Self-Sanitize: In-System Content Sanitization

• Self-Sanitize is a framework of systems that internally sanitize inputs, outputs, intermediates, and learned parameters to prevent privacy leakage.
• It employs diverse architectural patterns—edge-side, representation-side, and output/model-side sanitization—to balance privacy and operational utility.
• The approach leverages token-level monitoring, dynamic self-repair, and quantified metrics such as ASR reduction and similarity scores for effective privacy risk mitigation.

Self-Sanitize denotes a class of systems that sanitize their own inputs, outputs, intermediate representations, or learned parameters before those artifacts are consumed by an external service, another model, or a downstream application. In the recent LLM literature, the term refers to a framework with a token-level Self-Monitor and an in-place Self-Repair module for privacy-leakage mitigation during streaming generation (Fu et al., 29 Sep 2025). The broader research landscape shows the same design principle across client-side voice privacy, prompt sanitization for agentic LLMs and text-to-image models, distribution-aware text redaction, post-hoc unlearning of memorized terms, and runtime software sanitization (Qian et al., 2017, Geng et al., 13 Nov 2025, Qiu et al., 2024, Gusain et al., 29 Jan 2025, Boutet et al., 24 Oct 2025, Lettner et al., 2017).

1. Conceptual scope and historical lineage

Long before the explicit LLM-era naming, several systems already implemented automatic sanitization at the point where sensitive or dangerous content first became actionable. A social-network privacy framework automatically detected sensitive terms in user publications, constructed sanitized versions, and disclosed progressively more informative variants according to reader credentials (Viejo et al., 2015). VoiceMask placed a trusted sanitizer on the mobile device, transforming speech locally before cloud speech recognition so that the cloud never received the original voice or the original sensitive keywords (Qian et al., 2017). In web security, reverse-proxy and unit-testing approaches similarly inserted sanitization or repair between untrusted input and execution, either by sanitizing requests before they reached the application and database or by detecting and repairing improper output encoding that caused XSS vulnerabilities (Randhe et al., 2013, Mohammadi et al., 2018).

This suggests a broad lineage rather than a single method family. The unifying property is not a particular model class, but a placement strategy: sanitization is performed by the system that handles the artifact, prior to external disclosure, execution, or inference.

2. Recurrent architectural patterns

A first pattern is edge-side sanitization, where privacy transformation occurs on a trusted client device. VoiceMask combines voice conversion with evolution-based keyword substitution on Android, then restores intended text locally after the cloud returns a transcript (Qian et al., 2017). DySan uses an autoencoder-style sanitizer for motion windows and dynamically selects among 36 sanitizing models according to incoming data so that activity recognition remains useful while gender inference is suppressed (Ngueveu et al., 2020).

A second pattern is representation-side sanitization, where systems alter an internal representation rather than the raw string or signal. Embedding Sanitizer for text-to-image generation edits positive prompt embeddings according to

$$\text{Emb}_c = \text{Emb}_s - \alpha \cdot \mathcal{S} \cdot \text{Emb}_t,$$

with token-wise harmfulness scores produced by S-Net and toxic components extracted by E-Net (Qiu et al., 2024). SONAR sanitizes retrieved text for LLMs by building a sentence-level relational graph weighted by entailment and contradiction scores, then pruning suspicious seeds and their connected neighbors (Datta et al., 1 May 2026). PISanitizer deliberately induces instruction following in an auxiliary LLM, reads token attentions from the first generated token, groups high-attention peaks into spans, and deletes the highest-scoring suspicious group before passing the context to the backend model (Geng et al., 13 Nov 2025). SIC applies an LLM-based rewrite loop that masks, rephrases, or removes instruction-like content and halts if residual imperative content remains (Walter et al., 24 Oct 2025).

A third pattern is output- and model-side sanitization. The Self-Sanitize framework itself continuously inspects high-level intentions within the LLM at the token level via representation engineering and performs in-place correction of harmful content without initiating separate review dialogues (Fu et al., 29 Sep 2025). SANI treats memorization as post-training contamination, resetting 50% of the neurons in the last layer and then repairing the model while excluding blacklisted targets from the loss (Boutet et al., 24 Oct 2025). SanitAIs uses unsupervised data augmentation to sanitize Trojaned neural networks without trigger reconstruction, leveraging a supervised plus unsupervised consistency objective during fine-tuning (Karra et al., 2021).

