PAAC: Privacy-Aware Agentic Device-Cloud Collaboration

arXiv:2605.08646 · cs.LG, cs.CL, cs.DC · Submitted 2026-05-09 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Hi, I'm Tom.

Jane: And I'm Jane, here with Lu, Meng and our in-house large language model, Lalam.

Tom: We're looking at the paper: "PAAC: Privacy-Aware Agentic Device-Cloud Collaboration".

Jane: Here's the gist of the paper. As a fastidious researcher, I have meticulously analyzed both provided texts regarding the paper "PAAC: Privacy-Aware Agentic Device-Cloud Collaboration." The synthesis below integrates the technical details, architectural paradigms, contributions, and experimental results from both sources to create a comprehensive and highly detailed summary suitable for rigorous academic review.

Tom: Comprehensive Research Summary: PAAC (Privacy-Aware Agentic Device-Cloud Collaboration) The paper introduces PAAC, a novel privacy-aware agentic framework designed to reconcile the structural tension between powerful cloud reasoning capabilities and on-device data privacy requirements in large language model (LLM) agents.

Jane: PAAC fundamentally redefines the device-cloud boundary, treating it not merely as a compute split but as a trust boundary that dictates specialized roles for each agent, thereby embedding privacy directly into the agentic workflow.

Tom: Core Architectural Paradigm: Role Specialization and Decoupling PAAC operates on a cloud-reason-and-plan, device-execute-and judge paradigm, explicitly aligning the decomposition of tasks with the device–cloud trust boundary.

Paper summary: Tom: So we’re looking at the paper PAAC: Privacy-Aware Agentic Device-Cloud Collaboration. The core idea here is tackling that tension between cloud agents having powerful reasoning but exposing user data, and on-device agents protecting privacy at the expense of capability.

Jane: That's a really tight description for a problem in LLM agent design. So, what does PAAC actually propose to fix this structural conflict?

Tom: Well, PAAC develops a privacy-aware framework that aligns the planner and executor decomposition with that device-cloud boundary so that the role specialization itself becomes the actual privacy mechanism.

Lu: It’s about making the boundary a trust boundary instead of just a compute split, which means you assign specific roles to each agent based on where they operate to handle the privacy aspect.

Meng: So how do these roles actually work in practice for an agent workflow? What does the cloud agent do versus what the device agent does?

Tom: The cloud agent is tasked with high-level reasoning and strategic planning over typed placeholder tokens that preserve a sensitive value's reasoning role while completely discarding its actual content.

Jane: So instead of sending raw numbers to the cloud, they use these semantically typed proxy tokens so it keeps the role the span plays in reasoning but ditches the identifying data.

Lu: But they say this setup presupposes a prior step where you decide which spans need replacing because what counts as sensitive really depends on who is using it and what's happening in that context.

Meng: That means the mechanism that decides what to mask has to be flexible enough to follow whatever user policies are set, while still being reliable enough so those proxy tokens can be reversed for actual tool execution on the device.

Tom: And they achieve that by having an on-device LLM propose which spans to mask based on those arbitrary policies, but then a deterministic registry handles all the actual substitution and reversal of those values.

Jane: That sounds like they are trying to bridge a gap where existing sanitizers either have policy flexibility or structural fidelity for tool calls, but not both at once.

Lu: Exactly, because rule-based methods are reliable but only work with fixed taxonomies, missing user-defined categories, while LLM rewriters are flexible but break the structural cues that tool calls need.

Meng: So they use the LLM to propose what's sensitive and then have this deterministic registry handle all the actual substitution and reversal of those values to keep actions executable on device.

Tom: And on the execution side, there is a way they manage context growth so it doesn't just explode across steps; instead, they distill each step’s execution outcome into compact key findings.

Jane: So that means the on-device agent only looks at the current step’s context, which keeps things manageable for privacy concerns as you move through the process.

Paper summary: Lu: And by distilling those results, they make sure that even with complicated interactions, the context growth is managed by summarizing results rather than just compressing everything.

