A method and system for detecting privacy leakage of an intelligent agent

Abstract

This invention discloses a method and system for detecting privacy leaks in intelligent agents, solving the technical problem that existing methods for detecting privacy leaks in intelligent agents struggle to accurately distinguish between "business-essential data" and "overexposed data," ultimately leading to inaccurate privacy leak detection reports. The method includes: acquiring the intelligent agent toolset and target user assets; constructing a cross-tool function call graph using a referee model and predefined type compatibility rules; fine-grained segmentation and labeling of target user assets; outputting a set of executable user prompts and a set of acyclic valid paths through breadth-first search; generating runtime logs and terminal-proposed data packets during intelligent agent execution; determining functionally necessary data, overexposed datasets, and risk assessment results based on majority vote consensus rules; and finally integrating all core data from the entire process to generate a data overexposure detection report.

Description

Technical Field

[0001] This invention relates to the field of data privacy detection technology, and in particular to a method and system for detecting privacy leaks of intelligent agents. Background Technology

[0002] With the rapid development of large language models (LLM) and external tool integration technologies, large language model agents (LLMAgent) have been widely used in fields such as office automation, code development, and data analysis. These agents autonomously plan and call various external functions and tools to complete complex tasks, a process involving the exchange of a large amount of private user data.

[0003] However, under this highly autonomous architecture, data over-exposure has become a serious privacy and security challenge: when intelligent agents perform tasks, they often transmit sensitive data that exceeds the scope of user intent or the scope necessary for the target function to external third-party platforms or untrusted sinks, resulting in serious privacy leaks and compliance risks.

[0004] Existing methods for detecting privacy leaks in intelligent agents mostly rely on traditional program analysis tools or black-box adversarial testing modes. The former focuses on static / dynamic analysis of deterministic program paths, while the latter triggers agent behavior through random sampling or adversarial prompts. However, these solutions lack fine-grained privacy guidelines and struggle to accurately distinguish between "business-essential data" and "overexposed data," ultimately resulting in poor accuracy in privacy leak detection reports. Summary of the Invention

[0005] This invention provides a method and system for detecting privacy leaks in intelligent agents, solving the technical problem that existing methods for detecting privacy leaks in intelligent agents have difficulty accurately distinguishing between "business-essential data" and "overexposed data," ultimately leading to inaccurate privacy leak detection reports.

[0006] The first aspect of this invention provides a method for detecting privacy leaks in intelligent agents, comprising:

[0007] Acquire the intelligent agent toolset and target user assets, and construct a call graph based on the intelligent agent toolset using a referee model and predefined type compatibility rules to generate a cross-tool function call graph;

[0008] The target user assets are then broken down into fine-grained data items to obtain the labeled target assets.

[0009] A breadth-first search algorithm is used to integrate data based on the cross-tool function call graph, the labeled target assets, and pre-specified data source nodes and terminal nodes, and outputs a set of executable user prompt words and a set of acyclic valid paths;

[0010] The intelligent agent generates runtime logs and data packets to be transmitted by the terminal based on the functions corresponding to the pre-specified data source nodes, the labeled target assets, the set of executable user prompts, and the full data of the target assets corresponding to the target user assets.

[0011] Based on the majority vote consensus rule, the referee model uses the data packet to be transmitted by the terminal, the function description document corresponding to the pre-specified terminal node, the user intent data in the labeled target asset, and the full data of the target asset to perform data filtering and risk assessment, and generate functionally necessary data, over-exposed dataset, and risk assessment results corresponding to the over-exposed dataset.

[0012] The executable user prompt word set, the acyclic valid path set, the labeled target assets, the user intent data, the functionally necessary data, the data packets to be transmitted by the terminal, the agent runtime log, the overexposure dataset, and the risk assessment results are integrated to generate a data overexposure detection report.

[0013] Optionally, the step of constructing a call graph based on the agent toolset using a referee model and predefined type compatibility rules to generate a cross-tool function call graph includes:

[0014] Traverse the function list of the intelligent agent toolset to generate multiple ordered function pairs;

[0015] Extract the return value type of the predecessor function in each ordered function pair and the input parameter type of the target function in each ordered function pair;

[0016] Based on the return value type of each ordered function pair and the input parameter type, the ordered function pairs are filtered for type compatibility according to the predefined type compatibility rules to obtain multiple type-compatible ordered function pairs.

