智能体
arxiv.org ·
迷惑模型，控制信息流：利用信息流控制理解并缓解 LLM 智能体的隐私泄露
该论文指出，基于 LLM 的个人 AI 智能体因访问用户私密数据而面临持续隐私风险，而现有防御依赖让后端 LLM 更注重隐私（更强系统提示、训练或显式同意检查），存在结构性缺陷：当执行判断与攻击面共享同一对话上下文时，防御机制与攻击面重合。作者提出三种无需 prompt injection 的新攻击：Collaborative Workspace Lure 将提取请求伪装为协作任务；Semantic Obfuscation Attack 通过省略而非输出内容诱导泄露；Channel Decoupling Attack 将提取请求与泄露拆分到独立通道，三者泄漏率均显著高于现有防御所针对的攻击。为此提出 FLOWSEAL，在 LLM 上下文之外通过工具级拦截器，基于数据溯源与带受控解密的信息流控制格来强制保密。在三个基准、五个基于提示的基线和八种攻击（包括通过 MCP 执行实时工具调用的真实智能体）上评估，FLOWSEAL 将泄漏率降至接近零（如针对 Collaborative Workspace Lure 从 52.2% 降至 0.5%），同时保持任务效用，且与底层 LLM 后端无关。
AI推荐理由 arXiv 论文，提出针对 LLM 智能体隐私泄露的三类新攻击（Collaborative Workspace Lure、Semantic Obfuscation Attack、Channel Decoupling Attack），均无需 prompt injection，仅靠普通交互即可实现，泄漏率显著高于现有防御所针对的攻击；并给出 FLOWSEAL 防御，在 LLM 上下文之外通过工具级拦截器结合数据溯源与信息流控制格实现受控解密。摘要给出具体数据（如 Collaborative Workspace Lure 泄漏率从 52.2% 降至 0.5%），并在三个基准、五个基于提示的基线和八种攻击（含通过 MCP 执行实时工具调用的真实智能体）上评估，同时保持任务效用且不依赖底层 LLM。局限在于为 arXiv 预印本，尚未经同行评审，评估细节与复现性需查看全文。
82
正文
Computer Science > Cryptography and Security
arXiv:2609.14003 (cs)
[Submitted on 12 Sep 2026]
Title:Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control
Authors:Minsun Shim, Ramisha Raida Karim, Ruthwik Jakkula, Kaiwen Zhou, Xin Liu, Xin Eric Wang, Zhou Li
View a PDF of the paper titled Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control, by Minsun Shim and 6 other authors
View PDF
HTML (experimental)
Abstract:Personal AI agents built on large language models (LLMs) are increasingly given access to a user's private data and communications in order to provide personalized assistance. This access creates a persistent privacy risk: the agent must decide whether a given sensitive information should be disclosed to a particular party. Existing defenses address this by making the agent's backend LLM more privacy-preserving through stronger system prompts, training, or explicit consent-checking procedures, but this approach has a structural challenge: whenever enforcement is a judgment the LLM makes over the same conversational context an adversary controls, the enforcement mechanism and the attack surface coincide. We demonstrate this against existing defenses with three new attacks that require only ordinary agent interaction and no prompt injection: Collaborative Workspace Lure reframes an extraction attempt as collaborative work; Semantic Obfuscation Attack induces disclosure through omission rather than through anything the agent writes; and Channel Decoupling Attack splits the extraction request and the disclosure across independent channels. All three achieve substantially higher leak rates than the attacks these defenses were originally designed to withstand. Guided by this observation, we present FLOWSEAL, a defense that enforces confidentiality through a tool-level interceptor outside the LLM's context, grounded in data provenance and an information-flow-control lattice with controlled declassification. Evaluated across three benchmarks, five prompt-based baselines, and eight attacks, including a real agent executing live tool calls through MCP, FLOWSEAL reduces leak rates to near zero (e.g., 52.2% to 0.5% against Collaborative Workspace Lure) while preserving task utility, regardless of the underlying LLM backend.
Subjects:
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
Cite as:
arXiv:2609.14003 [cs.CR]
(or
arXiv:2609.14003v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.14003
Focus to learn more
arXiv-issued DOI via DataCite (pending registration)
Submission history
From: Minsun Shim [view email]
[v1]
Sat, 12 Sep 2026 15:31:37 UTC (815 KB)
Full-text links:
Access Paper:
View a PDF of the paper titled Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control, by Minsun Shim and 6 other authors
View PDF
HTML (experimental)
TeX Source
view license
Current browse context:
cs.CR
new
|
recent
| 2026-09
Change to browse by:
cs
cs.AI
References & Citations
NASA ADS
Google Scholar
Semantic Scholar
export BibTeX citation
Loading...
BibTeX formatted citation
×
loading...
Data provided by:
Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
Connected Papers Toggle
Connected Papers (What is Connected Papers?)
Litmaps Toggle
Litmaps (What is Litmaps?)
scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
Code, Data, Media
Code, Data and Media Associated with this Article
alphaXiv Toggle
alphaXiv (What is alphaXiv?)
Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub Toggle
DagsHub (What is DagsHub?)
GotitPub Toggle
Gotit.pub (What is GotitPub?)
Huggingface Toggle
Hugging Face (What is Huggingface?)
ScienceCast Toggle
ScienceCast (What is ScienceCast?)
Demos
Demos
Replicate Toggle
Replicate (What is Replicate?)
Spaces Toggle
Hugging Face Spaces (What is Spaces?)
Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
Related Papers
Recommenders and Search Tools
Link to Influence Flower
Influence Flower (What are Influence Flowers?)
Core recommender toggle
CORE Recommender (What is CORE?)
Author
Venue
Institution
Topic
About arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? |
Disable MathJax (What is MathJax?)