CIPL框架评估LLM代理隐私泄露
CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents
这个框架很实用，能帮你判断LLM代理的隐私泄露到底有多严重，比如内存、检索、工具使用这些场景，比单纯看存储标签更准确。
CIPL是一个评估框架，用于检测LLM代理中可恢复的隐私泄露。它通过模拟从敏感信息到攻击者可恢复输出的整个流程来评估。实验表明，仅靠存储标签无法确定泄露是否可恢复。对于基于内存的目标，泄露几乎饱和；对于检索介导的目标，泄露通常是部分的；对于工具介导和实时代理的目标，泄露程度与观察表面、提示与通道对齐、检索深度和提供商行为密切相关。
CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents
Privacy leakage in LLM agents is commonly evaluated within individual components such as memory, retrieval, or tool-use pipelines, which makes it difficult to distinguish internal exposure from information that an external observer can actually recover. We present CIPL (Channel Inversion for Privacy Leakage), a channel-aware evaluation framework for black-box privacy leakage in LLM agents. CIPL represents a target through sensitive source, selection, assembly, execution, observation, and extraction stages and evaluates the transition from selected sensitive units to attacker-recoverable output under a shared protocol. Experiments across memory-based, retrieval-mediated, and tool-mediated targets, together with a BrowserUse live-agent case study, show that storage labels alone do not determine recoverability. Memory targets form a near-saturated reference case, retrieval-mediated leakage is frequently partial, and tool-mediated and live-agent leakage varies strongly with observation surface, prompt-to-channel alignment, retrieval depth, and provider behavior. A stratified semantic audit further identifies attacker-useful disclosures that canonical exact matching misses. CIPL therefore provides a common framework for comparing how internal sensitive dependence is realized as externally recoverable leakage across heterogeneous agent pipelines.