[0017] For each type-compatible ordered function pair, construct semantic verification prompts and input each semantic verification prompt into the adjudication model to obtain the judgment result corresponding to each type-compatible ordered function pair;

[0018] Any type-compatible ordered function pair whose judgment result is yes is considered a semantically coherent legal function pair.

[0019] Extract the core verbs and object entities of each semantically coherent legal function pair, and generate call edges;

[0020] Map each tool function in the intelligent agent toolset to a node, and set a virtual entry node;

[0021] By integrating multiple nodes, the virtual entry node, and the call edge, a cross-tool function call graph is constructed.

[0022] Optionally, the breadth-first search algorithm integrates data based on the cross-tool function call graph, the labeled target assets, and pre-specified data source nodes and terminal nodes, outputting a set of executable user prompts and a set of acyclic valid paths, including:

[0023] The breadth-first search algorithm is used to traverse the cross-tool function call graph to extract multiple sets of acyclic valid paths from the data source node to the terminal node;

[0024] The core verbs and objects corresponding to adjacent nodes in each acyclic effective path in the set of acyclic effective paths are concatenated to obtain multiple call edge abstract instructions, which are then integrated with the labeled target assets to obtain the integrated content.

[0025] The integrated content is input into the referee model to generate a set of executable user prompts.

[0026] Optionally, the step of generating an agent runtime log and a data packet to be transmitted by the terminal based on the function corresponding to the pre-specified data source node, the labeled target asset, the executable user prompt word set, and the full data of the target asset corresponding to the target user asset includes:

[0027] The agent executes each executable user prompt word in the executable user prompt word set one by one to obtain the agent runtime log;

[0028] Based on the user intent data in the labeled target asset and the full data of the target asset, determine the taint data;

[0029] Data stream capture is performed based on the function corresponding to the data source node to obtain the data packet to be transmitted by the terminal.

[0030] Optionally, based on the majority vote consensus rule, the referee model performs data filtering and risk assessment according to the data packet to be transmitted by the terminal, the function description document corresponding to the pre-specified terminal node, the user intent data in the labeled target asset, and the full data of the target asset, generating functionally necessary data, an overexposed dataset, and risk assessment results corresponding to the overexposed dataset, including:

[0031] Based on the data packet to be transmitted by the terminal, the function description document corresponding to the pre-specified terminal node, and the user intent data, construct data necessity determination prompt words;

[0032] The necessary data determination prompts are input into the referee model to obtain necessary data determination results for multiple data items;

[0033] Based on the majority vote consensus rule, target data items are selected from the data packets to be transmitted by the terminal according to the necessity determination results of multiple data items, and integrated into functionally necessary data.

[0034] Based on the data packets to be transmitted by the terminal, the necessary data for the function, the user intent data, and the full data of the target asset, an overexposure dataset is output.

[0035] Based on the overexposed dataset, the risk of privacy leakage of the agent is determined, and the risk assessment result corresponding to the overexposed dataset is output.

[0036] Optionally, the step of determining the risk of privacy leakage of the intelligent agent based on the overexposed dataset and outputting the risk assessment result corresponding to the overexposed dataset includes:

[0037] Determine whether the overexposed dataset is an empty set;

[0038] If the overexposed dataset is not an empty set, then the risk assessment result is that there is a risk of overexposed data.

[0039] If the overexposed dataset is an empty set, then the risk assessment result is no risk of overexposed data.

[0040] A second aspect of the present invention provides a detection system for privacy leakage of intelligent agents, comprising:

[0041] The acquisition module is used to acquire the intelligent agent toolset and target user assets, and to construct a call graph based on the intelligent agent toolset using a referee model and predefined type compatibility rules to generate a cross-tool function call graph;

[0042] The splitting module is used to perform fine-grained data item splitting on the target user assets to obtain the labeled target assets;

[0043] The output module is used to integrate data based on the cross-tool function call graph, the labeled target assets, and the pre-specified data source nodes and terminal nodes using a breadth-first search algorithm, and output an executable user prompt word set and an acyclic valid path set;

[0044] The generation module is used to generate an agent runtime log and a data packet to be transmitted by the terminal based on the function corresponding to the pre-specified data source node, the labeled target asset, the executable user prompt word set, and the full data of the target asset corresponding to the target user asset.

