AgentTell：浏览器使用智能体中的行为侧信道泄漏

中文摘要 AI 辅助

浏览器使用智能体在网站间移动时，其上下文中常常携带信息。虽然这些信息可能是完成任务所必需的，但也带来了隐私风险，尤其是当信息包含关于用户的私人事实时。例如，智能体在阅读会员记录后可能获知用户的隶属关系。如果它随后在另一个网站上选择针对该隶属关系的特定注册选项，而非通用选项，该信息便遭到泄漏。在本工作中，我们定义并研究了浏览器使用智能体中的行为侧信道泄漏，即智能体的行为无意中泄露了从先前网站保留的私人信息（秘密），尽管有明确指令要求不得披露该信息。我们引入了AgentTell，一个包含20个场景和100个任务的基准，其中智能体在一个网站上获取秘密，然后在另一个网站上完成任务，该网站提供与秘密相关的特定操作以及不泄露任何信息的通用操作。我们在六个骨干模型上的9,760个会话中的评估显示，携带秘密的智能体在61.1%的会话中通过其行为泄露了秘密。即使智能体在记忆中明确声明不得共享秘密，它们仍在56.7%的这些会话中泄露了秘密。此外，在34.5%的泄露会话中，智能体的最终回答错误地向用户保证秘密未被披露。这些发现表明，智能体往往未能将侧信道泄漏视为隐私风险。

英文摘要

Browser-use agents often carry information in their context as they move between websites. While it may be necessary for task completion, it also creates a privacy risk, especially when the information contains a private fact regarding the user. For example, an agent may learn a user's affiliation after reading a membership record. If it later selects a registration option specific to that affiliation on another website instead of a general option, the information gets leaked. In this work, we define and study behavioural side-channel leakage in browser-use agents, where an agent's actions inadvertently reveal private information (secret) retained from a prior website, despite an explicit instruction not to disclose it. We introduce AgentTell, a benchmark of 20 scenarios and 100 tasks in which an agent acquires a secret on one website and then completes a task on another website that offers secret-specific actions alongside a general action that reveals nothing. Our evaluation across 9,760 sessions on six backbones shows that agents carrying a secret reveal it through their actions in 61.1% of sessions. Even when agents explicitly state in memory that the secret must not be shared, they still reveal it in 56.7% of those sessions. Moreover, in 34.5% of leaking sessions, their final responses falsely assure users that the secret was not disclosed. These findings show that agents often fail to recognize side-channel leakage as a privacy risk.

发表机构

• BRAC University（BRAC大学）
• Qatar Computing Research Institute (QCRI)（卡塔尔计算研究所（QCRI））

机构由 AI 辅助整理，请以论文原文为准。