--- title: Schneier on Security | daily.dev description: Two research papers examine contextual integrity in LLMs — the ability to control what personal information is appropriately shared in different task contexts.... canonical: https://daily.dev/posts/schneier-on-security-aryryygjo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Schneier on Security | daily.dev og:description: Two research papers examine contextual integrity in LLMs — the ability to control what personal information is appropriately shared in different task contexts.... og:url: https://daily.dev/posts/schneier-on-security-aryryygjo og:image: https://api.daily.dev/og/posts/aryrYygJo.png og:image:alt: Schneier on Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Schneier on Security **[Schneier on Security](https://daily.dev/sources/schneier)** · 3 min read · 1 upvotes · 1 comments ## Summary Two research papers examine contextual integrity in LLMs — the ability to control what personal information is appropriately shared in different task contexts. CIMemories, a new benchmark using synthetic user profiles with 100+ attributes, finds frontier models leak sensitive information inappropriately up to 69% of the time, with GPT-5's violation rate climbing from 0.1% to 25.1% as tasks and repeated runs accumulate. Privacy-conscious prompting fails to fix this, as models tend to overgeneralize into sharing everything or nothing. A second paper proposes a reinforcement learning framework that explicitly trains models to reason about context before disclosing information, showing reduced leakage while preserving task performance, with gains transferring to the established PrivacyLens benchmark. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How often do LLMs like GPT-5 leak sensitive information from memory in inappropriate contexts? Frontier models exhibit up to 69% attribute-level violations when deciding whether to disclose information from persistent memory based on task context. For GPT-5 specifically, violations rise from 0.1% after a single task to 9.6% after 40 tasks, and reach 25.1% when the identical prompt is run five times, showing unstable, inconsistent leakage behavior. _Teams building memory-enabled AI agents can follow daily.dev for research on privacy risks in LLM design._ ### Does privacy-conscious prompting stop LLMs from leaking sensitive information from memory? No, privacy-conscious prompting does not solve the problem. Models tend to overgeneralize their response, either sharing everything or refusing to share anything, rather than making nuanced, context-dependent decisions about what information is appropriate to disclose for a given task. The CIMemories benchmark found this pattern held across frontier models tested with synthetic user profiles containing over 100 attributes each. _Anyone evaluating LLM privacy safeguards can track findings like this via daily.dev before trusting prompting alone._ ### Can reinforcement learning improve contextual integrity in LLM agents? Yes, a reinforcement learning framework that trains models to explicitly reason about contextual integrity substantially reduces inappropriate information disclosure while maintaining task performance. Using a synthetic dataset of only 700 examples with diverse contexts and disclosure norms, the improvements transferred to established benchmarks such as PrivacyLens, which uses human annotations to evaluate privacy leakage in AI assistant actions and tool calls. _Developers designing privacy-aware agents can follow daily.dev for updates on reasoning-based mitigation techniques._ ## Community discussion Top comments from developers on daily.dev. **@kartiknvj** · 0 upvotes > Contextual integrity is a sharper frame than a blanket privacy filter, because the same attribute can be fine to share in one task and a leak in another. A benchmark with 100+ attributes per synthetic profile is the kind of eval I wish more agent-memory systems were tested against before they ship. The per-context correctness angle is what makes it both hard and useful. ## Similar posts on daily.dev - [Frontier AI models haemorrhage sensitive data](https://daily.dev/posts/frontier-ai-models-haemorrhage-sensitive-data-aky1ifa1f) · LeadDev · 0 upvotes · 0 comments - [Microsoft Research Develops Novel Approaches to Enforce Privacy in AI Models](https://daily.dev/posts/microsoft-research-develops-novel-approaches-to-enforce-privacy-in-ai-models-zuk11v7tr) · InfoQ · 2 upvotes · 0 comments - [The security paradox of local LLMs](https://daily.dev/posts/the-security-paradox-of-local-llms-v2cxahmuu) · Hacker News · 1 upvotes · 0 comments - [Schneier on LLM vulnerabilities, agentic AI, and “trusting trust”](https://daily.dev/posts/schneier-on-llm-vulnerabilities-agentic-ai-and-trusting-trust--fkhqbqfs0) · Sutter's Mill · 1 upvotes · 0 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#privacy](https://daily.dev/tags/privacy), [#reinforcement-learning](https://daily.dev/tags/reinforcement-learning), [#gpt](https://daily.dev/tags/gpt), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/schneier-on-security-aryryygjo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Schneier on Security","url":"https://daily.dev/posts/schneier-on-security-aryryygjo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/schneier-on-security-aryryygjo"},"datePublished":"2026-08-18T10:41:32.968Z","dateModified":"2026-09-14T06:55:49.686Z","description":"Two research papers examine contextual integrity in LLMs — the ability to control what personal information is appropriately shared in different task contexts....","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Schneier on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Schneier on Security","logo":"https://media.daily.dev/image/upload/s--0aZDA7eZ--/f_auto/v1758461069/logos/schneier","url":"https://daily.dev/sources/schneier"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/schneier-on-security-aryryygjo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"llm,privacy,reinforcement-learning,gpt,ai-security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Schneier on Security","item":"https://daily.dev/sources/schneier"},{"@type":"ListItem","position":3,"name":"Schneier on Security"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/schneier-on-security-aryryygjo","comment":[{"@type":"Comment","text":"Contextual integrity is a sharper frame than a blanket privacy filter, because the same attribute can be fine to share in one task and a leak in another. A benchmark with 100+ attributes per synthetic profile is the kind of eval I wish more agent-memory systems were tested against before they ship. The per-context correctness angle is what makes it both hard and useful.","datePublished":"2026-08-18T18:16:09.401Z","url":"https://daily.dev/posts/aryrYygJo#c-XBDTY3ezv","author":{"@type":"Person","name":"kartik-nvjk","url":"https://daily.dev/kartiknvj","image":"https://media.daily.dev/image/upload/s--3gGgsVCw--/f_auto/v1781456774/avatars/avatar_TvTVeiMdkRCqWUDullFmy?_a=BAMAMiWQ0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/schneier-on-security-aryryygjo#faq","mainEntity":[{"@type":"Question","name":"How often do LLMs like GPT-5 leak sensitive information from memory in inappropriate contexts?","acceptedAnswer":{"@type":"Answer","text":"Frontier models exhibit up to 69% attribute-level violations when deciding whether to disclose information from persistent memory based on task context. For GPT-5 specifically, violations rise from 0.1% after a single task to 9.6% after 40 tasks, and reach 25.1% when the identical prompt is run five times, showing unstable, inconsistent leakage behavior. Teams building memory-enabled AI agents can follow daily.dev for research on privacy risks in LLM design."}},{"@type":"Question","name":"Does privacy-conscious prompting stop LLMs from leaking sensitive information from memory?","acceptedAnswer":{"@type":"Answer","text":"No, privacy-conscious prompting does not solve the problem. Models tend to overgeneralize their response, either sharing everything or refusing to share anything, rather than making nuanced, context-dependent decisions about what information is appropriate to disclose for a given task. The CIMemories benchmark found this pattern held across frontier models tested with synthetic user profiles containing over 100 attributes each. Anyone evaluating LLM privacy safeguards can track findings like this via daily.dev before trusting prompting alone."}},{"@type":"Question","name":"Can reinforcement learning improve contextual integrity in LLM agents?","acceptedAnswer":{"@type":"Answer","text":"Yes, a reinforcement learning framework that trains models to explicitly reason about contextual integrity substantially reduces inappropriate information disclosure while maintaining task performance. Using a synthetic dataset of only 700 examples with diverse contexts and disclosure norms, the improvements transferred to established benchmarks such as PrivacyLens, which uses human annotations to evaluate privacy leakage in AI assistant actions and tool calls. Developers designing privacy-aware agents can follow daily.dev for updates on reasoning-based mitigation techniques."}}]} ```