[0045] The filtering and judgment module is used to perform data filtering and risk judgment based on the majority vote consensus rule and the judge model according to the data packet to be transmitted by the terminal, the function description document corresponding to the pre-specified terminal node, the user intent data in the labeled target asset, and the full data of the target asset, and to generate functionally necessary data, over-exposed dataset, and risk assessment results corresponding to the over-exposed dataset.

[0046] The integration module is used to integrate the executable user prompt word set, the acyclic valid path set, the labeled target assets, the user intent data, the functionally necessary data, the data packets to be transmitted by the terminal, the agent runtime log, the overexposure dataset, and the risk assessment results to generate a data overexposure detection report.

[0047] A third aspect of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the detection method for privacy leakage of intelligent agents as described above.

[0048] The fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed, implements the detection method for privacy leakage of intelligent agents as described above.

[0049] The fifth aspect of the present invention provides a computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein, when the program instructions are executed by a computer, the computer performs the steps of the detection method for privacy leakage of intelligent agents as described above.

[0050] As can be seen from the above technical solutions, the present invention has the following advantages:

[0051] The present invention provides a method for detecting privacy leaks in intelligent agents. This method involves acquiring an intelligent agent toolset and target user assets, and using a referee model and predefined type compatibility rules to construct a call graph based on the intelligent agent toolset, generating a cross-tool function call graph. The target user assets are then split into fine-grained data items to obtain labeled target assets. A breadth-first search algorithm is used to integrate data based on the cross-tool function call graph, labeled target assets, and pre-specified data source nodes and terminal nodes, outputting a set of executable user prompts and a set of acyclic valid paths. The intelligent agent generates runtime logs and terminal-to-be-transmitted data packets based on the functions corresponding to the pre-specified data source nodes, labeled target assets, the set of executable user prompts, and the full data of the target assets corresponding to the target user assets. Based on majority vote consensus rules, a referee model is used to perform data filtering and risk assessment based on the terminal-to-be-transmitted data packets, the function description documents corresponding to the pre-specified terminal nodes, user intent data in the labeled target assets, and the full data of the target assets, generating functionally necessary data. The invention generates an overexposure data detection report by integrating the executable user prompt set, the set of acyclic valid paths, the labeled target assets, user intent data, functionally necessary data, the terminal's intended data packets, the agent's runtime logs, the overexposure data set, and the risk assessment results. Based on the above scheme, the invention constructs a call graph through predefined type compatibility rules and a referee model, ensuring a structured mapping of the call logic between agent tools. Combined with a breadth-first search algorithm, it accurately extracts acyclic valid paths, laying a clear foundation for subsequent data flow tracking. Through fine-grained splitting and labeling of target user assets, the boundaries of user intent data are clarified, providing a core basis for distinguishing data types. Using majority vote consensus rules, combined with terminal node function descriptions, user intent data, and the full data of target assets, a multi-dimensional judgment is made to accurately filter functionally necessary data, thereby clarifying the scope of overexposure data and distinguishing between "business-necessary data" and "overexposure data," thus improving the accuracy of the privacy leak detection report. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 The flowchart illustrates the steps of a method for detecting privacy leaks of intelligent agents according to Embodiment 1 of the present invention.

[0054] Figure 2 This is a schematic diagram of the call graph path extraction algorithm provided in Embodiment 1 of the present invention;

[0055] Figure 3 This is an overall framework diagram of a method for detecting privacy leaks of intelligent agents provided in Embodiment 1 of the present invention;

[0056] Figure 4 This is a structural block diagram of a detection system for privacy leakage of intelligent agents provided in Embodiment 2 of the present invention. Detailed Implementation

[0057] This invention provides a method and system for detecting privacy leaks in intelligent agents, which solves the technical problem that existing methods for detecting privacy leaks in intelligent agents have difficulty in accurately distinguishing between "business-essential data" and "overexposed data," ultimately leading to poor accuracy in privacy leak detection reports.

