The paper proposes a cost‑efficient privacy enforcement method for email‑generating large language model (LLM) agents that intercepts drafts, creates an information‑release contract, rewrites the draft locally with a Gemma rewriter, and then optionally calls a final PrivacyChecker. Experiments on normal and strategically malicious prompts show that the Gemma + Checker approach reduces leakage from 11.41 % to 4.03 % and improves usable output rates, while also cutting the cost amplification of checker‑only pipelines from 1.32× to 1.02×. The results demonstrate that moving repair to a cheaper local layer can significantly lower both privacy leakage and operational cost, yet still rely on a checker for high‑risk sends.
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
arXiv:2609.14003v1 Announce Type: cross Abstract: Personal AI agents built on large language models (LLMs) are increasingly given access to a user's private data and communications in order to provid...
arXiv:2606. 09549v1 Announce Type: cross Abstract: Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene.
The paper introduces Task-Graph Contextual Integrity (TG‑CI), a formalism that extends traditional Contextual Integrity to multi‑agent systems by modeling workflows as Multi‑Agent Task Graphs (MATGs). TG‑CI evaluates privacy not just at individual disclosures but across the entire downstream propagation, offering two enforcement policies—Full‑Scope and Auto‑Region—that balance privacy protection with task performance. A new benchmark, MAPLE‑Bench, demonstrates that TG‑CI can cut unauthorized disclosures by up to 94% while preserving over 94% of task accuracy compared to existing local‑history CI methods.
arXiv:2610.16039v1 Announce Type: cross Abstract: Multi-agent LLM systems (MALS) introduce a privacy-leakage problem that conventional sensitivity-based defenses miss, since information disclosed to...
arXiv:2611.07640v1 Announce Type: cross Abstract: Indirect prompt-injection (IPI) benchmarks predominantly test planted instructions that redirect a tool-using agent toward an attacker-chosen task. Y...
BodhiPromptShield is a policy‑aware mediation layer for LLM agent pipelines that detects sensitive text spans before they propagate, replacing them with typed placeholders, semantic abstractions, or secure tokens and restoring them only at authorized execution boundaries. In evaluations on AI4Privacy, PrivacyLens, and AgentDojo datasets, the system reduces identifier exposure to 7.4% and 1.8% respectively, and limits exact identifier leakage in final actions to 2.1–3.1%. While mediation preserves factual content according to automated metrics, human annotations show a significant drop in inferability from 100% to 24–53%, indicating the need for human validation of semantic‑leakage measures.
arXiv:2605. 02187v2 Announce Type: replace-cross Abstract: LLM agents convert model outputs into consequential actions, including communications, code changes, and financial transactions.
The paper "Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization" examines how AI agents seek approval before performing actions such as sending money or deleting files. It identifies twelve attack vectors on the approval process and evaluates them against several protocols, finding that many agent runtimes lack verifiable approval records and exhibit binding weaknesses. The authors propose a defense called ASU (Agent Step-Up), which renders a canonical approval card, requires a phone passkey, and enforces single-use execution, demonstrating strong protection against substitution, replay, and grant-stretching attacks in extensive simulations.
The paper introduces APEX, an active defense for large language model agents that protects against indirect prompt injection by enforcing safety at execution boundaries. APEX uses an evidence‑gated prevention contract and deception‑based exposure to ensure that only authorized effects, endorsed by the task, are executed. Evaluation shows APEX achieves near‑zero attack success across multiple benchmarks and capability‑unit types, outperforming 13 baseline defenses.
arXiv:2607. 25364v1 Announce Type: new Abstract: Tool-using agents expose structured calls but commonly attach free-form rationales.
arXiv:2608.24569v2 Announce Type: replace Abstract: Large language model (LLM) agents build on one another's work through summaries, plans, and other intermediate artifacts. These records let a downs...