Noisegate: Differential-Privacy Gateway for Untrusted AI Agents (2026)

Date: August 2, 2026

Repository: yashmahajan10/llm-differential-privacy-gateway (Apache-2.0)

Stack: Python 3.13+, DuckDB, FastAPI, Streamlit, MCP SDK, Docker

1. Executive Summary & Core Premise

Noisegate is an open-source differential-privacy (DP) gateway and Model Context Protocol (MCP) server that sits between an untrusted AI agent (e.g. Claude Desktop, subagents) and sensitive corporate databases.

The core architectural principle of Noisegate is that privacy guarantees cannot depend on the LLM being trustworthy. Even if an LLM is prompt-injected, goal-hijacked, or hostile, mathematical enforcement below the model layer prevents the exfiltration or singling out of individual records.

2. Three-Stage Trusted/Untrusted Architecture

  Natural Language Question
            │
            ▼
  ┌───────────────────┐
  │   LLM Compiler    │   UNTRUSTED: Emits a CONSTRAINED QUERY AST (not free SQL)
  │   (Model Layer)   │   via schema-forced output.
  └───────────────────┘
            │  Query AST
            ▼
  ┌───────────────────┐
  │   Validation /    │   TRUSTED: Enforces policy rules (allowed columns,
  │   Guardrail Layer │   aggregates only, range bounds, cardinality caps).
  └───────────────────┘
            │  Validated AST
            ▼
  ┌───────────────────┐
  │  Privacy Engine   │   TRUSTED: Clamps sensitivity, adds calibrated Laplace
  │  (Zero-Egress)    │   noise, decrements persistent budget.
  └───────────────────┘
            │
            ▼
  Noisy Answer + Confidence Interval + Remaining Budget Balance

Key Controls:

• Constrained AST vs. Free SQL: The LLM NEVER generates raw SQL. It emits a constrained Query AST, strictly bounding query sensitivity and closing the prompt-injection SQL attack surface.
• Calibrated Laplace Noise: Built-in noise sampler cross-checked against OpenDP (industry reference certified to $10^{-9}$ precision).
• Persistent Budget Accounting: Tracks cumulative $(\epsilon, \delta)$-DP consumption using zero-concentrated differential privacy (zCDP) composition. When the budget is depleted, the gate returns a hard Refusal rather than a quieter or un-noised answer.

3. Pinned Attack Gallery (CI-Verified Defenses)

Noisegate ships with an active attack gallery pinned in its CI test suite to guarantee defenses do not rot over time:

1. Differencing Attack:

- Attack Vector: Asking Query A (total of 100 people) and Query B (total of 99 people excluding Alice) to compute $A - B = \text{Alice's value}$.

- Defense: Calibrated Laplace noise on each aggregate swamps the subtraction ($S/N \approx 0.13$), and the budget accountant charges for disclosure across both queries.

2. Membership Inference Attack:

- Attack Vector: Determining whether a specific person exists in a sensitive dataset.

- Defense: At $\epsilon = 0.05$ per query, attacker success rate collapses down to a random 0.5 coin flip.

3. Singling Out by Re-identification (Sweeney Attack):

- Attack Vector: Using demographic attributes (ZIP, birth date, sex) to isolate a single record ("Alice").

- Defense: The trust boundary filter rejects narrow sub-group queries outright before execution, saving budget.

4. Strategic Alignment with Sentinel Integrations (SI)

• Pillar I (Agentic Zero-Trust Controls): Noisegate demonstrates the exact "Trust Boundary Below the Model" pattern required for Guardian Agents.
• Pillar II (Sovereign Legacy-to-Agent Gateway - SLAG): Validates using constrained AST schemas to query sensitive legacy databases (e.g. Workday) rather than granting raw SQL access to LLMs.
• MCP Native Integration: Implemented natively as an MCP stdio server, making it directly consumable by Hermes and Claude Desktop environments via mcp_servers configuration.