Paper deep dive
SplitAgent: A Privacy-Preserving Distributed Architecture for Enterprise-Cloud Agent Collaboration
Jianshu She
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/13/2026, 12:41:46 AM
Summary
SplitAgent is a distributed architecture designed for privacy-preserving collaboration between enterprise-side privacy agents and cloud-side reasoning agents. It utilizes context-aware dynamic sanitization and differential privacy to enable cloud-based AI analysis of sensitive enterprise data without exposing raw information, achieving high task accuracy while maintaining strong privacy guarantees.
Entities (5)
Relation Signals (4)
SplitAgent â comprises â Privacy Agent
confidence 95% ¡ SplitAgent distributed architecture showing privacy agent (enterprise-side) and reasoning agent (cloud-side) components.
SplitAgent â comprises â Reasoning Agent
confidence 95% ¡ SplitAgent distributed architecture showing privacy agent (enterprise-side) and reasoning agent (cloud-side) components.
SplitAgent â implements â Differential Privacy
confidence 95% ¡ SplitAgent extends existing agent protocols with differential privacy guarantees.
Privacy Agent â utilizes â Context-Aware Dynamic Sanitization
confidence 95% ¡ The Privacy Agent serves as the guardian of enterprise data, implementing multiple layers of protection: Context Sanitizer: Applies task-aware sanitization.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Enterprise adoption of cloud-based AI agents faces a fundamental privacy dilemma: leveraging powerful cloud models requires sharing sensitive data, while local processing limits capability. Current agent frameworks like MCP and A2A assume complete data sharing, making them unsuitable for enterprise environments with confidential information. We present SplitAgent, a novel distributed architecture that enables privacy-preserving collaboration between enterprise-side privacy agents and cloud-side reasoning agents. Our key innovation is context-aware dynamic sanitization that adapts privacy protection based on task semantics -- contract review requires different sanitization than code review or financial analysis. SplitAgent extends existing agent protocols with differential privacy guarantees, zero-knowledge tool verification, and privacy budget management. Through comprehensive experiments on enterprise scenarios, we demonstrate that SplitAgent achieves 83.8\% task accuracy while maintaining 90.1\% privacy protection, significantly outperforming static approaches (73.2\% accuracy, 79.7\% privacy). Context-aware sanitization improves task utility by 24.1\% over static methods while reducing privacy leakage by 67\%. Our architecture provides a practical path for enterprise AI adoption without compromising sensitive data.
Tags
Links
- Source: https://arxiv.org/abs/2603.08221v1
- Canonical: https://arxiv.org/abs/2603.08221v1
Trouble viewing inline? Open PDF directly â
Full Text
35,348 characters extracted from source content.
Expand or collapse full text
SplitAgent: A Privacy-Preserving Distributed Architecture for Enterprise-Cloud Agent Collaboration Jianshu She MBZUAI Email: Jianshu.She@mbzuai.ac.ae AbstractâEnterprise adoption of cloud-based AI agents faces a fundamental privacy dilemma: leveraging powerful cloud models requires sharing sensitive data, while local processing limits capability. Current agent frameworks like MCP and A2A assume complete data sharing, making them unsuitable for enterprise environments with confidential information. We present SPLITA- GENT, a novel distributed architecture that enables privacy- preserving collaboration between enterprise-side privacy agents and cloud-side reasoning agents. Our key innovation is context- aware dynamic sanitization that adapts privacy protection based on task semanticsâcontract review requires different sanitization than code review or financial analysis. SPLITAGENT extends ex- isting agent protocols with differential privacy guarantees, zero- knowledge tool verification, and privacy budget management. Through comprehensive experiments on enterprise scenarios, we demonstrate that SPLITAGENT achieves 83.8% task accuracy while maintaining 90.1% privacy protection, significantly out- performing static approaches (73.2% accuracy, 79.7% privacy). Context-aware sanitization improves task utility by 24.1% over static methods while reducing privacy leakage by 67%. Our architecture provides a practical path for enterprise AI adoption without compromising sensitive data. Index Termsâprivacy-preserving AI, distributed agents, dif- ferential privacy, enterprise security, cloud computing I. INTRODUCTION Therapidadvancementoflargelanguagemodels (LLMs) [34], [35] has unlocked powerful capabilities for enterprise automation