[0058] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. It should be noted that in the optional embodiments of the present invention, the object information and other related data involved require the permission or consent of the object when the embodiments of the present invention are applied to specific products or technologies, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. That is to say, if the embodiments of the present invention involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations, and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information requires the consent of the individual. If sensitive information is involved, the separate consent of the information subject is required, and the embodiments also need to be implemented with the authorization and consent of the object.

[0059] Terminology Explanation:

[0060] 1. Large Language Model Agent (LLM Agent): This refers to an automated system that uses a large language model as its core decision engine and possesses autonomous planning, memory management, and external tool invocation capabilities. The agent can autonomously select and execute a series of external functions (such as reading emails, querying databases, and sending API (Application Programming Interface) requests) to complete complex tasks based on user natural language instructions. This invention focuses on the compliance of data interaction between the agent and the multi-step call chain.

[0061] 2. Data Over-Exposure (DOE): This refers to the situation where, during the execution of a task by an intelligent agent, the amount of data actually transmitted to an external third-party platform or untrusted terminal exceeds the scope authorized by the user's original intent, or exceeds the minimum data set necessary for the execution of the target function. This is usually caused by overly broad tool interface design (such as returning the entire file instead of specifying fields) or the failure of privacy filtering during large model inference, and is the core privacy leakage behavior detected by this invention.

[0062] 3. Function Call Graph (FCG): A graph structure used to represent dependencies between functions within an agent's tool space. In an FCG, nodes represent specific tool functions (such as reading a file), and edges represent semantic flow dependencies between functions (i.e., the output of function A can be used as the input of function B). This invention constructs a scene-aware FCG to transform the agent's nondeterministic planning path into a structured topological mapping, thereby achieving systematic auditing of deeply hidden paths.

[0063] 4. User Intent Data: This refers to fine-grained data items that the user explicitly authorizes the agent to process and transmit in the initial command. For example, in the command "Retrieve the date from the invoice and send it," the date is the intent data. It is one of the core benchmark boundaries for determining privacy compliance in this invention.

[0064] 5. Functionally Necessary Data: Following the "data minimization" principle in privacy protection, this refers to the minimum set of data fields strictly necessary to achieve a specific tool's function. This invention utilizes a multi-model consensus mechanism to precisely define this, eliminating transmission false alarms caused by business logic necessity.

[0065] 6. Source and Sink: "Source" refers to the starting node where the intelligent agent obtains sensitive information (such as a tool for reading personal privacy files); "Sink" refers to the exit node where data leaves the intelligent agent's controlled environment (such as a tool for sending emails or uploading to a server). The detection objective of this invention is to identify unauthorized data flows in the path from the source to the sink.

[0066] 7. Dynamic Taint Tracking: This is a technique for monitoring the flow of sensitive information during program execution. This invention marks data exceeding the scope of user intent as "targets" and, during the agent's cross-tool execution, intercepts and records from multiple observation points whether this tainted data flows to an untrusted terminal (sink), thereby providing definitive evidence of privacy breaches.

[0067] 8. Multi-LLM Voting Consensus: This mechanism introduces multiple heterogeneous large language models as "independent judges" to jointly determine the compliance of data transmission in accordance with privacy regulations (such as GDPR (General Data Protection Regulation), CCPA (California Consumer Privacy Act), and PIPL (Personal Information Protection Law of the People's Republic of China)). This mechanism eliminates the illusion or bias of a single model through the majority vote principle, ensuring high accuracy and fairness in privacy boundary determination.

[0068] Please see Figure 1 , Figure 1 This is a flowchart illustrating the steps of a method for detecting privacy leaks of intelligent agents, as provided in Embodiment 1 of the present invention.

[0069] This invention provides a method for detecting privacy leaks in intelligent agents, comprising:

[0070] Step 101: Obtain the agent toolset and target user assets, and use the referee model and predefined type compatibility rules to construct a call graph based on the agent toolset to generate a cross-tool function call graph.