3. Modalities and representative systems

The literature spans multiple objects of sanitization rather than a single medium.

Interface	Sanitized object	Representative systems
Client or edge device	Voice, motion data, social-network text	VoiceMask (Qian et al., 2017); DySan (Ngueveu et al., 2020); social-network semantic sanitization (Viejo et al., 2015)
Prompt or context	Retrieved text, long contexts, prompt embeddings	SONAR (Datta et al., 1 May 2026); PISanitizer (Geng et al., 13 Nov 2025); SIC (Walter et al., 24 Oct 2025); Embedding Sanitizer (Qiu et al., 2024)
Released text or links	Sensitive spans, latent attributes, URL decorations	Distribution-aware redaction (Gusain et al., 29 Jan 2025); INTACT (Pilán et al., 2024); PURL (Munir et al., 2023)
Model internals or execution	Memorized terms, backdoors, runtime behavior	SANI (Boutet et al., 24 Oct 2025); SanitAIs (Karra et al., 2021); PartiSan (Lettner et al., 2017)

Within natural-language sanitization, two distinct paradigms are especially prominent. One treats privacy as distributional indistinguishability between redacted sensitive and safe corpora. In "Improving Privacy Benefits of Redaction" the redacted distributions $\tilde{P}_0$ and $\tilde{P}_1$ are required to satisfy

$$\tilde{P}_0(y) \le e^\epsilon \tilde{P}_1(y) + \delta,\qquad \tilde{P}_1(y) \le e^\epsilon \tilde{P}_0(y) + \delta,$$

and a learned ranker over sentence-transformer embeddings orders content by privacy impact (Gusain et al., 29 Jan 2025). The second paradigm treats sanitization as truth-preserving abstraction. INTACT generates increasingly abstract replacements for a marked span, attacks each candidate with an LLM, and selects the most specific non-risky candidate, falling back to an entity label or placeholder when every candidate remains guessable (Pilán et al., 2024).

At the platform layer, sanitization may target transport artifacts rather than semantic content. PURL sanitizes link decoration by building a cross-layer graph of webpage execution and classifying fine-grained URL decorations as ATS or Non-ATS so that only tracking decorations are removed, not entire requests (Munir et al., 2023). In systems software, the term takes a different but related meaning: sanitizers are dynamic bug-finding tools that monitor actual executions, and PartiSan distributes a single binary containing sanitized and unsanitized function variants, switching among them at run time under an expected-cost policy (Song et al., 2018, Lettner et al., 2017).

4. Formal objectives and evaluation criteria

The field is unified by privacy–utility tradeoffs but not by a single privacy definition. Distribution-aware redaction uses the $(\epsilon,\delta)$-style indistinguishability condition above and optimizes Rényi divergence between redacted sensitive and safe distributions (Gusain et al., 29 Jan 2025). Contrastive Privacy instead evaluates sanitized media by requiring sanitized samples to be closer to sanitized peers than to originals that still contain the protected concept. Its defining inequality is

$$\forall x,y \in \mathbb{X}(\gamma \cap c), \quad \mathcal{D}(\mathcal{X}_c(x), y) + \delta > \mathcal{D}(\mathcal{X}_c(x), \mathcal{X}_c(y)),$$

with resolution $0$ identified as ideal under the paper’s assumptions (Bissias et al., 3 May 2026). INTACT evaluates utility with Text Preserved Similarity and privacy with Text Re-identification Risk, treating candidate selection itself as an inference-attack game over the edited document (Pilán et al., 2024).

Task-specific work uses domain-specific metrics. VoiceMask measures speaker-identification success rate, word accuracy defined as $1-\mathrm{WER}$, keyword-spotting ROC behavior, and realtime coefficient; its abstract reports an 84% reduction in the chance of identifying a user from 50 people while keeping the drop of speech-recognition accuracy within 14.2% (Qian et al., 2017). DySan measures privacy through balanced error rate for sensitive inference, activity-recognition utility, Dynamic Time Warping, and step-count preservation; the paper summarizes its main outcome as a reduction of gender inference from about 98% on raw data to about 57% on sanitized data while activity recognition drops from about 95% to about 92% (Ngueveu et al., 2020).

