arXiv 2603.227512026-03-30cs.CR

可观察通道而非仅存储：评估LLM代理流水线中的隐私泄露

Observable Channels, Not Just Storage: Evaluating Privacy Leakage in LLM Agent Pipelines

Minjiang University（闽江大学）；Renmin University of China（中国人民大学）

Tao Huang, Chen Hou, Guosen Wu, Jiayang Meng

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出CIPL框架，通过统一的通道导向接口评估LLM代理流水线中的隐私泄露，揭示内存、检索和工具中介目标的泄露特性，强调通道条件而非单一攻击方法的重要性。

摘要：

LLM代理中的隐私泄露通常通过单独的存储或执行组件研究，如内存模块、检索流水线或工具中介的产物。然而，这些设置通常孤立分析，难以比较隐私内部依赖如何在异构代理流水线中转化为外部可恢复性。本文提出CIPL（通道倒置用于隐私泄露）作为统一的通道导向评估接口，通过敏感源、选择、组装、执行、观察和提取阶段共同协议，测量内部暴露如何转化为攻击者可恢复的泄露。使用基于内存、检索中介和工具中介的实例，识别了跨目标风险图。内存表现为高风险特例，而超内存泄露表现出不同领域：检索中介目标显示频繁但通常不完整的泄露，工具中介目标受暴露观察表面和提供者行为强烈影响。进一步表明泄露由通道条件而非普遍主导配方决定：清洁弱控制显著抑制泄露，语义标注揭示攻击者有用的泄露超出精确匹配提取。这些发现表明，LLM代理流水线的隐私风险应通过可观察通道而非仅存储组件来理解。更广泛地说，我们的结果促使通道导向的隐私评估成为组件局部或精确仅分析的必要补充。

英文摘要：

Privacy leakage in LLM agents is often studied through individual storage or execution components, such as memory modules, retrieval pipelines, or tool-mediated artifacts. However, these settings are typically analyzed in isolation, making it difficult to compare how private internal dependence becomes externally recoverable across heterogeneous agent pipelines. In this paper, we present CIPL (Channel Inversion for Privacy Leakage) as a unified channel-oriented measurement interface for evaluating privacy leakage in LLM agent pipelines. Rather than claiming a universally strongest attack recipe, CIPL provides a shared way to represent a target through its sensitive source, selection, assembly, execution, observation, and extraction stages, and to measure how internal exposure is transformed into attacker-recoverable leakage under a common protocol. Using memory-based, retrieval-mediated, and tool-mediated instantiations under this shared interface, we identify a distinct cross-target risk picture. Memory behaves as a near-saturated high-risk special case, while beyond-memory leakage exhibits a different regime: retrieval-mediated targets show frequent but often incomplete leakage, and tool-mediated targets are strongly shaped by the exposed observation surface and provider behavior. We further show that leakage is governed by channel conditions rather than by a universally dominant recipe: cleaned weak controls sharply suppress leakage, and semantic annotation reveals attacker-useful leakage beyond exact-match extraction. Together, these findings suggest that privacy risk in LLM agent pipelines is better understood through \emph{observable channels}, not just storage components. More broadly, our results motivate channel-oriented privacy evaluation as a necessary complement to component-local or exact-only analyses.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

AI总结：

摘要：

英文摘要：

相关论文