k$-anonymity, $l$-diversity, or differential privacy; it is better described as sanitization, redaction, field-level minimization, and controlled disclosure (Damiani et al., 2010). A similar distinction appears in distributed inter-organizational reasoning: “Distributed Agent Reasoning Across Independent Systems With Strict Data Locality” uses HMAC-derived pseudonymous case tokens and concise natural-language summaries, while stressing that the result is pseudonymization and de-identification rather than full anonymization, because linkage remains possible under the right conditions (Vaughan et al., 20 Nov 2025).

A second line of work defines the anonymizer as a semantic-preserving substitution service. “Anonymous-by-Construction: An LLM-Driven Framework for Privacy-Preserving Text” replaces sensitive spans with realistic, type-consistent surrogates, runs entirely on-premise, preserves sentence structure, and is explicitly positioned as a pre-inference and pre-training transformation layer rather than a simple PII masker (Albanese et al., 17 Mar 2026). “Adanonymizer” places the same distinction in human-interaction terms: it treats privacy protection and model usefulness as a trade-off that should be navigable by users through selective pseudonymization rather than indiscriminate removal (Zhang et al., 2024).

A third line of work frames anonymization as operational invisibility rather than semantic deletion. “Anonymization-Enhanced Privacy Protection for Mobile GUI Agents” enforces “available-but-invisible” access: sensitive values remain usable for task execution but are never directly visible to the cloud agent, because deterministic, type-preserving placeholders replace the raw values across instructions, XML hierarchies, and screenshots (Zhao et al., 8 Feb 2026). This suggests that, in agentic systems, anonymization is often best understood as a boundary-enforced transformation regime whose strength depends on whether the transformed output is merely hidden, pseudonymized, generalized, or rendered resistant to linkage.

2. Architectural placement and trust boundaries

The location of the anonymization function in the system architecture is one of the strongest determinants of its privacy properties. The literature repeatedly places the transformation before the first untrusted processing stage, but the concrete boundary differs by application domain.

Context	Placement of anonymization function	Boundary enforced
Clinical ML pipeline (Shimgekar et al., 24 Jul 2025)	After Ingestion Identifier Agent, before Feature Extraction Agent	Ingestion-phase privacy gatekeeper
Distributed federated reasoning (Vaughan et al., 20 Nov 2025)	At each node’s outbound interface	Strict data locality across organizations
Browser-mediated LLM use (Holschneider et al., 26 Mar 2026)	Browser-extension overlay before prompt/file submission	Local processing before cloud LLM exposure
Mobile GUI automation (Zhao et al., 8 Feb 2026)	Trusted local privacy layer between device and cloud agent	Virtual UI visible to cloud, raw UI kept local

In the clinical pipeline, anonymization becomes the canonical upstream transformation: downstream agents such as feature extraction, model-data feature matching, preprocessing recommendation, preprocessing implementation, and model inference consume only privacy-protected artifacts (Shimgekar et al., 24 Jul 2025). In strict-locality federation, each node computes an outbound message $m_{i \to j} = f_i(D_i, q)$, where only the local node sees the full dataset $D_i$, and every inter-node message is already a constrained summary (Vaughan et al., 20 Nov 2025). In browser overlays, the system intercepts prompts and file uploads “at the speed and place of user interaction,” keeps originals local, and sends only transformed content to the cloud model (Holschneider et al., 26 Mar 2026). In mobile GUI agents, the cloud planner sees an anonymized interface, while a trusted local layer retains the raw device state and resolves placeholders back into actions (Zhao et al., 8 Feb 2026).

A more general architecture appears in AgentCrypt, which treats privacy as a deterministic enforcement layer added “on top of any AI agent platform.” It places security wrappers around data fetches, transformations, messages, tool calls, persistence, and agent-to-agent context, and it requires that protected outputs inherit policies from their inputs rather than relying on unconstrained LLM obedience (Karthikeyan et al., 8 Dec 2025). This suggests that a Data Anonymizer Agent is not necessarily a single model; it may instead be a composite of transformation tools, policy propagation, egress control, and secure orchestration.

