Untraceable developed advanced cloaking, which includes both semantic and sequential components to the cloak, but also rapid cloaking, which only includes a sequential component. Cloaking replaces each confidential and sensitive value in a text with informative markers which carry meaning-preserving flags, helping the AI reason about and contextualize the value without seeing the value itself. This all happens before the text leaves the user's device. The AI model receives only the cloaked text and never the underlying value, and real values are restored locally for the human operator. Unlike redaction, rapid and advanced cloaking preserve meaning (so output quality survives), which can generate much better writing benchmark results than fixed-identifier tokenization and redaction.
Advanced (semantic) cloaking is a meaning-preserving substitution
Advanced cloaking is the replacement of each confidential value in a text with informative markers and a sequential marker. The semantic markers tell the model what kind of data and endpoint we are speaking of, the importance of the datapoint, its direction and amplitude, and the category of data we are referring to. This is solidly helping the AI to contextualize and position the value within the documents and the reports (a dossier, for example), all of this without revealing the value, and all performed on the user's own device before any text is transmitted to an AI model.
The sequential component is helping the AI determine the location of the value, the number of repeats and occurrences, and to understand the context by validating all the occurrences and surrounding context in the document. The cumulation of both semantic and sequential markers is the most performing approach, but we truly recommend to use rapid cloaking (only sequential markers) for the large majority of sensitive values, and only generate advanced cloaking for key value drivers and critical datapoints, since advanced cloaking will require more human oversight. In the meantime, the benefit far outweighs the human factor for critical datapoints, such as price, ICER, key clinical outcomes (such as response rate), primary endpoints and TPP.
The distinction that matters is value versus meaning:
Original, what you see
Pembrolizumab lowered mortality with a hazard ratio of 0.68 (95% CI: 0.51–0.89)
The drug, the ratio and both bounds are the client's confidential result. They stay on your device.
Cloaked, what the model receives
NSSA_Drug_1 lowered mortality with a hazard ratio of SSA_0144_CLIN_HR_SIG+MCRD_KVM (95% CI: SLC_0165–SLC_0166)
Same sentence, same structure, no value. This is what leaves the device.
This is not "[a price]". Each cloak carries structured information: the name cloaks (NSSA_…) give the drug, indication and site stable identifiers so the model tracks them consistently; the semantic cloak (SSA_…) encodes what the hazard ratio means, an effect size, its direction and clinical role, without the number; the sequential cloaks (SLC_…) let the model reference the confidence-interval bounds in the right place and order without ever seeing them. The model reasons fluently; the values were never transmitted. When the answer returns, every cloak is restored to its real value locally, for the operator's eyes only.
Why it works: the model reasons from constraints, not values
A language model resolves meaning by narrowing probability. Semantic flags declare what a value is; sequential identity keeps the same token stable everywhere it appears. Important values repeat most, so they accumulate the most constraint, and the model's certainty rises with them.
One sentence in
NSSA_Drug_1 lowered mortality with a hazard ratio of SSA_0144_CLIN_HR_SIG+MCRD_KVM (95% CI: SLC_0165–SLC_0166)
What the model already knows
- Drug_1 is the anchor of the analysis
- SSA_0144 is a hazard ratio, statistically significant
- It meets MCID, so it sits below 0.8
- It is a key value message, so it must recur in the narrative
- SLC_0166 is the upper CI, below 1
- SLC_0165 is the lower CI, below 0.8
Full document in, context accumulates
In the base-case analysis, NSSA_Drug_1 lowered mortality with a hazard ratio of SSA_0144_CLIN_HR_SIG+MCRD_KVM (95% CI: SLC_0165–SLC_0166) relative to the comparator arm. … The relevant active comparator, NSSA_Drug_2, was significant in its own submission and is statistically inferior to SSA_0144, reporting a published hazard ratio of 0.88 (0.77–0.96). … Among newer entrants, NSSA_Drug_3 represents the best novel treatment in the indication, a stem cell treatment granted FDA approval with a hazard ratio of 0.5 (0.38–0.64), although the indirect treatment comparison does not demonstrate a statistically significant advantage over SSA_0144.
Where the model now places each token
- SSA_0144
- 0.37–0.68 certain · 0.44–0.62 plausible on log-scale standard errors
- SLC_0165
- 0.30–0.60 certain · modal position around 0.44
- SLC_0166
- 0.55–0.78 certain · modal position around 0.64
Enough certainty to write correctly. Never enough to resolve the value: the interval narrows, it cannot be back-engineered, neither by an AI nor by a human.
The three kinds of cloak
Cloaking is a system that requires more than one type of substitution. Three cloak types work together, and every datapoint carries a sequential component underneath:
| Cloak | What it does | Example |
|---|---|---|
| Name cloak | Replaces an entity (a name, drug, site, sponsor) with a field-specialized, stable identifier so the AI tracks it consistently across the document. | Pembrolizumab → NSSA_Drug_1 |
| Sequential cloak (SLC) | The always-present layer: a position-aware marker that lets the AI locate, repeat and use each datapoint in context, without the value. Most values, roughly 95%, are cloaked this way. | 0.51 → SLC_0165 |
| Semantic cloak (SSA) | Adds a semantic layer on top of the sequential one, encoding the value's strategic meaning. Reserved for the ~5% of key value messages that carry strategic weight. | hazard ratio 0.68 → SSA_0144_CLIN_HR_SIG+MCRD_KVM |
The practical workflow: you (or VaultAssist) personally cloak the few important variables with semantic cloaks, while automated name-cloaks specialized in your research field and sequential cloaks handle the rest. Every SLC and SSA cloak has a sequential component so the AI can identify and reference each datapoint correctly in its context; semantic cloaks simply carry both a sequential and a semantic aspect. For numeric and alphanumeric values, roughly 95% sequential and 5% semantic is the best mix of protection and efficiency, whereas alphabetic sensitive values (names, companies, institutions and the like) will all get a name cloak, which includes a sequential component.
