Framework reveals when AI agents leak sensitive data to outsiders
CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents
Cryptography and SecurityArtificial Intelligence
Summary
Sensitive information can leak from AI helpers even when it seems safely stored inside. The authors created a method called CIPL that checks how much private data an outside observer can actually recover from an AI agent. They tested different ways AI agents remember, find, and use information and found that just storing data securely doesn’t guarantee privacy. Their approach also finds important leaks missed by usual exact-match checks.
What this means in practice
- •For ai security teams: Assess the actual risk of sensitive information leaking from AI agents by measuring how much can be recovered by outsiders under different settings.
- •For software developers: Improve design of AI agents by understanding how data handling choices affect privacy leakage through memory, retrieval, or tool use.
Authors
Tao Huang, Guosen Wu, Guolong Zheng, Jiayang Meng, Chen Hou, Xu Yang, Xuechao Yang, Feng Xia
Abstract
Privacy leakage in LLM agents is commonly evaluated within individual components such as memory, retrieval, or tool-use pipelines, which makes it difficult to distinguish internal exposure from information that an external observer can actually recover. We present CIPL (Channel Inversion for Privacy Leakage), a channel-aware evaluation framework for black-box privacy leakage in LLM agents. CIPL represents a target through sensitive source, selection, assembly, execution, observation, and extraction stages and evaluates the transition from selected sensitive units to attacker-recoverable output under a shared protocol. Experiments across memory-based, retrieval-mediated, and tool-mediated targets, together with a BrowserUse live-agent case study, show that storage labels alone do not determine recoverability. Memory targets form a near-saturated reference case, retrieval-mediated leakage is frequently partial, and tool-mediated and live-agent leakage varies strongly with observation surface, prompt-to-channel alignment, retrieval depth, and provider behavior. A stratified semantic audit further identifies attacker-useful disclosures that canonical exact matching misses. CIPL therefore provides a common framework for comparing how internal sensitive dependence is realized as externally recoverable leakage across heterogeneous agent pipelines.