← Back to all news
arXiv AI By Guosen Wu, Huizhen Huang, Guoxiong Long, Tao Huang, Chen Hou

ASLEval: Measuring Privacy Exposure Displacement in LLM Agent Sessions

Read the original on arXiv AI →

The paper introduces ASLEval, a framework for measuring privacy exposure displacement in large language model (LLM) agent sessions. It highlights that traditional local proxies—such as inspecting a single action or final response—often miss unauthorized data leaks elsewhere in a multi-step session. ASLEval pre-registers hidden target sets, tracks all declared visible exits, and preserves internal traces for diagnosis, revealing that a single outlet view can overlook nearly 47% of exposure and that internal evidence typically precedes visible leaks. The study underscores the need for benchmarks that define complete visible boundaries, ground claims in pre-specified targets, and report privacy alongside task utility.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv AI
Sep 21

CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents

CIPL (Channel Inversion for Privacy Leakage) is a channel-aware framework designed to evaluate black-box privacy leakage in large language model agents. It models the leakage process through stages of sensitive source, selection, assembly, execution, observation, and extraction, assessing how selected sensitive units become attacker-recoverable outputs. Experiments across memory, retrieval, and tool-mediated targets, plus a live-agent case study, reveal that recoverability depends on factors beyond storage labels, such as observation surface, prompt alignment, retrieval depth, and provider behavior, and that a semantic audit can uncover disclosures missed by exact matching.

By Tao Huang, Guosen Wu, Guolong Zheng, Jiayang Meng, Chen Hou, Xu Yang, Xuechao Yang, Feng Xia
llmsagentssafety
More like this →
arXiv AI
Aug 28

When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents

The paper introduces SARA, a framework that separates action induction from runtime authorization in tool‑augmented LLM agents. By treating these as distinct roles, SARA uses an Action Probe to record action provenance and only authorizes tool calls that align with the user objective and past successful executions. Experiments on AgentDojo and AgentDyn show that SARA reduces action‑to‑side‑effect risk to below 0.63% while preserving task performance.

By Xiaokun Guo, Zhen Xu, Dongdong Huo, Yanqiu Zhang, Wei Wang, Qinfu Yang, Dongjin Yu, Yu Wang
llmsagentsmultimodal
More like this →