发表机构
Hefei University of Technology; East China Normal University; Alibaba Cloud Computing（合肥工业大学; 华东师范大学; 阿里云计算）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究提出OverAct基准测量LLM工具调用智能体的主动过度授权，发现请求特异性是主要预测因子，并推出SelfAudit推理时过滤方法，在无需预言机知识下将隐私过度行为减少43%。
AI 中文摘要
具有工具调用能力的LLM智能体可以访问外部服务和私人用户数据，但它们可能检索到超出用户请求明确要求的信息。我们在结构化工具调用智能体中研究这种行为，并将其称为主动过度授权。这一设置不同于文件系统级别的编码智能体，因为主要风险在于对私有数据的不必要访问。我们引入了OverAct，一个涵盖八个隐私敏感领域的受控基准，具有确定性的、无需评判的评分机制，同时提出了一个解释性的决策理论框架，该框架产生了三个可检验的预测。在来自四个家族的七个模型中，所有模型都显著超出了授权范围。请求特异性是严重程度的最强预测因子，过度授权随工具池规模呈次线性增长，解码温度影响甚微。这些模式与成本不对称的解释一致，表明过度授权更多源于结构性决策倾向，而非解码随机性。我们还提出了SelfAudit，一种零样本推理时方法，该方法生成基于请求的论证，并在执行前过滤无根据的调用。消融实验表明，显式过滤是范围缩减的主要驱动因素。SelfAudit在无需预言机知识的情况下将隐私导向的过度行为减少了43%。
英文摘要
LLM agents with tool-calling capabilities can access external services and private user data, but they may retrieve more information than a user's request explicitly requires. We study this behavior in structured tool-calling agents and term it proactive over-authorization. This setting differs from filesystem-level coding agents because the main risk is unnecessary access to private data. We introduce OverAct, a controlled benchmark spanning eight privacy-sensitive domains with deterministic, judge-free scoring, together with an interpretive decision-theoretic framework that yields three testable predictions. Across seven models from four families, all models significantly exceed authorized scope. Request specificity is the strongest predictor of severity, over-authorization grows sublinearly with tool-pool size, and decoding temperature has little effect. These patterns are consistent with a cost-asymmetry account, suggesting that over-authorization arises more from structural decision tendencies than from decoding randomness. We also propose SelfAudit, a zero-shot inference-time method that generates request-grounded justifications and filters unjustified calls before execution. Ablation shows that explicit filtering is the main driver of scope reduction. SelfAudit reduces privacy-oriented excess by 43% without oracle knowledge.