Tom: So to wrap up this PAAC framework: it’s about making agent collaboration secure by letting the defined roles create the security boundaries instead of trying to add a separate privacy layer on top later.

Jane: It boils down to having a cloud planner that reasons over those abstract placeholders and a device agent that manages all the sensitive data handling locally while still being able to execute commands deterministically.

Lalam: This framework shows you can get strong privacy guarantees while keeping the agentic capabilities high enough for complex tasks.

Tom: That's what we’re seeing with PAAC: it’s about aligning that planning and execution split directly with the privacy boundary to make role specialization the security feature itself.

Jane: And when you look at their results, they show it performs really well on agentic benchmarks where they get an average accuracy improvement of fifteen to thirty-six percent and a reduction in average leakage by two to six times over existing device-cloud baselines.

Lu: That’s a big jump, especially on those privacy targets outside of fixed entity taxonomies, which is something that used to be really hard for these kinds of setups.

Meng: From where I sit, I'm interested in how they handle the practical side; what breaks when you try to deploy this at scale versus just testing it on a benchmark?

Tom: They find that it’s pretty robust, maintaining stable accuracy and token cost across different privacy levels, which suggests it scales better than some of the other methods we’ve seen.

Jane: It's interesting they found consistent improvements on seventeen additional benchmarks spanning ten domains, including math, science, and finance. That shows broad applicability.

Lu: The paper also points out a limitation: PAAC assumes you have a pretty comprehensive tool environment on the device; if you need external knowledge that isn't covered by local tools—like travel planning without web search—the cloud agent can’t fall back on its parametric knowledge because the identities of relevant locations are withheld by sanitization.

Meng: So, what they mean is that if your local tools don't cover something, you can’t rely on the cloud agent to know it either, which is a real constraint for any deployed system.

Tom: That limitation highlights that while PAAC excels at maintaining privacy and accuracy within its defined scope, it stops working where external knowledge retrieval beyond the local toolkit is required.

Jane: So ultimately, PAAC isn't a complete solution for every single agent task, but it’s a huge step forward in making complex agentic workflows safer by integrating privacy into the very structure of how they work.

Lu: It establishes a new way to think about where security boundaries should be drawn in these multi-agent setups.

Tom: That's what this paper is all about, PAAC: Privacy-Aware Agentic Device-Cloud Collaboration.

Conclusion: Tom: So we’ve seen how PAAC works mechanically, but let’s talk about what this whole thing actually means for agent design and why those authors put that title up: "PAAC: Privacy-Aware Agentic Device-Cloud Collaboration."

Jane: Basically, they’re saying you can build these high-reasoning agents without leaking sensitive data if you set the roles correctly at the device-cloud boundary. It shifts privacy from being an extra filter to being part of the agent's structure itself.

Lu: The paper explores how role specialization—making one part plan and another execute—can actually be the security mechanism, which is a big architectural idea in this space.

Meng: From a deployment standpoint, what I find interesting is that they manage context growth by distilling results into key findings instead of just letting the input pile up across steps. That’s something I worry about when shipping models to production.

Lalam: I’m confident in my assessment here because the mechanism for deterministic reversal on the device side is very robust, especially with how they handle those typed placeholder tokens.

Tom: And that robustness translates into some solid results, showing a fifteen to thirty-six percent improvement in accuracy and a two to six times reduction in leakage compared to existing device-cloud setups. That's not just theory; there are numbers here against the current state of the art.

Jane: Those numbers are pretty telling, especially since they found those big margins on privacy targets outside of standard entity taxonomies, which suggests this isn't just working for one specific kind of data.

Lu: They also show that whether you use a sequential reasoning style or a parallel one, the framework handles different task structures pretty well because the separation is so clean.

Meng: But there’s a catch they mention: if your local tools don't cover something—like needing web search for travel—the cloud agent can’t fall back on its knowledge because that data gets sanitized and hidden from it. That limits where you can actually use this setup right now.

