PrivScope: Task-scoped Disclosure Control for Hybrid Agentic Systems

Unknown Date

AI Summary

This work addresses privacy leakage in hybrid on-device/cloud agents, which often disclose irrelevant or sensitive contextual information when delegating subtasks to the cloud. The authors propose an on-device trusted payload control mechanism that enforces task-level minimal disclosure at the device–cloud boundary. By extracting disclosure units, retaining direct identifiers locally, and applying cloud-side necessity assessment coupled with information abstraction, the system dynamically filters and transmits only the least sensitive data strictly required for task completion. Notably, this approach requires no modification to cloud models and represents the first task-level disclosure control framework tailored for hybrid agents. Evaluated in scenarios such as medical appointment scheduling, it reduces user profile leakage from 17.7% to 0.0%, lowers adversary re-identification rates by over 60%, maintains high recall and near-baseline task success rates, and incurs only a few seconds of on-device latency.

Abstract

Hybrid local--cloud agents enrich user requests with context from persistent working state before delegating capability-intensive subtasks to a cloud language model (CLM). While this enrichment can improve task success, it also exposes unnecessary information in the cloud-bound payload, including task-irrelevant context, carryover from prior workflows, and overly specific sensitive details, resulting in \emph{over-disclosure}. Existing solutions either isolate workflows to limit cross-workflow leakage or apply general-purpose sanitization that does not reason over LC-assembled payload scope. We present \textsc{PrivScope}, a trusted on-device payload governor that enforces \emph{task-scoped disclosure} at the local--CLM boundary, without requiring cloud-side changes. Its key idea: sensitive information should reach the cloud only when required for the delegated subtask, and then only in the least revealing form preserving utility. \textsc{PrivScope} extracts disclosure units from the assembled payload and keeps direct identifiers and account-linked values on device. The remaining units pass through cloud-necessity control, which determines what is actually needed; units that must reach the cloud are abstracted to the least-specific representation sufficient for the task. On 100 medical-booking workflows across three commercial CLMs, \textsc{PrivScope} eliminates profile leakage (0.0\% vs.\ 17.7\%), more than halves attacker re-identification (23.1\% vs.\ 64.3\%), and achieves the highest candidate recall on every CLM tested while preserving task success close to the unprotected baseline on GPT-4o-mini and Gemini 2.5 Flash. Gains hold across five local backbones and add only seconds of on-device latency on commodity hardware.

Problem

• over-disclosure
• hybrid agentic systems
• task-scoped disclosure
• privacy leakage
• cloud language models

Innovation

• task-scoped disclosure
• hybrid agentic systems
• on-device privacy control
• cloud-necessity reasoning
• least-specific abstraction