Large language models leak secrets despite topic changes in chats
PrivDrift: Auditing User-Secret Leakage Under Topic Drift in Active LLM Conversations
Artificial IntelligenceComputation and LanguageCryptography and Security
Summary
When people talk to large language models, sometimes they share private information. This paper shows that even after the conversation moves to different topics, the model often still remembers and reveals those secrets when asked cleverly. The researchers created a test called PrivDrift to measure how much secret information leaks during these topic shifts. They found that many models leak a significant amount of secret details, and simply changing the topic doesn’t stop this leakage.
What this means in practice
- •For chatbot developers: Detect persistent secret leaks in conversational AI by evaluating models using the PrivDrift benchmark across topic shifts.
- •For security testing teams: Audit AI assistants for privacy vulnerabilities where user secrets remain recoverable after dialogue shifts, improving compliance testing.
Authors
Luciano Maldonado
Abstract
Large language models increasingly operate as persistent assistants in user-facing, shared-session, and tool-augmented settings. When users disclose sensitive information during an active conversation, that information may remain behaviorally recoverable through later prompts even after the dialogue shifts to unrelated topics. We introduce \textbf{PrivDrift}, a benchmark for auditing whether user-disclosed secrets remain recoverable after conversational topic drift and persuasion-based probing. PrivDrift contains 1{,}000 controlled multi-turn dialogues with seeded secrets, content-dense drift turns, and standardized extraction probes. Across three LLMs with extended context windows, dialogue-level hybrid leakage remains substantial, ranging from 38.7\% to 54.6\%, and varies strongly by model, secret type, and persuasion intensity. Within the tested drift window, additional topic drift does not reliably reduce leakage, suggesting that privacy risk in active LLM contexts should be evaluated as a persistent behavioral failure mode rather than only as training-data memorization or immediate jailbreak behavior.