3. Modality-specific transformation mechanisms

The literature supports markedly different anonymization mechanisms for different data modalities. In tabular and image-oriented clinical ingestion, the concrete implementation described in “Agentic AI framework for End-to-End Medical Data Inference” is modality-aware but narrow: structured CSV and Excel files are scanned by Google Cloud Data Loss Prevention inspection and detected PII is replaced with fixed-length placeholders such as "****", while images are processed by Google Cloud DLP’s visual inspection and sensitive regions are redacted using opaque overlays such as black rectangles (Shimgekar et al., 24 Jul 2025). The emphasis is schema preservation for tabular downstream use and region-level redaction for image downstream use.

For free text, a stronger semantic alternative is type-consistent substitution rather than masking. “Anonymous-by-Construction” uses local LLM prompting to replace names, usernames, emails, phone numbers, addresses, codes, and numeric expressions with realistic fake alternatives of the same type, while preserving sentence structure and keeping the entire process on-premise (Albanese et al., 17 Mar 2026). “AgentStealth” extends this idea to subtler attribute leakage in user-generated text: it treats anonymization as adversarial rewriting against an attacker that tries to infer age, gender, geographic location, occupation, education level, relationship status, income level, and place of birth, and it optimizes a joint privacy-utility objective $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$ (Shao et al., 26 Jun 2025).

For heterogeneous packages and semi-structured corpora, the transformation becomes multi-stage. “Automatic de-identification of Data Download Packages” processes zipped Instagram DDPs by recursively parsing nested JSON, using structural patterns and regex-like rules to detect usernames, emails, phone numbers, and URLs, adding a top-down dictionary of the 10,000 most common Dutch names, pseudonymizing usernames and names with unique hexadecimal codes, replacing emails/phones/URLs with generic category codes, and blurring faces and all detected text in media using MTCNN and EAST (Boeschoten et al., 2021). “rx-anon” generalizes the same concern to heterogeneous documents containing relational attributes and text, extracting sensitive text terms, mapping them to structured attributes, defining redundant sensitive information, and enforcing joint $k$-anonymity over both the relational and textual disclosure surface (Singhofer et al., 2021).

Voice anonymization uses yet another mechanism. V-Cloak is a one-shot generative waveform anonymizer built on Wave-U-Net, with VP-Modulation to condition anonymization on a target voiceprint at multiple frequency levels and Throttle to allocate perturbation budget across those levels under a configurable $\ell_\infty$ constraint $\epsilon$. Its training objective combines anonymity against ASV, intelligibility preservation via a DeepSpeech2-derived loss, psychoacoustics-based naturalness preservation, and perturbation control (Deng et al., 2022). For images with context-dependent identifiers, “Towards Context-Aware Image Anonymization with Multi-Agent Reasoning” adds a hybrid perception-and-editing stack: direct PII categories are detected deterministically, while indirect PII is handled by multi-agent reasoning, scout-and-zoom segmentation, and diffusion-based inpainting (Aufschläger et al., 29 Mar 2026).

4. Agent roles, control loops, and secure mediation

Many Data Anonymizer Agent designs are explicitly multi-agent or multi-component rather than monolithic. In the untrusted-cloud dossier architecture, local client agents store dossiers locally, keep plaintext for dossiers they own, keep encrypted copies of dossiers owned by others, prepare receiver-specific reduced versions, synchronize shared updates, and request decryption keys when needed, while an untrusted Synchronizer stores encrypted pending dossiers, encrypted decryption keys, and public keys (Damiani et al., 2010). The crucial control primitive is receiver-specific disclosure: the owner decides what to reveal by calling generatePurgedDossier4Receiver(idReceiver) and by issuing grant or revoke operations through key availability (Damiani et al., 2010).

