Impact

Data privacy Research

Security research involving user or training data privacy

114 matching entries

Data privacy research results

114 entries

CoT PII Trace Leakage

Published Mar 5, 2026Analyzed Apr 10, 2026Source: arXiv

Inference-time Personally Identifiable Information (PII) leakage is significantly amplified when using Chain-of-Thought (CoT) prompting or reasoning-enabled Large Language Models (LLMs). When an attacker or user elicits step-by-step reasoning or utilizes models with native "thinking" token budgets, sensitive context data provided in the prompt is directly resurfaced into intermediate reasoning steps or the final output. This bypasses output-level privacy policies instructing the model not to…

Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in LLMs

Evaluated models: DeepSeek R1 Distill Llama 70B, Llama 3.3 70B, Mixtral 8x22B+3 more

DeepSeek R1 Distill Llama 70B
Llama 3.3 70B
Mixtral 8x22B
o3
Qwen 3 32B
o4-mini

Web-Triggered Silent Egress

Published Feb 25, 2026Analyzed Mar 8, 2026Source: arXiv

Agentic LLM systems that automatically preview URLs or extract web metadata are vulnerable to implicit prompt injection, resulting in silent data exfiltration ("silent egress"). Attackers can embed adversarial instructions in unobserved web elements, such as HTML <title> tags, <meta> descriptions, or Open Graph metadata. When a user requests a summary of the URL—or when the agent automatically unfurls a linked URL in a chat—the system fetches the malicious page and flattens this metadata into…

Silent Egress: When Implicit Prompt Injection Makes LLM Agents Leak Without a Trace

Evaluated models: Qwen 2.5 7B

Adaptive Agent Tool Injection

Published Feb 24, 2026Analyzed Apr 11, 2026Source: arXiv

Agentic LLMs integrated with external data services (e.g., Model Context Protocol, MCP) are vulnerable to Adaptive Indirect Prompt Injection (IPI) attacks. When an agent queries external servers, attackers can inject malicious payloads into the retrieved content to hijack the agent's reasoning process and force the execution of high-authority tools. Unlike traditional static prompt injections, this vulnerability dynamically exploits the agent's internal logic audit. By using Markovian…

AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs

Evaluated models: GPT-4.1, DeepSeek R1, Gemini 2.5 Flash+3 more

GPT-4.1
DeepSeek R1
Gemini 2.5 Flash
Qwen 3 8B
Llama 3.1 8B
Mistral 8B

Efficient KV-Cache Prompt Leakage

Published Feb 24, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in multi-tenant LLM serving frameworks allows attackers to reconstruct the private prompts of other users via an active Key-Value (KV) cache side-channel. Frameworks that utilize shared KV caches alongside specific scheduling policies, such as Longest Prefix Match (LPM), prioritize waiting requests based on the length of their matched prefix tokens. An attacker can exploit this by iteratively sending batches of guessed tokens mixed with dummy queries. If a guessed token matches…

OptiLeak: Efficient Prompt Reconstruction via Reinforcement Learning in Multi-tenant LLM Services

Evaluated models: Llama 3.1 8B, Qwen 2.5 3B

Agent Tool-Call Safety Gap

Published Feb 18, 2026Analyzed Mar 8, 2026Source: arXiv

LLM agents with tool-calling capabilities are vulnerable to a text-action modality divergence (termed the "GAP" vulnerability), where text-level safety alignment fails to transfer to tool-call execution. Attackers can craft adversarial prompts that cause the model to generate a text-based refusal (demonstrating text safety) while simultaneously executing the requested forbidden action through available external tools. Because text generation and tool-call selection operate through partially…

Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents

Evaluated models: Claude Sonnet 4.5, GPT-5.2, Grok 4.1 Fast+3 more

Claude Sonnet 4.5
GPT-5.2
Grok 4.1 Fast
DeepSeek V3.2
Kimi K2.5
GLM-4.7

Long-Horizon Agent Attacks

Published Feb 18, 2026Analyzed Apr 10, 2026Source: arXiv

LLM agents equipped with tool-use, persistent memory, and environmental interaction capabilities are vulnerable to long-horizon attacks. Attackers can bypass single-turn safety guardrails by exploiting the temporal dimension of multi-turn interactions to incrementally steer agent behavior. The vulnerability manifests because the agent's safety mechanisms perform localized, single-step evaluations but fail to maintain semantic safety across extended interaction trajectories. This enables…

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks

Evaluated models: GPT-4o, GPT-5.1, Gemini 3 Flash+1 more

GPT-4o
GPT-5.1
Gemini 3 Flash
Claude Sonnet 4.5

Zombie Agent Persistence

Published Feb 17, 2026Analyzed Feb 22, 2026Source: arXiv

Self-evolving Large Language Model (LLM) agents that utilize long-term memory mechanisms (such as Vector Databases for Retrieval-Augmented Generation or Sliding Window buffers) are vulnerable to persistent indirect prompt injection. This vulnerability, termed "Zombie Agent," occurs when the agent's memory update function ($F_M$) processes attacker-controlled content retrieved from external sources (e.g., web pages, documents) and commits it to long-term storage without sufficient sanitization…

Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections

Evaluated models: Not reported

Automated Stealth Skill Injection

Published Feb 15, 2026Analyzed Feb 21, 2026Source: arXiv

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…

SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents

Evaluated models: Claude Sonnet 4.6, GPT-5 Mini, GLM-4.7+7 more

Claude Sonnet 4.6
GPT-5 Mini
GLM-4.7
MiniMax M2.1
DeepSeek V4 Flash
GLM-5.1
MiniMax M2.7
MiMo V2.7
GPT-5.4
Claude Opus 4.6

Inter-Agent Privacy Leakage

Published Feb 12, 2026Analyzed Mar 9, 2026Source: arXiv

Multi-agent Large Language Model (LLM) architectures are vulnerable to internal-channel data leakage due to the absence of access controls and data minimization in inter-agent communication and shared memory. Frameworks such as LangChain, CrewAI, AutoGPT, and MetaGPT propagate complete task contexts—including unredacted sensitive data—between specialized agents during task delegation. Because traditional LLM security guardrails only filter final user-facing outputs, attackers or benign…

AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems

Evaluated models: GPT-4o, GPT-4o Mini, Claude 3.5 Sonnet+2 more

GPT-4o
GPT-4o Mini
Claude 3.5 Sonnet
Llama 3.3 70B Instruct
Mistral Large 2411

LLM Private Attribute Inference

Published Feb 12, 2026Analyzed Mar 8, 2026Source: arXiv

Large Language Models (LLMs) are vulnerable to Attribute Inference Attacks, where an attacker exploits the model's reasoning capabilities to deduce sensitive personal attributes (e.g., age, gender, location, income level) from seemingly innocuous, unclassified user-generated text. Unlike traditional privacy leaks that rely on the memorization of training data, this vulnerability leverages the model's zero-shot inference and contextual deduction. Because the attack prompts are benign in nature…

Stop Tracking Me! Proactive Defense Against Attribute Inference Attack in LLMs

Evaluated models: Llama 2 7B Chat, Llama 2 13B Chat, Llama 3.1 8B Instruct+5 more

Llama 2 7B Chat
Llama 2 13B Chat
Llama 3.1 8B Instruct
DeepSeek R1 Distill Qwen 7B
Qwen 2.5 7B Instruct
GPT-3.5 Turbo
GPT-4o
Gemini 2.5 Pro

Related research categories