ProxyGPT: Enabling User Anonymity in LLM Chatbots via (Un)Trustworthy Volunteer Proxies

TL;DR

ProxyGPT introduces a practical proxy-based system that enables user anonymity in LLM chatbots by leveraging browser interaction proxies, integrity audits, prompt guards, and an incentivized economy, ensuring privacy without significant performance overhead.

Contribution

This work presents the first comprehensive proxy-based framework for privacy-preserving AI chatbots, combining web proof protocols, prompt guards, and economic incentives to enhance user privacy and system practicality.

Findings

Chat requests take only a few seconds longer on average.

ProxyGPT effectively prevents malicious proxies through web proof protocols.

The system demonstrates practical user anonymity in real-world chatbot interactions.

Abstract

Popular large language model (LLM) chatbots such as ChatGPT and Claude require users to create an account with an email or a phone number before allowing full access to their services. This practice ties users' personally identifiable information (PII) to their sensitive conversational data, thus posing significant privacy risks. Unfortunately, existing private LLM solutions based on cryptography or trusted execution environments (TEEs) remain unpopular due to their prohibitive computational expense and platform restrictions. To enable practical user anonymity in LLM chatbots, we propose ProxyGPT, a privacy-enhancing system that leverages browser interaction proxies to submit user queries on their behalf. Unlike traditional proxy systems, ProxyGPT operates at the "user" layer by proxying user interactions with the browser in identity-required environments, thus easily supporting a wide range of chatbot services. We prevent malicious proxies by performing regular integrity audits using modern web proof protocols for TLS data provenance. We further utilize state-of-the-art LLM prompt guards on the proxy's side to mitigate unwanted user requests. Additionally, we incorporate a give-and-take economy based on Chaum's blind-signature e-cash to incentivize ProxyGPT users to proxy for others. Our system evaluation and user study demonstrate the practicality of our approach, as each chat request only takes a few additional seconds on average to fully complete. To the best of our knowledge, ProxyGPT is the first comprehensive proxy-based solution for privacy-preserving AI chatbots.