PrivScope让本地代理只向云端传输任务必需的最小信息，保护隐私不泄露。
PrivScope: Task-scoped Disclosure Control for Hybrid Agentic Systems
- 在本地设备上动态识别并过滤无关敏感信息，仅传递必要内容。
- 医疗预约任务中零隐私泄露（0.0%），攻击者重识别率降低64%以上。
- 无需修改云端模型，兼容主流大模型，延迟仅增加几秒。
混合本地-云端代理在将能力密集型子任务委托给云端语言模型（CLM）前，会利用持久工作状态丰富用户请求。然而，这种增强可能暴露不必要的信息，包括任务无关上下文、前序流程的残留信息及过于具体的敏感细节，造成过度披露。现有方案或隔离工作流以限制跨流程泄漏，或使用通用清洗方法，但无法针对本地与云端协同组装的负载进行细粒度判断。本文提出PrivScope，一种可信的本地负载管控器，在不改变云端的前提下，实现任务范围内的披露控制。核心思想：敏感信息仅在任务所需时才传至云端，且以最小揭示形式保留实用性。PrivScope从组装负载中提取披露单元，将直接标识符和账户关联值保留在本地；其余单元经云端必要性评估，必须上传的则抽象为完成任务所需的最不具体表示。在三个商用CLM上的100个医疗预约工作流测试中，PrivScope实现零个人资料泄露（0.0%对比17.7%），攻击者重识别率从64.3%降至23.1%，所有测试模型的候选召回率均最高，且在GPT-4o-mini和Gemini 2.5 Flash上保持接近无防护基线的任务成功率。该效果在五种本地后端上稳定，仅在普通硬件上增加数秒本地延迟。
原文摘要 · Abstract (English)
Hybrid local--cloud agents enrich user requests with context from persistent working state before delegating capability-intensive subtasks to a cloud language model (CLM). While this enrichment can improve task success, it also exposes unnecessary information in the cloud-bound payload, including task-irrelevant context, carryover from prior workflows, and overly specific sensitive details, resulting in \emph{over-disclosure}. Existing solutions either isolate workflows to limit cross-workflow leakage or apply general-purpose sanitization that does not reason over LC-assembled payload scope. We present \textsc{PrivScope}, a trusted on-device payload governor that enforces \emph{task-scoped disclosure} at the local--CLM boundary, without requiring cloud-side changes. Its key idea: sensitive information should reach the cloud only when required for the delegated subtask, and then only in the least revealing form preserving utility. \textsc{PrivScope} extracts disclosure units from the assembled payload and keeps direct identifiers and account-linked values on device. The remaining units pass through cloud-necessity control, which determines what is actually needed; units that must reach the cloud are abstracted to the least-specific representation sufficient for the task. On 100 medical-booking workflows across three commercial CLMs, \textsc{PrivScope} eliminates profile leakage (0.0\% vs.\ 17.7\%), more than halves attacker re-identification (23.1\% vs.\ 64.3\%), and achieves the highest candidate recall on every CLM tested while preserving task success close to the unprotected baseline on GPT-4o-mini and Gemini 2.5 Flash. Gains hold across five local backbones and add only seconds of on-device latency on commodity hardware.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。