SlotGuard: Stop Oversharing Private Local Context in LLM Agent Transcri

Agent Tool Learning Other Agents AI Safety / AI Ethics DPPDT Other AI Safety
2026年07月19日
大语言模型（LLM）智能体可能泄露隐私信息（例如文件路径、电子邮件地址）和凭证信息（例如API密钥），原因在于智能体的各类观测结果（如工具输出、Shell日志、文件读取内容）会被直接追加至由服务商托管的对话记录中。当前主流的占位符式脱敏方法鲁棒性较差：它既可能遗漏嵌入在文本中的敏感信息，或跨轮次出现的敏感引用；也可能过度脱敏那些与敏感信息形似但实际无害的内容；更会破坏原有文本结构，从而损害智能体后续的推理能力。为此，我们提出SlotGuard——一种部署于本地的对话记录边界机制，可在有效隐藏敏感数据的同时，充分保障智能体的任务性能。SlotGuard通过以下方式实现这一目标：将原有的结构性绑定重写为具备类型标识且支持后缀感知的“槽位”（slot）；以格式保持的方式，用合成数据替代真实敏感信息；借助轻量级会话图（session graph）建立跨轮次的敏感信息引用关联；仅在可信运行时环境中才还原原始值。在面向代码仓库任务构建的受控智能体对话记录测试集上，SlotGuard成功清除了全部20,814个经人工标注的结构性敏感字符（涉及9,229条路径），并将852个预埋凭证的泄露率降至0.0%。在四项上游模型的任务成功率评估中，SlotGuard的表现与原始未脱敏对话记录极为接近，而通用脱敏方法的任务成功率则骤降至2.5%。每轮智能体交互的对话记录重写耗时中位数仅为14.424微秒。本项目源代码已开源，地址为：https://github.com/illinoisdata/SlotGuard。
LLM agents can leak privacy (e.g., paths, emails) and credentials (e.g., API keys) as agent observations (e.g., tool outputs, shell logs, and file reads) are appended to provider-bound transcripts. Existing placeholder redaction is brittle: it can miss embedded or cross-turn references, over-redact benign lookalikes, and destroy the structure useful for reasoning. We present SlotGuard, a local transcript boundary that can hide sensitive data while retaining agents' performance. SlotGuard rewrites structural bindings as typed, suffix-aware slots, replaces secrets with format-preserving synthetic values, links cross-turn references with a lightweight session graph, and restores raw values only inside the trusted runtime. On controlled repository-oriented agent transcripts, SlotGuard removes all 20,814 annotated structurally sensitive characters across 9,229 paths and reduces credential leakage to 0.0\% across 852 planted values. It remains close to raw-transcript task success across four upstream models, while generic redaction drops to 2.5\%. Transcript rewriting takes a median of 14.424~$μ$s per agent turn. The code is publicly accessible at https://github.com/illinoisdata/SlotGuard.
许愿