{"id":"https://openalex.org/W4405182239","doi":"https://doi.org/10.1145/3658644.3690350","title":"AirGapAgent: Protecting Privacy-Conscious Conversational Agents","display_name":"AirGapAgent: Protecting Privacy-Conscious Conversational Agents","publication_year":2024,"publication_date":"2024-12-02","ids":{"openalex":"https://openalex.org/W4405182239","doi":"https://doi.org/10.1145/3658644.3690350"},"language":"en","primary_location":{"id":"doi:10.1145/3658644.3690350","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690350","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690350","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690350","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114402613","display_name":"Eugene Bagdasarian","orcid":"https://orcid.org/0000-0002-7994-6469"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Eugene Bagdasarian","raw_affiliation_strings":["Google Research, New York, USA"],"raw_orcid":"https://orcid.org/0000-0002-7994-6469","affiliations":[{"raw_affiliation_string":"Google Research, New York, USA","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101915554","display_name":"Ren Yi","orcid":"https://orcid.org/0000-0002-0238-3573"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ren Yi","raw_affiliation_strings":["Google Research, New York, USA"],"raw_orcid":"https://orcid.org/0000-0002-0238-3573","affiliations":[{"raw_affiliation_string":"Google Research, New York, USA","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052472139","display_name":"Sahra Ghalebikesabi","orcid":"https://orcid.org/0000-0002-2515-9507"},"institutions":[{"id":"https://openalex.org/I4210113297","display_name":"Google (United Kingdom)","ror":"https://ror.org/024bc3e07","country_code":"GB","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210113297","https://openalex.org/I4210128969"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Sahra Ghalebikesabi","raw_affiliation_strings":["Google Deepmind, London, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0002-2515-9507","affiliations":[{"raw_affiliation_string":"Google Deepmind, London, United Kingdom","institution_ids":["https://openalex.org/I4210113297"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064699160","display_name":"Peter Kairouz","orcid":"https://orcid.org/0000-0001-6897-5937"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I58610484","display_name":"Seattle University","ror":"https://ror.org/02jqc0m91","country_code":"US","type":"education","lineage":["https://openalex.org/I58610484"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peter Kairouz","raw_affiliation_strings":["Google Research, Seattle, USA"],"raw_orcid":"https://orcid.org/0000-0001-6897-5937","affiliations":[{"raw_affiliation_string":"Google Research, Seattle, USA","institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I58610484"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078160983","display_name":"Marco Gruteser","orcid":"https://orcid.org/0000-0002-7424-4951"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Marco Gruteser","raw_affiliation_strings":["Google Research, New York, USA"],"raw_orcid":"https://orcid.org/0000-0002-7424-4951","affiliations":[{"raw_affiliation_string":"Google Research, New York, USA","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028243041","display_name":"Sewoong Oh","orcid":"https://orcid.org/0000-0002-8975-8306"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I58610484","display_name":"Seattle University","ror":"https://ror.org/02jqc0m91","country_code":"US","type":"education","lineage":["https://openalex.org/I58610484"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sewoong Oh","raw_affiliation_strings":["Google Research, Seattle, USA"],"raw_orcid":"https://orcid.org/0000-0002-8975-8306","affiliations":[{"raw_affiliation_string":"Google Research, Seattle, USA","institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I58610484"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085679401","display_name":"Borja Balle","orcid":"https://orcid.org/0009-0003-8726-2803"},"institutions":[{"id":"https://openalex.org/I4210113297","display_name":"Google (United Kingdom)","ror":"https://ror.org/024bc3e07","country_code":"GB","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210113297","https://openalex.org/I4210128969"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Borja Balle","raw_affiliation_strings":["Google Deepmind, London, United Kingdom"],"raw_orcid":"https://orcid.org/0009-0003-8726-2803","affiliations":[{"raw_affiliation_string":"Google Deepmind, London, United Kingdom","institution_ids":["https://openalex.org/I4210113297"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5071710055","display_name":"Daniel Ramage","orcid":null},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I58610484","display_name":"Seattle University","ror":"https://ror.org/02jqc0m91","country_code":"US","type":"education","lineage":["https://openalex.org/I58610484"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Daniel Ramage","raw_affiliation_strings":["Google Research, Seattle, USA"],"raw_orcid":"https://orcid.org/0009-0008-1390-3475","affiliations":[{"raw_affiliation_string":"Google Research, Seattle, USA","institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I58610484"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":5.3,"has_fulltext":true,"cited_by_count":15,"citation_normalized_percentile":{"value":0.96864513,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"3868","last_page":"3882"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9861000180244446,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9821000099182129,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8536455631256104},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6597282886505127},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5642490386962891},{"id":"https://openalex.org/keywords/rendering","display_name":"Rendering (computer graphics)","score":0.5349997282028198},{"id":"https://openalex.org/keywords/private-information-retrieval","display_name":"Private information