STAFT: Privacy-preserving semantic trace abstraction for forensic triage of personal AI agent incidents

Abstract

Personal AI assistants act on private user context, which makes their execution traces primary forensic artifacts that are themselves privacy-sensitive. We present staft (Semantic Trace Abstraction for Forensic Triage), a forensic triage framework that replaces raw trace content with compact action, target, and intent tags for low-authorization triage while hash-linking the abstraction to the sealed raw trace at creation time. Across 150 agent traces from OS-HARM spanning indirect prompt injection, deliberate misuse, and model misbehavior, scope-matched Presidio masking removes the identifiers it is configured to detect while leaving the trace surface nearly unchanged (M₂ = 0.998 in every category). On the 50 injection traces, staft reduces token volume by 98.5%. In a focused evaluation of 18 validated canaries drawn from 12 traces, an adversary given the abstracted trace and the original task instruction recovers none, whereas identifier masking leaves 10 recoverable. The abstracted trace still narrows the six candidate sources to a shortlist of three containing the ground-truth source for 94% of traces. Under the evaluated benchmark and threat model, staft suppresses identifier- and surface-level exposure while retaining the behavioral structure that early triage depends on, and it supports scoped escalation rather than replacing analysis of the raw evidence.