# Addressing Labelled Data Scarcity: Taxonomy-Agnostic Annotation of PII Values in HTTP Traffic using LLMs

arXiv: https://arxiv.org/abs/2605.06305 · HTML: https://mlsanity.com/paper/2605.06305/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 33 references that are in the map.
- First posted on arXiv 7 May 2026.

## Builds on (most cited first, 11 of 11)

- [Modeling Tabular data using Conditional GAN](https://mlsanity.com/paper/1907.00503/) (2019)
- [Generating Multi-label Discrete Patient Records using Generative Adversarial Networks](https://mlsanity.com/paper/1703.06490/) (2017)
- [GPT-NER: Named Entity Recognition via Large Language Models](https://mlsanity.com/paper/2304.10428/) (2023)
- [PII-Bench: Evaluating Query-Aware Privacy Protection Systems](https://mlsanity.com/paper/2502.18545/) (2025)
- [ReCon: Revealing and Controlling PII Leaks in Mobile Network Traffic](https://mlsanity.com/paper/1507.00255/) (2015)
- [Automated Privacy Information Annotation in Large Language Model Interactions](https://mlsanity.com/paper/2505.20910/) (2025)
- [Haystack: A Multi-Purpose Mobile Vantage Point in User Space](https://mlsanity.com/paper/1510.01419/) (2015)
- [A Qualitative Analysis Framework for mHealth Privacy Practices](https://mlsanity.com/paper/2405.17971/) (2024)
- [Scalable multilingual PII annotation for responsible AI in LLMs](https://mlsanity.com/paper/2510.06250/) (2025)
- [PrivacyProxy: Leveraging Crowdsourcing and In Situ Traffic Analysis to Detect and Mitigate Information Leakage](https://mlsanity.com/paper/1708.06384/) (2017)
- [Word-level Annotation of GDPR Transparency Compliance in Privacy Policies using Large Language Models](https://mlsanity.com/paper/2503.10727/) (2025)

## Abstract (arXiv)

Automated privacy audits of web and mobile applications often analyse outbound HTTP traffic to detect Personally Identifiable Information (PII) leakage. However, existing learning-based detectors typically depend on scarce, manually labelled traffic and are tightly coupled to fixed label taxonomies, limiting transferability across domains and evolving definitions of PII. This paper investigates whether Large Language Models (LLMs) can support taxonomy-agnostic annotation of explicitly transmitted PII values in HTTP message bodies when the taxonomy is provided at runtime. We introduce a multi-stage LLM-based pipeline that combines deterministic pre-processing with label-level classification, targeted instance-level value annotation, and output validation. To enable controlled evaluation and exemplar-based prompting without relying on sensitive real-user captures, we further propose an LLM-based generator for synthetic HTTP traffic with manually validated, taxonomy-derived PII annotations. We evaluate the approach across three taxonomies spanning different PII domains and granularity levels. Results show that the pipeline accurately detects PII types and extracts corresponding values for concrete PII taxonomies. Overall, our findings position LLMs as a promising foundation for flexible, taxonomy-agnostic traffic annotation and for creating labelled data under evolving privacy taxonomies.