Research map / Multi-agent systems and games / LLM agents

AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents

NeurIPS 2025 · Multi-agent systems and games › LLM agents · approach: Agentic benchmarks and orchestration · 5 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces AgentDAM, an end-to-end benchmark (246 tasks in WebArena/VisualWebArena shopping, Reddit, GitLab) that measures whether web agents follow data minimization by avoiding leakage of irrelevant sensitive user data, and tests a privacy-aware CoT system prompt mitigation.

Problem

Web-navigation agents often need users' personal data to complete tasks, but it is unclear whether they use only the necessary information; existing privacy evaluations probe LLMs directly rather than measuring privacy in agent actions.

Approach

Measure inference-time privacy via end-to-end agent execution in real (isolated) WebArena environments with synthetic user data containing irrelevant sensitive facts, scored by an LLM judge (gpt-4o) on action traces, and compare against probing; mitigate with a privacy-aware system prompt plus CoT demonstrations.

Key results

• Without mitigation, GPT models achieve only about 0.54-0.73 privacy performance (gpt-4o 0.646 with axtree), while Llama and Claude reach roughly 0.88-0.90.
• A privacy-aware CoT system prompt raises gpt-4o privacy performance from 0.646 to 0.919 at a cost of utility dropping from 0.435 to 0.398 (axtree).
• Probing LLMs gives higher privacy scores than end-to-end agent runs for GPT models (e.g., gpt-4o 0.915 probing vs 0.646 agentic), and the LLM judge agreed with human evaluators 98% of the time.

Measured effects reported in the paper

Surprising findings

• Probing LLMs about privacy overestimates privacy for GPT models, but the reverse holds for Llama models, which leak less in agentic settings.
• Pre-filtering user data with an LLM was ineffective at reducing leakage, and post-filtering also gave unsatisfactory results.

Limitations

• Benign setting only; no adversarial third parties considered.
• Small benchmark of 246 tasks across three web apps (shopping, Reddit, GitLab), with synthetic user data.
• Privacy-aware prompting causes utility degradation from false denial-of-service refusals and no mitigation reaches perfect privacy (best about 94%).

Experimental setup

Datasets: WebArena VisualWebArena

Benchmarks: AgentDAM

Metrics: utility (task success rate) privacy leakage rate privacy performance (1 - leakage rate)

Baselines: probing LLMs for privacy pre-filtering post-filtering claude-cua

Builds on: WebArena VisualWebArena Set-of-Marks prompting chain-of-thought prompting

Closest papers by meaning

• MINIM: Privacy-Aware Minimal View for Agents via Trusted Local Sanitization (ICML 2026 · similarity 0.88)
• REAL: Benchmarking Autonomous Agents on Deterministic Simulations of Real Websites (NeurIPS 2025 · similarity 0.87)
• ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustworthiness in Web Agents (ICLR 2026 · similarity 0.86)
• WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks (NeurIPS 2025 · similarity 0.86)
• It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents (ICML 2026 · similarity 0.86)
• POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents (NeurIPS 2026 · similarity 0.86)