arXiv:2602. 11510v3 Announce Type: replace Abstract: Multi-agent Large Language Model (LLM) systems create privacy risks that current output-only benchmarks cannot measure.
The paper introduces Task-Graph Contextual Integrity (TG‑CI), a formalism that extends traditional Contextual Integrity to multi‑agent systems by modeling workflows as Multi‑Agent Task Graphs (MATGs). TG‑CI evaluates privacy not just at individual disclosures but across the entire downstream propagation, offering two enforcement policies—Full‑Scope and Auto‑Region—that balance privacy protection with task performance. A new benchmark, MAPLE‑Bench, demonstrates that TG‑CI can cut unauthorized disclosures by up to 94% while preserving over 94% of task accuracy compared to existing local‑history CI methods.
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
arXiv:2609.14003v1 Announce Type: cross Abstract: Personal AI agents built on large language models (LLMs) are increasingly given access to a user's private data and communications in order to provid...
arXiv:2512. 04668v4 Announce Type: replace-cross Abstract: Graph topology is a fundamental determinant of memory leakage in multi-agent LLM systems, yet its effects remain poorly quantified.
InferPriv is a new benchmark that evaluates inferential privacy leakage in large language model (LLM) assistants. It measures whether an honest-but-curious recipient can deduce a user’s sensitive attributes from an LLM’s reply during routine tasks, a type of leakage not captured by existing direct‑leakage benchmarks. Testing five frontier models, the study finds that inferential leakage rates (16.2–25.2%) far exceed direct leakage, even when direct leakage is near zero under privacy‑aware prompts.
CIPL (Channel Inversion for Privacy Leakage) is a channel-aware framework designed to evaluate black-box privacy leakage in large language model agents. It models the leakage process through stages of sensitive source, selection, assembly, execution, observation, and extraction, assessing how selected sensitive units become attacker-recoverable outputs. Experiments across memory, retrieval, and tool-mediated targets, plus a live-agent case study, reveal that recoverability depends on factors beyond storage labels, such as observation surface, prompt alignment, retrieval depth, and provider behavior, and that a semantic audit can uncover disclosures missed by exact matching.
arXiv:2606. 10749v1 Announce Type: cross Abstract: Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments.
arXiv:2606. 09844v1 Announce Type: cross Abstract: Large Language Models (LLMs) alter their privacy behavior based on the perceived identity of their interlocutor.
arXiv:2606.23189v2 Announce Type: replace-cross Abstract: Computer-use agents (CUAs) now act on a user's behalf across personal applications such as email, calendars, and to-do lists. This cross-appl...
The paper investigates how large language model agents can inadvertently leak confidential information by combining data from multiple documents—a phenomenon termed the "mosaic effect." Using 30 synthetic cybersecurity, medical, and military scenarios, the authors generate 10,800 simulated and 1,440 live answers from three LLM agents, finding that even the best model discloses forbidden composites in over 7% of simulated responses. While visible classification headers and aggregation rules reduce disclosure rates, unsafe disclosures remain in roughly one third of simulated answers, and increased refusals do not fully prevent leakage of prohibited conclusions.
arXiv:2609.39050v1 Announce Type: cross Abstract: As multi-agent systems enter high-stakes domains, the possibility that agents may circumvent safety boundaries is a growing concern. Prior work has e...