In distributed organizational systems, the roles are more specialized. “Distributed Agent Reasoning Across Independent Systems With Strict Data Locality” separates the Clinic, Insurer, and Specialist nodes. The Clinic computes an HMAC-based patient token, sends only a concise natural-language coverage inquiry, the Insurer resolves the token using its own local dataset, and the Specialist receives only a clinical summary without any identifier or token. The paper’s formalization $m_{i \to j} = f_i(D_i, q)$ captures the idea that outbound messages are lossy projections of local information rather than shared records (Vaughan et al., 20 Nov 2025).

The mobile GUI literature turns mediation into a first-class systems problem. “Anonymization-Enhanced Privacy Protection for Mobile GUI Agents” decomposes the architecture into a PII Detector, UI Transformer, Secure Interaction Proxy, and Privacy Gatekeeper, all tied together by a session-scoped local mapping table. Sensitive values are transformed into deterministic placeholders of the form

$$P = T\#\operatorname{Truncate}\big(\operatorname{Base36}(\operatorname{SHA256}(v \,\|\, T)),\ 5\big),$$

and all cloud-agent actions are executed against the anonymized “Virtual UI” rather than the raw device state (Zhao et al., 8 Feb 2026). When raw-value reasoning is unavoidable, the Privacy Gatekeeper exposes only narrowly scoped local computation through cloud_agent_compute_with_tokens(tokens, instruction, reason) and returns bounded outputs such as booleans or relation labels (Zhao et al., 8 Feb 2026).

AgentCrypt generalizes these mediation patterns into four privacy levels, from plaintext exchange to policy-based encryption and fully homomorphic encrypted computation. Its most consequential rule for anonymization pipelines is that a derived output inherits the intersection of the policies of all input items used in the computation (Karthikeyan et al., 8 Dec 2025). This makes the anonymizer not merely a text- or image-transformer, but an information-flow controller: every rewrite, aggregate, summary, or intermediate feature can carry policy tags, encryption identities, and release constraints.

5. Formal objectives, privacy models, and optimization strategies

Several papers move beyond ad hoc masking and specify explicit privacy or privacy-utility objectives. In heterogeneous semi-structured documents, rx-anon defines an RX-dataset with relational quasi-identifiers $l$0 and a textual attribute $l$1, extracts non-redundant sensitive text terms into a set-valued attribute $l$2, constructs a person-centric view $l$3, and requires joint $l$4-anonymity over relational values and extracted text terms. Its modified Mondrian algorithm introduces a parameter $l$5 to control whether partitioning favors relational or textual attributes, and utility is measured using an adapted Normalized Certainty Penalty over both structured and textual loss (Singhofer et al., 2021).

A more cryptographically ambitious formulation appears in “Secure k-Anonymization over Encrypted Databases.” There, a Data Owner encrypts a table $l$6, outsources the ciphertexts to party $l$7, gives the secret key to a non-colluding party $l$8, discovers direct identifiers and quasi-identifiers over encrypted values, and then enforces $l$9-anonymity by secure clustering, suppression, reassignment, and generalization. The protocol computes encrypted squared Euclidean distances

$m_{i \to j} = f_i(D_i, q)$0

keeps cluster membership hidden via permutations and blinded decrypt-assist steps, supports differential privacy through encrypted Laplace-style perturbation, and assumes honest-but-curious, non-colluding parties (Kesarwani et al., 2021). This is not a general-purpose text or image anonymizer, but it shows that an anonymization agent can be formulated as an encrypted data-publishing workflow rather than a plaintext preprocessing stage.

LLM-based text anonymization papers make privacy-utility optimization explicit. AgentStealth treats the attacker’s attribute-inference accuracy $m_{i \to j} = f_i(D_i, q)$1 as the privacy risk and utility as an average over similarity metrics, then optimizes

$m_{i \to j} = f_i(D_i, q)$2

using a self-reinforcing workflow that generates anonymization traces, attack feedback, joint defender/attacker supervision, and finally online reinforcement learning (Shao et al., 26 Jun 2025). RLAA introduces a rational-agent perspective, defining Marginal Privacy Gain $m_{i \to j} = f_i(D_i, q)$3, Marginal Utility Cost $m_{i \to j} = f_i(D_i, q)$4, and Marginal Rate of Substitution

