Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agents

Guangsheng Yu, Qin Wang, Rui Lang, Shuai Su, Xu Wang

Abstract

Cloud-hosted large language models (LLMs) have become the de facto planners in agentic systems, coordinating tools and guiding execution over local environments. In many deployments, however, the environment being planned over is private, containing source code, files, credentials, and metadata that cannot be exposed to the cloud. Existing solutions address adjacent concerns, such as execution isolation, access control, or confidential inference, but they do not control what cloud planners observe during planning: within the permitted scope, \textit{raw environment state is still exposed}. We introduce PlanTwin, a privacy-preserving architecture for cloud-assisted planning without exposing raw local context. The key idea is to project the real environment into a \textit{planning-oriented digital twin}: a schema-constrained and de-identified abstract graph that preserves planning-relevant structure while removing reconstructable details. The cloud planner operates solely on this sanitized twin through a bounded capability interface, while a local gatekeeper enforces safety policies and cumulative disclosure budgets. We further formalize the privacy-utility trade-off as a capability granularity problem, define architectural privacy goals using $(k,δ)$-anonymity and $ε$-unlinkability, and mitigate compositional leakage through multi-turn disclosure control. We implement PlanTwin as middleware between local agents and cloud planners and evaluate it on 60 agentic tasks across ten domains with four cloud planners. PlanTwin achieves full sensitive-item non-disclosure (SND = 1.0) while maintaining planning quality close to full-context systems: three of four planners achieve PQS $> 0.79$, and the full pipeline incurs less than 2.2\% utility loss.

PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agents

Abstract

Cloud-hosted large language models (LLMs) have become the de facto planners in agentic systems, coordinating tools and guiding execution over local environments. In many deployments, however, the environment being planned over is private, containing source code, files, credentials, and metadata that cannot be exposed to the cloud. Existing solutions address adjacent concerns, such as execution isolation, access control, or confidential inference, but they do not control what cloud planners observe during planning: within the permitted scope, \textit{raw environment state is still exposed}. We introduce PlanTwin, a privacy-preserving architecture for cloud-assisted planning without exposing raw local context. The key idea is to project the real environment into a \textit{planning-oriented digital twin}: a schema-constrained and de-identified abstract graph that preserves planning-relevant structure while removing reconstructable details. The cloud planner operates solely on this sanitized twin through a bounded capability interface, while a local gatekeeper enforces safety policies and cumulative disclosure budgets. We further formalize the privacy-utility trade-off as a capability granularity problem, define architectural privacy goals using -anonymity and -unlinkability, and mitigate compositional leakage through multi-turn disclosure control. We implement PlanTwin as middleware between local agents and cloud planners and evaluate it on 60 agentic tasks across ten domains with four cloud planners. PlanTwin achieves full sensitive-item non-disclosure (SND = 1.0) while maintaining planning quality close to full-context systems: three of four planners achieve PQS , and the full pipeline incurs less than 2.2\% utility loss.
Paper Structure (39 sections, 4 theorems, 47 equations, 9 figures, 8 tables, 2 algorithms)

This paper contains 39 sections, 4 theorems, 47 equations, 9 figures, 8 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Agent Architecture and Execution Isolation
  4. Capability Interfaces and Access Control
  5. Privacy-Preserving Context Mechanisms
  6. Agent Security Threats and Design Gap
  7. System Model
  8. System Overview
  9. Threat Model
  10. Problem Formulation
  11. Our Approach: PlanTwin
  12. Privacy-Preserving Planning Abstraction
  13. Capability-Based Planning
  14. Local Policy Enforcement
  15. Multi-Turn Disclosure Control
  16. ...and 24 more sections

Key Result

proposition 1

Let $\operatorname{Synth}: \mathcal{Z} \to \mathcal{S}$ be a (possibly randomized) sandbox generator that takes as input only the sanitized twin $Z_t = \Pi(X_t)$. Let $R_{1:T}$ denote the sequence of tool outputs produced by the planner interacting with the sandbox content $S = \operatorname{Synth}( By the Markov property (conditional independence): i.e., the sandbox and all interaction transcrip

Figures (9)

  • Figure 1: End-to-end architecture of PlanTwin. The trusted local edge layer (left) transforms raw context $X_t$ through a four-stage privacy projection pipeline into a sanitized digital twin $Z_t$, which crosses the trust boundary to the cloud planner (center-right). The planner reasons over the typed abstract graph and capability catalog to produce a declarative plan $P_t$. The trusted local execution plane (right) validates each step through a gatekeeper, executes on raw data, and sanitizes outputs via $\Pi_{\text{out}}$ before returning results $Y_t$. The cloud never observes raw files, paths, credentials, or code.
  • Figure 2: The 4-stage privacy projection pipeline. Raw local context enters Stage 1 (typed extraction via local small language model (SLM) and heuristics), proceeds through Stage 2 (sensitive entity redaction via deterministic regex patterns with code-specific rules), Stage 3 (value generalization into bounded buckets), and Stage 4 (schema projection into fixed JSON). The output is a planning-sufficient digital twin $Z_t$ that contains no raw text, filenames, paths, or credentials. A companion output sanitizer $\Pi_{\text{out}}$ applies Stages 2--4 to execution results before cloud exposure.
  • Figure 3: Privacy-utility trade-off for 19 configurations over 60 tasks in 10 domains. Only PlanTwin reaches the ideal high-privacy/utility region, achieving SND=1.0 with PQS$>$0.7. Error bars show per-task standard deviation.
  • Figure 4: Adversarial re-identification accuracy by strategy with $k=15$ candidate files. Error bars show standard deviation, and the dashed line marks the random baseline $1/k$. Full fingerprint matching reaches 94.1% accuracy.
  • Figure 5: Pipeline stage ablation across four variants. All maintain SND = 1.0, while PQS stays within 0.773--0.790, indicating minimal utility loss from privacy hardening. Error bars show per-task standard deviation.
  • ...and 4 more figures

Theorems & Definitions (7)

  • proposition 1: Synthetic-population privacy bound
  • theorem 1: Re-identification Bound
  • proof
  • theorem 2: Cross-Session Unlinkability
  • proof
  • theorem 3: Sequential Composition
  • proof