through AI agents [8], [9]. However, enterprise adoption faces a critical privacy challenge: most sophisticated AI capabilities reside in cloud-hosted models that require data sharing, while enterprises must protect confidential information including customer data, financial records,intellectualproperty,andcompliance-sensitive documents [16]. Current agent communication frameworks exemplify this privacy gap. Anthropicâs Model Context Protocol (MCP) and Googleâs Agent-to-Agent (A2A) protocol enable seamless agent collaboration but assume complete trust and data shar- ing between participants [1], [2]. This assumption fails in enterprise-cloud scenarios where one agent holds sensitive data while another provides reasoning capabilities. Existing solutions force a binary choice: keep all processing local with limited AI capabilities, or share everything with cloud models for maximum performance. This trade-off is particularly problematic because different enterprise tasks re- quire different privacy considerations. Contract review needs legal structure preservation while hiding party identities; code review requires syntax preservation while protecting creden- tials; financial analysis demands numerical pattern preserva- tion while concealing account details. We present SPLITAGENT, a privacy-preserving distributed architecture that enables secure collaboration between enter- prise and cloud agents without sacrificing utility. Our approach makes three key contributions: Split Agent Architecture: We introduce a novel two-tier design separating data handling from reasoning. Enterprise- side privacy agents manage sensitive data, perform local oper- ations, and generate sanitized abstractions. Cloud-side reason- ing agents operate exclusively on these abstractions, providing sophisticated analysis without accessing raw enterprise data. Context-Aware Dynamic Sanitization: Unlike static data masking approaches, our sanitization engine adapts protection strategies based on task semantics. The same document re- ceives different sanitization for contract review versus code audit, maximizing utility while maintaining privacy guaran- tees. SPLITAGENT Protocol: We extend existing agent proto- cols with privacy-preserving primitives including differential privacy context sharing, zero-knowledge tool verification, and cumulative privacy budget management. This provides formal privacy guarantees while maintaining protocol compatibility. Through comprehensive evaluation on enterprise scenarios, we demonstrate: ⢠SPLITAGENT achieves 83.8% average task accuracy with 90.1% privacy protection, significantly outperforming baseline approaches ⢠Context-aware sanitization improves task utility by 24.1% over static methods while reducing privacy leakage by 67% ⢠Our architecture scales to 50+ interaction turns with intelligent privacy budget management ⢠Strong resistance to reconstruction, inference, and linka- bility attacks This work provides a practical foundation for enterprise AI adoption that preserves both data privacy and analytical capability. arXiv:2603.08221v1 [cs.CR] 9 Mar 2026 I. RELATED WORK A. Agent Communication Protocols Modern AI agent frameworks rely on standardized com- munication protocols for coordination and collaboration. An- thropicâs Model Context Protocol (MCP) enables agents to share context and capabilities through structured message passing [1]. Googleâs Agent-to-Agent (A2A) protocol focuses on hierarchical agent coordination for complex task decom- position [2]. Microsoftâs AutoGen framework provides multi- agent conversation patterns with role-based interactions [3]. However, these frameworks assume complete trust between agents and provide no privacy protection mechanisms. All data sharing occurs in plaintext, making them unsuitable for enter- prise environments with confidential information [19], [20]. Our work extends these protocols with privacy-preserving primitives while maintaining compatibility. B. Privacy-Preserving Machine Learning Differential privacy provides formal guarantees for privacy protection by adding calibrated noise to data or query re- sponses [10], [11]. Federated learning enables collaborative model training without centralizing data [21]â[23]. Secure multi-party computation (MPC) allows joint computation over private inputs without revealing individual values [24], [26]. Recent work has explored privacy-preserving inference for language models [17], [18]. Deep learning with differential privacy [12] and differentially private language model train- ing [13], [14] provide formal guarantees but often sacrifice utility. Homomorphic encryption enables computation on en- crypted data but with significant computational overhead [25]. While these techniques provide strong privacy guarantees, they typically sacrifice utility or performance. Our approach focuses on practical privacy protection that maintains high utility for real enterprise tasks. C. Enterprise AI Security Enterprise AI adoption faces unique security challenges in- cluding data governance, compliance requirements, and insider threat protection [?]