MAGPIE: A benchmark for Multi-AGent contextual PrIvacy Evaluation
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
A core challenge for autonomous LLM agents in collaborative settings is balancing robust privacy understanding and preservation alongside task efficacy. Existing privacy benchmarks only focus on simplistic, single-turn interactions where private information can be trivially omitted without affecting task outcomes. In this paper, we introduce MAGPIE (Multi-AGent contextual PrIvacy Evaluation), a novel benchmark of 200 high-stakes tasks designed to evaluate privacy understanding and preservation in multi-agent collaborative, non-adversarial scenarios. MAGPIE integrates private information as essential for task resolution, forcing agents to balance effective collaboration with strategic information control. Our evaluation reveals that state-of-the-art agents, including GPT-5 and Gemini 2.5-Pro, exhibit significant privacy leakage, with Gemini 2.5-Pro leaking up to 50.7% and GPT-5 up to 35.1% of the sensitive information even when explicitly instructed not to. Moreover, these agents struggle to achieve consensus or task completion and often resort to undesirable behaviors such as manipulation and power-seeking (e.g., Gemini 2.5-Pro demonstrating manipulation in 38.2% of the cases). These findings underscore that current LLM agents lack robust privacy understanding and are not yet adequately aligned to simultaneously preserve privacy and maintain effective collaboration in complex environments.
Key facts. Cited by 29 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 30 of its 48 references that are in the map. First posted on arXiv 16 Oct 2025.
Builds on
30 of 48 references.
Closest ancestors · 9
Same direction, newest first
- 2025Architecting Resilient LLM Agents: A Guide to Secure Plan-then-Execute Implementations10 Sep
- 2025IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents21 Aug
- 2025Searching for Privacy Risks in LLM Agents via Simulation14 Aug
- 20251-2-3 Check: Enhancing Contextual Privacy in LLM via Multi-Agent Reasoning11 Aug
- 2025SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systems9 Jun
- 2025To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt6 Jun
- 2025Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution1 Jun
- 2025LLM Agents Should Employ Security Principles29 May
- 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
Other references · 21
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,568
- 2020Extracting Training Data from Large Language Modelscited by 2,189
- 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,988
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 230
- 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 86
- 2025SiriuS: Self-improving Multi-agent Systems via Bootstrapped Reasoningcited by 44
- 2025PC-Agent: A Hierarchical Multi-Agent Collaboration Framework for Complex Task Automation on PCcited by 40
- 2024INMS: Memory Sharing for Large Language Model based Agentscited by 31
- 2025SoK: The Privacy Paradox of Large Language Models: Advancements, Privacy Risks, and Mitigationcited by 19
9 more
- 2025LLM-Based Multi-Agent Blackboard System for Information Discovery in Data Sciencecited by 15
- 2025Multi-Agent Systems Powered by Large Language Models: Applications in Swarm Intelligencecited by 14
- 2024Efficient Multi-Agent Collaboration with Tool Use for Online Planning in Complex Table Question Answeringcited by 13
- 2025Prεεmpt: Sanitizing Sensitive Prompts for LLMscited by 12
- 2025Exploring Advanced LLM Multi-Agent Systems Based on Blackboard Architecturecited by 11
- 2025MAEBE: Multi-Agent Emergent Behavior Frameworkcited by 8
- 2025Language-Driven Coordination and Learning in Multi-Agent Simulation Environmentscited by 3
- 2025Enterprise AI Must Enforce Participant-Aware Access Controlcited by 3
- 2025The Social Laboratory: A Psychometric Framework for Multi-Agent LLM Evaluationcited by 2
Built on by
Citing papers per year: 2025: 1; 2026: 28.
29 papers.
