LLM agents now search, shop, and send messages on behalf of users, and every action is observed by some party. The authors of a new arXiv paper argue that current privacy training is too narrow: it rewards agents for not mentioning protected items, yet an observer can often infer a private fact from what the agent does — which sites it visits, what it clicks, how it phrases a request.
The paper, "Indistinguishable Agents: Training Agent Privacy as Twin-World Indistinguishability," proposes a different objective. Instead of teaching agents to avoid certain words, the goal is to make an agent's entire behavior indistinguishable across two "twin" worlds that differ only in the private fact to be protected. If the agent acts the same whether the secret is true or false, no observer can reliably infer it.
The approach reframes privacy as a property of the full action distribution rather than a list of forbidden topics. The abstract is truncated in the source, so details of the training procedure are not fully described here, but the core idea is clear: privacy should be measured by how much an agent's observable behavior leaks about the hidden variable, not just by what it says.