Singapore

As large language models (LLMs) become increasingly integrated into daily life, privacy concerns are on the rise. Driven by the appeal of convenient, universal solutions, current practices reflect a drift toward a one-size-fits-all approach to privacy. Unfortunately, we argue that a unified framework for prompt privacy is elusive and can instead mislead, creating even greater risk due to a false sense of safety. We identify five desirable properties of an effective privacy framework for prompts, namely protection guarantees, performance, efficiency, domain adaptability, and user accessibility, and highlight that existing frameworks, such as sanitization, differential privacy, cryptography, and contextual integrity, only satisfy a subset of these properties. Beyond individual frameworks, we find underlying tensions between these properties that preclude the development of a unified framework. We recommend two critical paths forward: emphasizing context-specific and application-specific evaluation of privacy frameworks, and fostering user awareness and privacy literacy.

AAAI 2026

A Unified Framework for Prompt Privacy is Elusive and Misleading

prompt privacy

llms

privacy

workshop paper

We are pleased to announce the Fortieth AAAI Conference on Artificial Intelligence (AAAI-26), which will be held in Singapore EXPO from January 20 to January 27, 2026.

The purpose of the AAAI conference series is to promote research in Artificial Intelligence (AI) and foster scientific exchange between researchers, practitioners, scientists, students, and engineers across the entirety of AI and its affiliated disciplines. AAAI-26 will feature technical paper presentations, special tracks, invited speakers, workshops, tutorials, poster sessions, senior member presentations, competitions, and exhibit programs, and a range of other activities to be announced.<br><br>

To access this event page, you need to log in with the **email address you registered with**. <br>Access credentials will be sent to your email from Underline -  subject line "Welcome to AAAI 2026". Please be sure to check your spam email folder if you do not see an email confirmation right away.

Please log in

To access this event page, you are required to register.
Please complete your registration to continue.

We recommend reading [**the registration information**](https://aaai.org/conference/aaai/aaai-26/registration/) first.

**Online Registration Form**: https://aaai.getregistered.net/conference-2026 

Registration Required

We are pleased to announce the Fortieth AAAI Conference on Artificial Intelligence (AAAI-26), which will be held in Singapore EXPO from January 20 to January 27, 2026.

We propose a novel framework for persona-based language model system, motivated by the need for personalized AI agents that adapt to individual user preferences. In our approach, the agent embodies the user’s “persona” (e.g. user profile or taste) and is powered by a large language model (LLM). To enable the agent to leverage rich contextual information, we introduce a Knowledge-Graph-enhanced Retrieval Augmented Generation (Graph RAG) mechanism that constructs an LLM-derived graph index of relevant documents and summarizes communities of related information. Our framework generates personalized prompts by combining: (1) a summary of the user’s historical behaviors and preferences extracted from the knowledge graph, and (2) relevant global interaction patterns identified through graph-based community detection. This dynamic prompt engineering approach allows the agent to maintain consistent persona-aligned behaviors while benefiting from collective knowledge. On the LaMP benchmark, our method improves news categorization F1 by 11.1%, movie tagging F1 by 56.1%, and reduces product rating MAE by 10.4% over prior methods.

PersonaAgent with GraphRAG: Community-Aware Knowledge Graphs for Personalized LLM

Large Language Models (LLMs) have demonstrated exceptional capabilities but face two critical deployment challenges: high computational costs and scarcity of personalized domain training data. We address these dual challenges through a comprehensive framework that combines synthetic data generation with inference optimization techniques. Our approach employs LLMs for zero-shot and few-shot synthetic dataset creation while applying structural pruning, knowledge distillation, quantization, and prompt caching for computational efficiency. We evaluate three architectural paradigms: encoder-only, encoder-decoder, and decoder-only on synthetic building permit classification and assess optimization techniques on public benchmarks. Our systematic evaluation reveals that strategic architectural selection based on task characteristics is more critical than model complexity: encoder-only models provide superior efficiency-accuracy trade-offs for high-throughput scenarios, demonstrating that understanding problem requirements enables effective deployment without requiring the largest available models. Knowledge distillation emerges as the key optimization technique for personalized domains, recovering pruning-induced performance degradation with Llama3-8B+KD achieving 87.1% accuracy at 20% pruning while exceeding unpruned baselines. Complementary optimization strategies, including dynamic caching (5-18% latency reduction with zero performance loss) and hardware acceleration (up to 200× speedup) enable flexible deployment configurations for domain specific applications.