. Traditional approaches rely on data loss prevention (DLP) tools and access controls, but these are insufficient for AI systems that require broad data access for effective operation. Recent work has explored privacy-preserving enterprise AI through techniques like data vault architectures, confidential computing [31], [32], and structured transparency [33]. Text anonymization techniques [27], [28], [30] and PII detection tools [29] provide building blocks but lack task-aware adap- tation. However, these approaches often require significant infrastructure changes and may not be compatible with cloud- based AI services. Our work provides a practical middle ground that enables cloud AI utilization while maintaining enterprise privacy re- quirements. I. PROBLEM FORMULATION A. System Model We consider a distributed system with two primary compo- nents: Enterprise Environment: Contains sensitive data including documents, databases, code repositories, and internal systems. Must remain under enterprise control for compliance and security reasons. Has limited AI capabilities due to resource constraints and model availability. Cloud Environment: Provides access to powerful LLMs and AI services with sophisticated reasoning capabilities. Cannot access enterprise data directly due to privacy and reg- ulatory constraints. Offers scalable computation but operates as an untrusted environment. The goal is to enable the cloud environment to provide AI capabilities for enterprise data without compromising privacy or utility. B. Threat Model We assume the following adversary capabilities: Honest-but-Curious Cloud: The cloud provider follows protocols correctly but may attempt to infer sensitive informa- tion from shared data. This includes reconstruction attacks on sanitized data [19], inference attacks from usage patterns [18], and linkability attacks across sessions [36], [37]. External Adversaries: May attempt to compromise cloud services to access enterprise data. We assume the enterprise environment remains secure through standard security prac- tices. Insider Threats: Malicious insiders at the cloud provider may attempt to extract enterprise information. Our protocols must limit information exposure even to privileged cloud personnel. C. Privacy Requirements We define the following privacy requirements: Data Confidentiality: Raw enterprise data must never leave the enterprise environment. Only sanitized abstractions may be shared with cloud services. Differential Privacy: Shared information must satisfy (Îľ,δ)-differential privacy to prevent reconstruction of individ- ual data points. Unlinkability: Multiple interactions must not be linkable to specific enterprise entities or sessions unless explicitly allowed. Utility Preservation: Privacy protection must preserve suf- ficient utility for meaningful AI analysis and recommendation generation. D. Formal Privacy Definitions Definition 1 (Context-Aware Sanitization). Given enterprise data D, task type T , and privacy budget Îľ, a context-aware sanitization function S(D,T,Îľ) produces sanitized data Ě D such that: 1) Ě D satisfies Îľ-differential privacy 2) Task utility U(T, Ě D)âĽ Ď for threshold Ď Enterprise Environment (On-Premise / Private Cloud) Privacy Agent Context-Aware Sanitizer Privacy Budget Manager Local RAG Engine Local Tool Executor Data Controller Docs | DB | Code | Secrets Cloud Environment (Untrusted / Third-Party) Reasoning Agent Task Planner Logical Reasoner Strategy Generator Abstract Synthesizer LLM Interface (Claude/GPT-4/Gemini) SplitAgent Protocol Sanitized Context + DP Noise Abstract Insights + Recommendations -Differential Privacy Zero-Knowledge Verification Budget Management Fig. 1.SPLITAGENT distributed architecture showing privacy agent (enterprise-side) and reasoning agent (cloud-side) components. 3) Semantic requirements for task T are preserved Definition 2 (Privacy Budget Consumption). For a sequence of queries Q 1 ,Q 2 ,...,Q k with privacy costs Îľ 1 ,Îľ 2 ,...,Îľ k , the total privacy cost is P k i=1 Îľ i under sequential composition. IV. SPLITAGENT ARCHITECTURE Our solution is a distributed architecture that separates data handling from reasoning while enabling secure collaboration between enterprise and cloud components. A. Architecture Overview Figure 1 shows the SPLITAGENT architecture with two primary components: Privacy Agent (Enterprise-side): Manages all sensitive data and local operations. Key responsibilities include: ⢠Context-aware data sanitization based on task semantics ⢠Local tool execution for sensitive operations ⢠Privacy budget management and tracking ⢠Abstraction generation for cloud sharing ⢠Local retrieval-augmented generation (RAG) over enter- prise documents Reasoning Agent (Cloud-side): Performs sophisticated analysis on sanitized abstractions. Key responsibilities include: ⢠High-level reasoning and planning using large-scale LLMs ⢠Pattern analysis and trend identification in abstract data ⢠Strategic recommendation generation ⢠Abstract synthesis without access to raw data B. Privacy Agent Design The Privacy Agent serves as the guardian of enterprise data, implementing multiple layers of protection: Data Controller: Manages all access to sensitive enterprise data including documents, databases, and APIs. Implements fine-grained access controls and audit logging. Context Sanitizer: Applies task-aware sanitization to re- move or abstract sensitive information while preserving utility. Algorithm 1: Context-Aware Dynamic Sanitization Data: Document D, Task type T , Privacy budget Îľ Result: Sanitized document Ě D, Abstraction map M semanticsâ GetTaskSemantics(T); entitiesâ ExtractEntities(D); M â; for entity eâ entities do sensitivity â GetSensitivityLevel(e); if sensitivity > PrivacyThreshold(Îľ) then abstractionâ GenerateAbstraction(e,semantics); M[e]â abstraction; end end Ě D â ApplyAbstractions(D,M); if semantics.requiresDP then Ě D â AddDifferentialPrivacyNoise( Ě D,Îľ); end return Ě D, M Uses advanced techniques including named entity recognition, pattern detection, and semantic analysis. Local RAG Engine: Performs document search and re- trieval [38] entirely within the enterprise environment. Gen- erates abstracts and summaries for cloud sharing without exposing source documents. Privacy Budget Manager: Tracks cumulative privacy ex- penditure across interactions. Implements dynamic budget allocation based on query importance and remaining capacity. Tool Executor: Runs sensitive operations locally to avoid cloud exposure. Includes document analysis, compliance checking, and data validation tools. C. Reasoning Agent Design The Reasoning Agent operates exclusively on sanitized data while providing sophisticated AI capabilities: Task Planner: Decomposes complex requests into manage- able sub-tasks. Generates strategic plans based on abstract data patterns without seeing sensitive details. Logical Reasoner: Applies advanced reasoning techniques using large language models. Performs causal analysis, trend identification, and pattern recognition on abstracted data. Strategy Generator: Creates actionable recommendations based on abstract insights. Generates implementation plans that respect privacy constraints. Abstract Synthesizer: Combines insights from multiple abstract sources to generate comprehensive analysis. Maintains semantic coherence despite working with sanitized inputs. D. Context-Aware Dynamic Sanitization Our key innovation is sanitization that adapts based on task semantics rather than applying static rules. Algorithm 1 shows our approach. The algorithm adapts sanitization based on task require- ments: Contract Review: Preserves legal structure and clause relationships while abstracting party identities, specific amounts, and dates. Example: âACME Corp will pay $150,000 by March 15â becomes âCOMPANY A will pay AMOUNTLARGE by DATEQ1â. Code Review: Maintains syntax structure and API patterns while removing credentials, internal URLs, and proprietary logic. Preserves code quality patterns for analysis. Financial Analysis: Retains numerical relationships and trends while abstracting specific amounts and account iden- tifiers. Enables trend analysis without exposing sensitive fi- nancial data. Customer Support: Preserves sentiment and issue clas- sification while removing personal information and account details. Allows pattern analysis for support optimization. V. SPLITAGENT PROTOCOL We extend existing agent communication protocols with privacy-preserving capabilities while maintaining backward compatibility. A. Protocol Extensions Privacy-Aware Handshake: Establishes privacy parame- ters and capabilities before data sharing. Enterprise -> Cloud: HELLO task_type: "contract_review", privacy_level: "confidential", budget: 5.0 Cloud -> Enterprise: ACK capabilities: ["reasoning", "planning"], abstractions: ["entity_replacement", "dp_noise"] Context Sharing with DP: Shares sanitized context with differential privacy guarantees. Enterprise -> Cloud: CONTEXT_SHARE sanitized_data: apply_dp(context, Îľ), abstraction_map: entity_mappings, privacy_cost: Îľ_consumed, utility_preserved: 0.89 