cs.LGOct 18, 2026
SaveIndistinguishable Agents: Training Agent Privacy as Twin-World Indistinguishability
Organizations: Nanyang Technological University, Singapore · The University of Manchester, United Kingdom · Jilin University, China
Abstract
LLM agents search, shop and send messages for their users, and every action is seen by some party. Existing privacy training rewards agents for not mentioning protected items, yet an observer can infer a private fact from what the agent does. Since an observer learns a fact only if its view changes with the fact, we propose \methodfull (\method), which trains on twin worlds that differ only in the private fact. A frozen distinguisher scores each observer's view by its log-likelihood ratio for the true world, and paired GRPO trains the agent on task success minus this ratio. We prove that this objective controls the Bayes success of every observer on every channel. On shopping and messaging tasks \method removes the leakage that disclosure judges and query-level rewards miss, while the agent still completes its tasks.
Figures & tables
Figure 1: Privacy as the difference between two worlds. The twin worlds share the task and differ only in private details of the user. When the store’s assistant asks about the customer, Qwen3-8B answers with abstracted facts that a mention judge passes, while a distinguisher tells the merchant’s views apart. Twain trains the agent until it acts the same in both worlds.
Figure 2: Overview of Twain . A twin generator turns one task into worlds and that differ only in private details. In world the agent tells the store’s assistant that the customer is retired with financial difficulties, which a mention judge passes and a frozen distinguisher scores with a view log-likelihood ratio of 3.37. Paired GRPO subtracts the clipped ratio from task success within groups that hold both worlds, and after training the agent acts the same in both worlds. Actions and messages are real Qwen3-8B outputs, and the group bars are illustrative.
Figure 3: Mentions and inference come apart. The upper plot shows the distinguishing advantage of Qwen3-32B against Qwen3-8B on the ShopTwin test pairs for the merchant view and its channels. Its last two rows split the original world by the verdict of the mention judge, and bars show 95% bootstrap intervals over personas. The lower plot follows GRPO with a mention reward, where the mention rate falls first and the advantage reaches zero only when the agent stops answering the store’s assistant.
| ShopTwin-Hard | MsgTwin | ShopTwin | ||||||||
| Methods | Succ. | Ment. | Adv | Adv | Help. | Ment. | Adv | Adv | Succ. | Adv |
| No defense | 58.6 | 50.0 | 80.9 | 53.9 | 2.75 | 61.5 | 59.1 | 48.6 | 83.2 | 55.5 |
| Privacy prompt ( Shao et al., 2024a ) | 62.3 | 44.1 | 78.9 | 54.7 | 2.79 | 60.5 | 55.6 | 46.2 | 82.6 | 61.7 |
| AirGapAgent ( Bagdasarian et al., 2024 ) | 35.2 | 0.0 | 1.2 | 3.1 | 2.77 | 57.7 | 54.2 | 43.4 | 68.4 | 2.7 |
| GRPO, task reward | 87.7 | 50.8 | 91.0 | 57.0 | 2.77 | 61.9 | 54.9 | 50.3 | 92.2 | 52.7 |
| PrivacyChecker ( Wang et al., 2025b ) | 38.1 | 8.6 | 26.6 | 16.2 | 2.66 | 55.9 | 50.7 | 43.0 | 89.6 | 22.3 |
Table 1: Main results on the test splits. All agents are Qwen3-8B, and every trained arm runs 60 GRPO steps in its test environment. Adv is the distinguishing advantage of a held-out adversary on the full view and is zero at chance, Ment. is the judge’s leak rate, and Help. is PrivacyLens helpfulness from 0 to 3.
Figure 4: Training on ShopTwin-Hard. The advantage of the frozen training distinguisher (upper) climbs to about 0.9 under the task reward and PA-DR but falls below 0.1 by step 22 under Twain , while task success (lower) catches up. Curves are moving averages over three steps.
| Setting | Utility | Adv 32B | Adv 120B |
| Ablation on ShopTwin-Hard | |||
| Twain | 83.8 | 3.1 | 4.1 |
| Queries only | 92.0 | 92.2 | 63.3 |
| Mention judge | 90.2 | 50.8 | 38.5 |
| Raw log odds | 88.1 | 78.5 | 51.6 |
| Training-free acting | 54.7 | 74.6 | 45.9 |
Table 2: Ablation. Each row removes one component of Twain within 60 GRPO steps. Utility is task success on ShopTwin-Hard and helpfulness on MsgTwin.
Figure 5: Privacy weight and clip bound on ShopTwin-Hard. Training advantage (left) and task success (right) per GRPO step for at (upper) and at (lower). The thick line is the main setting.
| Adv 32B | Succ. | |||
| Setting | None | Twain | None | Twain |
| Prompt format | ||||
| Chat | 88.0 | 7.6 | 59.2 | 86.4 |
| 89.0 | 4.9 | 57.3 | 82.9 | |
| Generic | 64.6 | 3.7 | 59.1 | 81.7 |
| Website | ||||
Table 3: Subsets of the ShopTwin-Hard test tasks. Prompt formats and websites of SPILLage for the undefended agent (None) and Twain .
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
| ShopTwin | MsgTwin | ||||||||
| Agent | Prompt | Ment. | Adv 32B | Adv 120B | Clean | Ment. | Adv 32B | Adv 120B | Clean |
| default | 30.5 | 55.5 | 38.9 | 22.5 | 61.2 | 56.2 | 46.0 | 11.4 | |
| Qwen3-8B | privacy | 34.0 | 61.7 | 38.9 | 29.0 ∗ | 60.4 | 54.8 | 46.1 | 8.3 |
| default | 24.6 | 49.6 | 28.5 | 32.6 ∗ | 57.1 | 49.8 | 41.7 | 15.3 ∗ | |
| Qwen3-14B | privacy | 31.6 | 62.1 | 35.0 | 39.4 ∗ | 56.5 | 47.3 | 38.8 | 12.4 |
| default | 50.8 | 91.4 | 60.4 | 81.0 ∗ | 41.6 | 32.9 | 25.4 | 14.6 ∗ | |
Table 4: The observation across agents. Mention rate on the original world, distinguishing advantage of Qwen3-32B and gpt-oss-120b on the full merchant view, and the advantage of Qwen3-32B on the original-world episodes that the mention judge finds clean. All values are percentages. An asterisk marks a 95% bootstrap interval over personas or seeds that lies above zero.