{"id":295,"date":"2026-08-22T21:11:38","date_gmt":"2026-08-22T13:11:38","guid":{"rendered":"https:\/\/www.ydcyang.top\/index.php\/llm-privacy-proxy\/"},"modified":"2026-08-23T08:32:11","modified_gmt":"2026-08-23T00:32:11","slug":"llm-privacy-proxy","status":"publish","type":"page","link":"https:\/\/www.ydcyang.top\/index.php\/llm-privacy-proxy\/","title":{"rendered":"LLM Privacy Proxy\uff08\u5927\u8bed\u8a00\u6a21\u578b\u9690\u79c1\u4ee3\u7406\u7f51\u5173\uff09"},"content":{"rendered":"<h1>LLM Privacy Proxy\uff08\u5927\u8bed\u8a00\u6a21\u578b\u9690\u79c1\u4ee3\u7406\u7f51\u5173\uff09<\/h1>\n<p><strong>LLM Privacy Proxy<\/strong> is a lightweight control plane that places a privacy and governance boundary between applications and large language models. It preserves an OpenAI-compatible interface while masking sensitive data before it leaves your environment.<\/p>\n<h2>Why a Privacy Gateway Matters\uff08\u4e3a\u4ec0\u4e48\u9700\u8981\u9690\u79c1\u7f51\u5173\uff09<\/h2>\n<p>Production AI adoption is also a data-boundary problem. Applications may send email addresses, phone numbers, national IDs, bank cards, or domain-specific identifiers to an upstream provider. This gateway makes the boundary explicit and enforceable: authenticate the client, mask sensitive values, call the model, restore the response, and record lightweight audit metadata.<\/p>\n<h2>Architecture\uff08\u7cfb\u7edf\u67b6\u6784\uff09<\/h2>\n<p>The gateway creates a controlled privacy boundary between the client and the upstream model. Sensitive values are masked before transmission and restored only after the response returns to the gateway.<\/p>\n<pre class=\"mermaid\">sequenceDiagram\n    participant Client as OpenAI SDK \/ Client\n    participant Gateway as Privacy Gateway\n    participant Audit as SQLite Audit DB\n    participant LLM as Upstream LLM Provider\n\n    Client-&gt;&gt;Gateway: POST \/v1\/chat\/completions + Bearer token\n    Gateway-&gt;&gt;Gateway: Validate proxy key\n    Gateway-&gt;&gt;Gateway: Detect and replace PII\n    Gateway-&gt;&gt;LLM: Send masked prompt\n    LLM--&gt;&gt;Gateway: Return model response\n    Gateway-&gt;&gt;Gateway: Restore masked values\n    Gateway--&gt;&gt;Client: Return OpenAI-compatible response\n    Gateway--&gt;&gt;Audit: Write async request metadata<\/pre>\n<p><strong>Data boundary:<\/strong> the upstream provider receives the masked prompt; the original sensitive values remain inside the gateway&#8217;s request-scoped masking session.<\/p>\n<details>\n<summary>Mermaid Source\uff08\u67b6\u6784\u56fe\u6e90\u7801\uff09<\/summary>\n<pre><code>sequenceDiagram\n    participant Client as OpenAI SDK \/ Client\n    participant Gateway as Privacy Gateway\n    participant Audit as SQLite Audit DB\n    participant LLM as Upstream LLM Provider\n\n    Client-&gt;&gt;Gateway: POST \/v1\/chat\/completions + Bearer token\n    Gateway-&gt;&gt;Gateway: Validate proxy key\n    Gateway-&gt;&gt;Gateway: Detect and replace PII\n    Gateway-&gt;&gt;LLM: Send masked prompt\n    LLM--&gt;&gt;Gateway: Return model response\n    Gateway-&gt;&gt;Gateway: Restore masked values\n    Gateway--&gt;&gt;Client: Return OpenAI-compatible response\n    Gateway--&gt;&gt;Audit: Write async request metadata<\/code><\/pre>\n<\/details>\n<h2>Core Features\uff08\u6838\u5fc3\u529f\u80fd\uff09<\/h2>\n<ul>\n<li><strong>OpenAI-compatible endpoint:<\/strong> existing clients can call <code>\/v1\/chat\/completions<\/code> with minimal changes.<\/li>\n<li><strong>Request-scoped PII masking:<\/strong> email, phone, national ID, bank card, and patient identifiers are replaced with temporary placeholders.