Prompt and generation defenses also use heterogeneous metrics. Embedding Sanitizer reports Erasure Rate, CLIP Score, and FID, reaching an overall I2P Erasure Rate of 81.91 and adversarial Erasure Rate of 95.04 while moving CLIP/FID from 31.31/25.15 for the base model to 30.22/26.12 under sanitization (Qiu et al., 2024). SONAR measures Attack Success Rate and Task Fidelity, and reports a peak ASR reduction of 97.6% with near-zero ASR on several settings (Datta et al., 1 May 2026). PISanitizer likewise evaluates utility and ASR in long-context settings and reports near-zero ASR with almost unchanged clean utility across several backends (Geng et al., 13 Nov 2025).

5. Limitations, controversies, and failure modes

A central controversy is whether LLM-based sanitization can remain robust under adaptive attack. SONAR argues that detector-based defenses are structurally brittle and reports that DataSentinel can be bypassed by an adaptive GCG suffix with 96.5% overall ASR (Datta et al., 1 May 2026). SIC achieves 0% ASR on its standard AgentDojo attacks, yet its own worst-case analysis shows that a strong adversary can still obtain 15% ASR by embedding non-imperative workflows rather than overt imperative instructions (Walter et al., 24 Oct 2025). PISanitizer is similarly explicit that it is designed for instruction-based prompt injection, not for malicious factual corruption of context that contains no instruction-like token span (Geng et al., 13 Nov 2025).

A second limitation is semantic coverage. VoiceMask protects selected sensitive keywords rather than arbitrary semantics, and the paper notes residual leakage through ambient noise, microphone idiosyncrasies, accent effects, and user-defined keyword coverage (Qian et al., 2017). Distribution-aware redaction requires paired sensitive and safe corpora and does not specify an explicit token-alignment mechanism from ranked embedding dimensions back to exact text spans (Gusain et al., 29 Jan 2025). INTACT depends on prior span detection, candidate ordering by abstraction, and a modeled LLM attacker; it can still produce paraphrases rather than true abstractions and may leak through surrounding context (Pilán et al., 2024). SANI reduces regurgitation sharply, but its forgetting target is a blacklist of words or $n$-grams, and the evaluation remains centered on prediction or generation of designated terms rather than full semantic erasure (Boutet et al., 24 Oct 2025).

A third limitation is deployability versus precision. The SoK on sanitizers shows that stronger referent-aware runtime checking often reduces compatibility with uninstrumented code, while the most deployable tools, such as ASan, retain known blind spots like intra-object overflows and dependence on executed paths (Song et al., 2018). This broader tradeoff recurs across data-sanitization systems: selective, low-overhead sanitization is easier to deploy, but it rarely yields complete guarantees.

6. Contemporary significance

Recent work makes the term explicit in generative AI. Self-Sanitize introduces a lightweight Self-Monitor that inspects high-level intentions at the token level and a Self-Repair module that performs in-place correction of harmful content for privacy-leakage scenarios with negligible impact on latency and resource utilization, according to the abstract (Fu et al., 29 Sep 2025). Around it, the literature shows convergence on four recurring requirements: streaming or online operation, selective rather than wholesale removal, preservation of downstream utility, and modularity with respect to existing systems. Embedding Sanitizer is plug-and-play after the text encoder, PISanitizer can front-end closed-source backends with an auxiliary open model, SANI retrofits already fine-tuned LLMs, and Contrastive Privacy evaluates sanitized corpora independently of the mechanism used (Qiu et al., 2024, Geng et al., 13 Nov 2025, Boutet et al., 24 Oct 2025, Bissias et al., 3 May 2026).

This suggests that Self-Sanitize is evolving into a cross-domain systems pattern rather than a narrowly defined algorithm. In that pattern, a system does not merely receive a sanitization policy from outside; it operationalizes sanitization internally at the point where raw inputs, model states, or generated outputs would otherwise become dangerous. The research record now includes client devices, retrieval pipelines, diffusion conditioning, learned redaction, model unlearning, browser privacy tools, and runtime software instrumentation, all organized around that same structural idea.