PrivScope: Task-scoped Disclosure Control for Hybrid Agentic Systems
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Hybrid local--cloud agents enrich user requests with context from persistent working state before delegating capability-intensive subtasks to a cloud language model (CLM). While this enrichment can improve task success, it also exposes unnecessary information in the cloud-bound payload, including task-irrelevant context, carryover from prior workflows, and overly specific sensitive details, resulting in over-disclosure. Existing solutions either isolate workflows to limit cross-workflow leakage or apply general-purpose sanitization that does not reason over LC-assembled payload scope. We present textscPrivScope, a trusted on-device payload governor that enforces task-scoped disclosure at the local--CLM boundary, without requiring cloud-side changes. Its key idea: sensitive information should reach the cloud only when required for the delegated subtask, and then only in the least revealing form preserving utility. textscPrivScope extracts disclosure units from the assembled payload and keeps direct identifiers and account-linked values on device. The remaining units pass through cloud-necessity control, which determines what is actually needed; units that must reach the cloud are abstracted to the least-specific representation sufficient for the task. On 100 medical-booking workflows across three commercial CLMs, textscPrivScope eliminates profile leakage (0.0% vs. 17.7%), more than halves attacker re-identification (23.1% vs. 64.3%), and achieves the highest candidate recall on every CLM tested while preserving task success close to the unprotected baseline on GPT-4o-mini and Gemini 2.5 Flash. Gains hold across five local backbones and add only seconds of on-device latency on commodity hardware.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 32 of its 52 references that are in the map. First posted on arXiv 15 May 2026.
Builds on
32 of 52 references.
Closest ancestors · 3
Same direction, newest first
- 2025AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents12 Mar
- 2024AirGapAgent: Protecting Privacy-Conscious Conversational Agents8 May
- 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
Other references · 29
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2024The Llama 3 Herd of Modelscited by 14,192
- 2025Qwen3 Technical Reportcited by 8,195
- 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,655
- 2023Mistral 7Bcited by 3,065
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
- 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,883
- 2023Can Generalist Foundation Models Outcompete Special-Purpose Tuning? Case Study in Medicinecited by 319
- 2021Sustainable AI: Environmental Implications, Challenges and Opportunitiescited by 242
- 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 218
- 2024MobileLLM: Optimizing Sub-billion Parameter Language Models for On-Device Use Casescited by 216
17 more
- 2023Beyond Memorization: Violating Privacy Via Inference with Large Language Modelscited by 167
- 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 161
- 2023ProPILE: Probing Privacy Leakage in Large Language Modelscited by 127
- 2019Privacy- and Utility-Preserving Textual Analysis via Calibrated Multivariate Perturbationscited by 115
- 2023Hide and Seek (HaS): A Lightweight Framework for Prompt Privacy Protectioncited by 37
- 2024Operationalizing Contextual Integrity in Privacy-Conscious Assistantscited by 36
- 2024CI-Bench: Benchmarking Contextual Integrity of AI Assistants on Synthetic Datacited by 34
- 2024CoGenesis: A Framework Collaborating Large and Small Language Models for Secure Context-Aware Instruction Followingcited by 32
- 2024PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restorationcited by 27
- 2025Agentic Plan Caching: Test-Time Memory for Fast and Cost-Efficient LLM Agentscited by 23
- 2025Towards Automating Data Access Permissions in AI Agentscited by 20
- 2024Confidence in the Reasoning of Large Language Modelscited by 18
- 2025Collaborative Inference and Learning between Edge SLMs and Cloud LLMs: A Survey of Algorithms, Execution, and Open Challengescited by 14
- 2024The Fire Thief Is Also the Keeper: Balancing Usability and Privacy in Promptscited by 13
- 2025SplitReason: Learning To Offload Reasoningcited by 11
- 2024DePrompt: Desensitization and Evaluation of Personal Identifiable Information in Large Language Model Promptscited by 8
- 2025Anti-adversarial Learning: Desensitizing Prompts for Large Language Modelscited by 2
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026PAAC: Privacy-Aware Agentic Device-Cloud Collaboration
- 2026Towards a Systems Foundation for Agentic Cloud Management
- 2026AgentSCOPE: Evaluating Contextual Privacy Across Agentic Workflows
- 2026From Privacy to Workflow Integrity: Communication-Graph Metadata in Autonomous Agent Interoperability
- 2026Minim: Privacy-Aware Minimal View for Agents via Trusted Local Sanitization
- 2026SplitAgent: A Privacy-Preserving Distributed Architecture for Enterprise-Cloud Agent Collaboration
- 2026Securing LLM Agents Need Intent-to-Execution Integrity
- 2026TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents