PiSAs (Privacy in Shared Agentic systems), a benchmark for assessing unintentional leaks with dual CI annotations, enables direct measurement of cross-user spillage across agentic system components and interfaces, such as outputs, inter-agent communication, and memory.
Abstract
As LLM agents evolve from single-user assistants into shared organizational infrastructure, new privacy risks emerge: inappropriate information may not only be exposed through outputs for external recipients, but also internally across users through inter-agent messages, shared memory and agents. These data spillage risks are not captured by existing privacy benchmarks grounded in contextual integrity (CI) as they focus primarily on either single-user settings or interactions between independently owned agents. We introducePiSAs (Privacy in Shared Agentic systems), a benchmark for assessing unintentional leaks with dual CI annotations: whether an information is appropriate for the task, and which users may legitimately access it. This enables direct measurement of cross-user spillage across agentic system components and interfaces, such as outputs, inter-agent communication, and memory. PiSAsis system-agnostic and supports evaluation across different agent topologies and memory regimes. We find that, although system design improves CI compliance, results are bottlenecked by incorrect LLM judgment calls: even state-of-the-art models fail to reliably filter inappropriate content or restrict transmission to authorized users. Our findings underscore the need for privacy-preserving strategies, beyond those studied in this work.
Recent advances in persistent personal-agent frameworks are making human-centered agent networks realistic deployment targets: each user can be served by an AI agent that acts on the user's behalf, maintains state, and communicates with other agents through social and task relations. In these networks, everyday tool use becomes multi-party owned-agent collaboration over personal workspaces, where files, records, tools, and policies are not directly visible across owners. Existing agent benchmarks study tool use and collaboration, but they do not provide an end-to-end sandbox for verifiable cross-user agent collaboration with realistic user digital workspaces or test how harmful actions can travel through the human-centered agent network. We introduce WeClawArena, an auditable benchmark and runtime sandbox for multi-party owned-agent collaboration over personal workspaces. WeClawArena targets collaborative tool-use tasks in which personal workspaces serve as both operational tools and personal constraints. The benchmark contains 124 base tasks across six cross-user task domains and expands them into 620 scenario variants, with one benign control and four attack-vector variants per base task. The sandbox records peer messages, tool calls, resource operations, governed decisions, and final workspace states. WeClawArena reports utility and attack success rate separately and audits attack success from bounded runtime evidence, supporting diagnosis of task breakdown, privacy leakage, poisoned evidence, and invalid authority paths.
P. Wang, Ao-Jie Yuan, Haiyu Zhang et al.· 0 citations
Persona skills distill personal interaction histories into portable and executable artifacts for downstream agents. While enabling flexible personalization, this process concentrates fragmented personal signals, amplifies their impact through reuse, and challenges defenses designed for individual records or retrieval-based memory. To systematically investigate the safety of the persona-skill pipeline, we introduce AntiSkillBench, an end-to-end benchmark for evaluating risks and defenses across the persona-skill pipeline. It comprises: (i) a dataset of 7,500 persona-grounded dialogue traces, constructed from 50 behaviorally rich profiles spanning diverse task scenarios; (ii) an evaluation suite that measures skill-level privacy leakage and agent-level attribute disclosure and behavioral impersonation across three skill-distillation strategies; and (iii) a defense evaluation covering four configurations across online and post-hoc interventions, including active risk suppression and passive provenance protection. Experiments across three frontier agents show that persona-skill risks persist across agent backbones and distillation protocols, extending from explicit attributes to communication styles and personality traits. Existing defenses exhibit limited and distillation-dependent effectiveness, failing to generalize across risk and distillation strategies. These results highlight AntiSkillBench as a challenging benchmark for developing privacy-preserving and authenticity-aware persona skills.
Yongli Xiang, Zhifang Zhang, Bojun Yang et al.· 0 citations
RedAgentBench is introduced, an executable framework for autonomous red-teaming and faithful measurement that shows that executable evaluation can improve safety measurement and identify actionable intervention points.
Zixing Chen, Xingyuan Liu, Jie Zhu et al.· 0 citations
A minimal benchmark design and candidate reporting metrics for user-conditioned adaptation are proposed and a concrete design requirement for future personal-agent evaluation, with metrics used as reporting tools for that requirement.
Pinyan Qian, Su Wang, Yihang Chen et al.· 2 citations
Large language model (LLM) based agents are evolving from conversational chatbots into autonomous decision-makers that plan, reason, wield tools, and collaborate across high-stakes domains such as healthcare, finance, and scientific discovery. Yet this power brings a fundamental challenge: trustworthiness. How can we guarantee that an agent remains robust when real-world data shifts, degrades, or is deliberately poisoned? What defenses exist against memory injection, tool-based exploits, or cascade failures in multi-agent systems? Can we embed domain-specific causal validity, clinical safety, or fairness directly into agent reasoning? And how do we measure trust when it spans robustness, security, reliability, and alignment — each with its own irreconcilable trade-offs? This tutorial delivers a systematic, data-centric roadmap to build LLM agents that are not merely capable but provably trustworthy. We organize the landscape into four interconnected pillars: (i) generalizability under distribution shift, noise, and adversarial inputs; (ii) security architectures that defend against emerging threats — from indirect prompt injection to supply-chain vulnerabilities; (iii) domain-grounded trust in science, engineering, medicine, and commerce, where agents must respect theories, systems, clinical causality, and fairness constraints; and (iv) multi-dimensional evaluation benchmarks that expose trade-offs rather than collapsing them into a single score. By unifying advances in LLM agents, robust machine learning, and data-centric AI, we equip the audience with both foundational principles and actionable recipes to design, deploy, and ultimately trust the next generation of autonomous agent systems.
Tianlong Chen, Jian Pei, Minxing Zhang et al.· Proceedings of the 32nd ACM...· 0 citations
These findings establish context measurement as a validated preflight signal for agent reliability and position context engineering as an auditable layer of agent evaluation and governance.