Research map / Multi-agent systems and games / LLM agents

MINIM: Privacy-Aware Minimal View for Agents via Trusted Local Sanitization

ICML 2026 · Multi-agent systems and games › LLM agents · approach: LLM multi-agent collaboration and safety · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MINIM, a trusted local broker that predicts per-element sensitivity and task-conditioned necessity scores on accessibility trees and applies a keep/abstract/remove policy before sending observations to a remote agent.

Problem

Agents send full UI/accessibility-tree state to remote inference servers, leaking sensitive task-irrelevant context (2FA codes, notifications, background windows). Existing task-agnostic PII filters, differential privacy, and cryptographic methods do not fit structured, action-critical observations.

Approach

A GATv2-based local scorer predicts sensitivity and task-conditioned necessity per UI node; a ternary policy (remove, abstract, keep) gates disclosure, trained with a CI-weighted necessity loss that penalizes necessity errors more on sensitive nodes.

Key results

• MINIM achieves TCNP 0.9491, TCNP-I 0.9931, and TISL 0.101 (10.1% of full observation) while keeping about 12% of nodes.
• Necessity-Only baseline reaches TCNP 0.9445 but TISL 0.2032; MINIM halves leakage at matched utility.
• Prompted open-weight LLM scorers (7B to 70B) reach TCNP-I 0.985-0.996 but TISL 0.194-0.312, above MINIM's 0.101.

Surprising findings

• Scaling prompted LLM scorers from 8B to 70B increased leakage (Llama-3.3-70B TISL 0.312 vs Llama-3-8B 0.206).
• Abstraction (A action) yields lower TCNP-I loss than strict redaction, but adds only marginal leakage versus conservative redaction.

Limitations

• Honest-but-curious threat model; prompt injection and cumulative privacy loss over long horizons are not addressed.
• Evaluated on only 27 task templates and synthetically injected sensitive content on WebArena; scaling to enterprise or full desktop interfaces is untested.
• The abstraction leakage p_abs and placeholder cost are assumed parameters rather than measured re-identification risk.

Experimental setup

Datasets: WebArena

Benchmarks: augmented WebArena (N=662 test variants)

Metrics: TCNP TCNP-I TISL Keep%

Baselines: Full Observation Random Budget Sensitivity-Only Necessity-Only Qwen3-8B-Instruct Nemotron-Nano-9B GPT-OSS-20B Llama-3.3-70B-Instruct Mistral-7B-v0.3 Llama-3-8B-Instruct Gemma-3N-E4B

Builds on: Contextual Integrity GATv2 WebArena MiniLM

Closest papers by meaning

• AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents (NeurIPS 2025 · similarity 0.88)
• PrivAct: Internalizing Contextual Privacy Preservation via Multi-Agent Preference Training (ICML 2026 · similarity 0.88)
• Contextualized Privacy Defense for LLM Agents (ICML 2026 · similarity 0.88)
• POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents (NeurIPS 2026 · similarity 0.88)
• Contextual Integrity in LLMs via Reasoning and Reinforcement Learning (NeurIPS 2025 · similarity 0.88)
• From History to State: Constant-Context Skill Learning for LLM Agents (NeurIPS 2026 · similarity 0.87)