近來，全球雲端服務提供商相繼挹注大量資源開發代理式人工智慧（Agentic AI） 服務，希冀藉由其卓越的複雜任務拆解與自主決策執行能力，對人類生活品質改善乃至於企業營運效能優化帶來助益。一般來說，雲端的Agentic AI服務多仰賴多方協作框架，涵蓋雲端服務提供商、大型語言模型（LLM）與模型上下文協議（MCP）伺服器。隨著隱私保護意識日漸高漲，如何在使用者運用這類服務時，確保隱含於提示詞、MCP伺服器回應及模型推論結果中的隱私資訊不被外洩，便成為當今最重要的議題。然而，現有的解決方案多只考量來自單方角色的威脅，無法應對多方協作框架下複雜的隱私保護需求。
為此，本論文提出一個專為雲端Agentic AI環境打造的多方隱私保護授權框架(BlindAgent)，以全面保障運算過程中的使用者隱私。首先，BlindAgent導入全同態加密技術來實現Token建構機制與回應分派機制，使雲端Agent在完全無法存取提示詞、模型推論結果與MCP伺服器回應等明文資訊的情況下，仍能完成所有任務規劃。另外，本框架提出一個基於一次性遮罩的盲化廣播機制，有效阻斷攻擊者透過分析 MCP 伺服器的呼叫特徵來反向推測使用者行為的意圖。最後，利用基於規則的任務授權機制來落實嚴格的存取控制，確保規劃之子任務僅交由合法授權的 MCP 伺服器執行。
最後，本論文提出詳細的安全分析來證明BlindAgent能夠防止雲端Agent、LLM與未經授權的MCP伺服器取得使用者的明文資訊，並提出使用案例展現本框架真實的運作情形，用以說明BlindAgent之可行性。此外，實驗結果顯示，採用BlindAgent來保障使用者隱私僅額外造成60%的運算負擔。由此可見，本論文所提出的框架能提供安全且具可行性的雲端 Agentic AI 服務。

Recently, cloud service providers worldwide have successively invested substantial resources in developing Agentic Artificial Intelligence (Agentic AI) services, with the aim of leveraging their outstanding capabilities in complex task decomposition, autonomous decision-making, and task execution to improve human quality of life and optimize enterprise operational efficiency. In general, cloud-based Agentic AI services rely heavily on a multi-party collaborative framework involving cloud service providers, large language models (LLMs), and Model Context Protocol (MCP) Servers. As awareness of privacy protection continues to increase, ensuring that privacy information contained in user prompts, MCP Server responses, and model inference results is not leaked when users utilize such services has become one of the most important issues today. However, existing solutions mostly consider threats originating from only a single party and are therefore unable to address the complex privacy-protection requirements of multi-party collaborative frameworks.
To address this issue, this research proposes BlindAgent, a multi-party privacy-preserving authorization framework specifically designed for cloud-based Agentic AI environments, to comprehensively protect user privacy throughout the computation process. First, BlindAgent introduces fully homomorphic encryption(FHE) to implement a token construction mechanism and a response dispatch mechanism, enabling the cloud-based Agent to complete all task planning without being able to access any plaintext information, including user prompts, model inference results, and MCP Server responses. In addition, the framework proposes a one-time-mask-based blind broadcasting mechanism that effectively prevents attackers from inferring users’ behavioral intentions by analyzing the invocation characteristics of MCP Servers. Finally, a rule-based task authorization mechanism is employed to enforce strict access control, ensuring that planned subtasks are executed only by legitimately authorized MCP Servers.
Finally, this research presents a detailed security analysis to demonstrate that BlindAgent can prevent the cloud-based Agent, LLM, and unauthorized MCP Servers from obtaining users’ plaintext information. It also presents a use case demonstrating the actual operation of the framework to illustrate the feasibility of BlindAgent. Furthermore, the experimental results show that protecting user privacy with BlindAgent introduces only an additional 60% computational overhead. These results demonstrate that the framework proposed in this research can provide secure and feasible cloud-based Agentic AI services.

[1] W. X. Zhao et al., "A survey of large language models," arXiv preprint arXiv:2303.18223, 2023.
[2] A. Vaswani et al., "Attention is all you need," Advances in neural information processing systems, vol. 30, 2017.
[3] T. Schick et al., "Toolformer: Language models can teach themselves to use tools," Advances in neural information processing systems, vol. 36, pp. 68539–68551, 2023.
[4] S. G. Patil et al., "The berkeley function calling leaderboard (bfcl): From tool use to agentic evaluation of large language models," in Forty-second International Conference on Machine Learning, 2025, vol. 267, pp. 48371–48392.
[5] L. Wang et al., "A survey on large language model based autonomous agents," Frontiers of Computer Science, vol. 18, no. 6, p. 186345, 2024.
[6] Z. Xi et al., "The rise and potential of large language model based agents: A survey," Science China Information Sciences, vol. 68, no. 2, p. 121101, 2025.
[7] P. Lewis et al., "Retrieval-augmented generation for knowledge-intensive nlp tasks," Advances in neural information processing systems, vol. 33, pp. 9459–9474, 2020.
[8] Y. Gao et al., "Retrieval-augmented generation for large language models: A survey," arXiv preprint arXiv:2312.10997, 2023.
[9] S. Yao et al., "ReAct: Synergizing reasoning and acting in language models," in 11th International Conference on Learning Representations, ICLR, 2023.
