A new privacy scheme for AI prompts doesn't hide your words. It replaces them with different ones entirely, then swaps the real meaning back in after the model responds.
The framework, called CROSS-MAP, comes from a paper posted to arXiv this week. It targets a specific problem: when you send a prompt to an LLM API, the provider sees the raw text, and privacy tricks that just tweak or redact that text still leave enough clues for someone to reconstruct the original. CROSS-MAP instead maps your input into a different semantic domain before it ever reaches the model, then recovers the intended output on your end afterward. A local model handles both directions, trained to make the swapped version as semantically distant from the original as possible while keeping the underlying structure the reasoning model needs intact - and trained separately to make sure the recovery step doesn't lose meaning along the way. The researchers report it cuts down successful reconstruction attempts across several attack scenarios while still beating existing privacy baselines on task performance.
This matters because most privacy add-ons for LLMs trade off usefulness for protection - anonymize too aggressively and the model's answers get worse. CROSS-MAP's pitch is that separating "structure" from "meaning" lets you keep both, since the cloud model still gets something it can reason over even though it's not your actual content.
It's a preprint, not a shipped product, and "reduces reconstruction success" is not the same as "reconstruction-proof" - worth watching how it holds up once someone tries to break it in production.