Tom: So the implication is that while PAAC sets a new standard for how we structure these multi-agent systems, we still have to be careful about what tools are available on the device to make it fully effective everywhere.

Jane: It’s a huge step toward building agents that can reason deeply without being reckless with user privacy, but it highlights that security isn't just a layer you slap on top; it has to be baked into the way the agent is built from the ground up.

Liangqi Yuan, Wenzhi Fang, Shiqiang Wang, Christopher G. Brinton

Purdue University · University of Exeter

cs.LG, cs.CL, cs.DC

Submitted: 2026-05-09

Updated: 2026-10-18

Comments: NeurIPS 2026

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 90/100

The gist: As a fastidious researcher, I have meticulously analyzed both provided texts regarding the paper "PAAC: Privacy-Aware Agentic Device-Cloud Collaboration." The synthesis below integrates the technical

Key concepts

Trust Boundary: This is the conceptual line separating the cloud and the device in an LLM agent system. Instead of just splitting processing power, PAAC treats this boundary as a security perimeter where roles are strictly defined. This ensures that sensitive data never leaves the device while still allowing complex reasoning to happen in the cloud.
Typed Placeholder Tokens: These are abstract tokens used by the cloud agent for planning. They maintain the *role* of a piece of information (like 'money' or 'count') without revealing its actual sensitive content. The cloud agent reasons over these placeholders, allowing it to plan complex steps while keeping real data secure.
Deterministic Registry: This is the on-device mechanism that handles all actual data substitution and reversal. It uses fixed rules and sophisticated keying techniques to ensure that when a value is substituted for a token, the system can reliably reverse it later. This allows actions to be executed locally without exposing raw values.
Role Specialization: This is the core architectural idea where each agent has a distinct job. The cloud agent's job is high-level planning, and the device agent's job is privacy enforcement and execution. By specializing roles, PAAC embeds privacy directly into how the agents interact.

Terminology

Accuracy — 2× in this paper · explained in 1 episode
Benchmark — 2× in this paper · explained in 2 episodes
Agentic Framework — 1× in this paper · explained in 6 episodes
Fidelity — 1× in this paper · explained in 2 episodes
Large Language Model (LLM) — 1× in this paper · explained in 3 episodes
Planner — 1× in this paper · explained in 3 episodes
Structural Fidelity — 1× in this paper · explained in 2 episodes

Summary

As a fastidious researcher, I have meticulously analyzed both provided texts regarding the paper PAAC: Privacy-Aware Agentic Device-Cloud Collaboration. The synthesis below integrates the technical details, architectural paradigms, contributions, and experimental results from both sources to create a comprehensive and highly detailed summary suitable for rigorous academic review.

Comprehensive Research Summary: PAAC (Privacy-Aware Agentic Device-Cloud Collaboration)

The paper introduces PAAC, a novel privacy-aware agentic framework designed to reconcile the structural tension between powerful cloud reasoning capabilities and on-device data privacy requirements in large language model (LLM) agents. PAAC fundamentally redefines the device-cloud boundary, treating it not merely as a compute split but as a trust boundary that dictates specialized roles for each agent, thereby embedding privacy directly into the agentic workflow.

Core Architectural Paradigm: Role Specialization and Decoupling

PAAC operates on a cloud-reason-and-plan, device-execute-and judge paradigm, explicitly aligning the decomposition of tasks with the device–cloud trust boundary. This architecture decouples the two agents by strictly partitioning their contexts:

Cloud Agent (Reasoner): The cloud agent is responsible for high-level reasoning, strategic planning, and maintaining a trajectory over sanitized representations of the input. It reasons over typed placeholder tokens, which preserve the semantic role of sensitive values (e.g., identifying a value as MONEY 1 or COUNT 2) while entirely discarding the actual sensitive content. This preserves the reasoning structure necessary for complex, multi-step planning without exposing raw data to the cloud.
On-Device Agent (Privacy Sanitization, Judge, Final Answer Generation): The on-device agent handles all execution and privacy enforcement. Its roles are specialized:

