@inproceedings{yang-etal-2026-guardianagent,
title = "{G}uardian{A}gent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation",
author = "Yang, Ruiyi and
Lihinikaduarachchi, Gayathri and
Masood, Rahat and
Salim, Flora D. and
Kanhere, Salil S.",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1729/",
pages = "36968--36984",
ISBN = "979-8-89176-462-0",
abstract = "Privacy protection for live web traffic requires more than detecting private spans. Agent-based privacy protection systems must determine whether an outgoing action complies with the destination site{'}s privacy policy, then apply only the level of rewriting or sanitisation justified by the residual disclosure risk. We present **GuardianAgent**, a policy-conditioned anonymization framework that couples structured risk assessment with verified adaptive rewriting. GuardianAgent computes risk through **AMRSF** (*Adaptive Multi-factor Risk Scoring Formula*), an explicit controller that combines policy-violation likelihood with data sensitivity, recipient transmission, purpose legitimacy, contextual basis, and policy transparency, rather than relying on an LLM to assign risk directly. This risk score determines both the allow/transform/deny decision and the initial anonymization level. For efficiency, GuardianAgent uses an evidential fast path for low-uncertainty policy matches and invokes an LLM slow path only for uncertain cases. For rewriting, it applies a **five-level hierarchy** driven by a **verified adversarial guesser**: guesses trigger escalation only when supported by the original text, preventing hallucinated attacker confidence from causing unnecessary over-anonymization. Experiments across three benchmarks spanning legal text (*TAB*), Reddit posts (*SynthPAI*), and multi-format synthetic PII records (*PII-Masking-300k*) show that GuardianAgent achieves the strongest privacy{--}utility trade-off among published baselines and is the only method to reach {\ensuremath{\geq}} 0.90 privacy in all three domains, remaining robust under a backbone switch. Action-context stress tests further show that the same outgoing text receives different decisions and anonymization strengths under different recipients, purposes, action bases, and policy-transparency conditions."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="yang-etal-2026-guardianagent">
<titleInfo>
<title>GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation</title>
</titleInfo>
<name type="personal">
<namePart type="given">Ruiyi</namePart>
<namePart type="family">Yang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Gayathri</namePart>
<namePart type="family">Lihinikaduarachchi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Rahat</namePart>
<namePart type="family">Masood</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Flora</namePart>
<namePart type="given">D</namePart>
<namePart type="family">Salim</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Salil</namePart>
<namePart type="given">S</namePart>
<namePart type="family">Kanhere</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Privacy protection for live web traffic requires more than detecting private spans. Agent-based privacy protection systems must determine whether an outgoing action complies with the destination site’s privacy policy, then apply only the level of rewriting or sanitisation justified by the residual disclosure risk. We present **GuardianAgent**, a policy-conditioned anonymization framework that couples structured risk assessment with verified adaptive rewriting. GuardianAgent computes risk through **AMRSF** (*Adaptive Multi-factor Risk Scoring Formula*), an explicit controller that combines policy-violation likelihood with data sensitivity, recipient transmission, purpose legitimacy, contextual basis, and policy transparency, rather than relying on an LLM to assign risk directly. This risk score determines both the allow/transform/deny decision and the initial anonymization level. For efficiency, GuardianAgent uses an evidential fast path for low-uncertainty policy matches and invokes an LLM slow path only for uncertain cases. For rewriting, it applies a **five-level hierarchy** driven by a **verified adversarial guesser**: guesses trigger escalation only when supported by the original text, preventing hallucinated attacker confidence from causing unnecessary over-anonymization. Experiments across three benchmarks spanning legal text (*TAB*), Reddit posts (*SynthPAI*), and multi-format synthetic PII records (*PII-Masking-300k*) show that GuardianAgent achieves the strongest privacy–utility trade-off among published baselines and is the only method to reach \ensuremath\geq 0.90 privacy in all three domains, remaining robust under a backbone switch. Action-context stress tests further show that the same outgoing text receives different decisions and anonymization strengths under different recipients, purposes, action bases, and policy-transparency conditions.</abstract>
<identifier type="citekey">yang-etal-2026-guardianagent</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1729/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>36968</start>
<end>36984</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation
%A Yang, Ruiyi
%A Lihinikaduarachchi, Gayathri
%A Masood, Rahat
%A Salim, Flora D.
%A Kanhere, Salil S.
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F yang-etal-2026-guardianagent
%X Privacy protection for live web traffic requires more than detecting private spans. Agent-based privacy protection systems must determine whether an outgoing action complies with the destination site’s privacy policy, then apply only the level of rewriting or sanitisation justified by the residual disclosure risk. We present **GuardianAgent**, a policy-conditioned anonymization framework that couples structured risk assessment with verified adaptive rewriting. GuardianAgent computes risk through **AMRSF** (*Adaptive Multi-factor Risk Scoring Formula*), an explicit controller that combines policy-violation likelihood with data sensitivity, recipient transmission, purpose legitimacy, contextual basis, and policy transparency, rather than relying on an LLM to assign risk directly. This risk score determines both the allow/transform/deny decision and the initial anonymization level. For efficiency, GuardianAgent uses an evidential fast path for low-uncertainty policy matches and invokes an LLM slow path only for uncertain cases. For rewriting, it applies a **five-level hierarchy** driven by a **verified adversarial guesser**: guesses trigger escalation only when supported by the original text, preventing hallucinated attacker confidence from causing unnecessary over-anonymization. Experiments across three benchmarks spanning legal text (*TAB*), Reddit posts (*SynthPAI*), and multi-format synthetic PII records (*PII-Masking-300k*) show that GuardianAgent achieves the strongest privacy–utility trade-off among published baselines and is the only method to reach \ensuremath\geq 0.90 privacy in all three domains, remaining robust under a backbone switch. Action-context stress tests further show that the same outgoing text receives different decisions and anonymization strengths under different recipients, purposes, action bases, and policy-transparency conditions.
%U https://aclanthology.org/2026.findings-emnlp.1729/
%P 36968-36984
Markdown (Informal)
[GuardianAgent: Policy-Conditioned Risk-Adaptive Anonymization with Verified Adversarial Escalation](https://aclanthology.org/2026.findings-emnlp.1729/) (Yang et al., Findings 2026)
ACL