CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents

2026-09-18

AI Summary

CIPL框架通过模拟敏感信息处理流程，评估大型语言模型代理中的隐私泄露问题，揭示了存储标签不决定泄露风险，并提供了跨不同组件的统一评估方法。

Abstract

Privacy leakage in LLM agents is commonly evaluated within individual components such as memory, retrieval, or tool-use pipelines, which makes it difficult to distinguish internal exposure from information that an external observer can actually recover. We present CIPL (Channel Inversion for Privacy Leakage), a channel-aware evaluation framework for black-box privacy leakage in LLM agents. CIPL represents a target through sensitive source, selection, assembly, execution, observation, and extraction stages and evaluates the transition from selected sensitive units to attacker-recoverable output under a shared protocol. Experiments across memory-based, retrieval-mediated, and tool-mediated targets, together with a BrowserUse live-agent case study, show that storage labels alone do not determine recoverability. Memory targets form a near-saturated reference case, retrieval-mediated leakage is frequently partial, and tool-mediated and live-agent leakage varies strongly with observation surface, prompt-to-channel alignment, retrieval depth, and provider behavior. A stratified semantic audit further identifies attacker-useful disclosures that canonical exact matching misses. CIPL therefore provides a common framework for comparing how internal sensitive dependence is realized as externally recoverable leakage across heterogeneous agent pipelines.

Problem

• Privacy Leakage
• LLM Agents
• Internal Exposure
• External Recovery
• Channel-Aware

Innovation

• Channel-Aware Evaluation
• Privacy Leakage
• LLM Agents
• Recoverable Output
• Semantic Audit