Zero-Knowledge Tool Verification: Allows cloud agents to verify tool execution without seeing sensitive data. Privacy Budget Updates: Tracks cumulative privacy ex- penditure across the session. B. Formal Protocol Specification We define the protocol state machine with privacy-aware transitions: States:INIT,HANDSHAKE,ACTIV E, BUDGET LOW,DEPLETED Messages: HELLO,ACK,CONTEXTSHARE, TOOL REQUEST,BUDGETUPDATE Invariants: ⢠Privacy budget never decreases except for legitimate operations ⢠All shared data satisfies differential privacy requirements ⢠Tool execution proofs are verifiable without sensitive data access VI. IMPLEMENTATION We implement SPLITAGENT as a practical system that extends existing agent frameworks. A. Privacy Agent Implementation The Privacy Agent is implemented in Python with the following key components: Sanitization Engine: Uses spaCy for named entity recog- nition [28] combined with custom pattern detection for enterprise-specific sensitive data types, extending existing anonymization approaches [27], [30]. Implements context- aware abstraction generation based on configurable task se- mantics. Privacy Budget Manager: Tracks epsilon consumption using composition theorems from differential privacy. Imple- ments dynamic budget allocation with alerting when thresholds are exceeded. Local Tool Registry: Provides secure execution environ- ment for sensitive operations including document analysis, compliance checking, and statistical computation. Protocol Handler: Implements the SPLITAGENT protocol with secure message serialization and verification. B. Reasoning Agent Implementation The Reasoning Agent leverages cloud-based LLM APIs while operating exclusively on sanitized data: LLM Interface: Provides abstracted access to models in- cluding Claude, GPT-4 [34], and Gemini. Implements prompt engineering optimized for abstract data analysis, leveraging tool-use capabilities [39] and reasoning-action patterns [40]. Pattern Analyzer: Identifies trends and relationships in abstracted data without reconstructing original values. Strategic Planner: Generates actionable recommendations based on abstract insights while respecting privacy constraints. C. Performance Optimizations Caching: Aggressive caching of sanitized contexts and abstractions to reduce computation overhead. Batching: Groups multiple privacy operations to optimize budget utilization. Precomputation: Pre-generates common abstractions for frequently accessed data. VII. EXPERIMENTAL EVALUATION We conduct comprehensive experiments to evaluate SPLITAGENTâs effectiveness across multiple dimensions. Full-CloudFull-LocalStatic-SplitSplitAgent 0.0 0.2 0.4 0.6 0.8 1.0 Score 92.5% 69.2% 73.2% 83.8% 0.0% 100.0% 79.7% 90.1% Architecture Performance Comparison Task AccuracyPrivacy Protection Fig. 2. Architecture performance comparison across task accuracy and privacy protection. SPLITAGENT achieves the best balance between both objectives. TABLE I ARCHITECTURE PERFORMANCE COMPARISON ArchitectureAccuracyPrivacyLatency (ms)Cost ($) Full-Cloud0.9250.0001,0240.201 Full-Local0.6921.0003,8470.067 Static-Split0.7320.7971,2890.143 SPLITAGENT0.8380.9011,4870.161 A. Experimental Setup Datasets: We generate realistic synthetic enterprise datasets including contracts, code repositories, financial documents, and customer service records. Documents range from 1KB to 100KB with varying complexity levels. Task Types: Six enterprise scenarios: contract review, code audit, financial analysis, customer support, risk assessment, and compliance checking. Baselines: ⢠Full-Cloud: All data shared with cloud (no privacy protection) ⢠Full-Local: All processing local (limited AI capabilities) ⢠Static-Split: Fixed sanitization rules ⢠SPLITAGENT: Our context-aware approach Metrics: Task accuracy, privacy leakage, latency, cost effi- ciency, and utility preservation. B. Experiment 1: Split Architecture Comparison Figure 2 shows performance across different architectures. SPLITAGENT achieves the best privacy-utility balance: Key findings: ⢠SPLITAGENT achieves 83.8% accuracy vs. 73.2% for static approaches ⢠Provides 90.1% privacy protection vs. 79.7% for static methods ⢠Modest latency increase (15%) for significant privacy gains C. Experiment 2: Context-Aware vs Static Sanitization Table I shows the effectiveness of context-aware sanitiza- tion across different task types: TABLE I SANITIZATION APPROACH COMPARISON Task Type Task Utility Static RegexStatic NERContext-Aware Contract Review0.6180.7140.906 Code Review0.5920.6970.928 Financial Audit0.6340.7210.873 Customer Support0.6050.6890.942 Average0.6120.7050.912 Improvement-+15.2%+24.1% 0.10.51.02.05.010.0 Privacy Budget () 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Score Optimal ( =0.5) Privacy-Utility Tradeoff Analysis Task Accuracy Privacy Level Accuracy Ă Privacy Fig. 3. Privacy-utility tradeoff across different Îľ values. The optimal balance (highest accuracyĂ privacy product) occurs at Îľ = 0.5. Context-aware sanitization shows consistent improvements: ⢠24.1% utility improvement over static regex approaches ⢠15.2% improvement over static NER methods ⢠Best performance on customer support (94.2%) due to sentiment preservation ⢠Maintains high performance across all task types D. Experiment 3: Privacy-Utility Tradeoff Figure 3 shows the Pareto frontier for privacy vs. utility across different epsilon values: The optimal privacy-utility balance occurs at Îľ = 0.5, achieving 83.4% accuracy with 94.5% privacy protection. E. Experiment 4: Multi-Turn Budget Management Figure 4 compares budget management strategies over 50 interaction turns: SPLITAGENTâs intelligent budget management achieves: ⢠34.2 total utility vs. 24.3 for naive allocation ⢠96% task completion rate ⢠Efficient budget utilization (85% used) ⢠Graceful degradation as budget depletes F. Experiment 5: Adversarial Evaluation Table V shows resistance to different attack types: SPLITAGENT provides strong attack resistance: ⢠89% reduction in attack success vs. static masking TABLE I PRIVACY-UTILITY TRADEOFF (Îľ VALUES) ÎľTask AccuracyPrivacy LevelProductOptimal 0.10.7820.9910.775 0.50.8340.9450.788 1.00.8670.8960.777 2.00.8920.8340.744 5.00.9120.6720.613 10.00.9230.4870.450 Optimal--0.788 Îľ = 0.5 01020304050 Interaction Turn 0 5 10 15 20 25 30 35 Cumulative Utility Budget Management: Cumulative Utility Over 50 Turns Naive Linear Adaptive SplitAgent Fig. 4.Cumulative utility comparison of budget management strategies over 50 interaction turns. SPLITAGENTâs intelligent allocation consistently outperforms alternatives. ⢠Particularly effective against linkability attacks (6.7% success) ⢠Maintains protection across all attack types G. Experiment 6: End-to-End Task Performance Table VI shows performance across enterprise scenarios: SPLITAGENT maintains high performance across all enter- prise scenarios while preserving privacy. VIII. DISCUSSION A. Deployment Considerations Integration Complexity: SPLITAGENT integrates with ex- isting enterprise systems through standard APIs. Privacy agents can be deployed as containerized services within enter- prise networks. Scalability: The architecture scales horizontally by deploy- ing multiple privacy agent instances. Cloud reasoning agents auto-scale based on demand. Cost Analysis: Total cost includes local processing over- head (15-25% increase) offset by reduced data transfer and cloud storage costs. B. Limitations Sanitization Overhead: Context-aware sanitization adds 200-500ms latency per query. This is acceptable for most enterprise workflows but may impact real-time applications. TABLE IV BUDGET MANAGEMENT STRATEGY COMPARISON StrategyTotal UtilityCompletionBudget UsedEfficiency Naive24.30.820.890.67 Linear27.10.860.910.72 Adaptive31.80.940.870.81 SPLITAGENT34.20.960.850.88 TABLE V ATTACK RESISTANCE EVALUATION Attack Type Attack Success Rate No DefenseStatic MaskingSPLITAGENT Reconstruction0.8910.5470.118 Inference0.9230.6280.145 Linkability0.8870.4210.067 Average0.9000.5320.110 Utility Loss: Even with context-aware approaches, saniti- zation inevitably reduces utility. Our experiments show 8-15% utility loss compared to full data sharing. Trust Assumptions: We assume the enterprise environment remains secure. Compromised privacy agents could expose sensitive data. Model Limitations: Reasoning quality depends on cloud LLM capabilities. Abstract data may limit certain types of analysis requiring fine-grained details. C. Future Work Advanced Privacy Techniques: Integration of homo- morphic encryption and secure multi-party computation for stronger privacy guarantees. Adaptive Privacy Budgets: Dynamic privacy budget allo- cation based on query sensitivity and enterprise policies. Multi-Enterprise Collaboration: Extension to scenarios involving multiple enterprises with different privacy require- ments. Formal Verification: Mathematical proofs of privacy guar- antees and security properties. IX. CONCLUSION Enterprise adoption of AI agents requires balancing sophis- ticated capabilities with strict privacy requirements. Current agent frameworks fail to address this fundamental challenge, forcing enterprises to choose between privacy and utility. We present SPLITAGENT, a novel distributed architecture that enables privacy-preserving collaboration between enter- prise and cloud agents. Our key innovations include context- aware dynamic sanitization that adapts to task semantics, formal privacy guarantees through differential privacy, and intelligent privacy budget