Pith. sign in

REVIEW 5 cited by

AirGapAgent: Protecting Privacy-Conscious Conversational Agents

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2405.05175 v2 pith:NDYOG3T7 submitted 2024-05-08 cs.CR cs.CLcs.LG

Eugene Bagdasarian , Ren Yi , Sahra Ghalebikesabi , Peter Kairouz , Marco Gruteser , Sewoong Oh , Borja Balle , Daniel Ramage This is my paper
classification cs.CRcs.CLcs.LG
keywords agentsagentcontextdataairgapagentwhileattackconversational
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

The growing use of large language model (LLM)-based conversational agents to manage sensitive user data raises significant privacy concerns. While these agents excel at understanding and acting on context, this capability can be exploited by malicious actors. We introduce a novel threat model where adversarial third-party apps manipulate the context of interaction to trick LLM-based agents into revealing private information not relevant to the task at hand. Grounded in the framework of contextual integrity, we introduce AirGapAgent, a privacy-conscious agent designed to prevent unintended data leakage by restricting the agent's access to only the data necessary for a specific task. Extensive experiments using Gemini, GPT, and Mistral models as agents validate our approach's effectiveness in mitigating this form of context hijacking while maintaining core agent functionality. For example, we show that a single-query context hijacking attack on a Gemini Ultra agent reduces its ability to protect user data from 94% to 45%, while an AirGapAgent achieves 97% protection, rendering the same attack ineffective.

Discussion (0). Sign in to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. NeuroFilter: Activation-Based Guardrails for Privacy-Conscious LLM Agents

    cs.CR 2026-01 conditional novelty 6.0 of 10

    Private-information-extraction intent can be detected by a linear probe on LLM activations, including via a new 'activation velocity' signal for multi-turn attacks.

  2. Prevalence of Security and Privacy Risk-Inducing Usage of AI-based Conversational Agents

    cs.CR 2025-10 conditional novelty 6.0 of 10

    Roughly a third of UK adults use AI chatbots weekly, and among them a substantial minority upload untrusted content, connect bots to other programs, share sensitive data, or attempt jailbreaks.

  3. Design Patterns for Securing LLM Agents against Prompt Injections

    cs.LG 2025-06 conditional novelty 4.0 of 10

    Six composable design patterns (action-selector, plan-then-execute, map-reduce, dual LLM, code-then-execute, context-minimization) constrain LLM agents so prompt-injected text cannot reach consequential actions.

  4. Get Experience from Practice: LLM Agents with Record & Replay

    cs.LG 2025-05 reject novelty 4.0 of 10

    AgentRR is a proposed paradigm that records agent traces, generalizes them into multi-level experiences, and replays them under safety checks to make LLM agents cheaper, faster, and more reliable.

  5. SoK: The Privacy Paradox of Large Language Models: Advancements, Privacy Risks, and Mitigation

    cs.CR 2025-06 conditional novelty 3.0 of 10

    A systematization-of-knowledge survey that categorizes LLM privacy risks into training data, prompts, outputs, and agents, and reviews limitations of current mitigations.

Pith tools