MuPPET: A Benchmark for Contextual Privacy of LLM Assistants in Multi-Party Conversations

2026-06-22

AI Summary

This work addresses the limitations of existing privacy evaluations, which are confined to single-turn or one-on-one dialogue settings and fail to capture the risk of large language models inadvertently leaking sensitive information to unintended recipients in multi-party conversations. To bridge this gap, the authors introduce MuPPET—the first context-aware privacy evaluation benchmark tailored for multi-party dialogues—leveraging simulated group chats, targeted privacy exposure tests, and integrated contextual analysis of model behavior to systematically assess privacy preservation capabilities. Experimental results demonstrate that mainstream large language models exhibit substantially higher information leakage in multi-party scenarios compared to dyadic interactions, with smaller open-source models posing even greater risks. Moreover, current defense mechanisms not only offer limited protection but also significantly impair model utility.

Abstract

LLM agents are increasingly deployed in multi-party environments, handling sensitive personal data on behalf of individual users, for instance in group chats. When such an agent discloses private information, it reaches every group member at once. This risk is structurally harder to control than in one-to-one settings, as every piece of private information must be appropriate for every recipient in the group. Yet all existing contextual privacy benchmarks consider only single-interlocutor settings, leaving multi-party privacy risks unmeasured. We introduce MuPPET (Multi-Party Privacy Exposure Testing), a benchmark for contextual privacy in multi-party conversations. Our experiments show that models leak substantially more in multi-party settings than one-to-one evaluations suggest. Frontier models are vulnerable, and smaller open-weights models, often preferred for local deployment with sensitive data, even more so. Existing contextual privacy defences offer only partial protection, degrade utility, and do not resolve the underlying party-tracking problem.

Problem

• contextual privacy
• multi-party conversations
• privacy leakage
• LLM assistants
• privacy benchmark

Innovation

• multi-party privacy
• contextual privacy
• LLM agents
• privacy benchmarking
• privacy leakage