当安全检查成为隐私风险：LLM 智能体安全审计的隐私保护范式
When Safety Checks Become Privacy Risks: A Privacy-Preserving Paradigm for LLM Agent Safety Auditing
Yixiang Luo · Ziheng Ma · Ke Chang · Jian Wang · Jiqiang Liu
中文摘要
大型语言模型（LLM）智能体通过工具调用与在线服务交互，可能访问隐私数据或执行敏感操作。专业提供商可为智能体运营方提供并维护执行前安全审计能力，但将任务描述、调用参数和交互历史发送给外部审计方可能泄露敏感用户信息。提出一种隐私保护安全审计范式，将委托审计计算与明文访问及执行权限分离。基于三域审计模型，该范式通过显式接口连接可信表示构建、加密审计计算以及可信决策与执行。这些接口可容纳替代表示与评分器，加密计算保护审计输入免受半诚实审计方窥探。在 SealCall 框架中实例化该范式，结合学习型审计表示、基于 CKKS 的加密相似度计算以及与受审计工具调用绑定的执行控制。在 1,252 个公开二元候选上评估，SealCall 在分组嵌套评估下平均 F1 分数为 0.840，并在所有测量案例中保持明文审计决策。代表性配置完成每次加密评分操作耗时 0.176 秒。
关键要点
- 01外部安全审计需上传任务描述与调用参数，可能泄露用户敏感信息
- 02提出三域审计模型，分离委托计算与明文访问及执行权限
- 03SealCall 结合学习型表示、CKKS 加密相似度与执行控制
- 041,252 个候选上平均 F1 为 0.840，单次加密评分 0.176 秒
- 05加密计算仅防半诚实审计方，未覆盖恶意审计方场景
解读
尚无解读。
原始英文摘要
arXiv:2610.41401v1 Announce Type: cross Abstract: Large language model agents interact with online services through tool calls that may access private data or perform sensitive actions. Specialized providers can supply and maintain pre-execution safety auditing capabilities for agent operators. However, sending task descriptions, call arguments, and interaction histories to an external auditor may expose sensitive user information. In this work, we propose a paradigm for privacy-preserving safety auditing that separates delegated audit computation from plaintext access and execution authority. Grounded in a three-domain auditing model, the paradigm connects trusted representation construction, encrypted audit computation, and trusted decision and execution through explicit interfaces. These interfaces accommodate alternative representations and scorers, while encrypted computation protects audit inputs from a semi-honest auditor. We instantiate this paradigm in SealCall, a framework combining learned audit representations, CKKS-based encrypted similarity computation, and execution control bound to audited tool calls. Evaluated on 1,252 public binary candidates, SealCall achieves a mean F1 score of 0.840 under grouped nested evaluation, while preserving plaintext audit decisions in all measured cases. A representative configuration completes each encrypted scoring operation in 0.176 s.