← 研踪 PaperTrailarXiv:2607.17147 · v2
SlotGuard: Stop Oversharing Private Local Context in LLM Agent Transcripts
首次提交 2026-07-19 17:13
版本更新 2026-11-10 00:35
雷达观测 2026-11-10 15:22
摘要
LLM agents can expose private local context (e.g., paths, emails) and credentials (e.g., API keys) as agent observations (e.g., tool outputs, shell logs, and file reads) are appended to provider-bound transcripts. Existing placeholder redaction is brittle: it can miss embedded or cross-turn references, over-redact benign lookalikes, and destroy the structure useful for reasoning. We present SlotGuard, a local transcript boundary that can hide sensitive data while retaining agents' performance. SlotGuard rewrites structural bindings as typed, suffix-aware slots, replaces secrets with format-preserving synthetic values, links cross-turn references with a lightweight session graph, and restores raw values only inside the trusted runtime. On controlled repository-oriented agent transcripts, SlotGuard removes all 20,814 annotated structurally sensitive characters across 9,229 paths and reduces credential leakage to 0.0% across 852 planted values. It remains close to raw-transcript task success across four upstream models, while generic redaction drops to 2.5%. Deterministic transcript rewriting takes a median of 14.424 microseconds per agent turn, excluding the optional semantic detector. The code is publicly accessible at https://github.com/illinoisdata/SlotGuard.
作者备注：11 pages; ICML 2026 AIWILD. v2: corrected truncated title and clarified notation, privacy claims, and evaluation reporting
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v2 · 2026-11-10 00:35 · 最新观测版本
SlotGuard: Stop Oversharing Private Local Context in LLM Agent Transcripts
LLM agents can expose private local context (e.g., paths, emails) and credentials (e.g., API keys) as agent observations (e.g., tool outputs, shell logs, and file reads) are appended to provider-bound transcripts. Existing placeholder redaction is brittle: it can miss embedded or cross-turn references, over-redact benign lookalikes, and destroy the structure useful for reasoning. We present SlotGuard, a local transcript boundary that can hide sensitive data while retaining agents' performance. SlotGuard rewrites structural bindings as typed, suffix-aware slots, replaces secrets with format-preserving synthetic values, links cross-turn references with a lightweight session graph, and restores raw values only inside the trusted runtime. On controlled repository-oriented agent transcripts, SlotGuard removes all 20,814 annotated structurally sensitive characters across 9,229 paths and reduces credential leakage to 0.0% across 852 planted values. It remains close to raw-transcript task success across four upstream models, while generic redaction drops to 2.5%. Deterministic transcript rewriting takes a median of 14.424 microseconds per agent turn, excluding the optional semantic detector. The code is publicly accessible at https://github.com/illinoisdata/SlotGuard.
查看此版本解读 →查看此版本原文 ↗