Reading Notes

Personal reading notes. Original paper: arXiv:2606.13949v1.

arXiv 2606.13949v1 Reading Note: Minim - Privacy-Aware Agent Minimal View Based on Trusted Local Purification

1. Research Background and Problem Definition

As autonomous agents based on Large Language Models (LLMs) become increasingly prevalent in complex digital environments, they rely more heavily on rich User Interface (UI) state observations to achieve reliable action execution. However, the paper points out that many current deployment schemes tend to transmit the complete UI state to remote inference servers, even though most elements are irrelevant to the current task. This practice leads to the leakage of sensitive but unnecessary context, such as authentication codes, private notifications, and background application states.

The authors define this failure mode as Semantic Over-Privileged Observation. In this mode, task-irrelevant elements in the structured hierarchy are exposed along with their functional semantics. For example, when performing a task like “summarize this email,” a remote agent might observe sidebar notifications, background application windows, or irrelevant browser tabs, thereby leaking Personally Identifiable Information (PII) and cross-session behavioral trajectories.

Existing privacy paradigms struggle to address this scenario:

• Task-irrelevant Entity Filtering (e.g., Presidio): Relies on static PII categories, which may remove task-critical context or miss sensitive non-PII attributes.
• Differential Privacy (DP): Introduces random perturbations, which may distort the precise semantic cues required for reliable operations in structured interfaces.
• Encrypted LLM Methods (e.g., MPC, FHE): While protecting the computation process, they cannot prevent sensitive inference from states disclosed to the remote server, and their latency is often incompatible with real-time agent control loops.

2. MINIM System Architecture and Method

To address the above issues, the authors propose MINIM, a Trusted Local Broker that performs pre-disclosure minimization on client devices. MINIM performs privacy-aware purification of the agent’s observations before the observation data leaves the device.

Unlike prompt-based purifiers that rely on the agent’s own reasoning, MINIM uses specialized local models to predict two scalar scores for each element in the structured observation:

1. Sensitivity Score ($s$): Captures inherent information risk.
2. Task-conditioned Necessity Score ($n$): Captures utility for the current intent.

These two scores drive a disclosure strategy based on Contextual Integrity (CI), restricting the disclosure of high-sensitivity content unless it is predicted to be necessary for completing the user’s task.

The paper illustrates the system architecture of MINIM, as shown in Figure 1. The trusted local broker intercepts raw structured observations (e.g., accessibility trees) and performs contextual integrity-based purification. By jointly predicting sensitivity and task-conditioned necessity, MINIM implements a structural bottleneck that filters or abstracts information before transmission to the remote agent.

3. Theoretical Foundation: Contextual Integrity and Optimization Objective

The paper uses Contextual Integrity (CI) as a lens for regulating disclosure and social reasoning. CI posits that privacy is managed by adherence to appropriate norms of information flow, rather than absolute confidentiality. These norms are characterized by four parameters: context, participants (sender and receiver), attributes (type of information), and transmission principles (constraints on information flow).

In the MINIM setup:

• The user’s active task $T$ establishes the context.
• The client device and remote inference server act as participants.
• Data fields in $X_t$ correspond to attributes.
• The goal is to achieve a transmission principle of task-conditioned necessity, meaning information with high disclosure risk is shared only if it is critical for completing the current task.

To operationalize this principle, the authors learn predictive signals to drive the disclosure strategy. The optimization objective is a CI-aware objective function that imposes heavier penalties on necessity errors regarding high-risk content. This enables the system to achieve aggressive pruning while retaining task-critical information.

4. Experimental Evaluation and Results

The authors evaluated MINIM on real agent observations derived from WebArena, covering multiple domains (shopping, Reddit, and Gmail). Experimental results show that MINIM significantly reduces task-irrelevant sensitive leakage while preserving task-critical semantic context and the interactive functionality required for reliable agent actions.

The paper illustrates the privacy-utility trade-off under necessity threshold scanning in Figure 2. This figure reflects how MINIM balances privacy protection (reducing sensitive information leakage) with task utility (maintaining the agent’s ability to complete tasks) under different threshold settings.

5. Summary and Contributions

The paper makes the following three main contributions:

1. Problem Formalization: Identified the privacy risk of “Semantic Over-Privileged Observation” in agent systems relying on structured observations, and formalized pre-disclosure minimization as learning a structural bottleneck compliant with CI.
2. Method Proposal: Proposed MINIM, which decouples context scoring from policy execution through joint sensitivity and necessity prediction, and is trained using a CI-aware objective function to penalize unnecessary disclosure of high-risk content.
3. Empirical Evaluation: Conducted evaluation on real agent observations based on WebArena, demonstrating the effectiveness of MINIM in reducing task-irrelevant sensitive leakage while retaining key information required to complete tasks.

This work emphasizes the importance of minimizing structured observations before data leaves the device, providing new insights for building privacy-aware autonomous agent systems.