InferPriv：评估 LLM 助手的推理型隐私泄露
InferPriv: Evaluating Inferential Privacy Leakage in LLM Assistants
AI 导读
InferPriv 是一个新基准，用于测量“诚实但好奇”的接收方能从 LLM 助手对日常任务的回复中推断出用户敏感属性的程度。对五个前沿模型的评估显示，推理型泄露远超直接泄露：在隐私感知 system prompt 下，GPT-6.1-Sol、Sonnet-5.5 和 Gemini-3.8-Flash 的直接泄露接近零，但推理型泄露率仍达 16.2%–25.2%。
正文 · 原文
Abstract:Large language model (LLM)-based personal agents are increasingly deployed to handle everyday tasks on users' behalf. These agents have access to private user information, while their tasks involve communicating with third parties; this raises a critical privacy concern that agents may inappropriately reveal sensitive user information to these recipients. Existing benchmarks primarily assess direct privacy leakage, where an agent explicitly states a pre-specified secret or attribute. However, they do not capture \textit{inferential leakage}, where the model leaves indirect cues in the reply that implicitly leaks sensitive attributes. We introduce \textsc{InferPriv}, a benchmark that measures whether an honest-but-curious recipient can infer a user's sensitive attributes from an LLM's reply on routine task. Evaluating five frontier models, we find that inferential leakage substantially exceeds direct leakage across models and prompts. Under a privacy-aware system prompt, GPT-6.1-Sol, Sonnet-5.5, and Gemini-3.8-Flash achieve near-zero direct leakage, yet the inferential leakage rate remains between 16.2--25.2\%. These findings suggest that evaluating explicit leakage alone can substantially understate the privacy risks.
| Subjects: | Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.34640 [cs.AI] |
| (or arXiv:2610.34640v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.34640 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Pengrun Huang [view email]
[v1]
Sun, 25 Oct 2026 23:51:50 UTC (877 KB)
来源：arXiv cs.AI · arxiv.org