链式思维会泄露隐私信息，该研究提出量化与缓解方案。
Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in LLMs
- 定义11类隐私信息的令牌级泄露风险，按推理预算追踪泄露曲线。
- 高风险类别泄露显著增加，且不同模型家族和预算下表现差异大。
- 提出混合自适应门控策略，兼顾效果与隐私，可复现性强。
链式思维提示虽提升大模型推理能力，但可能在推理过程中将用户输入中的个人身份信息（PII）泄露至中间推理轨迹与最终输出，即使模型被指令不重复此类信息。本文采用一种模型无关框架，(i) 将泄露定义为跨11类PII的、风险加权的令牌级事件；(ii) 分析泄露曲线随允许推理预算的变化；(iii) 在结构化PII数据集上，对开源与闭源模型家族进行对比，使用分层风险分类体系。结果表明，链式思维会持续加剧泄露，尤其在高风险类别中；泄露程度强烈依赖于模型家族与推理预算。增加推理预算可能放大或抑制泄露，取决于基础模型。随后，评估四种轻量级推理时门控方法：规则检测器、TF-IDF+逻辑回归分类器、GLiNER-based NER模型、以及基于LLM的判别器，以风险加权F1、宏平均F1与召回率为指标。单一方法无法在所有模型与预算下占优，因而推动采用混合、风格自适应的门控策略，在统一可复现协议下实现效用与风险平衡。
原文摘要 · Abstract (English)
Chain-of-Thought (CoT) prompting improves LLM reasoning but can increase privacy risk by resurfacing personally identifiable information (PII) from the prompt into reasoning traces and outputs, even under policies that instruct the model not to restate PII. We study such direct, inference-time PII leakage using a model-agnostic framework that (i) defines leakage as risk-weighted, token-level events across 11 PII types, (ii) traces leakage curves as a function of the allowed CoT budget, and (iii) compares open- and closed-source model families on a structured PII dataset with a hierarchical risk taxonomy. We find that CoT consistently elevates leakage, especially for high-risk categories, and that leakage is strongly family- and budget-dependent. Increasing the reasoning budget can either amplify or attenuate leakage depending on the base model. We then benchmark lightweight inference-time gatekeepers: a rule-based detector, a TF-IDF + logistic regression classifier, a GLiNER-based NER model, and an LLM-as-judge, using risk-weighted F1, Macro-F1, and recall. No single method dominates across models or budgets, motivating hybrid, style-adaptive gatekeeping policies that balance utility and risk under a common, reproducible protocol.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。