Agent privacy evals miss half the exposure by watching one exit

What is this?

On September 16, 2026, five authors — Guosen Wu, Huizhen Huang, Guoxiong Long, Tao Huang and Chen Hou — posted ASLEval to arXiv cs.CR. It is an eight-page paper about a measurement error, not an attack, and it is the most useful thing published on agent privacy this month.

The error has a name now: privacy exposure displacement, defined as the mismatch between a local evaluation proxy and target-grounded session exposure. Plainly: most privacy evaluations of tool-using agents inspect one designated action, the final response, or an attacker’s self-report. An agent session has many more ways out than that. Anything that leaves through a different exit is not scored, and therefore does not exist.

The headline number is the one to carry: across multiple enterprise-style environments and two independently implemented runtimes, an expected-outlet-only view misses 46.9% of the exposure recovered by the union of all declared visible exits.

How it works

ASLEval’s contribution is a measurement contract rather than a technique. Three design choices do the work.

Pre-register a hidden target set. Decide in advance which specific items count as sensitive, and score against those, not against a judge’s impression of the transcript. Without pre-specified targets there is no common ground truth across outlets, reports and tool paths, and two benchmarks can disagree simply because they labelled different things.

Declare the complete visible boundary. Enumerate every channel through which content can leave the session — not only the outlet the scenario expects — and measure the union. That union is what the 46.9% figure compares against.

Reserve internal traces for diagnosis, not scoring. Intermediate evidence inside the agent loop is kept out of the verdict and used to explain it. The paper’s finding here is directional: schema-aligned internal evidence usually precedes visible exposure at the request or probe level.

  what most evals score          what ASLEval scores
  ─────────────────────          ───────────────────
                                 ┌─ expected outlet     ─┐
  expected outlet only  ─────►   ├─ other visible exit  ─┤──► union
                                 ├─ tool path           ─┤    (+46.9%)
                                 └─ alternate channel   ─┘
                                        │
                                 internal traces ──► diagnosis only

Two further results matter for anyone reading a privacy score. Attacker self-reports combine omissions with high false discovery — an attacker model asked whether it got the data is wrong in both directions at once, so its report is not a substitute for observation. And reducing model-visible returns changes the exposure path but can eliminate normal-task success: the obvious mitigation, showing the model less, is not free.

Why it matters

The result lands in a literature that has been drifting toward proxies for two years, and it explains a pattern that was already visible.

Go back to AgentDAM (arXiv 2503.09780), a 246-task benchmark for data minimization in web-navigation agents. Its authors ran the same comparison in miniature: they asked models whether disclosing an item would be appropriate (probing), then watched what the agents actually did. The gap is large and consistent in direction — gpt-4o scored 0.915 by probing and 0.646 in action; gpt-4o-mini, 0.890 versus 0.557. Asking a model about privacy measures its stated norms. Running it measures its behaviour. These are different quantities.

Then AgentCIBench, released June 22, 2026 by Anmol Goel and Iryna Gurevych at UKP Lab as Capable but Careless. It scores contextual-integrity failures deterministically across a six-app workspace, from 128 hand-authored seed scenarios, using a matcher plus an LLM judge merged conservatively. Its own framing is the point: because refusal masks raw leakage, the primary metric is engagement-conditioned leakage, Leng = L / (1 − R). Their stated takeaway — task-completion utility does not predict disclosure restraint — means a capable agent and a careful one are independent axes. The reported evaluation of 15 frontier agents found 11 leaking on more than half of scenarios, averaging 67.9%.

Line the three up and the conclusion is uncomfortable: published agent leakage rates are floors, not estimates. Probing overstates restraint. Expected-outlet scoring understates exposure by roughly half. Refusal inflates the denominator unless you correct for it. Every known bias in this measurement stack points the same way.

That has direct procurement consequences. A vendor privacy score is only as meaningful as the exit set it was computed over, and almost none of them say what that set was. We have made the same argument about safeguard scores not being deployment evidence and about security benchmarks disagreeing with each other; this is the privacy-specific instance, with a number attached.

Defenses

Ask any privacy number what its exit set was. Before comparing two agents, establish whether both were scored over the union of visible exits or only the expected one. If the report does not say, treat the number as a lower bound and say so in writing. This is the single highest-value question in an AI vendor review right now.

Enumerate your own exits before you instrument. In your deployment, list every channel content can leave through: the assistant’s reply, outbound messages and email, file writes, tool arguments sent to third parties, logs, telemetry, search queries, webhook payloads. Most teams find channels they had not counted. You cannot monitor a boundary you have not written down. This extends naturally from purpose-bound disclosure — purpose constrains what, the exit set constrains where.

Pre-register targets in internal testing. Decide which records count as sensitive before the run, not by reading the transcript afterwards. Post-hoc labelling lets a judge grade what it happens to notice, which is precisely the failure ASLEval formalises.

Do not accept a model’s self-report as evidence. Applies to attacker models in red-team harnesses, and equally to production agents asked to flag their own disclosures. The finding is omissions plus high false discovery — bad in both directions, so the error does not average out.

Alert on request-level precursors. Because schema-aligned internal evidence tends to precede visible exposure, a query shaped like the sensitive schema is a signal available before anything leaves. Tool-call argument inspection is cheaper than reconstructing exposure after the fact, and it is the same instrumentation point as ghost tool calls.

Report privacy and utility together. Both papers converge here: restricting model-visible returns can eliminate normal-task success, and utility does not predict restraint. A privacy figure without the accompanying task-success figure is not interpretable, and neither is the reverse.

Status

Item	Detail
Primary source	Wu G., Huang H., Long G., Huang T., Hou C., ASLEval: Measuring Privacy Exposure Displacement in LLM Agent Sessions, arXiv:2609.18864 [cs.CR]
Date	Submitted September 16, 2026 (v1); 8 pages, 3 figures
Licence	CC BY-NC-SA 4.0
Core concept	Privacy exposure displacement — mismatch between a local evaluation proxy and target-grounded session exposure
Headline figure	Expected-outlet-only view misses 46.9% of exposure recovered by the visible-exit union
Secondary findings	Attacker self-reports show omissions plus high false discovery; internal schema-aligned evidence precedes visible exposure; reducing model-visible returns can eliminate normal-task success
Method	Pre-registered hidden target set; all declared visible exits measured; internal traces reserved for diagnosis; independent human review of the adjudication pipeline
Corroborating work	Goel A., Gurevych I., Capable but Careless, arXiv:2606.23189, June 22, 2026 — AgentCIBench, 128 seed scenarios, six-app workspace, engagement-conditioned leakage Leng = L / (1 − R)
Earlier evidence	AGENTDAM, arXiv:2503.09780 — 246 tasks; probing versus in-action privacy scores diverge (gpt-4o 0.915 / 0.646; gpt-4o-mini 0.890 / 0.557)
Vendor status	Not a product vulnerability; no advisory, patch or coordinated disclosure applicable
Practical status	Benchmarking guidance, actionable today in procurement and internal red-team design