Domain-Specific LLM Adaptation: Bridging Personalization and Efficiency Through Synthetic Data and Optimization

As AI becomes more personal, e.g., Agentic AI, there is an increasing need for personalizing models for various use cases. Personalized federated learning (PFL) enables each client to collaboratively leverage other clients' knowledge for better adaptation to the task of interest, without privacy risks. Despite its potential, existing PFL methods remain confined to rather simplified scenarios where data and models are the same across clients. To move towards realistic scenarios, we propose FedMosaic, a method that jointly addresses data and model heterogeneity with a task-relevance-aware model aggregation strategy to reduce parameter interference, and a dimension-invariant module that enables knowledge sharing across heterogeneous architectures without huge computational cost. To mimic the real-world task diversity, we propose a multi-modal PFL benchmark spanning 40 distinct tasks with distribution shifts over time. The empirical study shows that FedMosaic outperforms the state-of-the-art PFL methods, excelling in both personalization and generalization capabilities under challenging, realistic scenarios.

Not All Clients Are Equal: Collaborative Model Personalization on Heterogeneous Multi-Modal Clients

Personalizing Large Language Model (LLM) agents requires conditioning them on user-specific data, creating a critical trade-off between task utility and data disclosure. While the utility of adding user data often exhibits diminishing returns (i.e., submodularity), enabling near-optimal greedy selection, real-world personalization is complicated by structural constraints. These include logical dependencies (e.g., selecting fact A requires fact B), categorical quotas (e.g., select at most one writing style), and hierarchical rules (e.g., select at most two social media preferences, of which at most one can be for a professional network). These constraints violate the assumptions of standard subset selection algorithms. We propose a principled method to formally model such constraints. We introduce a compilation process that transforms a user‚Äôs knowledge graph with dependencies into a set of abstract macro-facets. Our central result is a proof that common hierarchical and quota-based constraints over these macro-facets form a valid laminar matroid. This theoretical characterization lets us cast structured personalization as submodular maximization under a matroid constraint, enabling greedy with constant-factor guarantees (and (1‚àí1/e) via continuous greedy) for a much richer and more realistic class of problems.

Structured Personalization: Modeling Constraints as Matroids for Data-Minimal LLM Agents

Large Language Models (LLMs) are typically aligned for safety during the post-training phase; however, they may still generate harmful outputs that pose risks to users. 
This challenge underscores the need for robust safeguards that operate across both model inputs and outputs. In this work, we introduce RoGuard 1.0, a state-of-the-art instruction fine-tuned LLM designed to enhance the safety of LLM systems through comprehensive input‚Äìoutput moderation, using a pipeline of LLMs to enhance moderation capability. 
Built on the Llama-3.1-8B-Instruct backbone, our model is instruction fine-tuned to generalize across previously unseen safety taxonomies and demonstrates strong performance on out-of-domain safety benchmarks. 
The instruction fine-tuning process uses a mix of synthetic and open-source safety datasets, augmented with chain-of-thought (CoT) rationales and input inversion to enhance contextual understanding and decision making. 
To support systematic evaluation, we also release RoGuard Evaluation, a new benchmark featuring an extensible safety taxonomy to assess the effectiveness of LLM guardrails and moderation frameworks.

Taxonomy-Adaptive Moderation Model with Robust Guardrails for Large Language Models

Large foundation models (LFMs) transform healthcare AI in prevention, diagnostics, and treatment. However, whether LFMs can provide truly personalized treatment recommendations remains an open question. Recent research has revealed multiple challenges for personalization, including the fundamental generalizability paradox: models achieving high accuracy in one clinical study perform at chance level in others, demonstrating that personalization and external validity exist in tension. This exemplifies broader contradictions in AI-driven healthcare: the privacy-performance paradox, scale-specificity paradox, and the automation-empathy paradox. As another challenge, the degree of causal understanding required for personalized recommendations, as opposed to mere predictive capacities of LFMs, remains an open question. N-of-1 trials -- crossover self-experiments and the gold standard for individual causal inference in personalized medicine -- resolve these tensions by providing within-person causal evidence while preserving privacy through local experimentation. Despite their impressive capabilities, this paper argues that LFMs cannot replace N-of-1 trials. We argue that LFMs and N-of-1 trials are complementary: LFMs excel at rapid hypothesis generation from population patterns using multimodal data, while N-of-1 trials excel at causal validation for a given individual. We propose a hybrid framework that combines the strengths of both to enable personalization and navigate the identified paradoxes: LFMs generate ranked intervention candidates with uncertainty estimates, which trigger subsequent N-of-1 trials. Clarifying the boundary between prediction and causation and explicitly addressing the paradoxical tensions are essential for responsible AI integration in personalized medicine.

