LLM agent privacy exposure often missed by common evaluations
ASLEval: Measuring Privacy Exposure Displacement in LLM Agent Sessions
Cryptography and SecurityArtificial Intelligence
Summary
Privacy checks on AI tools that use multiple steps often miss hidden leaks of private information during their sessions. The authors introduce a way to measure these hidden leaks by comparing official privacy checks with what actually gets exposed. They built a system called ASLEval to track all private exposures, finding that usual methods miss almost half of the leaks. Their work suggests new ways to evaluate AI privacy that balance protection with task success.
What this means in practice
- •For enterprise security teams: Identify hidden privacy leaks in AI tool workflows beyond simple endpoints in multi-step business scenarios.
- •For ai system auditors: Provide comprehensive diagnostics on where private data is exposed during AI assistant sessions to improve privacy controls.
Authors
Guosen Wu, Huizhen Huang, Guoxiong Long, Tao Huang, Chen Hou
Abstract
Privacy evaluations of tool-using LLM agents often inspect a designated action, final response, or attacker report. These local proxies can miss unauthorized exposure elsewhere in a multi-step session and lack common ground truth across outlets, reports, and tool paths. We introduce privacy exposure displacement, the mismatch between a local evaluation proxy and target-grounded session exposure, and ASLEval, an authorization-aware framework that pre-registers a hidden target set, measures all declared visible exits, and reserves internal traces for diagnosis. Across multiple enterprise-style environments and independently implemented runtimes, we observe three recurring patterns. An expected-outlet-only view misses 46.9% of exposure recovered by the visible-exit union; attacker self-reports combine omissions with high false discovery; and schema-aligned internal evidence usually precedes visible exposure at the request/probe level. Reducing model-visible returns changes this path but can eliminate normal-task success. Independent human review supports the adjudication pipeline while identifying harder console and candidate cases. These findings motivate benchmarks that declare the complete visible boundary, ground claims in pre-specified targets and authorization, and report privacy together with task utility.