mlsanityData to 14 Oct 2026

CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents

arXiv 2609.21686 ↗First posted 18 Sep 2026cs.CR cs.AIcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Privacy leakage in LLM agents is commonly evaluated within individual components such as memory, retrieval, or tool-use pipelines, which makes it difficult to distinguish internal exposure from information that an external observer can actually recover. We present CIPL (Channel Inversion for Privacy Leakage), a channel-aware evaluation framework for black-box privacy leakage in LLM agents. CIPL represents a target through sensitive source, selection, assembly, execution, observation, and extraction stages and evaluates the transition from selected sensitive units to attacker-recoverable output under a shared protocol. Experiments across memory-based, retrieval-mediated, and tool-mediated targets, together with a BrowserUse live-agent case study, show that storage labels alone do not determine recoverability. Memory targets form a near-saturated reference case, retrieval-mediated leakage is frequently partial, and tool-mediated and live-agent leakage varies strongly with observation surface, prompt-to-channel alignment, retrieval depth, and provider behavior. A stratified semantic audit further identifies attacker-useful disclosures that canonical exact matching misses. CIPL therefore provides a common framework for comparing how internal sensitive dependence is realized as externally recoverable leakage across heterogeneous agent pipelines.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 11 of its 21 references that are in the map. First posted on arXiv 18 Sep 2026.

Builds on

11 of 21 references.

Closest ancestors · 3

Same direction, newest first

  1. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification30 Jul
  2. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies28 Jul
  3. 2024WIPI: A New Web Threat for LLM-Driven Web Agents26 Feb

Other references · 8

  1. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,439
  2. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  4. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 634
  5. 2023Privacy-Preserving In-Context Learning with Differentially Private Few-Shot Generationcited by 96
  6. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systemscited by 76
  7. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacycited by 39
  8. 2025MARAGE: Transferable Multi-Model Adversarial Attack for Retrieval-Augmented Generation Data Extractioncited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Observable Channels, Not Just Storage: Evaluating Privacy Leakage in LLM Agent Pipelines
  2. 2026AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems
  3. 2026Rethinking Side-Channel Analysis: Automated Discovery and Analysis of Side-Channel Leakage with LLM-Assisted Agents
  4. 2026OCELOT: Inference-Leakage Budgets for Privacy-Preserving LLM Agents
  5. 2026AgentSecBench: Measuring Prompt Injection, Privacy Leakage, and Tool-Use Integrity in LLM Agents
  6. 2026PrivacyPeek: Auditing What LLM-Based Agents Acquire, Not Just What They Say
  7. 2026When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
  8. 2026ASLEval: Measuring Privacy Exposure Displacement in LLM Agent Sessions