Personalization of Large Foundation Models for Health Interventions

Real-world deployment of large vision‚Äìlanguage models (LVLMs) makes everyday photos vulnerable to unintended geolocation inference, motivating techniques that enable safe, user-controllable personalization and privacy-aware deployment. We present Adversarial Tiled Location Anonymity Shield (ATLAS), a fully user-side, zero-query, black-box image-layer adaptation module that can be inserted before any LVLM to control the visibility of geospatial and contextual cues under strict perceptual constraints. ATLAS learns such modulations through a Mixture-of-Tiles (MoT) formulation: a semantic segmenter decomposes an image into regions, and a compact tile bank is routed by learned semantic gates and assembled per region before blending with the input to yield a perceptually faithful image that misdirects LVLM geolocation inference. ATLAS is trained on multiple frozen surrogate vision encoders (e.g., LLaMA-4 vision tower, CLIP, BLIP), each paired with lightweight GeoHeads for geolocation supervision; tower-wise losses are aggregated to guide the MoT generator while keeping all backbones frozen. We further explore two complementary training domains: a pixel-space variant perturbing texture and color statistics, and a frequency-space variant modulating low-frequency phase structure to probe distribution-level fragility. On OpenStreetView-5M, ATLAS reduces country-level accuracy by over 40\% and increases mean localization error by over 3,000 km under matched perceptual fidelity. In practice, ATLAS serves as a deployable personalization-safety layer, complementing dialogue-level policies with portable, image-level control, offering a practical path toward privacy-preserving and user-controllable personalization in real-world LVLM deployments.

ATLAS: User-Side Personalization and Privacy Protection Against Geolocation Risks in Large Vision–Language Models

Recent advancements in large language models (LLMs) have significantly enhanced many aspects of research and daily lives. While LLMs are inherently powerful, their performance can be further improved through post-training tailored to specific user needs. For individual users who are unable to directly finetune base models due to resource constraints, classifier guidance offers a more cost-effective solution for controlled text generation. However, traditional ways of applying classifier guidance (CFG) dose not transfer well to Diffusion Large Language Models (DLLMs), which would suffer from instability, criterion mismatch and slow inference. In this work, we propose an efficient approach to utilize and adapt classifier guidance on DLLMs, substantially reducing training and inference time while delivering notable improvements in task performance.

Controlled Text Generation of DLLMs with Efficient Classifier Guidance

Foundation models for knowledge graphs (KGs) achieve strong cohort-level performance in link prediction, yet fail to capture individual user preferences; a key disconnect between general relational reasoning and personalized ranking. We propose GatedBias, a lightweight inference-time personalization framework that adapts frozen KG embeddings to individual user contexts without retraining or compromising global accuracy. Our approach introduces structure-gated adaptation: profile-specific features combine with graph-derived binary gates to produce interpretable, per-entity biases, requiring only ${\sim}300$ trainable parameters. We evaluate GatedBias on two benchmark datasets (Amazon-Book and Last-FM), demonstrating statistically significant improvements in alignment metrics while preserving cohort performance. Counterfactual perturbation experiments validate causal responsiveness; entities benefiting from specific preference signals show 6--30$\times$ greater rank improvements when those signals are boosted. These results show that personalized adaptation of foundation models can be both parameter-efficient and causally verifiable, bridging general knowledge representations with individual user needs.

Lightweight Inference-Time Personalization for Frozen Knowledge Graph Embeddings

Online grocery shopping presents unique challenges for sequential recommendations due to repetitive purchase patterns and complex item relationships within the baskets. Unlike traditional e-commerce, grocery recommendations must capture both complementary item associations and temporal dependencies across shopping sessions. To address these challenges in Amazon's online grocery business, we propose T-REX, a novel transformer architecture that generates personalized category-level suggestions by learning both short-term basket dependencies and long-term user preferences. Our approach introduces three key innovations: (1) an efficient sampling strategy utilizing dynamic sequence splitting for sparse shopping patterns, (2) an adaptive positional encoding scheme for temporal patterns, and (3) a category-level modeling approach that reduces dimensionality while maintaining recommendation quality. Although masked language modeling techniques like BERT4Rec excel at capturing item relations, they prove less suitable for next basket generation due to information leakage issues. In contrast, T-REX's causal masking approach better aligns with the sequential nature of basket generation, enabling more accurate next-basket predictions. Experiments on large-scale grocery offline data and online A/B tests show significant improvement over existing systems.

Content not yet available

Next from AAAI 2026

PersonaAgent with GraphRAG: Community-Aware Knowledge Graphs for Personalized LLM

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES