Skip to content

Privacy Reasoning in Ambiguous Contexts

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

LLMs acting as privacy-reasoning agents fail on ambiguous information-sharing scenarios due to underspecified context rather than model capability gaps. The paper introduces Camber, a framework that systematically disambiguates scenario context by extracting implicit reasoning assumptions, yielding up to 13.3% precision and 22.3% recall gains across three frontier models.

Problem

Existing privacy benchmarks for LLMs test only refusal of inappropriate sharing, ignoring the utility dimension (when sharing is appropriate). More critically, no prior work isolates context ambiguity as a root cause of errors: models make inconsistent, prompt-sensitive decisions because scenarios lack contextual details, causing the model to silently fill gaps with differing plausible assumptions rather than seek clarification.

Method

The authors augment two public benchmarks (PrivacyLens, ConfAIde) with appropriate-to-share counterpart examples to enable precision/recall evaluation. They then build Camber, a context disambiguation simulation framework with three expansion strategies: 1. Label-independent: adds neutral descriptive context to individual fields (baseline) 2. Label-dependent: adds context aligned with the ground-truth appropriateness label, constrained to contextual integrity fields 3. Reasoning-guided: elicits model rationales for each judgment, performs qualitative coding to extract nine implicit assumption categories (Privacy, Consent, Sender Auth, Recipient Auth, etc.), then generates label-dependent context expansions targeting those assumption categories

Experiments use Gemini 2.5 Pro, GPT-4.1, and Claude 3.7 Sonnet at temperature=0 with three prompt variants (neutral, restrictive, permissive) to measure both accuracy and prompt sensitivity.

Key Contributions

  • Identification and empirical quantification of context ambiguity as a primary barrier to LLM privacy reasoning performance
  • Augmented datasets (PrivacyLens+, ConfAIde+) with balanced positive/negative examples (986 and 540 examples respectively)
  • Camber framework with three disambiguation strategies and a nine-code assumption taxonomy derived from model reasoning analysis
  • Empirical evidence that reasoning-guided disambiguation outperforms both label-independent and label-dependent baselines, and reduces prompt sensitivity

Results

  • Reasoning-guided expansion achieves up to +13.3% precision and +22.3% recall over no-expansion baseline
  • Top-performing single code on PrivacyLens+: consent — identical across all three models
  • Label-independent expansion provides negligible gains over baseline; label-dependent shows moderate improvement, especially on PrivacyLens+
  • Reasoning-guided expansion is the only strategy that consistently reduces prompt sensitivity across prompt variants and datasets
  • Code generalization: expansions based on a specific assumption code improve accuracy even for examples not labeled with that code (27–70% wrong→right corrections per code), suggesting aggregate reasoning is a better signal than per-instance rationales
  • F1 scores with reasoning-guided top code reach 91–97% on PrivacyLens+ and 88–97% on ConfAIde+ (vs. baselines of ~75–86%)

Limitations

  • Synthetic context expansions may not reflect real-world user clarifications; no mechanism for obtaining clarifications in production
  • Assumption codebook derived from two specific datasets; generalizability to broader agent interactions is unknown
  • Label-dependent expansions deliberately reinforce existing labels — not representative of authentic bidirectional user clarifications
  • LLM-elicited reasoning may not faithfully reflect the model's internal decision process, complicating interpretation of code-level generalization results
  • Potential bias amplification in any production deployment is unaddressed

Relevance to Agentic AI / LLM Agents

This paper directly addresses a core safety requirement for personal AI agents: deciding when to share user data with third-party tools or sub-agents. The finding that context ambiguity — not model size or capability — drives privacy reasoning errors has direct implications for how agents should be designed to seek clarification before acting on sensitive information flows. The Camber framework provides a blueprint for agentic architectures that elicit implicit assumptions, surface them to users for disambiguation, and thereby reduce both errors and prompt brittleness. The reasoning-guided disambiguation approach generalizes the idea that model-generated rationales are a useful signal for improving agent reliability even when those rationales are not perfectly faithful.