Reducing the Signal Without Breaking the Agent

The defense problem for local research agents is not simply how to encrypt a connection. It is how to reduce the relationship between a sensitive task and the trace that the agent emits while preserving a useful report. The study evaluates two behavioral approaches: hiding, which adds plausible activity to muddy the mapping, and blocking, which avoids distinctive destinations when the task can be satisfied another way. The right choice depends on what the task requires, what the observer can see, and how much overhead the deployment can accept.

These approaches act on different links in the leakage chain. Decoys leave the real research activity in place but make the combined trace harder to interpret. Blocking changes the activity itself by removing some destinations. Neither should be presented as a universal cure. A decoy can add cost without removing all signal; blocking can reduce report quality when a unique source is genuinely necessary. Stronger network protection remains a separate layer.

Hiding the task inside plausible activity

The study's decoy defense is inspired by systems that generate extra browsing to confuse a tracker. For each real prompt, the defender creates additional prompts in the same broad topical space but with different framing, intent, or entity. The real and decoy tasks run concurrently, and all of their domains become part of the observable traffic. The user receives only the real result, but the observer sees a blended trace.

The decoy must be different in the dimensions that matter to the inference model. If it merely rephrases the original request while sending the agent to the same kinds of sources, the observer may still recover the functional task. The study therefore uses decoys that shift the domain or entity as well as the wording. A request about recognizing depression and seeking medical help might be paired with a question about comparing yoga and meditation for sleep. A prompt about Swahili food might be mixed with prompts about Italian cuisine or modern American dishes. The objective is not linguistic noise; it is behavioral divergence.

The paper also considers a trait-aware variant. A virtual persona can generate conflicting prompts based on estimated user attributes, so that a longer sequence of sessions contains misleading signals about ideology, religion, or other traits. This changes the defense from one-off camouflage to an attempt to disrupt the stable correlations used in longitudinal profiling. It also introduces a new operational dependency: the defender must maintain an estimate of which traits to contradict, and a poor estimate could add cost without creating useful ambiguity.

The measured prompt-recovery results show both value and limits. Without a defense, the baseline in Table 8 is 0.770 for functional OBELS, 0.735 for domain equivalence, 0.520 for semantic equivalence, 0.640 for entity granularity, 0.492 for SBERT, and 0.415 for the LLM judge. With one, three, or five decoys, the functional and judge scores generally fall.