management. Comprehensive experiments demonstrate that SPLITAGENT achieves 83.8% task accuracy while maintaining 90.1% pri- vacy protection, significantly outperforming static approaches. Context-aware sanitization improves utility by 24.1% while TABLE VI TASK PERFORMANCE BY SCENARIO ScenarioCompletionQualityPrivacy Contract Negotiation0.8840.9010.912 Code Audit0.8670.8830.894 Customer Service0.8320.8570.891 Financial Analysis0.8080.8240.887 Average0.8480.8660.896 reducing privacy leakage by 67%. The architecture provides strong resistance to adversarial attacks and scales effectively across enterprise scenarios. SPLITAGENT represents a practical step toward enterprise AI adoption that preserves both data privacy and analytical capability. By separating data handling from reasoning while maintaining utility, our approach provides a foundation for secure enterprise AI deployment in cloud environments. Future work will explore advanced privacy techniques, formal verification of security properties, and extensions to multi-enterprise collaboration scenarios. We believe SPLITA- GENT provides a crucial bridge between enterprise privacy requirements and cloud AI capabilities. ACKNOWLEDGMENTS We thank the anonymous reviewers for their valuable feed- back and suggestions that improved this work. REFERENCES [1] Anthropic, âModel Context Protocol: Connecting AI assistants to data sources,â Technical Report, 2024. [2] Google DeepMind, âAgent-to-Agent Protocol: An open protocol for agent interoperability,â Technical Report, 2024. [3] Q. Wu, G. Bansal, J. Zhang, Y. Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liu, A. H. Awadallah, R. W. White, D. Burger, and C. Wang, âAutoGen: Enabling next-gen LLM applications via multi- agent conversation,â arXiv preprint arXiv:2308.08155, 2023. [4] S. Hong, M. Zhuge, J. Chen, X. Zheng, Y. Cheng, C. Zhang, J. Wang, Z. Wang, S. K. S. Yau, Z. Lin, L. Zhou, C. Ran, L. Xiao, C. Wu, and J. Schmidhuber, âMetaGPT: Meta programming for a multi-agent collaborative framework,â arXiv preprint arXiv:2308.00352, 2023. [5] G. Li, H. A. A. K. Hammoud, H. Itani, D. Khizbullin, and B. Ghanem, âCAMEL: Communicative agents for âmindâ exploration of large lan- guage model society,â Advances in Neural Information Processing Systems, vol. 36, 2023. [6] J. S. Park, J. C. OâBrien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, âGenerative agents: Interactive simulacra of human behavior,â Proceedings of the 36th ACM Symposium on User Interface Software and Technology, 2023. [7] Y. Talebirad and A. Nadiri, âMulti-agent collaboration: Harnessing the power of intelligent LLM agents,â arXiv preprint arXiv:2306.03314, 2023. [8] L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y. Lin, W. X. Zhao, Z. Wei, and J. Wen, âA survey on large language model based autonomous agents,â Frontiers of Computer Science, vol. 18, no. 6, 2024. [9] Z. Xi, W. Chen, X. Guo, W. He, Y. Ding, B. Hong, M. Zhang, J. Wang, S. Jin, E. Zhou, R. Zheng, X. Fan, X. Wang, L. Xiong, Y. Zhou, W. Wang, C. Jiang, Y. Zou, X. Liu, Z. Yin, S. Dou, R. Weng, W. Cheng, Q. Zhang, W. Qin, Y. Zheng, X. Qiu, X. Huang, and T. Gui, âThe rise and potential of large language model based agents: A survey,â arXiv preprint arXiv:2309.07864, 2023. [10] C. Dwork and A. Roth, âThe algorithmic foundations of differential privacy,â Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3â4, p. 211â407, 2014. [11] C. Dwork, F. McSherry, K. Nissim, and A. Smith, âCalibrating noise to sensitivity in private data analysis,â Proceedings of the 3rd Theory of Cryptography Conference, p. 265â284, 2006. [12] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Tal- war, and L. Zhang, âDeep learning with differential privacy,â Proceed- ings of the ACM SIGSAC Conference on Computer and Communications Security, p. 308â318, 2016. [13] H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang, âLearning differentially private recurrent language models,â Proceedings of the International Conference on Learning Representations, 2018. [14] D. Yu, S. Naik, A. Backurs, S. Gopi, H. A. Inan, G. Kamath, J. Kulkarni, Y. T. Lee, A. Manoel, L. Wutschitz, S. Yekhanin, and H. Zhang, âDifferentially private fine-tuning of language models,â Proceedings of the International Conference on Learning Representations, 2022. [15] X. L. Li, A. Trischler, Y. Dong, and D. Kiela, âLarge language models with controllable privacy guarantees,â arXiv preprint, 2022. [16] Y. Yao, J. Duan, K. Xu, Y. Cai, Z. Sun, and Y. Zhang, âA survey on large language model (LLM) security and privacy: The good, the bad, and the ugly,â High-Confidence Computing, vol. 4, no. 2, 2024. [17] Y. Chen, S. Xiang, T. Chen, and B. Li, âEmojiPrompt: Generative prompt obfuscation for privacy-preserving