超越越狱：审计 LLM 智能体中的上下文隐私
Beyond Jailbreaking: Auditing Contextual Privacy in LLM Agents
AI总结：
本文提出 CMPL 多轮会话隐私审计框架，通过迭代探测揭示 LLM 智能体在渐进操纵和侧信道泄漏下的潜在漏洞，并提供量化风险指标与开放基准。
摘要：
LLM 智能体已开始以个人助理、客服机器人和临床辅助工具的形式出现。尽管这些应用带来了显著的运营效益，但它们也需要持续访问敏感数据，从而增加了未经授权披露的可能性。此外，这些披露并不局限于单纯的显式泄露，还为渐进式操纵或侧信道信息泄漏留下了途径。本研究提出了一种会话隐私审计框架，用于量化智能体对这些风险的易感程度。所提出的 Conversational Manipulation for Privacy Leakage（CMPL，面向隐私泄漏的会话操纵）框架旨在对执行严格隐私指令的智能体进行压力测试，使其面对一种迭代探测策略。CMPL 并非仅关注单一披露事件或纯粹的显式泄漏，而是模拟真实的多轮交互，以系统性地发现潜在漏洞。我们在不同领域、数据模态和安全配置上的评估表明，该审计框架能够揭示现有单轮防御无法阻止的隐私风险；同时，本文还对泄漏的时间动态、自适应攻击者采用的策略，以及攻击者关于敏感目标的信念演化进行了深入的纵向研究。除了将 CMPL 作为一种诊断工具引入外，本文还提供：（1）一套以可量化风险指标为基础的审计流程；（2）一个用于跨智能体实现评估会话隐私的开放基准。
英文摘要：
LLM agents have begun to appear as personal assistants, customer service bots, and clinical aides. While these applications deliver substantial operational benefits, they also require continuous access to sensitive data, which increases the likelihood of unauthorized disclosures. Moreover, these disclosures go beyond mere explicit disclosure, leaving open avenues for gradual manipulation or sidechannel information leakage. This study proposes an auditing framework for conversational privacy that quantifies an agent's susceptibility to these risks. The proposed Conversational Manipulation for Privacy Leakage (CMPL) framework is designed to stress-test agents that enforce strict privacy directives against an iterative probing strategy. Rather than focusing solely on a single disclosure event or purely explicit leakage, CMPL simulates realistic multi-turn interactions to systematically uncover latent vulnerabilities. Our evaluation on diverse domains, data modalities, and safety configurations demonstrates the auditing framework's ability to reveal privacy risks that are not deterred by existing single-turn defenses, along with an in-depth longitudinal study of the temporal dynamics of leakage, strategies adopted by adaptive adversaries, and the evolution of adversarial beliefs about sensitive targets. In addition to introducing CMPL as a diagnostic tool, the paper delivers (1) an auditing procedure grounded in quantifiable risk metrics and (2) an open benchmark for evaluation of conversational privacy across agent implementations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