Sort:
By area:
- 2025Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigationcited by 11
- 2026MAESTRO: Multi-Agent Evaluation Suite for Testing, Reliability, and Observabilitycited by 7
- 2026AgentSocialBench: Evaluating Privacy Risks in Human-Centered Agentic Social Networkscited by 7
- 2026LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systemscited by 6
- 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agentscited by 4
- 2026MuPPET: A Benchmark for Contextual Privacy of LLM Assistants in Multi-Party Conversationscited by 3
- 2026Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agentscited by 3
- 2026PrivacyAlign: Contextual Privacy Alignment for LLM Agentscited by 2
- 2026PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systemscited by 2
- 2026Beyond Goodhart's Law: A Dynamic Benchmark for Evaluating Compliance in Multi-Agent Systemscited by 1
- 2026The Interlocutor Effect: Why LLMs Leak More Personal Data to Agents Than Humanscited by 1
- 2026TRAP: Benchmark for Task-completion and Resistance to Active Privacy-extractioncited by 1
17 more
- 2026SovereignNegotiation-Bench: Evaluating User-Owned Personal Agents In Delegated Bargaining Under Privacy, Consent, Evidence, And Institutional Pressurecited by 1
- 2026Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policiescited by 1
- 2026WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networkscited by 1
- 2026Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systemscited by 1
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systemscited by 1
- 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agentscited by 0
- 2026Can LLM Agents Price Competitively? A Dynamic Multi-Attribute Auction Benchmark for Agentic Commercecited by 0
- 2026From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systemscited by 0
- 2026MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communicationcited by 0
- 2026MemArena: An Ego-Centric Benchmark for On-Device Agentic Personal Memory Assistants at Scalecited by 0
- 2026From Passive Delegates to Strategic Negotiators: Reinforcing Social Reasoning in Small Language Models with SocialRLcited by 0
- 2026PriMobiBench: Characterizing Visual Privacy Leakage in VLM-Driven Mobile GUI Agentscited by 0
- 2026Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Controlcited by 0
- 2026CoSec: Benchmarking Agent Security in Communitiescited by 0
- 2026EP-Mem: Elastic Privacy Memory for Social Relationship-Aware LLM Agentscited by 0
- 2026HarnessNet: Feedback-driven Hierarchical Joint Harness Evolution for Multi-agent Systemscited by 0
- 2026When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systemscited by 0
- 2026When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems12 Oct 2026
- 2026HarnessNet: Feedback-driven Hierarchical Joint Harness Evolution for Multi-agent Systems10 Oct 2026
- 2026EP-Mem: Elastic Privacy Memory for Social Relationship-Aware LLM Agents28 Sep 2026
- 2026CoSec: Benchmarking Agent Security in Communities28 Sep 2026
- 2026Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control12 Sep 2026
- 2026PriMobiBench: Characterizing Visual Privacy Leakage in VLM-Driven Mobile GUI Agents12 Sep 2026
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems1 Sep 2026
- 2026Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems17 Aug 2026
- 2026From Passive Delegates to Strategic Negotiators: Reinforcing Social Reasoning in Small Language Models with SocialRL13 Aug 2026
- 2026WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networks4 Aug 2026
- 2026MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication3 Aug 2026
- 2026From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems31 Jul 2026
17 more
- 2026Can LLM Agents Price Competitively? A Dynamic Multi-Attribute Auction Benchmark for Agentic Commerce30 Jul 2026
- 2026Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies7 Jul 2026
- 2026PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems6 Jul 2026
- 2026SovereignNegotiation-Bench: Evaluating User-Owned Personal Agents In Delegated Bargaining Under Privacy, Consent, Evidence, And Institutional Pressure2 Jul 2026
- 2026Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents29 Jun 2026
- 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents25 Jun 2026
- 2026MuPPET: A Benchmark for Contextual Privacy of LLM Assistants in Multi-Party Conversations22 Jun 2026
- 2026PrivacyAlign: Contextual Privacy Alignment for LLM Agents19 Jun 2026
