ML Security PapersWhen Privacy Meets Recovery: The Overlooked Half of Surrogate-Driven Privacy Preservation for MLLM Editing
Siyuan Xu 1, Yibing Liu 1, Peilin Chen 1, Yung-Hui Li 2, Shiqi Wang 1, Sam Kwong 3
Published on arXiv
2512.07166
Sensitive Information Disclosure
OWASP LLM Top 10 — LLM06
Key Finding
SOER generalizes across diverse visual content and editing tasks on SPPE-Bench and InstructPix2Pix, achieving strong edit fidelity while ensuring private content is never exposed to the cloud MLLM service.
SOER (Surrogate-to-Original Editable Recovery)
Novel technique introduced
Privacy leakage in Multimodal Large Language Models (MLLMs) has long been an intractable problem. Existing studies, though effectively obscure private information in MLLMs, often overlook the evaluation of the authenticity and recovery quality of user privacy. To this end, this work uniquely focuses on the critical challenge of how to restore surrogate-driven protected data in diverse MLLM scenarios. We first bridge this research gap by contributing the SPPE (Surrogate Privacy Protected Editable) dataset, which includes a wide range of privacy categories and user instructions to simulate real MLLM applications. This dataset offers protected surrogates alongside their various MLLM-edited versions, thus enabling the direct assessment of privacy recovery quality. By formulating privacy recovery as a guided generation task conditioned on complementary multimodal signals, we further introduce a unified approach that reliably reconstructs private content while preserving the fidelity of MLLM-generated edits. The experiments on both SPPE and InstructPix2Pix further show that our approach generalizes well across diverse visual content and editing tasks, achieving a strong balance between privacy protection and MLLM usability.
Key Contributions
- SPPE-Bench: first benchmark dataset explicitly designed to evaluate edit fidelity and privacy recovery quality under surrogate-based MLLM privacy protection, covering diverse privacy-sensitive categories and editing instructions
- SOER (Surrogate-to-Original Editable Recovery): a Diffusion Transformer framework that reconstructs MLLM-style edits on original images using surrogate-edited outputs as semantic references, without ever exposing private content to the cloud MLLM
- Formulation of privacy recovery as a guided multimodal generation task, achieving strong balance between privacy preservation and MLLM usability across diverse visual content and editing tasks