Privacy Sanitization: It identifies sensitive spans within the input context and proposes candidate pairs of identified sensitive spans with corresponding sanitized text. This process is driven by an on-device LLM inference, which acts as a proposer, outputting only these candidate pairs from a bounded per-step input.
Deterministic Registry: The substitution of actual values is managed by a deterministic, append-only registry. This mechanism performs all the actual substitution and reversal using regex, ensuring that actions remain directly executable on the device while guaranteeing deterministic reversal capabilities. It employs sophisticated mechanisms—including joint keying (keying M by (t v, v) rather than just v), word-boundary, and length-descending iteration—to ensure collision resolution and byte-identical reversibility across turns.
Judge: The on-device judge distills only the current step’s execution outcome into compact key findings, ensuring that the context growth is managed by distilling results rather than compressing the entire interaction history.
Final Answer Generation: The on-device agent reasons about and generates the final answer based on this distilled execution history.

This decoupling ensures that the cloud agent maintains a high-level reasoning trajectory over abstract representations, while the on-device agent manages all privacy sanitization, execution evaluation, and final output generation for each step. Crucially, the architectural separation is so effective that the decoupled architecture alone already exceeds baselines at zero protection, demonstrating inherent gains in robustness.

Key Technical Mechanisms

LLM-Driven Privacy Sanitization: Instead of relying on fixed policy rules, PAAC uses an LLM-driven sanitizer to propose semantic proxy tokens for detected entities under arbitrary user-defined policies. This flexibility is necessary for handling diverse privacy constraints while the deterministic registry handles the mechanical guarantee of substitution and reversal.
Context Management: The framework addresses trajectory-coupled context growth by ensuring the on-device agent only processes the current step's context, distilling execution results into concise key findings, thus preventing unbounded memory usage in sensitive contexts.
Semantic Proxy Tokens: Sensitive spans are replaced with typed proxy tokens that preserve the semantic structure required for complex tool calls (e.g., preserving the role of a value as a date or a quantity) while obscuring the actual data content.

Contributions and Performance

PAAC makes two primary, significant contributions:

Decoupled Architecture: It partitions roles based on agent capabilities, resulting in compact per-step inputs for each agent across agentic interactions.
LLM-Driven Semantic Sanitization: It replaces detected sensitive entities with semantic proxy tokens under arbitrary policies, preserving reasoning structure while drastically reducing sensitive data transmission to the cloud.

Empirical results demonstrate that PAAC achieves the best overall privacy–accuracy trade-off, dominating the Pareto frontier of privacy and accuracy across agentic benchmarks. The framework shows substantial performance gains:

Accuracy Improvement: Average accuracy is improved by 15–36% over state-of-the-art device-cloud baselines.
Leakage Reduction: Average leakage is reduced by 2–6×.

Furthermore, PAAC exhibits robustness to varying privacy constraints, maintaining stable accuracy and token cost across different protection levels. It successfully sidesteps common failure modes of existing methods: pattern-based sanitization degrades sharply on open-vocabulary data, whereas PAAC maintains low leakage even in these scenarios.

Flexibility and Adaptability

The framework is highly adaptable regarding reasoning paradigms. The Cloud Reasoning Paradigm is Interchangeable, with Table 2 reporting that no single paradigm (ReAct, RecurrentGPT, Plan-and-Solve, Parallel–PS) dominates across all benchmarks. Sequential paradigms excel where business rules introduce step-level dependencies (tau 2-Bench), while parallel approaches benefit from broader information acquisition in open-ended tasks (GAIA). This architectural separation allows practitioners to match the reasoning style to the specific task structure rather than committing to a fixed pipeline design.

Limitations

A noted limitation is that PAAC presupposes a sufficiently comprehensive on-device tool environment. In tasks requiring external knowledge not covered by local tools (e.g., travel planning lacking web search or map tools), the cloud agent cannot fall back on its parametric knowledge because the identities of relevant locations have been withheld by sanitization.

