Tokenized Key-Gated Adapter Routing (Locket) is a framework that embeds fine‑grained, policy‑driven access control into large language models by training lightweight LoRA adapters for different privacy policies. A gating module associates a learned keyed entry token with a specific adapter, allowing authorized tokens to unlock private knowledge while invalid or missing tokens trigger privacy‑preserving adapters that redact or sanitize sensitive content. Experiments on datasets such as Enron, ECHR, and Yelp with models like Qwen3, Llama‑3.2, and Gemma‑2‑2B show that Locket maintains perplexity comparable to fine‑tuning when the correct token is provided, and significantly reduces PII leakage when the token is absent or invalid, without sacrificing utility.
By Mohamed Shaaban, Mohamed Elmahallawy
Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream.
arXiv:2606. 17110v1 Announce Type: cross Abstract: Large Language Models are increasingly trained on proprietary or sensitive data, from private healthcare and financial records to user conversations containing secrets.
By Md Abdullah Al Mamun, Ngoc Phu Doan, Pedram Zaree, Ihsen Alouani, Nael Abu-Ghazaleh
arXiv:2606. 28479v1 Announce Type: cross Abstract: CSIRTs increasingly fine tune language models on vulnerability scan records, but these records expose internal network topology and create privacy risks under regulations such as GDPR and LGPD.
By Cristhian Kapelinski, Diego Kreutz
arXiv:2609.38830v1 Announce Type: new
Abstract: Sparse attention is widely used to accelerate long-context inference in modern large language models (LLMs), but its input-dependent execution behavior...
By Fahao Chen, Linkang Du, Jinhao Zhou, Peng Li, Zhou Su
arXiv:2608. 09001v1 Announce Type: cross Abstract: Black-box privacy scores for retrieval-augmented generation (RAG) are difficult to interpret unless the audited defense's active pipeline hook is known.
By Yanhang Li, Zhichao Fan, Zexin Zhuang
CIPL (Channel Inversion for Privacy Leakage) is a channel-aware framework designed to evaluate black-box privacy leakage in large language model agents. It models the leakage process through stages of sensitive source, selection, assembly, execution, observation, and extraction, assessing how selected sensitive units become attacker-recoverable outputs. Experiments across memory, retrieval, and tool-mediated targets, plus a live-agent case study, reveal that recoverability depends on factors beyond storage labels, such as observation surface, prompt alignment, retrieval depth, and provider behavior, and that a semantic audit can uncover disclosures missed by exact matching.
By Tao Huang, Guosen Wu, Guolong Zheng, Jiayang Meng, Chen Hou, Xu Yang, Xuechao Yang, Feng Xia
The paper introduces Audience‑Bound Persistent Memory, a system that tracks the audience of each memory item and enforces authorization throughout the memory lifecycle. Each item carries the audience present at recording, and derived items are partitioned or suppressed based on the intersection of source audiences, expanding only through explicit grants. The authors implement the approach in two reference architectures—a flat store and a relationship graph—and evaluate it on 10,000 multi‑party histories, showing that no forbidden items entered any context while unscoped retrieval exposed forbidden items in 82% of cases, and that entitled recall matched policy‑equivalent baselines and outperformed unscoped retrieval by 0.30 Recall@5.
By Sibo Liu
arXiv:2606. 16952v2 Announce Type: replace-cross Abstract: The rapid adoption of generative AI and Large Language Models (LLMs) has spurred interest in synthetic data as a privacy-preserving alternative to sensitive real-world datasets.
By Kareem Amin, Rudrajit Das, Alessandro Epasto, Adel Javanmard, Dennis Kraft, M\'onica Ribero, Sergei Vassilvitskii
arXiv:2606. 26627v1 Announce Type: cross Abstract: Large language model agents increasingly query databases, search document collections, call external APIs, remember past interactions, and act on a user's behalf.
By Nada Lahjouji, Ashwin Gerard Colaco
The paper introduces CAPTURE, a system designed to help personalized language agents distinguish genuine preference changes from temporary context shifts or malicious memory poisoning. CAPTURE employs a neural differential-equation belief tracker, a multi-timescale memory ledger, uncertainty-triggered clarification, and counterfactual auditing to resolve ambiguity. Experiments on 480 episodes from 96 users show CAPTURE outperforms baseline methods, limiting poisoning success while accepting most real preference updates.
By S M Asif Hossain, Ruksat Khan Shayoni, Md Kishor Morol
arXiv:2608.21727v1 Announce Type: cross
Abstract: Reinforcement learning with verifiable rewards (RLVR) is deployed to make models better at reasoning tasks, but its side effect on what models will d...
By Renfei Zhang, Niloofar Mireshghallah