retrieval","score":0.5248249173164368},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5085393190383911},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.5085378885269165},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.4236186742782593},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.4212642014026642},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.4134679138660431},{"id":"https://openalex.org/keywords/human\u2013computer-interaction","display_name":"Human\u2013computer interaction","score":0.36969923973083496},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.1689935326576233},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.06965580582618713}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8536455631256104},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6597282886505127},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5642490386962891},{"id":"https://openalex.org/C205711294","wikidata":"https://www.wikidata.org/wiki/Q176953","display_name":"Rendering (computer graphics)","level":2,"score":0.5349997282028198},{"id":"https://openalex.org/C99221444","wikidata":"https://www.wikidata.org/wiki/Q1532069","display_name":"Private information retrieval","level":2,"score":0.5248249173164368},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5085393190383911},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5085378885269165},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4236186742782593},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.4212642014026642},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.4134679138660431},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.36969923973083496},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.1689935326576233},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.06965580582618713},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3658644.3690350","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690350","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690350","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3658644.3690350","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690350","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690350","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.5699999928474426,"id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4405182239.pdf","grobid_xml":"https://content.openalex.org/works/W4405182239.grobid-xml"},"referenced_works_count":37,"referenced_works":["https://openalex.org/W72496981","https://openalex.org/W1587574739","https://openalex.org/W1640628807","https://openalex.org/W2002204971","https://openalex.org/W2004915866","https://openalex.org/W2007395635","https://openalex.org/W2013823004","https://openalex.org/W2057028717","https://openalex.org/W2066266646","https://openalex.org/W2088609604","https://openalex.org/W2104359975","https://openalex.org/W2130099852","https://openalex.org/W2147435839","https://openalex.org/W2245160765","https://openalex.org/W2797851444","https://openalex.org/W2911978475","https://openalex.org/W2946325696","https://openalex.org/W2952718464","https://openalex.org/W3035252911","https://openalex.org/W3093715810","https://openalex.org/W3133843004","https://openalex.org/W4206199121","https://openalex.org/W4283170666","https://openalex.org/W4283172211","https://openalex.org/W4292078547","https://openalex.org/W4320165837","https://openalex.org/W4327739747","https://openalex.org/W4328051263","https://openalex.org/W4385894687","https://openalex.org/W4388092128","https://openalex.org/W4390041933","https://openalex.org/W4392490108","https://openalex.org/W6602972026","https://openalex.org/W6770247297","https://openalex.org/W6852967902","https://openalex.org/W6860774757","https://openalex.org/W6898505805"],"related_works":["https://openalex.org/W4320018150","https://openalex.org/W4239582170","https://openalex.org/W2918664383","https://openalex.org/W106056076","https://openalex.org/W4320855730","https://openalex.org/W2135200719","https://openalex.org/W2260680879","https://openalex.org/W2034199088","https://openalex.org/W1551379303","https://openalex.org/W2085319386"],"abstract_inverted_index":{"The":[0],"growing":[1],"use":[2],"of":[3,48,68,114],"large":[4],"language":[5],"model":[6,40],"(LLM)-based":[7],"conversational":[8],"agents":[9,20,53,105],"to":[10,50,60,78,88,139,145],"manage":[11],"sensitive":[12],"user":[13,141],"data":[14,81,91,142],"raises":[15],"significant":[16],"privacy":[17,162],"concerns.While":[18],"these":[19],"excel":[21],"at":[22,63],"understanding":[23],"and":[24,101,161],"acting":[25],"on":[26,131],"context,":[27],"this":[28,112],"capability":[29],"can":[30],"be":[31],"exploited":[32],"by":[33,83],"malicious":[34],"actors.We":[35],"introduce":[36,72],"a":[37,74,94,126,132],"novel":[38],"threat":[39],"where":[41],"adversarial":[42],"third-party":[43],"apps":[44],"manipulate":[45],"the":[46,61,66,85,90,154],"context":[47,115,128],"interaction":[49],"trick":[51],"LLM-based":[52],"into":[54],"revealing":[55],"private":[56],"information":[57],"not":[58],"relevant":[59],"task":[62],"hand.Grounded":[64],"in":[65,110],"framework":[67],"contextual":[69],"integrity,":[70],"we":[71,123],"AirGapAgent,":[73],"privacy-conscious":[75],"agent":[76,120,135],"designed":[77],"prevent":[79],"unintended":[80],"leakage":[82],"restricting":[84],"agent's":[86],"access":[87],"only":[89],"necessary":[92],"for":[93],"specific":[95],"task.Extensive":[96],"experiments":[97],"using":[98],"Gemini,":[99],"GPT,":[100],"Mistral":[102],"models":[103],"as":[104],"validate":[106],"our":[107],"approach's":[108],"effectiveness":[109],"mitigating":[111],"form":[113],"hijacking":[116,129],"while":[117,147],"maintaining":[118],"core":[119],"functionality.For":[121],"example,":[122],"show":[124],"that":[125],"single-query":[127],"attack":[130,156],"Gemini":[133],"Ultra":[134],"reduces":[136],"its":[137],"ability":[138],"protect":[140],"from":[143],"94%":[144],"45%,":[146],"an":[148],"AirGapAgent":[149],"achieves":[150],"97%":[151],"protection,":[152],"rendering":[153],"same":[155],"ineffective.":[157],"CCS":[158],"Concepts":[159],"Security":[160],"Information":[163],"flow":[164],"control.":[165]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":5}],"updated_date":"2026-08-02T14:50:37.381335","created_date":"2025-10-10T00:00:00"}