PrivacyPeek：審計基於LLM之代理所獲取的內容，而非僅其所言

摘要

基於大型語言模型（LLM）的代理正迅速發展，能夠自主呼叫外部工具，為使用者完成多步驟任務。然而，代理往往會取得比任務所需更多的敏感資訊。現有的隱私基準稽核的是代理的回應或對外動作所揭露的內容，卻忽略了資料首次進入代理上下文時的取得階段。如此一來，過度取得的資訊距離徹底洩漏僅差一次粗心的操作或一次攻擊。為了評估這種現象的普遍程度，我們提出了 PrivacyPeek，這是一個用於評估基於 LLM 的代理在取得階段隱私洩漏的基準，涵蓋 7 種取得行為與 16 個應用領域，共 1,182 個案例。具體而言，取得檢查（Acquisition Inspection）檢視代理的工具呼叫軌跡，包括其所呼叫的工具與所接收的資料，以偵測其何時取得超出任務範圍的敏感資訊。接著，探測誘發（Probe Elicitation）發出後續探測，衡量攻擊者能多容易地引出代理已取得但未揭露的敏感資訊。我們在橫跨 4 個模型家族的 10 個 LLM 代理上進行的實驗顯示，不必要的敏感資訊取得現象相當普遍。此外，我們觀察到任務完成能力與取得階段洩漏之間存在相關性。提示層級的防禦措施僅能減少一小部分的取得階段洩漏，大多數洩漏仍未獲得緩解。這些結果使得稽核取得階段的隱私變得既迫切又必要。我們的資料集與程式碼可於 https://github.com/Xuan269/PrivacyPeek-Resource 取得。

English

LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users. However, agents often acquire more sensitive information than the task requires. Existing privacy benchmarks audit what the agent's response or outgoing actions disclose, but overlook the acquisition stage where data first enters the agent's context. The over-acquired information is then one careless action or one attack away from an outright leak. To assess its prevalence, we introduce PrivacyPeek, a benchmark for evaluating acquisition-stage privacy leakage of LLM-based agents, with 1{,}182 cases across 7 acquisition behaviours and 16 application domains. Specifically, Acquisition Inspection examines the agent's tool-call trajectory, both the tools it invokes and the data it receives, to detect when it acquires sensitive information beyond the task scope. Probe Elicitation then issues a follow-up probe and measures how readily an attacker could elicit sensitive information the agent acquired but did not disclose. Our experiments on 10 LLM-based agents across 4 model families show that the unnecessary acquisition of sensitive information is widespread. In addition, we observe a correlation between the task-completion capability and acquisition-stage leakage. Prompt-level defences reduce only a small fraction of acquisition-stage leakage, leaving the majority unmitigated. These results make auditing acquisition-stage privacy both urgent and necessary. Our dataset and code are available at https://github.com/Xuan269/PrivacyPeek-Resource.