ASLEval: Measuring Privacy Exposure Displacement in LLM Agent Sessions

Problem

The paper addresses a significant gap in the evaluation of privacy for tool-using large language model (LLM) agents, specifically concerning unauthorized exposure during multi-step sessions. Existing methodologies do not adequately measure the risks associated with privacy breaches in these complex interactions. This work is particularly relevant as it is presented as a preprint and has not undergone peer review.

Method

The authors propose a novel framework named ASLEval, which operates by pre-registering a hidden target set to assess privacy exposure. The framework measures all declared visible exits and reserves internal traces for diagnostic purposes. ASLEval is designed to function in multiple enterprise-style environments and is implemented with independently executed runtimes, ensuring that the evaluations are robust and applicable across different contexts.

Results

The results indicate that ASLEval can recover 46.9% of exposure that is missed when relying solely on the visible-exit union compared to an expected-outlet-only view. Additionally, the study reports a high false discovery rate in attacker self-reports, coupled with significant omissions, although no specific baseline for comparison is provided. Furthermore, the internal evidence collected through the framework shows that schema-aligned internal evidence typically precedes visible exposure at the request or probe level, again without a baseline for reference.

Limitations

The authors acknowledge that reducing model-visible returns may lead to a decrease in the success of normal tasks, which could impact the usability of the LLM agents. They also note the identification of more challenging console and candidate cases during independent human review, suggesting that the framework may not be universally applicable across all scenarios.

Why it matters

The implications of this work are significant for downstream research and applications involving LLM agents, particularly in enterprise settings where privacy is paramount. By providing a structured approach to evaluate privacy exposure, ASLEval can help inform the design of more secure LLM systems and guide future research in privacy-preserving AI methodologies.