PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agents

1. Problem Statement

Large Language Models (LLMs) hosted in the cloud have become the de facto planners for agentic systems, coordinating tools and guiding execution over local environments. However, a critical privacy gap exists:

• The Challenge: In many deployments, the local environment contains sensitive data (source code, credentials, logs, PII) that cannot be exposed to the cloud.
• Limitations of Existing Solutions:
  • Sandboxing/Access Control: Systems like Claude Code or OpenAI Codex isolate execution (what the agent can do) but do not restrict observation (what the cloud planner sees). Within the allowed scope, raw context is still transmitted.
  • PII Redaction: Regex-based masking removes obvious tokens but fails to catch domain-specific secrets, structural metadata, or cumulative leakage across multiple turns.
  • Local-Only Inference: Running models locally preserves privacy but sacrifices the superior planning capabilities of frontier cloud models.
  • Trusted Execution Environments (TEEs): These protect data during computation but do not address the semantic question of how much information the planner needs to observe to generate a useful plan.

Core Question: How can a local agent leverage cloud-scale planning intelligence without revealing the raw underlying state of the local environment?

2. Methodology: The PlanTwin Architecture

PlanTwin introduces a privacy-preserving architecture where the local environment is projected into a planning-oriented digital twin. The cloud planner operates solely on this sanitized abstraction, while all raw data access, execution, and policy enforcement remain local.

A. System Overview

The system follows a split architecture:

1. Trusted Local Layer: Holds the raw environment ($X_t$). It performs privacy projection, policy enforcement, execution, and output sanitization.
2. Untrusted Cloud Planner: Receives only the sanitized digital twin ($Z_t$) and a bounded capability catalog. It generates declarative plans but never sees raw files, paths, or credentials.

B. The Four-Stage Privacy Projection Pipeline ($\Pi$)

The local agent transforms the raw environment into a schema-constrained abstract graph through four stages:

1. Typed Extraction ($\Pi_{extract}$): Uses a lightweight local Small Language Model (SLM) and heuristics to identify object modalities (e.g., code_file, log_stream) and task affordances without exposing content.
2. Sensitive Entity Redaction ($\Pi_{redact}$): Deterministically removes or masks identifiers (names, emails, API keys, paths, tokens) using regex and code-specific rules.
3. Generalization & Bucketization ($\Pi_{generalize}$): Replaces precise values with coarse categories (e.g., file size $\to$ {small, medium, large}, timestamps $\to$ {today, recent}).
4. Schema Projection ($\Pi_{schema}$): Projects the processed data into a fixed JSON schema. The output is a typed graph where nodes are anonymous artifacts and edges represent relations (dependencies, conflicts).

C. Capability-Based Planning Protocol

Instead of free-form access, the cloud planner interacts via a bounded capability interface ($C$).

• Declarative Plans: The planner outputs a structured action graph (e.g., security_audit(artifact_1)), not raw code or file paths.
• Granularity Trade-off: The system formalizes the privacy-utility trade-off as a capability granularity problem. Capabilities must be fine-grained enough for effective planning but coarse enough to prevent information leakage.

D. Local Policy Enforcement & Disclosure Budgeting

A Local Gatekeeper mediates every interaction:

• Validation: Checks if a requested capability is allowed for the referenced objects.
• Cumulative Disclosure Budget: Tracks the total information revealed about each object over multiple turns ($B(o)$).
• Mechanism: Each schema field has a "weight" ($w_f$) based on its re-identification risk. The gatekeeper blocks requests that would exceed a threshold ($\tau(o)$), ensuring $(k, \delta)$-anonymity and $\epsilon$-unlinkability.

3. Key Contributions

1. System Formulation: Positions cloud-assisted planning without raw-context exposure as a distinct systems problem, separating planning-time privacy control from execution-time access control.
2. Privacy-Preserving Projection: Proposes a four-stage pipeline that converts raw environments into a sanitized, schema-constrained abstract graph, ensuring the cloud never receives free-form raw context.
3. Formal Privacy Goals: Defines planning-time privacy using $(k, \delta)$-anonymity (resistance to re-identification) and $\epsilon$-unlinkability (resistance to cross-session linkage), mitigated by multi-turn disclosure budgets.
4. Implementation & Evaluation: Implements PlanTwin as middleware and evaluates it across 60 tasks in 10 domains using four different cloud planners.

4. Experimental Results

The evaluation compared PlanTwin against Raw Context (no privacy), PII Redaction, Local-Only models, and a Heuristic Oracle.

• Sensitive Item Non-Disclosure (SND):

  • PlanTwin: Achieved 1.0 (100%) SND across all planners and domains. No raw sensitive items (API keys, PII, secrets) reached the cloud.
  • PII Redaction: Achieved only 0.835 SND, leaking 16.5% of sensitive items (especially in coding tasks where regex fails).
  • Local-Only: Achieved 1.0 SND but suffered from poor planning quality.

• Planning Quality Score (PQS):

  • PlanTwin: Maintained high planning quality, with PQS > 0.79 for three out of four cloud planners (Kimi, GLM 5, MiniMax).
  • Comparison: PlanTwin's PQS was statistically indistinguishable from the "Raw Context" baseline for top-tier models, despite removing all raw content.
  • Utility Loss: The full pipeline incurred less than 2.2% utility loss compared to full-context systems.

• Privacy-Utility Trade-off:

  • PlanTwin is the only method that occupies the "ideal" quadrant of high privacy (SND=1.0) and high utility (PQS > 0.7).
  • Re-identification Risk: Without budget control, an adversary could re-identify files with 94.1% accuracy using the twin's schema. The disclosure budget mechanism effectively mitigated this.

• Overhead:

  • Total latency is dominated by the local SLM extraction (13–34s) and cloud API time. The deterministic projection pipeline adds negligible overhead (<1ms).

5. Significance and Implications

• Paradigm Shift: PlanTwin demonstrates that strong cloud planning does not require raw-context exposure. It decouples the reasoning capability of the cloud from the data sensitivity of the local environment.
• Architectural Privacy: It moves beyond simple token masking to a structural approach where the "interface" itself is privacy-preserving. The cloud plans over an abstract control surface rather than a compressed replica of reality.
• Scalability: The approach is planner-agnostic and works with various frontier models. It offers a viable path for deploying secure, high-capability AI agents in enterprise and sensitive environments (e.g., healthcare, finance, proprietary codebases).
• Future Directions: The paper suggests extending this to cloud-side sandbox construction, where the cloud generates synthetic environments based on the twin to further isolate execution, provided the synthetic generation adheres to the same disclosure budgets.

In summary, PlanTwin provides a robust framework for privacy-preserving agentic systems, proving that high-quality planning can be achieved through structured abstractions and strict local governance without compromising the utility of powerful cloud models.