<\/li>\n<li><strong>Response restoration:<\/strong> placeholders are restored only within the same request session.<\/li>\n<li><strong>Bearer authentication:<\/strong> a valid proxy token is required before model invocation.<\/li>\n<li><strong>SQLite audit trail:<\/strong> request time, proxy identity, resolved model, and masked-item count are recorded asynchronously.<\/li>\n<li><strong>Private deployment:<\/strong> run locally, inside a controlled network, or as a containerized service.<\/li>\n<\/ul>\n<h2>Request Lifecycle\uff08\u8bf7\u6c42\u751f\u547d\u5468\u671f\uff09<\/h2>\n<ol>\n<li>The client sends a chat request with a Bearer token.<\/li>\n<li>The gateway validates the request and creates an isolated masking session.<\/li>\n<li>Supported identifiers are replaced with placeholders before transmission.<\/li>\n<li>The masked payload is forwarded to the configured provider.<\/li>\n<li>The response is restored and returned in an OpenAI-compatible shape.<\/li>\n<li>Non-content audit metadata is written asynchronously to SQLite.<\/li>\n<\/ol>\n<h2>Technology Stack\uff08\u6280\u672f\u6808\uff09<\/h2>\n<p><strong>Backend:<\/strong> FastAPI and Python<br \/><strong>Provider:<\/strong> Gemini API through a provider abstraction<br \/><strong>Storage:<\/strong> SQLite<br \/><strong>Deployment:<\/strong> Docker Compose<\/p>\n<h2>Quick Start\uff08\u5feb\u901f\u5f00\u59cb\uff09<\/h2>\n<pre><code>cp .env.example .env\n# Set GEMINI_API_KEY and PROXY_KEY in .env\ndocker compose up --build -d<\/code><\/pre>\n<p>The service exposes <code>\/health<\/code> for health checks and <code>\/docs<\/code> for interactive API documentation.<\/p>\n<h2>API Example\uff08\u63a5\u53e3\u793a\u4f8b\uff09<\/h2>\n<pre><code>curl http:\/\/localhost:8000\/v1\/chat\/completions \n  -H \"Content-Type: application\/json\" \n  -H \"Authorization: Bearer sk-proxy-client-001\" \n  -d '{\n    \"model\": \"gemini-3.6-flash\",\n    \"messages\": [{\"role\": \"user\", \"content\": \"Please review this text.\"}]\n  }'<\/code><\/pre>\n<h2>Security Boundary\uff08\u5b89\u5168\u8fb9\u754c\uff09<\/h2>\n<p>The gateway reduces accidental exposure, but it is not a complete compliance system by itself. Production deployments should replace the shared-key mechanism with an identity provider, rotate secrets through a secret manager, define audit retention policies, restrict network egress, and expand PII detection for the target regulatory and business context.<\/p>\n<h2>Repository\uff08\u4ee3\u7801\u4ed3\u5e93\uff09<\/h2>\n<p><a href=\"https:\/\/github.com\/cyH2001\/llm-privacy-proxy\" target=\"_blank\" rel=\"noopener nofollow\">View the source code on GitHub\uff08\u5728 GitHub \u67e5\u770b\u6e90\u4ee3\u7801\uff09<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>LLM Privacy Proxy\uff08\u5927\u8bed\u8a00\u6a21\u578b\u9690\u79c1\u4ee3\u7406\u7f51\u5173\uff09 LLM Privacy Proxy is a l [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-295","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.ydcyang.top\/index.php\/wp-json\/wp\/v2\/pages\/295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ydcyang.top\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.ydcyang.top\/index.php\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ydcyang.top\/index.php\/wp-json\/wp\/v2\/comments?post=295"}],"version-history":[{"count":4,"href":"https:\/\/www.ydcyang.top\/index.php\/wp-json\/wp\/v2\/pages\/295\/revisions"}],"predecessor-version":[{"id":305,"href":"https:\/\/www.ydcyang.top\/index.php\/wp-json\/wp\/v2\/pages\/295\/revisions\/305"}],"wp:attachment":[{"href":"https:\/\/www.ydcyang.top\/index.php\/wp-json\/wp\/v2\/media?parent=295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}