发表机构
Siebel School of Computing; Data Science, University of Illinois Urbana-Champaign（计算机科学系; 数据科学，伊利诺伊大学厄巴纳-香槟分校）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
研究大语言模型代理转录本隐私泄露问题，提出SlotGuard方法，通过重写结构绑定、替换机密值、链接跨轮引用等操作隐藏敏感数据，在保持代理性能的同时大幅降低凭证泄漏率。
AI 中文摘要
大语言模型代理可能会泄露隐私（如路径、电子邮件）和凭证（如API密钥），因为代理观察结果（如工具输出、 shell日志和文件读取）会附加到与提供商绑定的转录本中。现有的占位符编辑很脆弱。我们提出了SlotGuard，一种本地转录本边界，它可以隐藏敏感数据，同时保持代理的性能。SlotGuard将结构绑定重写为带类型的、后缀感知的插槽，用格式保留的合成值替换机密，通过轻量级会话图链接跨轮引用，并仅在可信运行时恢复原始值。在面向存储库的代理转录本上，SlotGuard消除了9229条路径上的所有20814个带注释的结构敏感字符，并将852个植入值的凭证泄漏率降至0.0%。在四个上游模型中，它的任务成功率仍接近原始转录本，而通用编辑则降至2.5%。转录本重写平均每个代理轮次耗时14.424微秒。代码可通过此https URL公开访问。
英文摘要
LLM agents can leak privacy (e.g., paths, emails) and credentials (e.g., API keys) as agent observations (e.g., tool outputs, shell logs, and file reads) are appended to provider-bound transcripts. Existing placeholder redaction is brittle: it can miss embedded or cross-turn references, over-redact benign lookalikes, and destroy the structure useful for reasoning. We present SlotGuard, a local transcript boundary that can hide sensitive data while retaining agents' performance. SlotGuard rewrites structural bindings as typed, suffix-aware slots, replaces secrets with format-preserving synthetic values, links cross-turn references with a lightweight session graph, and restores raw values only inside the trusted runtime. On controlled repository-oriented agent transcripts, SlotGuard removes all 20,814 annotated structurally sensitive characters across 9,229 paths and reduces credential leakage to 0.0\% across 852 planted values. It remains close to raw-transcript task success across four upstream models, while generic redaction drops to 2.5\%. Transcript rewriting takes a median of 14.424~$μ$s per agent turn. The code is publicly accessible at https://github.com/illinoisdata/SlotGuard.
CommentsICML 2026 AIWILD
