The paper introduces Task-Graph Contextual Integrity (TG‑CI), a formalism that extends traditional Contextual Integrity to multi‑agent systems by modeling workflows as Multi‑Agent Task Graphs (MATGs). TG‑CI evaluates privacy not just at individual disclosures but across the entire downstream propagation, offering two enforcement policies—Full‑Scope and Auto‑Region—that balance privacy protection with task performance. A new benchmark, MAPLE‑Bench, demonstrates that TG‑CI can cut unauthorized disclosures by up to 94% while preserving over 94% of task accuracy compared to existing local‑history CI methods.
By Hengyu Wu, Blaise Delattre, Yang Cao
Autonomous LLM agents executing multi-step workflows over personal data often misalign with user privacy expectations and leak sensitive, out-of-context information. Although Contextual Integrity (CI)...
PrivacyFlow introduces a new benchmark, PrivacyBench, and a defense system that separates privacy planning from task execution in autonomous LLM agents. The system traces data provenance, models recipient knowledge, and simulates inference attacks to weigh disclosure risk against task utility, allowing it to minimize or block data sharing. Experiments show that PrivacyFlow reduces privacy failures and increases completed task sequences by 22–55 percentage points, while revealing a tradeoff between privacy, utility, and user autonomy.
By Robin Staab, Tom Wollschl\"ager, Vahab Mirrokni, Reza Shokri
CIPL (Channel Inversion for Privacy Leakage) is a channel-aware framework designed to evaluate black-box privacy leakage in large language model agents. It models the leakage process through stages of sensitive source, selection, assembly, execution, observation, and extraction, assessing how selected sensitive units become attacker-recoverable outputs. Experiments across memory, retrieval, and tool-mediated targets, plus a live-agent case study, reveal that recoverability depends on factors beyond storage labels, such as observation surface, prompt alignment, retrieval depth, and provider behavior, and that a semantic audit can uncover disclosures missed by exact matching.
By Tao Huang, Guosen Wu, Guolong Zheng, Jiayang Meng, Chen Hou, Xu Yang, Xuechao Yang, Feng Xia
arXiv:2602. 11510v3 Announce Type: replace Abstract: Multi-agent Large Language Model (LLM) systems create privacy risks that current output-only benchmarks cannot measure.
By Faouzi El Yagoubi, Godwin Badu-Marfo, Ranwa Al Mallah
arXiv:2606. 26627v1 Announce Type: cross Abstract: Large language model agents increasingly query databases, search document collections, call external APIs, remember past interactions, and act on a user's behalf.
By Nada Lahjouji, Ashwin Gerard Colaco
arXiv:2609.14003v1 Announce Type: cross
Abstract: Personal AI agents built on large language models (LLMs) are increasingly given access to a user's private data and communications in order to provid...
By Minsun Shim, Ramisha Raida Karim, Ruthwik Jakkula, Kaiwen Zhou, Xin Liu, Xin Eric Wang, Zhou Li
Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream.
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
By Mingxuan Zhang, Jiahui Han, Dadi Guo, Songze Li, Guanchu Wang, Na Zou, Dongrui Liu, Xia Hu
BodhiPromptShield is a policy‑aware mediation layer for LLM agent pipelines that detects sensitive text spans before they propagate, replacing them with typed placeholders, semantic abstractions, or secure tokens and restoring them only at authorized execution boundaries. In evaluations on AI4Privacy, PrivacyLens, and AgentDojo datasets, the system reduces identifier exposure to 7.4% and 1.8% respectively, and limits exact identifier leakage in final actions to 2.1–3.1%. While mediation preserves factual content according to automated metrics, human annotations show a significant drop in inferability from 100% to 24–53%, indicating the need for human validation of semantic‑leakage measures.
By Bo Ma, Jinsong Wu, Weiqi Yan
arXiv:2607. 24625v1 Announce Type: cross Abstract: Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors.
By Arseny Kravchenko, Vadim Liventsev, Innokentii Konstantinov, Ildar Iskhakov, Matvey Kukuy
The paper proposes the Analytical Memory Unit (AMU), a memory schema that attaches a full derivation (lineage) graph to every cached result in enterprise AI agents. By gating retrieval with a policy that requires authorization for every column touched, the authors prove that sensitive columns cannot be leaked through derived results, achieving up to 90% lineage completeness to eliminate leakage. Experiments show lineage‑gated retrieval removes 18.8‑25.5% of cross‑department leakage while maintaining 81.5‑82.6% memory reuse with minimal overhead, and a real‑agent proof‑of‑concept demonstrates zero leaks over multiple interactions.
By Venkata M Sangaraju, Sudhir Vissa