[0071] An agent toolkit refers to the collection of various tool functions that an agent can call during operation. It includes the signature information of each tool function (such as return type, input type, etc.) and is the core data source for constructing a cross-tool function call graph.

[0072] The target user assets refer to the user-related assets that need to be detected for excessive data exposure during this intelligent agent privacy leakage detection process. Specifically, these include various types of user-related data such as user personal identity information, business interaction data, and authorized transmission data. These are the core objects for subsequent fine-grained segmentation and labeling, data flow capture, and risk assessment.

[0073] The referee model refers to a pre-deployed judgment model built based on a large language model or a dedicated logic judgment algorithm. In this stage, it is used to determine the legality of the call relationship between functions in the intelligent agent tool set by combining predefined type compatibility rules. It will also be used in subsequent stages such as data necessity screening and risk assessment, providing core judgment basis for the logical verification and result output of each detection stage.

[0074] It should be noted that the system collects the tool resources that the intelligent agent can call and the user assets corresponding to this detection. Then, the judge model, in conjunction with predefined type compatibility rules, judges the input and output type matching and the rationality of the calls between tool functions, filters out legal call relationships, and then constructs a cross-tool function call graph with functions as nodes and legal call relationships as edges. This provides basic support for subsequent detection steps such as path extraction and data flow tracking.

[0075] Further, step 101 may include the following sub-steps:

[0076] S11. Traverse the function list of the agent's toolset and generate multiple ordered function pairs;

[0077] S12. Extract the return type of the predecessor function and the input parameter type of the target function in each ordered function pair;

[0078] S13. Based on the return value type of each ordered function pair and the input parameter type, perform type compatibility filtering on each ordered function pair according to the predefined type compatibility rules to obtain multiple type-compatible ordered function pairs;

[0079] S14. Construct semantic verification prompts for each type-compatible ordered function pair, and input each semantic verification prompt into the referee model to obtain the judgment result corresponding to each type-compatible ordered function pair;

[0080] S15. Treat any type-compatible ordered function pair whose judgment result is yes as a semantically coherent legal function pair.

[0081] S16. Extract the core verbs and object entities of each semantically coherent legal function pair, and generate call edges;

[0082] S17. Map each tool function in the agent toolkit to a node and set a virtual entry node;

[0083] S18. Integrate multiple nodes, virtual entry nodes, and call edges to construct a cross-tool function call graph.

[0084] A virtual entry node refers to a virtual node that represents the initial input trigger source of the user. It serves as the starting point of the entire function call sequence and is used to connect user commands with utility function calls.

[0085] The predecessor function refers to the function that initiates the call in an ordered function pair, and its return type is used as the basis for verifying the input parameter type of the target function.

[0086] The target function refers to the function that is the caller in an ordered function pair, and its input parameter types are checked for compatibility with the return type of the predecessor function.

[0087] It should be noted that the main objective of this step is to reconstruct the underlying system data flow landscape of the intelligent agent by identifying functional dependencies between and within tools. By formalizing these relationships into a cross-tool function call graph (FCG), this invention provides a structured blueprint for subsequent targeted deep privacy testing. To provide a rigorous foundation for graph construction, this invention provides the definitions shown in Table 1.

[0088] Table 1. Definition of Cross-Utility Function Call Graph

[0089]

[0090] in, The i-th source node is the node that initiates the call. Its output will be used as the input parameter for subsequent calls (such as the "entry" node or the "read email" node). It is the initiator of the call action. For the j-th target node (i.e., the node being called), the source node receives the data. The output of the function is used as an input parameter to perform its own function (such as the "Read Email" node or the "Send Email" node), and it is the receiver of the calling action.

[0091] It is worth mentioning that, in order to accurately identify real data dependencies and control computational overhead, this invention adopts a hybrid strategy of "static path pruning + semantic verification based on a large model":

[0092] (1) Efficiency-driven static function pruning. This invention first performs fast static analysis on function signatures to eliminate incompatible function pairs. Specifically, the system checks whether the return type of one function satisfies a specific logical relationship with the input type of another function (as shown in Table 2 below). For custom objects and containers, this invention recursively scans nested member variables to ensure that no potential data flow links are missed.

