IC-1268LLMs leak private information in theory-of-mind scenarios even when explicitly instructed to preserve privacy

Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, Yejin Choi

SourceCan LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theory

In tier 3, models are given a scenario where character X shares a secret with Y, and Y must respond to Z without revealing it. Despite explicit privacy-preserving instructions, models leak the secret in their free-form responses. Worst-case string-match leakage over 10 runs: GPT-4 0.22, ChatGPT 0.93, InstructGPT 0.79, Mixtral 0.96, Llama-2 Chat 1.00, Llama-2 0.99. A proxy model (Llama-2-13B-Chat) confirms the leakage is recoverable. The authors note that GPT-4 and ChatGPT perform well on the binary control question (error 0.06 and 0.04) but still leak in free-form generation, indicating a gap between knowing and controlling.

Evidence
correlational
Key metric
Worst-case string-match leakage: GPT-4 0.22, ChatGPT 0.93, InstructGPT 0.79, Mixtral 0.96, Llama-2 Chat 1.00, Llama-2 0.99; proxy agent leakage: GPT-4 0.20, ChatGPT 0.89; binary control question error: GPT-4 0.06, ChatGPT 0.04
Caveat
Leakage detection relies on exact string-match and a proxy model; the authors note 16 additional nuanced leaks in GPT-4 responses were missed by string matching. Scenarios were generated by GPT-4, which may introduce familiarity bias.
Model
GPT-4 / ChatGPT4 / GPT-4 Code Interpreter / GPT-4 Technical Report, ChatGPT, InstructGPT, Mixtral, Llama 2 / Llama 2 base Llama-2-Chat
Concepts
Failure mode
Related work
FANTOM [context]
Related findings
IC-1267, IC-1269, IC-1270
Extraction
automatic-extraction