1-2-3 Check: Enhancing Contextual Privacy in LLM via Multi-Agent Reasoning (2025)

Abstract: Addressing contextual privacy concerns remains challenging in interactive settings where large language models (LLMs) process information from multiple sources. Building on the theory of contextual integrity, we introduce a multi-agent framework that decomposes privacy reasoning into specialized subtasks—extraction, classification—reducing the information load on any single agent while enabling iterative validation and more reliable adherence to contextual privacy norms. Experiments on the ConfAIde benchmark with two LLMs (GPT-4, Llama3) demonstrate that our multi-agent system substantially reduces private information leakage (36% reduction) while maintaining the fidelity of public content compared to a single-agent system, showing the promise of multi-agent frameworks towards contextual privacy with LLMs.

## introduction as large language models (llms) are increasingly deployed in real-world applications, ensuring they respect privacy norms remains a major challenge. while early research focused on static data protection and preventing memorization leaks @xcite , these efforts overlook the dynamic nature of real-time interactions. current llms still struggle to uphold inferencetime contextual privacy norms, particularly in applications like chatbots and virtual assistants that must filter information based on user roles and expectations @xcite . drawing from nissenbaums contextual integrity theory @xcite , enforcing appropriate information flowssuch as limiting medical data to physicians while preventing disclosure to marketersis crucial @xcite . however, traditional single-prompt approaches rely on static instructions during inference, leading to inconsistent enforcement and unintended leakage @xcite . to address this gap, we propose a multi-agent framework that decomposes the reasoning process into multiple specialized stages @xcite . rather than protecting contextual privacy protection using one single prompted llm, we introduce separate agentseach responsible for a distinct subtaskto process and refine the information flow incrementally. by structuring the workflow around multiple agents, we enable fine-grained enforcement of contextual norms, reducing the complexity faced by any single agent and allowing for incremental verification of privacy constraints. our multi-agent framework consists of three types of agents: extractor, executor, and checker agents. specifically, the extractor agent identifies key events from user dialogue and categorizes them as private or public. these extracted events are then passed to an executor agent, which synthesizes a privacy-aware summary, ensuring that sensitive details are appropriately withheld. furthermore, we explore a checker agent, which serves as a validation layer to refine classifications and enforce privacy constraints before execution. this pipeline encourages iterative validation, aligning the resulting summaries more closely with user expectations and contextual integrity norms. we evaluate our methods on the most challenging tier of the confaide contextual privacy benchmark @xcite , which focuses on automatically generating personalized meeting transcript summaries while considering recipients' backgrounds as a key privacy factor. our results show that our framework surpasses the privacyprompted single-agent baseline by 36%. further analyses show the importance of breaking down each agents role gains in both privacy preservation and public completeness. by systematically channeling only the necessary information from one agent to the next, we mitigate leakage risks at each stage while retaining key public content. ## approach: multi-agent privacy in this section, we describe our methodology for constructing privacy-preserving multi-agent pipelines to summarize meeting dialogues. the work of confaide @xcite establishes a foundational baseline, where a single llm is prompted to summarize a meeting transcript while excluding private or sensitive information. however, recent evaluations of single-llm setups in the context of contextual privacy @xcite have highlighted inherent limitations stemming from the heavy load placed on a single agent. to mitigate these challenges and motivated by the recent successes of multi-agent setups @xcite @xcite ) (see app.a), we introduce a privacypreserving multi-agent framework that decomposes the task into specialized subtasksnamely, event extraction, summarization, and an optional checking stage. their prompts are shown in app. c. ## experiment results and analysis to systematically evaluate how different agent configurations balance privacy preservation and completeness of public content, we conducted experiments on single-agent, two-agent, and three-agent pipelines with different information flow configurations. we show our results in single-agent vs. multi-agent baselines: our results consistently show that multi-agent pipelines yield stronger privacy safeguards compare with single agent, but also lead to more public information being omitted. however, overall, the multi-agent framework balances secret leakage with public information omission, enhancing both data security and retention. for the llama model, the twoagent framework demonstrates fewer omissions of public information compared to the threeagent setup, while performing similarly on preventing secret leakage. in contrast, with the more advanced gpt model, the threeagent framework shows superior performance on both secret leakage prevention and minimizing omissions of public information, thus leading to stronger overall outcomes. our qualitative analysis (see app. d) shows that when the executor has direct access to the meeting transcript, it can refine the checkers decisions, resulting in better final summary quality for the gpt model when guided by a checker agent. llama performs better under a twoagent setup might because the simpler configuration can reduce potential communication overhead and inconsistencies that can arise from coordinating an additional agent in a less capable model. only private vs. only public information: our experiments result with llama-3 and gpt-4 shows that using a checker that supplies only private information increases secret leakage compared to one that supplies only public information. upon qualitative investigation, we observe that the publiconly approach reduce the risks that the checker may erroneously fail to label private content, thereby reducing the risk of misinterpretation by the executor, see app. d. notably, our quantitative analysis for llama 3 shows that the private-only strategy also leads to a significant reduction in the omission of public information compared to the publicinclusive method. in contrast, the gpt-4 experiments reveal that both strategies yield comparable outcomes in terms of preserving public information, suggesting that gpt-4's enhanced contextual understanding may make the checker's performance better or render the executor less sensitive to the output provided by the checker agent. ## conclusion we introduced a multi-agent approach that partitions the tasks of event extraction, classification, and final summary generation among separate agents, addressing the limitations of a single llm operating alone. experimental results and ablation studies confirm that our multi-agent pipelines significantly reduce private information leakage without substantially compromising public content. in particular, offloading the classification step from the extractor to a dedicated checker agent alleviates classification errors and supports more faithful summaries. our findings highlight the importance of modular, intermediate validation steps in complex, context-dependent scenarios.