How it differs from the alternatives
| Technique | What the model receives | Meaning preserved? | Scope |
|---|---|---|---|
| Redaction / censoring | [REDACTED] or blanks | No, the model reasons about nothing | Anything you mark |
| Tokenization / masking | Opaque tokens (x7Qk) | No, tokens carry no meaning; models often treat them as real words | Usually a fixed list (18 HIPAA identifiers) |
| Differential privacy | Aggregates with statistical noise | N/A, built for datasets, not interactive drafting | Statistical outputs |
| Homomorphic encryption | Ciphertext (computed on without decryption) | N/A, currently impractical for general-purpose LLM drafting | Encrypted computation |
| Cloaking (name + sequential + semantic) | Structured cloaks (NSSA_Drug_1, SSA_…, SLC_…) that carry identity, meaning and position | Yes, role, meaning and sequence retained | Any confidential value, not a fixed list |
Retained AI writing quality, as a share of baseline: ~94–98% under semantic cloaking, versus ~37% for censoring-style redaction and ~32% for random crypto-tokenization.
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access,” Zenodo, doi:10.5281/zenodo.21343321. Internal benchmark, 30 tests per technique, rebalanced out of the study’s 96/100 baseline. The ~37% and ~32% de-identification figures are provisional pending publication of the per-condition data.
Why the meaning-vs-value split is the whole point
Every other method forces a trade between protection and usefulness: hide enough to be safe and the model goes blind. If you reveal enough to be useful, then you have disclosed the secret. Semantic cloaking breaks the trade because an AI drafting task rarely needs the literal value, it needs to know there is a launch price and a response rate, and how they relate. Withholding the digits while keeping the roles is usually invisible to the quality of the output and total to the protection of the value.
It also means the protection isn't bounded by a list. Fixed-identifier approaches protect what someone enumerated in advance, but a pricing assumption or an unpublished endpoint isn't on the HIPAA-18 list, so they won't get caught in time. Semantic cloaking targets confidential and sensitive meaning wherever it appears, which is what NDA-bound and trade-secret work actually requires.
Frequently asked questions
What is semantic cloaking?
Semantic cloaking is a technique that replaces each confidential value in a text with an informative marker, one that preserves the value's meaning and role for reasoning. This transformation happens before the text leaves the user's device. The AI model receives only the cloaked text and never the underlying value. The real values are restored locally, for the human operator only.
How is semantic cloaking different from redaction?
Redaction removes information, since it replaces a value with [REDACTED] or a black box, leaving the model nothing to reason about. The output quality collapses when important variables are redacted, and sensitive values and secrets are typically very important to the narrative. Semantic cloaking removes the value but keeps an informative flag encoding what the value means and how to contextualize it in the text, so the model can still reason about the document while the specific confidential value is never sent.
What is the difference between rapid (sequential) and advanced (semantic) cloaking?
They are two cloak types in the same system. Every datapoint carries a sequential component (SLC), which is a stable, position-aware marker that lets the AI locate, repeat and reference the value consistently across the document without knowing it. Semantic cloaks (SSA) add a semantic component on top of the sequential one, encoding the value's strategic meaning (for example, that a price is a premium launch price). In practice users cloak roughly 95% of values sequentially and reserve semantic cloaks for the ~5% of key value messages that carry strategic meaning, the best mix of protection and efficiency.
How is it different from tokenization or masking?
Fixed-identifier tokenization and masking target a defined list, which typically includes the 18 HIPAA identifiers, and swap them for opaque tokens (x7Qk) that carry no meaning. Semantic cloaking applies to any confidential value, not a fixed list, and its markers are informative rather than opaque, which is why AI output quality survives.
Is semantic cloaking the same as differential privacy or homomorphic encryption?
No. Differential privacy adds statistical noise to protect individuals in aggregate datasets, where homomorphic encryption lets computation run on encrypted data. Both are powerful for their use cases but do not fit interactive drafting with a general-purpose LLM. Semantic cloaking is a text transformation applied before a normal model call, avoiding noise and hallucination at all cost: no special model, no advanced computation, and no encryption math on the model side.
Does semantic cloaking reduce AI quality?
Far less than the alternatives. Because the markers preserve meaning, internal benchmarks measured roughly 94 to 98% of baseline writing quality retained under semantic cloaking (Tremblay & Harricharan, 2026), versus about 37% for censoring-style redaction and 32% for random tokenization. The ~37% and ~32% de-identification figures are provisional and the data is not yet published.
About the author
Gabriel Tremblay, DBA, Founder & CEO, Untraceable. Gabriel holds a doctorate in business administration (DBA) specialising in decision-making, and has published health economics and outcomes research on de-identification, cloaking methods and AI writing quality. Publications and DOIs are listed on the publications page.
This guide is general information about how AI tools interact with confidentiality obligations. It is not legal advice, and it does not create any professional relationship. Confidentiality agreements vary, so review your own agreements with qualified counsel before relying on any framework described here.
Work with AI on data you can't share with it.
Untraceable cloaks confidential values on your computer before any AI model sees the text. The model never receives the secret at all.