Large language model (LLM) personal assistants are increasingly deployed to act on users’ behalf for everyday tasks. These assistants have access to private user data and must communicate with third parties, creating a risk that they inadvertently reveal sensitive information to recipients. Existing benchmarks mainly measure direct leakage, where the model explicitly states a predefined secret or attribute, and thus miss \textit{inferential leakage}—subtle cues in the response that allow a curious recipient to infer sensitive user attributes. To address this, we introduce the \textsc{InferPriv} benchmark, which tests whether an honest‑but‑curious recipient can infer a user’s sensitive attributes from an LLM’s reply to a routine task. Evaluation on five state‑of‑the‑art models shows that inferential leakage rates substantially exceed direct leakage. Even with a privacy‑aware system prompt, GPT‑6.1‑Sol, Sonnet‑5.5, and Gemini‑3.8‑Flash achieve near‑zero direct leakage, yet their inferential leakage remains between 16.2% and 25.2%. These findings indicate that assessing only explicit leakage can severely underestimate privacy risks.
Review