$m_{i \to j} = f_i(D_i, q)$5

then arguing that greedy anonymization becomes irrational when $m_{i \to j} = f_i(D_i, q)$6 approaches zero while $m_{i \to j} = f_i(D_i, q)$7 remains positive. Its Attacker-Arbitrator-Anonymizer architecture uses a categorical validity gate $m_{i \to j} = f_i(D_i, q)$8 as a discrete estimator of whether a rewrite is worth performing (Duan et al., 7 Dec 2025). At the interface level, Adanonymizer makes the same trade-off visible to users by mapping privacy sensitivity $m_{i \to j} = f_i(D_i, q)$9 and performance impact $D_i$0 onto a trade-off curve whose point at privacy level $D_i$1 is $D_i$2 (Zhang et al., 2024).

6. Empirical evidence and observed performance

Empirical support for Data Anonymizer Agents is uneven. Some papers are architectural and intentionally lack benchmark-style evaluation. “Handling Confidential Data on the Untrusted Cloud” reports essentially no full empirical evaluation, providing neither benchmark results nor latency or throughput measurements (Damiani et al., 2010). “PII Shield” is likewise a systems/HCI proposal without completed quantitative evaluation, with future studies still prospective (Holschneider et al., 26 Mar 2026). By contrast, several papers provide detailed privacy-utility evidence.

For text, “Anonymous-by-Construction” evaluates local LLM substitution against Microsoft Presidio, Google DLP, and ZSTS variants on privacy recall, sentiment stability, topic drift, QA accuracy, and a trainability-under-privacy criterion based on BERT+LoRA. Its GPT-oss variant reaches privacy recall $D_i$3, sentiment accuracy $D_i$4, topic distance $D_i$5, QA accuracy $D_i$6, QA true accuracy $D_i$7, and LoRA MAE $D_i$8, dominating rule-based and redaction-heavy baselines on the combined privacy-utility-trainability frontier (Albanese et al., 17 Mar 2026). AgentStealth reports improvements of $D_i$9 in anonymization effectiveness and $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$0 in utility relative to its baselines, supporting the claim that attacker-in-the-loop local SLM anonymization can outperform rigid replacement and standard prompt-only rewriting (Shao et al., 26 Jun 2025).

For user-facing prompt mediation, Adanonymizer combines a survey of $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$1 participants with an evaluation involving $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$2 participants across work, academic, and life-related consultations. It reports the shortest modification time for the full interactive system—$$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$3, $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$4, versus $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$5, $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$6, and $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$7 for comparison conditions—and significantly higher perceived control, transparency, satisfaction, and model output performance while maintaining comparable perceived privacy protection (Zhang et al., 2024). This provides direct evidence that a Data Anonymizer Agent can be effective not only as a backend service but also as an interactive human-in-the-loop control surface.

For GUI and vision systems, the evidence is similarly concrete. In mobile GUI automation, the “available-but-invisible” framework reduces leakage rate from $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$8 to $$\mathcal{J} = \lambda \cdot (1 - Acc_{\text{attack}}) + (1 - \lambda)\cdot \mathcal{U}$$9 for Qwen2.5-VL-7B on PrivScreen while keeping accuracy at $k$0, and adds an average privacy-layer overhead of $k$1 s per image (Zhao et al., 8 Feb 2026). In context-aware image anonymization, CAIAMAR reduces person Re-ID risk on CUHK03-NP by $k$2 at $k$3 ($k$4 versus $k$5 baseline), achieves KID $k$6 and FID $k$7 on CityScapes, and preserves downstream semantic segmentation with mIoU $k$8 (Aufschläger et al., 29 Mar 2026). For voice, V-Cloak achieves real-time coefficient $k$9, improves average MMR from $\ell_\infty$0 to $\ell_\infty$1 as $\ell_\infty$2 increases from $\ell_\infty$3 to $\ell_\infty$4, and keeps WER in the $\ell_\infty$5 to $\ell_\infty$6 range when ASR preservation is active (Deng et al., 2022).

