PAPC: Platform Mediation for Privacy-Propagation Externalities in AI-Mediated Workflows
Huang, Wu, Hou and Zheng model privacy loss in multi-principal agent platforms as an externality created by intermediate events rather than by the final answer, and build PAPC, a platform layer that intercepts every information-moving event before it reaches shared state.
Ask this paper
The exposure happens before the answer. A memory write, a shared-workspace update, an inter-agent message or a tool call can impose cost on a different principal even when the user-visible output is clean, so output filtering measures the wrong surface.
Cost depends on topology, not just content. The authors formalize privacy-propagation externality, in which the damage from one raw disclosure scales with fanout and with where in the agent graph the write lands. High-fanout shared objects amplify a single leak across principals.
Five actions at the interception point. PAPC combines policy, provenance, topology, privilege and content signals to allow an event, substitute a policy-safe abstraction, quarantine the raw content, block the transition, or narrow onward rights.
Measured leakage goes to zero without breaking tasks. Across retrieval-memory and multi-agent workflow benchmarks, PAPC eliminates measured exact raw-value and external raw-value exposure while deterministic task completion is preserved.
Event-level mediation as a platform primitive. The argument is that this belongs in the platform runtime, next to permissions, rather than in each agent's prompt.
Abstract
AI-mediated platforms coordinate work through LLM agents acting for different principals. In these workflows, privacy loss can be created before a final answer appears: a memory write, shared-workspace update, inter-agent message, or tool event may impose downstream exposure cost on another principal. We model this failure mode as a privacy-propagation externality, where the cost of a raw disclosure depends on topology and fanout as well as content. We present PAPC, a platform-mediated mechanism that intercepts information-moving events before they update shared state or external channels. PAPC combines policy, provenance, topology/fanout, privilege, and content signals to allow an event, release a policy-safe abstraction, quarantine raw content, block a transition, or narrow onward rights. The model explains why final-output control misses intermediate exposure costs and why high-fanout objects amplify propagation. Across retrieval-memory and multi-agent workflow benchmarks, PAPC preserves deterministic task completion and eliminates measured exact raw-value and external raw-value exposure. The results position event-level mediation as a platform-governance primitive for agent-mediated online work.