communication with cloud- based LLMs,â arXiv preprint arXiv:2402.05868, 2024. [18] R. Staab, M. Vero, M. Balunovi Ě c, and M. Vechev, âBeyond memoriza- tion: Violating privacy via inference with large language models,â Pro- ceedings of the International Conference on Learning Representations, 2024. [19] N. Carlini, F. Tram ` er, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, A. Oprea, and C. Raffel, âExtracting training data from large language models,â Proceedings of the USENIX Security Symposium, 2021. [20] N. Lukas, A. Salem, R. Sim, S. Tople, L. Wutschitz, and S. Zanella- B Ě eguelin, âAnalyzing leakage of personally identifiable information in language models,â Proceedings of the IEEE Symposium on Security and Privacy, p. 346â363, 2023. [21] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, âFederated learning: Challenges, methods, and future directions,â IEEE Signal Processing Magazine, vol. 37, no. 3, p. 50â60, 2020. [22] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, âCommunication-efficient learning of deep networks from decentralized data,â Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, p. 1273â1282, 2017. [23] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings, et al., âAdvances and open problems in federated learning,â Foundations and Trends in Machine Learning, vol. 14, no. 1â2, p. 1â210, 2021. [24] R. Cramer, I. B. Damg Ě ard, and J. B. Nielsen, Secure Multiparty Computation and Secret Sharing. Cambridge University Press, 2015. [25] C. Gentry, âFully homomorphic encryption using ideal lattices,â Pro- ceedings of the 41st Annual ACM Symposium on Theory of Computing, p. 169â178, 2009. [26] P. Mohassel and Y. Zhang, âSecureML: A system for scalable privacy- preserving machine learning,â Proceedings of the IEEE Symposium on Security and Privacy, p. 19â38, 2017. [27] P. Lison, I. Pil Ě an, D. S Ě anchez, M. Batet, and L. Ăvrelid, âAnonymisation models for text data: State of the art, challenges and future directions,â Proceedings of the 59th Annual Meeting of the Association for Compu- tational Linguistics, p. 4188â4203, 2021. [28] F. Dernoncourt, J. Y. Lee, O. Uzuner, and P. Szolovits, âDe-identification of patient notes with recurrent neural networks,â Journal of the American Medical Informatics Association, vol. 24, no. 3, p. 596â606, 2017. [29] Microsoft, âPresidio: Data protection and de-identification SDK,â GitHub Repository, 2023. [30] I. Pil Ě an, P. Lison, L. Ăvrelid, A. Papadopoulou, D. S Ě anchez, and M. Batet, âThe text anonymization benchmark (TAB): A dedicated cor- pus and evaluation framework for text anonymization,â Computational Linguistics, vol. 48, no. 4, p. 1053â1101, 2022. [31] T. Hunt, Z. Zhu, Y. Xu, S. Peter, and E. Witchel, âRyoan: A distributed sandbox for untrusted computation on secret data,â ACM Transactions on Computer Systems, vol. 35, no. 4, p. 1â32, 2018. [32] T. Lee, Z. Lin, S. Pushp, C. Li, Y. Liu, Y. Song, T. Jia, L. Fang, and Y. Jia, âOcclumency: Privacy-preserving remote deep-learning inference using SGX,â Proceedings of the 25th Annual International Conference on Mobile Computing and Networking, 2019. [33] A. Trask, E. Bluemke, B. Garfinkel, C. G. Segalin, and A. Dafoe, âBeyond privacy trade-offs with structured transparency,â arXiv preprint arXiv:2012.08347, 2020. [34] OpenAI, âGPT-4 technical report,â arXiv preprint arXiv:2303.08774, 2023. [35] H. Touvron, T. Lavril, G. Izacard, X. Martinet, M. A. Lachaux, T. Lacroix, B. Rozi ` ere, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample, âLLaMA: Open and efficient foundation language models,â arXiv preprint arXiv:2302.13971, 2023. [36] A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson, âUniversal and transferable adversarial attacks on aligned language models,â arXiv preprint arXiv:2307.15043, 2023. [37] E. Shayegani, M. A. Mamun, Y. Fu, P. Zaree, Y. Dong, and N. Abu- Ghazaleh, âSurvey of vulnerabilities in large language models revealed by adversarial attacks,â arXiv preprint arXiv:2310.10844, 2023. [38] P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. K Ě uttler, M. Lewis, W. Yih, T. Rockt Ě aschel, S. Riedel, and D. Kiela, âRetrieval-augmented generation for knowledge-intensive NLP tasks,â Advances in Neural Information Processing Systems, vol. 33, p. 9459â 9474, 2020. [39] T. Schick, J. Dwivedi-Yu, R. Dess ` Äą, R. Raileanu, M. Lomeli, E. Hambro, L. Zettlemoyer, N. Cancedda, and T. Scialom, âToolformer: Language models can teach themselves to use tools,â Advances in Neural Infor- mation Processing Systems, vol. 36, 2024. [40] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, âReAct: Synergizing reasoning and acting in language models,â Pro- ceedings of the International Conference on Learning Representations, 2023.