[0093] Table 2 Static path pruning rules (i.e., predefined type compatibility rules)

[0094]

[0095] in, For example, function A (or of type ) The return type of the function, that is, the type of data output after the function is executed; For example, function B (or of type B) The input parameter type of the function, that is, the type of input data that the function needs to receive when it is executed; To change the input type of function B Consider it as a set. This represents the elements in the set; To determine the return type of function A It can be considered as a set.

[0096] (2) Accuracy-Oriented Large Model Validation. Since static analysis can only infer the probability of a function's "type layer," it may produce semantically incoherent false positives, meaning that the input and output types of functions may match, but there is no logical correlation. This invention utilizes the powerful natural language understanding capabilities of a large language model to determine whether the output of the predecessor function is logically suitable as the input of the successor function, based on the function description and parameter names (e.g., "extract email body," "send SMS"). This step precisely filters out false positive dependencies generated by static analysis, ensuring the accuracy of the final dependency relationship.

[0097] Furthermore, after identifying legitimate function pairs, this invention synthesizes their call logic into action prompts that trigger the agent to call the function pair, i.e., generates call edges. To avoid semantic drift and ensure consistency in path activation, this invention adopts a "semantic extraction + structured template" strategy: First, the system performs entity analysis on the natural language description of each tool function, extracting core verbs and objects from semantically coherent legitimate function pairs. Then, these entities are filled into a defined template to generate abstract action instructions (call edges): "Based on the previous step {verb 1} {object 1}, the next step is based on {object 1} {verb 2} {object 2}." For example, for the function pair of reading an email → sending an email, the generated call edge is: "Based on the content read in the previous step, the next step is based on this content to send an email." This structured generation ensures that the final synthesized user prompts are accurate enough to unambiguously drive the agent through the predetermined data flow path. Finally, by integrating all function pairs and their corresponding call edges, this invention produces a complete cross-tool function call graph, serving as the cornerstone for subsequent prompt generation and data overexposure detection.

[0098] In this embodiment, the complete list of all tool functions within the agent's toolset is first traversed. Multiple ordered function pairs, consisting of a predecessor function and a target function, are generated based on the likelihood of invocation, covering all potential function call combinations. Then, for each ordered function pair, the return value type of the predecessor function and the input parameter type of the target function are extracted to provide basic data for compatibility verification. Based on this type information, the type matching of each ordered function pair is verified one by one according to predefined type compatibility rules (i.e., static path pruning rules). Incompatible function pairs are pruned, resulting in multiple type-compatible ordered function pairs. For each type-compatible ordered function pair, semantic verification prompts containing function descriptions and invocation logic are further constructed. These prompts are then input into the adjudication model to determine the rationality of the invocation. The process involves obtaining the semantic judgment result for each type-compatible ordered function pair. Type-compatible ordered function pairs with a "yes" judgment result are identified as semantically coherent and legal function pairs, ensuring that function calls are not only type-compatible but also logically sound. Next, core verbs and object entities are extracted from each semantically coherent legal function pair. Based on this, call edges describing the flow logic between functions are generated, clarifying the action direction and data association of the edges. Each tool function in the intelligent agent toolkit is then mapped to a separate node, and a virtual entry node representing the user's initial input trigger source is added as the starting point of the entire call sequence. Finally, all nodes, virtual entry nodes, and generated call edges are integrated to construct a cross-tool function call graph that fully represents the legal call relationships between tool functions. This invention, through a two-stage screening mechanism of first filtering for type compatibility and then verifying semantic coherence, ensures that the call relationships in the cross-tool function call graph possess both type legality and semantic rationality, providing a structured foundation for subsequent accurate extraction of acyclic effective paths and tracking of data flow.

[0099] Step 102: Perform fine-grained data item splitting on the target user assets to obtain the labeled target assets.

[0100] Fine-grained data item decomposition refers to the operation of breaking down target user assets into the smallest independent data units according to business attributes and data characteristics, ensuring that each data item can be labeled and tracked separately, which is a prerequisite for accurately distinguishing data types.