- 2026TRAP: Benchmark for Task-completion and Resistance to Active Privacy-extraction17 Jun 2026
- 2026Beyond Goodhart's Law: A Dynamic Benchmark for Evaluating Compliance in Multi-Agent Systems5 Jun 2026
- 2026LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systems21 May 2026
- 2026MemArena: An Ego-Centric Benchmark for On-Device Agentic Personal Memory Assistants at Scale20 May 2026
- 2026The Interlocutor Effect: Why LLMs Leak More Personal Data to Agents Than Humans26 Apr 2026
- 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents11 Apr 2026
- 2026AgentSocialBench: Evaluating Privacy Risks in Human-Centered Agentic Social Networks1 Apr 2026
- 2026MAESTRO: Multi-Agent Evaluation Suite for Testing, Reliability, and Observability1 Jan 2026
- 2025Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigation18 Dec 2025
- 2025Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigationcited by 11
- 2026MAESTRO: Multi-Agent Evaluation Suite for Testing, Reliability, and Observabilitycited by 7
- 2026AgentSocialBench: Evaluating Privacy Risks in Human-Centered Agentic Social Networkscited by 7
- 2026LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systemscited by 6
- 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agentscited by 4
- 2026MuPPET: A Benchmark for Contextual Privacy of LLM Assistants in Multi-Party Conversationscited by 3
- 2026PrivacyAlign: Contextual Privacy Alignment for LLM Agentscited by 2
- 2026PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systemscited by 2
- 2026Beyond Goodhart's Law: A Dynamic Benchmark for Evaluating Compliance in Multi-Agent Systemscited by 1
- 2026The Interlocutor Effect: Why LLMs Leak More Personal Data to Agents Than Humanscited by 1
- 2026Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policiescited by 1
- 2026Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systemscited by 1
12 most cited of 24 All 24 (JSON)
- 2026When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems12 Oct 2026
- 2026HarnessNet: Feedback-driven Hierarchical Joint Harness Evolution for Multi-agent Systems10 Oct 2026
- 2026EP-Mem: Elastic Privacy Memory for Social Relationship-Aware LLM Agents28 Sep 2026
- 2026CoSec: Benchmarking Agent Security in Communities28 Sep 2026
- 2026Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control12 Sep 2026
- 2026PriMobiBench: Characterizing Visual Privacy Leakage in VLM-Driven Mobile GUI Agents12 Sep 2026
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems1 Sep 2026
- 2026Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems17 Aug 2026
- 2026MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication3 Aug 2026
- 2026From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems31 Jul 2026
- 2026Can LLM Agents Price Competitively? A Dynamic Multi-Attribute Auction Benchmark for Agentic Commerce30 Jul 2026
- 2026Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies7 Jul 2026
12 newest of 24 All 24 (JSON)
- 2026Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agentscited by 3
- 2026TRAP: Benchmark for Task-completion and Resistance to Active Privacy-extractioncited by 1
- 2026SovereignNegotiation-Bench: Evaluating User-Owned Personal Agents In Delegated Bargaining Under Privacy, Consent, Evidence, And Institutional Pressurecited by 1
- 2026WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networkscited by 1
- 2026WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networks4 Aug 2026
- 2026SovereignNegotiation-Bench: Evaluating User-Owned Personal Agents In Delegated Bargaining Under Privacy, Consent, Evidence, And Institutional Pressure2 Jul 2026
- 2026Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents29 Jun 2026
- 2026TRAP: Benchmark for Task-completion and Resistance to Active Privacy-extraction17 Jun 2026
Similar, not cited
Close in wording, no citation either way
- 2025MAGPIE: A dataset for Multi-AGent contextual PrIvacy Evaluation
- 2025Privacy in Action: Towards Realistic Privacy Mitigation and Evaluation for LLM-Powered Agents
- 2026Contextualized Privacy Defense for LLM Agents
- 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents
- 2025Privacy-R1: Privacy-Aware Multi-LLM Agent Collaboration via Reinforcement Learning
- 2025Measuring Physical-World Privacy Awareness of Large Language Models: An Evaluation Benchmark
- 2026PrivAct: Internalizing Contextual Privacy Preservation via Multi-Agent Preference Training
- 2026AgentCIScope: Grounded Contextual Integrity Evaluation for LLM Agents