Technical Summary: MINIM - Privacy-Aware Minimal View for Agents via Trusted Local Sanitization

1. Problem Statement: Semantic Over-Privileged Observation

Modern autonomous agents increasingly rely on structured observations (e.g., accessibility trees, DOM representations) to interact with digital environments. While these structured interfaces provide rich semantic context for reliable action grounding, current deployment paradigms often follow a "share-first" design, transmitting the entire raw interface state to remote inference servers.

The authors identify a specific failure mode termed Semantic Over-Privileged Observation. In this scenario, agents receive not only the elements necessary for the current user task but also a vast amount of task-irrelevant context (e.g., sidebar notifications, background application windows, unrelated browser tabs). This exposure leads to the leakage of sensitive but unnecessary information, such as authentication codes, private notifications, and behavioral traces, which can be exploited for profiling.

Existing privacy solutions are ill-suited for this setting:

• Task-agnostic filtering (e.g., PII redaction) risks removing task-critical context or missing sensitive non-PII attributes.
• Differential Privacy introduces stochastic noise that can distort the precise semantic cues required for reliable agent actuation.
• Cryptographic methods (e.g., FHE, MPC) protect computation but do not prevent the remote server from inferring sensitive information from the disclosed state, often at the cost of prohibitive latency.

The core challenge is that privacy requirements are task-conditioned: an element (e.g., a 2FA code) may be critical for one task but constitute pure leakage for another.

2. Methodology: MINIM Framework

The authors propose MINIM, a trusted local broker that performs pre-disclosure minimization on the client device. MINIM acts as a structural bottleneck, sanitizing the agent's observation before it leaves the device. The framework is grounded in Contextual Integrity (CI), operationalizing the principle that information flow should adhere to norms defined by the context, actors, attributes, and transmission principles.

2.1. Dual-Score Representation

MINIM employs a learned model to predict two scalar scores for each element in the structured observation (e.g., an accessibility tree node):

1. Inherent Sensitivity Score ($s$): Captures the intrinsic information risk of the element, independent of the current task.
2. Task-Conditioned Necessity Score ($n$): Captures the utility of the element for completing the specific user task $T$.

2.2. Training Objective

The model is trained using a CI-aware objective that minimizes the disclosure of contextually inappropriate information while satisfying a task utility constraint. The loss function combines:

• Sensitivity Loss ($L_{sens}$): Minimizes the error in predicting inherent risk.
• Necessity Loss ($L_{nec}$): Minimizes the error in predicting task necessity, but weighted by sensitivity. The loss is amplified for nodes that are highly sensitive but task-irrelevant, penalizing the model heavily for failing to identify unnecessary high-risk content.

2.3. Ternary Disclosure Policy

At deployment, the predicted scores drive a deterministic policy that maps each node to one of three actions:

• Keep (K): If the node is necessary ($n \ge \tau_{nec}$) and low-risk ($s < \tau_{sens}$). The element is transmitted unchanged.
• Abstract (A): If the node is necessary ($n \ge \tau_{nec}$) but high-risk ($s \ge \tau_{sens}$). Sensitive attributes are replaced with placeholders (e.g., [REDACTED]) while preserving the structural role (e.g., keeping the button structure but masking the 2FA code value).
• Remove (R): If the node is unnecessary ($n < \tau_{nec}$). The element is pruned entirely.

3. Key Contributions

1. Problem Formalization: The paper identifies and formalizes "Semantic Over-Privileged Observation" as a distinct privacy risk in agentic systems relying on structured inputs, proposing pre-disclosure minimization as the solution.
2. MINIM Architecture: The authors introduce a trusted local broker that decouples contextual scoring from policy enforcement. It utilizes a dual-score mechanism (sensitivity and necessity) trained with a CI-aware objective to enforce a "need-to-know" disclosure rule.
3. Empirical Validation: The framework is evaluated on real-world accessibility trees derived from WebArena across Shopping, Reddit, and Gmail domains, demonstrating significant leakage reduction without compromising task execution.

4. Experimental Results

Experiments were conducted on a dataset of 662 test variants derived from WebArena, augmented with synthesized sensitive contexts (e.g., 2FA codes, passwords).

4.1. Performance Metrics

• Task-Critical Node Preservation (TCNP): MINIM retains 94.91% of task-critical context and 99.31% of task-critical interactive elements (TCNP-I).
• Task-Irrelevant Sensitive Leakage (TISL): MINIM reduces sensitive leakage to 0.101 (normalized), which is approximately 10% of the leakage observed in full observations. This is a 50% reduction compared to a "Necessity-Only" baseline (0.2032) and significantly outperforms "Sensitivity-Only" or "Random" baselines.

4.2. Comparison with LLM Baselines

The authors compared MINIM against several open-weight Large Language Models (LLMs) prompted to act as scorers.

• LLM Limitations: While general LLMs achieved high utility (TCNP-I $\approx$ 0.99), they exhibited significantly higher leakage (TISL ranging from 0.194 to 0.312). They tended to retain task-irrelevant sensitive content alongside useful elements.
• Efficiency: MINIM retained only 12% of nodes (compared to ~26–35% for LLMs) while achieving comparable or superior actionable recall. This highlights that general instruction tuning does not inherently enforce task-conditioned minimization.

4.3. Ablation and Robustness

• Value of Abstraction: Replacing the "Abstract" (A) action with "Remove" (R) caused a drop in actionable recall (TCNP-I) from 0.9931 to 0.9650, demonstrating that preserving structural affordances while masking values is crucial for task execution.
• Task Semantics: The model adapted its compression rate based on task type, retaining more nodes for "Sensitive/Admin" tasks (15.84%) compared to "Informational" tasks (8.66%) to ensure security flows remained functional.

5. Significance and Claims

The paper claims that MINIM demonstrates that strong privacy guarantees can coexist with reliable agent actuation. By shifting from a "share-first" paradigm to a "need-to-know" paradigm via trusted local sanitization, MINIM addresses the "Privacy Judgment-Action Gap" where agents fail to protect context even when recognized as sensitive.

The authors emphasize that their approach is representation-agnostic; while evaluated on accessibility trees, the CI-driven structural scoring mechanism applies to other structured observation formats (DOM, scene graphs, tool schemas). They position MINIM not as a complete security solution against active adversaries, but as a critical privacy-mitigation component for the observation channel of autonomous agents, enabling safer deployment in privacy-sensitive environments.