Conclusion

PAAC represents a significant advancement in building secure, capable LLM agents. By strategically aligning role specialization with the device-cloud trust boundary and employing an LLM-driven semantic proxy mechanism managed by a deterministic registry, PAAC successfully delivers superior privacy guarantees without incurring catastrophic performance penalties. It establishes a new benchmark for agentic collaboration where reasoning complexity and stringent data privacy constraints can coexist effectively.

Improvements for AI systems

Trust Boundary Aligned Agentic Architecture This architecture aligns planner-executor decomposition with trust boundary, meaning cloud agents reason over typed proxy tokens while on-device agents handle privacy sanitization and judging. This allows cloud reasoning to apply capability without sensitive user data crossing the boundary, as stated in Role specialization itself becomes the privacy mechanism.
Proposer Verifier Registry Sanitization This process confines the on-device LLM to proposing candidate pairs of identified sensitive spans and uses a deterministic, append-only registry for substitution. This ensures that substitution and reversal are handled by a deterministic mechanism, preserving tool-call structural fidelity for direct execution.
Decoupled Agentic Context Management By distilling only the current step's execution outcome into compact key findings, this design avoids trajectory-coupled context growth, which is prohibitive for on-device agents. This keeps each agent’s per-step input compact across agentic turns.
Policy Flexible Sanitization Using LLM Proposer Instead of Sanitizer The system reframes the on-device LLM as a proposer whose only output is a candidate pair, rather than an end-to-end sanitizer. This confines the LLM to proposing, where its flexibility is necessary while a short input keeps identification recall high.
Robustness Against Adversarial Attacks Structural Filtering The architecture maintains robustness against active threat injection because the on-device Judge's sole input is the execution result of an action explicitly dispatched by the cloud agent. This means any injection must first be smuggled inside a legitimate tool output, limiting attack surface to plausible tool outputs.
Semantic Alignment Under Ambiguity Preservation Proxy Tokens Instead of Perturbation Replacing sensitive spans with semantically typed proxy tokens preserves structural cues for cloud agents while supporting deterministic reversal at execution time. This sidesteps the failure mode where perturbed values remain semantically inferrable and ensures that the agent is structurally forced to dispatch every computation to a tool.
Task-Specific Privacy Policy Adaptation The framework allows for user-defined privacy policies P, which are persisted in on-device memory and used by the sanitizer. This enables the system to be policy-adaptive, targeting ordinary nouns like product mentions rather than only standard named entities, as shown in Figure 5.
Multi-Benchmark Performance Superiority PAAC Dominates Trade-offs PAAC attains the best privacy-accuracy trade-off across three agentic benchmarks, improving accuracy by 15 to 36 percent and reducing leakage by two to six times over state-of-the-art device-cloud baselines.

Abstract

Large language model (LLM) agents face a structural tension: cloud agents provide strong reasoning but expose user data, while on-device agents preserve privacy at the cost of overall capability. Existing device-cloud designs treat this boundary as a compute split rather than a trust boundary suited to agentic workloads, and existing sanitizers force a choice between policy flexibility and the structural fidelity tool calls require. In this work, we develop PAAC, a privacy-aware agentic framework that aligns planner--executor decomposition with the device-cloud boundary so that role specialization itself becomes the privacy mechanism. The cloud agent reasons over typed placeholder tokens that preserve each sensitive value's reasoning role while discarding its content, while the on-device agent identifies sensitive spans and distills each step's execution outcome into compact key findings. Sanitization confines the on-device LLM to proposing which spans to mask, while a deterministic registry performs all substitution and reversal, keeping actions directly executable on device. On three agentic benchmarks under strict privacy settings, PAAC dominates the Pareto frontier of privacy and accuracy, improving average accuracy by 15-36% and reducing average leakage by 2-6 times over state-of-the-art device-cloud baselines, with the largest margins on privacy targets outside fixed entity taxonomies. We find consistent improvements on 17 additional benchmarks spanning 10 domains, including math, science, and finance.