更安全的推理轨迹：衡量和减轻大语言模型中的推理链泄露
Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in LLMs
AI总结：
本文研究了大语言模型中推理链泄露问题，提出了一种模型无关的框架来衡量和减轻隐私风险，通过比较不同模型和预算下的泄露情况，提出了混合门卫策略以平衡效用与风险。
摘要：
推理链（CoT）提示提高了大语言模型的推理能力，但通过将个人可识别信息（PII）从提示中重新浮现到推理轨迹和输出中，可能增加隐私风险，即使在规定模型不得重述PII的政策下。我们使用一种模型无关的框架研究这种直接的推理时间PII泄露，该框架（i）将泄露定义为跨11种PII类型的风险加权、token级事件；（ii）追踪泄露曲线作为允许的CoT预算函数；（iii）在结构化的PII数据集上比较开源和闭源模型家族，采用分层风险分类法。我们发现，CoT一致提高了泄露水平，尤其是在高风险类别中，且泄露强烈依赖于模型和预算。增加推理预算可能根据基础模型放大或减轻泄露。我们随后评估轻量级的推理时间门卫：基于规则的检测器、TF-IDF + 逻辑回归分类器、基于GLiNER的命名实体识别模型以及LLM-as-judge，使用风险加权F1、宏F1和召回率。没有单一方法在所有模型或预算上占优，这促使了混合、风格自适应的门卫策略，以在统一、可重复的协议下平衡效用和风险。
英文摘要：
Chain-of-Thought (CoT) prompting improves LLM reasoning but can increase privacy risk by resurfacing personally identifiable information (PII) from the prompt into reasoning traces and outputs, even under policies that instruct the model not to restate PII. We study such direct, inference-time PII leakage using a model-agnostic framework that (i) defines leakage as risk-weighted, token-level events across 11 PII types, (ii) traces leakage curves as a function of the allowed CoT budget, and (iii) compares open- and closed-source model families on a structured PII dataset with a hierarchical risk taxonomy. We find that CoT consistently elevates leakage, especially for high-risk categories, and that leakage is strongly family- and budget-dependent. Increasing the reasoning budget can either amplify or attenuate leakage depending on the base model. We then benchmark lightweight inference-time gatekeepers: a rule-based detector, a TF-IDF + logistic regression classifier, a GLiNER-based NER model, and an LLM-as-judge, using risk-weighted F1, Macro-F1, and recall. No single method dominates across models or budgets, motivating hybrid, style-adaptive gatekeeping policies that balance utility and risk under a common, reproducible protocol.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