[0101] The labeled target assets refer to user assets that have been broken down into fine-grained data items, and have completed the specification of user intent data (D_int) and the marking of overexposed candidate data. They are the core data input for subsequent data integration, executable prompt word generation and risk assessment.

[0102] It should be noted that, based on the cross-tool function call graph constructed above and the requirements for subsequent data integration and prompt word generation, the target user assets are decomposed according to business scenarios and data attributes, refined to the smallest independent data unit (such as name and mobile phone number in personal identity information, transaction amount and time in business data). After completing the fine-grained data item decomposition, each data item is further classified and labeled, clearly specifying the user intent data (D_int) that the user has authorized to transmit. At the same time, the remaining data items in the same asset that are not designated as D_int are uniformly marked as overexposed candidate data, ultimately forming the labeled target assets. This provides a clear data foundation for subsequent data integration based on acyclic effective paths, executable prompt word generation, and risk assessment. This invention, through fine-grained decomposition and precise labeling, clarifies the boundary between user-authorized data and candidate risk data, solving the core pain point of existing detection methods that are vague in data boundaries and difficult to distinguish between "business-necessary data" and "overexposed data." It provides a traceable basis for subsequent accurate screening of functionally necessary data and defining the scope of overexposed data.

[0103] Step 103: Using a breadth-first search algorithm, integrate data based on the cross-tool function call graph, the labeled target assets, and the pre-specified data source nodes and terminal nodes, and output the set of executable user prompt words and the set of acyclic valid paths.

[0104] It should be noted that, starting from the pre-specified data source node and ending at the terminal node, a breadth-first search algorithm is used to traverse the nodes and call edges in the cross-tool function call graph layer by layer to extract all acyclic valid paths from the data source to the terminal. Then, the core verbs and object entities of the call edges in each path are concatenated into abstract instructions, which are then integrated with the user intent data and overexposure candidate data in the labeled target assets to generate a set of executable user prompt words. Finally, these two sets are output.

[0105] Furthermore, step 103 may include the following sub-steps:

[0106] S31. Use a breadth-first search algorithm to traverse the cross-tool function call graph and extract a set of multiple acyclic valid paths from the data source node to the terminal node;

[0107] S32. Concatenate the core verbs and objects corresponding to adjacent nodes in each acyclic valid path in the set of acyclic valid paths to obtain multiple call edge abstract instructions, and integrate them with the labeled target assets to obtain the integrated content;

[0108] S33. Input the integrated content into the referee model to generate a set of executable user prompts.

[0109] The set of acyclic valid paths refers to the set of legal paths from the data source node to the terminal node that do not have cycles, extracted by the breadth-first search algorithm. Each path represents a possible sequence of utility function calls.

[0110] The abstract instruction for calling the edge refers to the abstract instruction that describes the path flow logic by sequentially concatenating the core verbs and objects of adjacent nodes in an acyclic valid path. It is the basis for generating executable user prompt words.

[0111] The executable user prompt set refers to the set of prompts generated by the referee model that can be directly executed by the agent. Each prompt corresponds to a loop-free valid path flow logic and user asset data, which is used to drive the operation of the agent.

[0112] It's important to note that, to effectively detect the risk of excessive data exposure, this module aims to ensure that the agent not only has the ability to interact with the tool but can also be deterministically driven by user prompts to execute specific "source-to-sink" paths. This module achieves the triggering of concrete behavior from abstract logic by transforming static topological paths in the function call graph (FCG) into high-fidelity executable user prompts. The synthesis process employs a two-stage pipeline: call graph path extraction and call edge instantiation, ensuring that the generated prompts are semantically coherent while focusing on fine-grained data items.

[0113] Specifically, the main objective of this step is to extract, in detail, all reachable execution sequences connecting the specified "source" node and the "sink" node from the FCG. The overall algorithm is as follows: Figure 2 As shown.

[0114] (1) Path retrieval algorithm: Based on the function call graph constructed in the previous module, this invention uses the breadth-first search (BFS) algorithm to traverse the entire graph to identify all acyclic paths.

