CanaryBench: 集群级对话摘要中的隐私泄露压力测试
CanaryBench: Stress Testing Privacy Leakage in Cluster-Level Conversation Summaries
AI总结：
CanaryBench通过生成包含秘密字符串的合成对话，测试集群级对话摘要中的隐私泄露风险，并提出最小防御措施以减少泄露。
摘要：
在大型语言模型系统中，对话数据的聚合分析越来越多地用于安全监控、治理和产品分析。一种常见做法是嵌入对话、对其进行聚类，并发布简短的文本摘要描述每个聚类。虽然原始对话可能永远不会被暴露，但这些衍生摘要如果包含个人身份信息（PII）或可追溯的字符串，仍可能造成隐私风险。我们介绍了CanaryBench，一种简单的、可重复的隐私泄露压力测试方法，用于测试集群级对话摘要中的隐私泄露。CanaryBench生成包含植入秘密字符串（
英文摘要：
Aggregate analytics over conversational data are increasingly used for safety monitoring, governance, and product analysis in large language model systems. A common practice is to embed conversations, cluster them, and publish short textual summaries describing each cluster. While raw conversations may never be exposed, these derived summaries can still pose privacy risks if they contain personally identifying information (PII) or uniquely traceable strings copied from individual conversations. We introduce CanaryBench, a simple and reproducible stress test for privacy leakage in cluster-level conversation summaries. CanaryBench generates synthetic conversations with planted secret strings ("canaries") that simulate sensitive identifiers. Because canaries are known a priori, any appearance of these strings in published summaries constitutes a measurable leak. Using TF-IDF embeddings and k-means clustering on 3,000 synthetic conversations (24 topics) with a canary injection rate of 0.60, we evaluate an intentionally extractive example snippet summarizer that models quote-like reporting. In this configuration, we observe canary leakage in 50 of 52 canary-containing clusters (cluster-level leakage rate 0.961538), along with nonzero regex-based PII indicator counts. A minimal defense combining a minimum cluster-size publication threshold (k-min = 25) and regex-based redaction eliminates measured canary leakage and PII indicator hits in the reported run while maintaining a similar cluster-coherence proxy. We position this work as a societal impacts contribution centered on privacy risk measurement for published analytics artifacts rather than raw user data.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
