保护大模型代理的私密信息，防止敏感数据泄露。
SlotGuard: Stop Oversharing Private Local Context in LLM Agent Transcri
- 用带类型和后缀感知的槽位替换敏感数据结构
- 9229个路径中20,814个敏感字符被清除，凭证泄露归零
- 适合关注隐私安全的大模型应用开发者
大模型代理在执行过程中可能泄露隐私（如路径、邮箱）和凭证（如API密钥），因为工具输出、命令行日志和文件读取等观察结果会被添加到与服务提供商绑定的对话记录中。现有占位符脱敏方法脆弱：会漏掉嵌入或跨轮次引用，误删良性相似内容，并破坏推理所需的结构。我们提出SlotGuard，一种本地对话边界机制，在保留代理性能的同时隐藏敏感数据。SlotGuard将结构化绑定重写为有类型的、后缀感知的槽位，用格式保持的合成值替换密钥，通过轻量级会话图链接跨轮次引用，并仅在受信任运行时还原原始值。在面向代码库的受控代理记录上，SlotGuard成功清除9,229条路径中的20,814个标注的结构敏感字符，852个植入凭证的泄露降至0.0%。其任务成功率接近原始记录，而通用脱敏降至2.5%。每轮代理操作的记录重写耗时中位数为14.424 μs。代码已公开于https://github.com/illinoisdata/SlotGuard。
原文摘要 · Abstract (English)
LLM agents can leak privacy (e.g., paths, emails) and credentials (e.g., API keys) as agent observations (e.g., tool outputs, shell logs, and file reads) are appended to provider-bound transcripts. Existing placeholder redaction is brittle: it can miss embedded or cross-turn references, over-redact benign lookalikes, and destroy the structure useful for reasoning. We present SlotGuard, a local transcript boundary that can hide sensitive data while retaining agents' performance. SlotGuard rewrites structural bindings as typed, suffix-aware slots, replaces secrets with format-preserving synthetic values, links cross-turn references with a lightweight session graph, and restores raw values only inside the trusted runtime. On controlled repository-oriented agent transcripts, SlotGuard removes all 20,814 annotated structurally sensitive characters across 9,229 paths and reduces credential leakage to 0.0\% across 852 planted values. It remains close to raw-transcript task success across four upstream models, while generic redaction drops to 2.5\%. Transcript rewriting takes a median of 14.424~$μ$s per agent turn. The code is publicly accessible at https://github.com/illinoisdata/SlotGuard.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。