The paper introduces Task-Graph Contextual Integrity (TG‑CI), a formalism that extends traditional Contextual Integrity to multi‑agent systems by modeling workflows as Multi‑Agent Task Graphs (MATGs). TG‑CI evaluates privacy not just at individual disclosures but across the entire downstream propagation, offering two enforcement policies—Full‑Scope and Auto‑Region—that balance privacy protection with task performance. A new benchmark, MAPLE‑Bench, demonstrates that TG‑CI can cut unauthorized disclosures by up to 94% while preserving over 94% of task accuracy compared to existing local‑history CI methods.
By Hengyu Wu, Blaise Delattre, Yang Cao
Autonomous LLM agents executing multi-step workflows over personal data often misalign with user privacy expectations and leak sensitive, out-of-context information. Although Contextual Integrity (CI)...
PrivacyFlow introduces a new benchmark, PrivacyBench, and a defense system that separates privacy planning from task execution in autonomous LLM agents. The system traces data provenance, models recipient knowledge, and simulates inference attacks to weigh disclosure risk against task utility, allowing it to minimize or block data sharing. Experiments show that PrivacyFlow reduces privacy failures and increases completed task sequences by 22–55 percentage points, while revealing a tradeoff between privacy, utility, and user autonomy.
By Robin Staab, Tom Wollschl\"ager, Vahab Mirrokni, Reza Shokri
CIPL (Channel Inversion for Privacy Leakage) is a channel-aware framework designed to evaluate black-box privacy leakage in large language model agents. It models the leakage process through stages of sensitive source, selection, assembly, execution, observation, and extraction, assessing how selected sensitive units become attacker-recoverable outputs. Experiments across memory, retrieval, and tool-mediated targets, plus a live-agent case study, reveal that recoverability depends on factors beyond storage labels, such as observation surface, prompt alignment, retrieval depth, and provider behavior, and that a semantic audit can uncover disclosures missed by exact matching.
By Tao Huang, Guosen Wu, Guolong Zheng, Jiayang Meng, Chen Hou, Xu Yang, Xuechao Yang, Feng Xia
arXiv:2602. 11510v3 Announce Type: replace Abstract: Multi-agent Large Language Model (LLM) systems create privacy risks that current output-only benchmarks cannot measure.
By Faouzi El Yagoubi, Godwin Badu-Marfo, Ranwa Al Mallah
arXiv:2606. 26627v1 Announce Type: cross Abstract: Large language model agents increasingly query databases, search document collections, call external APIs, remember past interactions, and act on a user's behalf.
By Nada Lahjouji, Ashwin Gerard Colaco