[10] S. Yao, N. Shinn, P. Razavi, and K. Narasimhan, "τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains," in Proc. 13th Int. Conf. Learn. Representations (ICLR), 2025.
[11] Model Context Protocol, "Specification," Nov. 25, 2025. [Online]. Available: https://modelcontextprotocol.io/specification/2025-11-25
[12] Model Context Protocol, "Architecture Overview." [Online]. Available: https://modelcontextprotocol.io/docs/learn/architecture
[13] Model Context Protocol, "Authorization," Nov. 25, 2025. [Online]. Available: https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization
[14] M. Albrecht et al., "Homomorphic encryption standard," in Protecting privacy through homomorphic encryption: Springer, 2022, pp. 31–62.
[15] J. Zhang et al., "Secure transformer inference made non-interactive," in Proc. Network and Distributed System Security Symposium (NDSS), 2025.
[16] T. Chen et al., "THE-X: Privacy-preserving transformer inference with homomorphic encryption," in Findings of the association for computational linguistics: ACL 2022, 2022, pp. 3510–3520.
[17] L. De Castro, D. Escudero, A. Agrawal, A. Polychroniadou, and M. Veloso, "EncryptedLLM: Privacy-preserving large language model inference via GPU-accelerated fully homomorphic encryption," in Forty-second International Conference on Machine Learning, 2025, vol. 267, pp. 12677–12688.
[18] L. Zhao, Z. Zou, S. Li, and Z. Liu, "Anonymization-Enhanced Privacy Protection for Mobile GUI Agents: Available but Invisible," arXiv preprint arXiv:2602.10139, 2026.
[19] J. Wu, M. Hu, J. Zhu, J. Wang, and Y. Jin, "Agent-Memory Protocol: A Privacy-Focused Protocol for LLM Agents and User Memory Interaction," in Second AAAI Bridge Program on AI for Medicine and Healthcare, 2026, vol. 317, pp. 293–301.
[20] X. Zhang et al., "PrivacyAsst: Safeguarding user privacy in tool-using large language model agents," IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 6, pp. 5242–5258, 2024.
[21] Y. Dong et al., "PUMA: Secure inference of LLaMA-7B in five minutes," Security and Safety, vol. 4, 2025, Art no. 2025014.
[22] S. Wang et al., "Privacy in Action: Towards Realistic Privacy Mitigation and Evaluation for LLM-Powered Agents," in Findings of the Association for Computational Linguistics: EMNLP 2025, 2025, pp. 17055–17074.
[23] R. Surapaneni, M. Jha, M. Vakoc, and T. Segal. "Announcing the Agent2Agent Protocol (A2A)." Google. https://developers.googleblog.com/en/a2a-a-new-era-of-agent-interoperability/ (accessed Jul. 23, 2026).
[24] H. Nissenbaum, "Privacy as contextual integrity," Wash. L. Rev., vol. 79, p. 119, 2004.
[25] S. Halevi, Y. Polyakov, and V. Shoup, "An improved RNS variant of the BFV homomorphic encryption scheme," in Cryptographers’ Track at the RSA Conference, 2019: Springer, pp. 83–105.
[26] J. Fan and F. Vercauteren, "Somewhat practical fully homomorphic encryption," Cryptology ePrint Archive, 2012.
[27] H. Krawczyk, M. Bellare, and R. Canetti, "HMAC: Keyed-hashing for message authentication," RFC 2104, 1997.
[28] Y. Nir and A. Langley, "ChaCha20 and Poly1305 for IETF Protocols," RFC 8439, Jun. 2018.
[29] V. Lyubashevsky, C. Peikert, and O. Regev, "On ideal lattices and learning with errors over rings," in Annual international conference on the theory and applications of cryptographic techniques, 2010: Springer, pp. 1–23.
[30] M. R. Albrecht, R. Player, and S. Scott, "On the concrete hardness of Learning with Errors," J. Math. Cryptol., vol. 9, no. 3, pp. 169–203, 2015.
[31] J. M. Pollard, "Monte Carlo methods for index computation (mod p)," Mathematics of computation, vol. 32, no. 143, pp. 918–924, 1978.
[32] A. K. Lenstra and H. W. Lenstra, Eds. The development of the number field sieve. Springer Science & Business Media, 1993.
[33] A. Al Badawi et al., "OpenFHE: Open-source fully homomorphic encryption library," in proceedings of the 10th workshop on encrypted computing & applied homomorphic cryptography, 2022, pp. 53–63.
[34] M. Abdalla, D. Catalano, D. Fiore, R. Gay, and B. Ursu, "Multi-input functional encryption for inner products: Function-hiding realizations and constructions without pairings," in Annual International Cryptology Conference, 2018: Springer, pp. 597–627.
[35] T. Marc, M. Stopar, J. Hartman, M. Bizjak, and J. Modic, "Privacy-enhanced machine learning with functional encryption," in European Symposium on Research in Computer Security, 2019: Springer, pp. 3–21.
[36] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever, "Language models are unsupervised multitask learners," OpenAI, San Francisco, CA, USA, Tech. Rep. 2019. [Online]. Available: https://cdn.openai.com/better-language-models/language_models_are_unsupervised_multitask_learners.pdf
[37] A. Grattafiori et al., "The Llama 3 herd of models," arXiv preprint arXiv:2407.21783, 2024.
[38] J. Lu et al., "ToolSandbox: A stateful, conversational, interactive evaluation benchmark for LLM tool use capabilities," in Findings of the Association for Computational Linguistics: NAACL 2025, 2025, pp. 1160–1183.