Not all modality-specific results are uniformly strong. The same CAIAMAR paper reports much weaker zero-shot PII detection on the Visual Redactions Dataset than a supervised Mask R-CNN baseline, with Dice $\ell_\infty$7 versus $\ell_\infty$8 and IoU $\ell_\infty$9 versus $\epsilon$0, making clear that multi-agent reasoning improves context-sensitive coverage but does not eliminate the need for specialized detectors (Aufschläger et al., 29 Mar 2026). This suggests that empirical best practice is hybrid: deterministic detectors for frequent, well-defined identifiers; agentic reasoning for residual, context-dependent cases.

7. Limitations, threat models, and future directions

A recurring limitation is that many systems offer risk reduction without formal anonymity guarantees. Text-oriented frameworks such as Adanonymizer, PII Shield, AgentStealth, and RLAA optimize privacy-utility trade-offs through prompting, attackers, arbiters, or substitution rules, but they do not provide $\epsilon$1-differential privacy or universally quantified re-identification bounds (Zhang et al., 2024, Holschneider et al., 26 Mar 2026, Shao et al., 26 Jun 2025, Duan et al., 7 Dec 2025). Even AgentCrypt, which moves privacy enforcement into deterministic wrappers and encryption, explicitly notes that secure computation does not prevent inference from the final output itself and suggests differential privacy as future work for protecting against low-count or highly identifying outputs (Karthikeyan et al., 8 Dec 2025).

A second limitation is metadata and contextual leakage. The untrusted-cloud dossier framework does not treat metadata confidentiality in depth, even though identifiers such as idOwner, accessList, idReceiver, and update frequency can leak relationships (Damiani et al., 2010). Strict-locality federation prevents direct record exchange, but its own authors note that natural-language summaries remain vulnerable to identifier leakage, cross-system inference, and prompt-dependent behavior, and that they performed no adversarial testing beyond basic functional runs (Vaughan et al., 20 Nov 2025). Mobile GUI anonymization depends on OCR and detection quality; if a value is never detected or never matched, it may remain exposed (Zhao et al., 8 Feb 2026).

A third limitation is that removing direct identifiers is often insufficient. The mobility re-identification study “Agentic AI-Powered Re-Identification: An Emerging, Scalable Threat to Mobility Microdata Privacy” demonstrates that, from spatio-temporal data and public sources alone, an agentic pipeline fully re-identified 18 of 25 re-identifiable individuals ($\epsilon$2) and 18 of 43 cases overall ($\epsilon$3), with $\epsilon$4 precision among named candidates and mean cost $\epsilon$5 per attempt (Thees et al., 26 Jun 2026). Its implication for anonymizer design is explicit: direct-identifier removal and light perturbation do not suffice when home/work anchors or other strong quasi-identifiers remain recoverable. This strengthens the case for adversarial risk assessment, formal privacy models where feasible, and stronger transformation of linkage-enabling structure rather than surface-level masking alone.

Future directions in the cited literature converge on several themes. One is locality and sovereignty: browser-local anonymization, on-prem substitution, and local GUI mediation all aim to prevent raw data egress before any cloud exposure (Holschneider et al., 26 Mar 2026, Albanese et al., 17 Mar 2026, Zhao et al., 8 Feb 2026). Another is policy-aware secure execution: grant/revoke disclosure, field-level policy tags, encrypted role-based access, and output-policy propagation place privacy outside the LLM’s discretionary behavior [(Damiani et al., 2010); (Karthikeyan et al., 8 Dec 2025)]. A third is evaluation beyond redaction accuracy: trainability under privacy, downstream QA retention, semantic segmentation preservation, ASV/ASR trade-offs, and human-centered control measures show that a Data Anonymizer Agent must be judged as an operational subsystem, not merely as a detector (Albanese et al., 17 Mar 2026, Aufschläger et al., 29 Mar 2026, Deng et al., 2022, Zhang et al., 2024). Taken together, these directions suggest that the mature form of a Data Anonymizer Agent is a boundary-enforced, modality-aware, policy-governed transformation service whose outputs are explicitly designed for both privacy resistance and downstream computational use.