Semantic cloaking replaces each confidential value in a text with an informative marker — one that carries the value's meaning for reasoning but not the value itself — before the text leaves the user's device. The AI model receives only the cloaked text and never the underlying value; real values are restored locally for the human operator. Unlike redaction it preserves meaning (so output quality survives); unlike fixed-identifier tokenization it applies to any confidential value, not a list of 18.
Semantic cloaking is a meaning-preserving substitution
Semantic cloaking is the replacement of each confidential value in a text with an informative marker — a stand-in that tells the model what kind of thing was there and how it functions in the sentence, without revealing the value — performed on the user's own device before any text is transmitted to an AI model.
The distinction that matters is value versus meaning:
Original (what you see): "The study evaluated Pembrolizumab in patients with non-small cell lung cancer at Memorial Sloan Kettering. The primary endpoint showed a hazard ratio of 0.68 (95% CI: 0.51–0.89)."
Cloaked (what the model receives): "The study evaluated NSSA_Drug_1 in patients with NSSA_Indication_1 at NSSA_InstitutionalInvestigator. The primary endpoint showed a hazard ratio of SSA_OSHR_POB_SMCID_KVM_CLIN_054 (95% CI: SLC_004431_012–SLC_004532_054)."
This is not "[a price]". Each cloak carries structured information: the name cloaks (NSSA_…) give the drug, indication and site stable identifiers so the model tracks them consistently; the semantic cloak (SSA_…) encodes what the hazard ratiomeans — an effect size, its direction and clinical role — without the number; the sequential cloaks (SLC_…) let the model reference the confidence-interval bounds in the right place and order without ever seeing them. The model reasons fluently; the values were never transmitted. When the answer returns, every cloak is restored to its real value locally, for the operator's eyes only.
The three kinds of cloak
Cloaking is a system, not a single swap. Three cloak types work together, and every datapoint carries a sequential component underneath:
| Cloak | What it does | Example |
|---|---|---|
| Name cloak | Replaces an entity (a name, drug, site, sponsor) with a field-specialized, stable identifier so the AI tracks it consistently across the document. | Pembrolizumab → NSSA_Drug_1 |
| Sequential cloak (SLC) | The always-present layer: a position-aware marker that lets the AI locate, repeat and use each datapoint in context — without the value. Most values (~90%) are cloaked this way. | 0.51 → SLC_004431_012 |
| Semantic cloak (SSA) | Adds a semantic layer on top of the sequential one, encoding the value's strategic meaning. Reserved for the ~10% of key value messages that carry strategic weight. | hazard ratio 0.68 → SSA_OSHR_… |
The practical workflow: you (or VaultAssist) personally cloak the few important variables with semantic cloaks, while automated name-cloaks specialized in your research field and sequential cloaks handle the rest. Every SLC and SSA cloak has a sequential component so the AI can identify and reference each datapoint correctly in its context; semantic cloaks simply carry both a sequential and a semantic aspect. Roughly 90% sequential, 10% semantic is the best mix of protection and efficiency.
How it differs from the alternatives
| Technique | What the model receives | Meaning preserved? | Scope |
|---|---|---|---|
| Redaction / censoring | [REDACTED] or blanks | No — the model reasons about nothing | Anything you mark |
| Tokenization / masking | Opaque tokens (x7Qk) | No — tokens carry no meaning; models often treat them as real words | Usually a fixed list (18 HIPAA identifiers) |
| Differential privacy | Aggregates with statistical noise | N/A — built for datasets, not interactive drafting | Statistical outputs |
| Homomorphic encryption | Ciphertext (computed on without decryption) | N/A — impractical for general-purpose LLM drafting | Encrypted computation |
| Cloaking (name + sequential + semantic) | Structured cloaks (NSSA_Drug_1, SSA_…, SLC_…) that carry identity, meaning and position | Yes — role, meaning and sequence retained | Any confidential value, not a fixed list |
Retained AI writing quality: ~94–98% under semantic cloaking, versus ~37% for censoring-style redaction and ~32% for random crypto-tokenization.
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access,” Zenodo, doi:10.5281/zenodo.21343321. Internal benchmark, 30 tests per technique.
Why the meaning-vs-value split is the whole point
Every other method forces a trade between protection and usefulness: hide enough to be safe and the model goes blind; reveal enough to be useful and you've disclosed the secret. Semantic cloaking breaks the trade because an AI drafting task rarely needs the literal value — it needs to know there is a launch price and a response rate, and how they relate. Withholding the digits while keeping the roles is usually invisible to the quality of the output and total to the protection of the value.
It also means the protection isn't bounded by a list. Fixed-identifier approaches protect what someone enumerated in advance; a pricing assumption or an unpublished endpoint isn't on the HIPAA-18 list, so those tools sail it straight through. Semantic cloaking targets confidential meaning wherever it appears, which is what NDA-bound and trade-secret work actually requires.
Frequently asked questions
What is semantic cloaking?
Semantic cloaking is a technique that replaces each confidential value in a text with an informative marker — one that preserves the value's meaning and role for reasoning — before the text leaves the user's device. The AI model receives only the cloaked text and never the underlying value; the real values are restored locally, for the human operator only.
How is semantic cloaking different from redaction?
Redaction removes information — it replaces a value with [REDACTED] or a black box, leaving the model nothing to reason about, so output quality collapses. Semantic cloaking removes the value but keeps an informative flag encoding what the value means and how it functions — so the model can still reason about the document while the specific confidential value is never sent.
What is the difference between sequential and semantic cloaking?
They are two cloak types in the same system. Every datapoint carries a sequential component (SLC) — a stable, position-aware marker that lets the AI locate, repeat and reference the value consistently across the document without knowing it. Semantic cloaks (SSA) add a semantic component on top of the sequential one, encoding the value's strategic meaning (for example, that a price is a premium launch price). In practice users cloak roughly 90% of values sequentially and reserve semantic cloaks for the ~10% of key value messages that carry strategic meaning — the best mix of protection and efficiency.
How is it different from tokenization or masking?
Fixed-identifier tokenization and masking target a defined list — typically the 18 HIPAA identifiers — and swap them for opaque tokens (x7Qk) that carry no meaning. Semantic cloaking applies to any confidential value, not a fixed list, and its markers are informative rather than opaque, which is why AI output quality survives.
Is semantic cloaking the same as differential privacy or homomorphic encryption?
No. Differential privacy adds statistical noise to protect individuals in aggregate datasets; homomorphic encryption lets computation run on encrypted data. Both are powerful for their use cases but don't fit interactive drafting with a general-purpose LLM. Semantic cloaking is a text-transformation applied before a normal model call — no noise, no special model, no encryption math on the model side.
Does semantic cloaking reduce AI quality?
Far less than the alternatives. Because the markers preserve meaning, internal benchmarks measured roughly 94–98% of baseline writing quality retained under semantic cloaking (Tremblay & Harricharan, 2026), versus about 37% for censoring-style redaction and 32% for random tokenization.
Work with AI on data you can't share with it.
Untraceable cloaks confidential values on your computer before any AI model sees the text — the model never receives the secret at all.