PrivacyPeek：审计基于LLM的智能体获取了什么，而不仅仅是它们说了什么

摘要

基于大语言模型的智能体正在快速发展，能够自主调用外部工具为用户完成多步任务。然而，智能体获取的敏感信息往往超出任务所需。现有的隐私基准测试主要审查智能体的响应或对外动作所泄露的内容，却忽视了获取阶段——即数据首次进入智能体上下文之时。过度获取的信息距离完全泄露仅一步之遥，一次粗心的操作或一次攻击便足以使其暴露。为评估这一问题的普遍性，我们提出了PrivacyPeek，一个用于评估基于大语言模型的智能体获取阶段隐私泄露的基准测试，涵盖7种获取行为和16个应用领域的1，182个案例。具体而言，获取检查（Acquisition Inspection）审查智能体的工具调用轨迹，包括其调用的工具和接收的数据，以检测其是否获取了超出任务范围的敏感信息。随后，探测诱导（Probe Elicitation）发出后续探测问题，衡量攻击者能多容易地诱导智能体泄露其已获取但未披露的敏感信息。我们在4个模型家族的10个基于大语言模型的智能体上进行的实验表明，不必要地获取敏感信息的现象普遍存在。此外，我们观察到任务完成能力与获取阶段泄露之间存在相关性。提示级防御仅能减少一小部分获取阶段的泄露，大部分泄露仍未得到缓解。这些结果使得审计获取阶段的隐私泄露既紧迫又必要。我们的数据集和代码可在https://github.com/Xuan269/PrivacyPeek-Resource获取。

English

LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users. However, agents often acquire more sensitive information than the task requires. Existing privacy benchmarks audit what the agent's response or outgoing actions disclose, but overlook the acquisition stage where data first enters the agent's context. The over-acquired information is then one careless action or one attack away from an outright leak. To assess its prevalence, we introduce PrivacyPeek, a benchmark for evaluating acquisition-stage privacy leakage of LLM-based agents, with 1{,}182 cases across 7 acquisition behaviours and 16 application domains. Specifically, Acquisition Inspection examines the agent's tool-call trajectory, both the tools it invokes and the data it receives, to detect when it acquires sensitive information beyond the task scope. Probe Elicitation then issues a follow-up probe and measures how readily an attacker could elicit sensitive information the agent acquired but did not disclose. Our experiments on 10 LLM-based agents across 4 model families show that the unnecessary acquisition of sensitive information is widespread. In addition, we observe a correlation between the task-completion capability and acquisition-stage leakage. Prompt-level defences reduce only a small fraction of acquisition-stage leakage, leaving the majority unmitigated. These results make auditing acquisition-stage privacy both urgent and necessary. Our dataset and code are available at https://github.com/Xuan269/PrivacyPeek-Resource.