Technical Summary: PRIVSCOPE

Problem Statement

Hybrid local–cloud agent architectures offer a practical balance between autonomy and capability. In these systems, a trusted on-device Local Controller (LC) manages planning and routine reasoning, delegating capability-intensive subtasks (e.g., real-time retrieval, complex reasoning) to an untrusted Cloud Language Model (CLM). However, this delegation creates a critical privacy boundary.

The LC constructs payloads for the CLM by combining the current user request with a persistent working state that accumulates across workflows. This leads to over-disclosure, where the cloud-bound payload contains more information than the delegated subtask requires. The paper identifies three specific forms of this risk:

1. Prior-task residue: Context from previous workflows (e.g., availability windows, past provider names) included in the current payload despite being irrelevant to the new task.
2. Task-irrelevant inclusion: Profile details (e.g., member IDs, dates of birth) that have no functional role in the delegated subtask.
3. Excessive specificity: Disclosing information at a granularity finer than necessary (e.g., exact address vs. neighborhood, precise symptom vs. broad category).

Existing solutions either isolate workflows to prevent cross-flow leakage or apply general-purpose sanitization (like redaction) that fails to reason about the specific scope of the LC-assembled payload, often breaking task utility or failing to prevent re-identification via context.

Methodology: PRIVSCOPE

The authors propose PRIVSCOPE, a trusted on-device payload governor that enforces task-scoped disclosure at the LC→CLM boundary without requiring changes to the cloud provider. The system operates on the principle that sensitive information should reach the cloud only when required for the subtask, and only in the least revealing form sufficient for task utility.

PRIVSCOPE implements a four-stage on-device pipeline:

1. Disclosure Unit Extraction and Local Binding:

   • The LC-assembled payload is decomposed into typed disclosure units ($U_t$).
   • A layered extraction process is used: deterministic rules for structured patterns (emails, IDs), profile matching for account-linked values, and lightweight parsing (e.g., spaCy) for open-class semantic content.
   • Local Binding: Exact account-linked values (e.g., insurance member IDs, payment details) are routed to a local binding table ($B_t$) and removed from the payload. These remain on-device for later local actuation but never reach the cloud.

2. Cloud Necessity and Carryover Control:

   • Each unit is assigned a role: cloud (needed for the subtask) or local (withheld).
   • This decision is made via a batched local model call that evaluates units in the context of the delegated task.
   • Provenance-aware guards are applied:
     • Current Request: Filtered based on task necessity.
     • Working State (Prior Carryover): Stricter filtering; retained only if the current request explicitly depends on them (e.g., "continue from previous").
     • Unknown Source: Never promoted to cloud to prevent LC-inferred leakage.

3. Task-Sufficient Abstraction:

   • Units assigned to the "cloud" role are not necessarily released in their exact form.
   • PRIVSCOPE applies typed abstraction hierarchies (e.g., $Region \prec City \prec Neighborhood \prec Exact Address$).
   • An offline-calibrated policy selects the coarsest representation sufficient for the delegated task (e.g., replacing an exact date with a "week-level window" or a specific symptom with a "service category").
   • This stage ensures the CLM receives a minimized view sufficient for candidate discovery.

4. Local Resolution and Workflow Completion:

   • The sanitized payload ($\hat{P}_t$) is sent to the CLM.
   • Upon receiving candidate results, the LC uses the withheld private state (from $B_t$ and working state) to ground the response, rank candidates, and complete the workflow locally.

Key Contributions

The paper outlines four primary contributions:

1. Problem Characterization: Identification and characterization of persistent-state over-disclosure as a distinct privacy risk in hybrid agents, where the LC-assembled payload (not just the raw prompt) exposes prior-task residue and task-irrelevant state.
2. Formulation: A formulation of task-scoped disclosure control as a payload mediation problem at the LC→CLM boundary, decomposing the payload into typed units with source provenance.
3. System Design: The design of PRIVSCOPE, which combines local binding of exact values, provenance-aware necessity filtering, and task-sufficient abstraction. This allows exact private state to remain on-device while exposing a minimized task view to the CLM.
4. Evaluation: Implementation and evaluation on 100 medical-booking provider-discovery workflows across three commercial CLMs and five local backbones.

Experimental Results

The evaluation compares PRIVSCOPE against an unprotected baseline (Vanilla), prompt-based rewriting (PEP), and deterministic redaction (Presidio).

• Privacy:
  • Profile Leakage: PRIVSCOPE eliminates profile leakage entirely (0.0%), compared to 17.7% for the unprotected baseline.
  • Re-identification Risk (RIR): PRIVSCOPE reduces attacker-based recovery of private values to 23.1%, more than halving the unprotected baseline (64.3%) and outperforming PEP (39.6%) and Presidio (29.3%).
  • Injection Leakage: It reduces unsolicited state injection by an order of magnitude (0.3% vs. 5.1% in Vanilla).
• Utility:
  • Candidate Recall: PRIVSCOPE achieves the highest candidate recall across all tested cloud LLMs (e.g., 54.1% on GPT-4o-mini, 69.6% on Gemini 2.5 Flash), significantly outperforming Presidio (25.5% on GPT-4o-mini) which often strips task-critical context.
  • Task Success: On GPT-4o-mini and Gemini 2.5 Flash, task success rates remain close to the unprotected baseline (82–86%), whereas Presidio causes significant drops due to over-redaction.
• Efficiency:
  • Latency: The system adds approximately 3.13 seconds of on-device mediation latency on commodity hardware (MacBook M2 Pro) using a 3B parameter local model.
  • Cloud Cost: PRIVSCOPE reduces cloud API costs by 13–23% compared to prompt-based rewriting, as it minimizes payload size rather than expanding it for clarity.

Significance and Claims

The paper claims that PRIVSCOPE provides a stronger privacy–utility–cost trade-off than existing approaches. Unlike redaction methods that break task utility or prompt rewriting that is brittle and model-dependent, PRIVSCOPE's structured, provenance-aware mediation ensures that:

1. Privacy is preserved by preventing the cloud from seeing unnecessary identifiers and prior-workflow residue.
2. Utility is maintained by abstracting sensitive data only to the level necessary for the specific delegated subtask, allowing the local controller to resolve the final task using private state.
3. Deployability is high as it operates as a plug-in on the device, requires no cloud-side changes, and reuses the existing local controller model for mediation.

The authors note that their evaluation is focused on information-seeking delegations in the medical-booking domain. They acknowledge that while the design applies broadly to LC–CLM payloads, future work is needed to handle implicit spans, learn abstraction hierarchies dynamically, and address adversarial CLMs. The system is presented as a practical step toward securing hybrid agentic systems against persistent-state leakage.