大模型工具调用可能泄露敏感信息，研究提出评估与缓解方法。
Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigation
- 构建四库反推框架生成隐私泄露数据集
- 六款代理平均泄露率88.6%，安全得分仅20.4
- 后训练方法比提示词改进更有效，适合安全开发人员
基于大语言模型的智能体越来越多地使用多个外部工具完成复杂任务。本文研究工具调用隐私风险（TOP-R）：单个工具返回非敏感信息，但组合后可能泄露未预期的敏感结论。我们提出三个条件定义该风险：结论敏感性、单源不可推断性、组合可推断性。设计LRSE（库基逆向推理种子扩展）框架，融合隐私规范、推理链、工具模式和任务场景，构建包含1000个实例的TOP-Bench基准。该基准在受控双阶段工具使用协议下评估最终响应的语义泄露。六个大模型代理任务完成率保持高位，但平均泄露率达88.6%，安全得分（H-score）仅为20.4。两种仅通过提示词的防护措施使H-score提升约2.7分。进一步提出TOP-Align方法，采用SFT+DPO后训练优化任务完成边界，在独立评估集上相比基线模型提升16.2分，远超提示词平均提升4.9分。结果表明，仅靠提示词无法充分应对该风险。
原文摘要 · Abstract (English)
LLM-based agents increasingly use multiple external tools to complete complex tasks. We study Tools Orchestration Privacy Risk (TOP-R): an agent may combine individually non-sensitive tool returns and disclose an unintended sensitive conclusion. We formalize TOP-R with three conditions: conclusion sensitivity, single-source non-inferability, and compositional inferability. We introduce LRSE (Library-Grounded Reverse-Inference Seed Expansion), a four-library reverse-construction pipeline grounded in privacy norms, reasoning chains, tool schemas, and task scenarios, and use it to build TOP-Bench, a 1,000-instance benchmark. The benchmark evaluates final-response semantic disclosure under a controlled two-stage tool-use protocol. Across six LLM agents, task completion remains high, but the average leakage rate reaches 88.6 percent, yielding an H-score of only 20.4. Two prompt-only safeguards improve H-score by about 2.7 points on the main benchmark. We further propose TOP-Align, an SFT+DPO post-training method for safer task completion boundaries. On a separate post-training evaluation split, TOP-Align improves H-score by 16.2 points over the corresponding base model, compared with a 4.9-point average gain from prompt-only mitigation on the same split. These results show that TOP-R requires mitigation beyond prompting alone.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。