[0115] (2) Validation and Pruning: During the retrieval process, the system verifies the existence of the data source-terminal pair and maintains a queue of explored functional chains. To improve testing efficiency and prevent entering infinite loops, this invention explicitly prunes loop trajectories.

[0116] Output: This stage outputs a series of structured function call sequences, each of which represents a potential data stream channel that requires privacy verification.

[0117] Furthermore, although the extracted paths provide a structured sequence, their essence remains an abstract "skeleton." This stage transforms them into concrete natural language instructions executable by the agent. The instantiation logic comprises the following three key steps:

[0118] (1) Fine-grained segmentation of target assets (i.e., fine-grained data item splitting of target user assets): In user-accessible assets (such as file A or email B), this invention will perform fine-grained labeling of the assets. The system designates a small subset of data items as user intent data (D_int), representing the specific information that the user "formally" requests to be transmitted. The remaining data in the same asset is marked as overexposed candidate data. This segmentation is crucial for creating a controlled testing environment, as the transmission of any candidate data will pose a potential privacy leakage risk. Among them, user intent data (D_int) refers to compliant data that the user explicitly authorizes the agent to transmit for the purpose of realizing core business functions, and is a key reference for distinguishing between business-essential data and overexposed data.

[0119] (2) Abstract chain concatenation: Since each call edge in FCG is generated using a standardized "previous step-next step" semantic template, these abstract prompts can be concatenated naturally. This invention merges the serialized abstract instructions into a logically continuous workflow description (i.e., the integrated content) along the extracted path.

[0120] (3) Semantic Entity Resolution: To ensure the agent can successfully invoke functions, this invention utilizes a Large Language Model (LLM) to resolve abstract placeholders into concrete entities. By providing the LLM with the concatenated path, function metadata, and labeled D_int, the final prompt words (i.e., the set of user prompt words to be executed) are synthesized. This process includes: 1) Entity Binding: Replacing general terms (such as "target file") with specific identifiers (such as "file A"); 2) Intent Data Instantiation: Restricting the task description to only process D_int (e.g., only extracting payment dates).

[0121] In this embodiment, building upon the cross-tool function call graph and labeled target assets constructed earlier, a breadth-first search algorithm is used to traverse the nodes and call edges in the graph layer by layer, starting from a pre-specified data source node. By recording visited nodes, path loops are avoided, and multiple sets of acyclic valid paths from the data source node to the terminal node are accurately extracted. Then, for each acyclic valid path, the core verbs and object entities of the call edges between adjacent nodes are concatenated in the order of the calls to form multiple abstract instructions describing the path flow logic. These abstract instructions are then integrated with user intent data and overexposure candidate data from the labeled target assets to generate integrated content containing path logic and user asset labeling information. Subsequently, the integrated content is input into the referee model, which combines the semantic rationality of the path with the labeling information of the user assets to generate a set of executable user prompts that can be directly executed by the agent. This invention ensures that the extracted paths are acyclic and cover all legal flow possibilities through the breadth-first search algorithm. Combined with the executable prompts generated from the labeled target assets, it can accurately drive the agent to simulate real data flow.

[0122] Step 104: The agent generates the agent runtime log and the data packet to be transmitted to the terminal based on the function corresponding to the pre-specified data source node, the labeled target asset, the set of executable user prompt words, and the full data of the target asset corresponding to the target user asset.

[0123] It should be noted that the agent first loads the function corresponding to the pre-specified data source node, imports the full data of the target asset and the target user asset corresponding to the labeled target asset, and then executes the prompt words in the executable user prompt word set one by one to simulate the data flow process in the real business scenario. It synchronously records various status information (such as function call order, data processing nodes, etc.) during the execution process to generate the agent runtime log, and at the same time captures the data to be transmitted to the outside world output by the terminal node to form the data packet to be transmitted by the terminal.

[0124] Furthermore, step 104 may include the following sub-steps:

[0125] S41. The agent executes each executable user prompt word in the executable user prompt word set one by one to obtain the agent runtime log;

[0126] S42. Based on the user intent data and the full data of the target asset after annotation, determine the data to be marked as tainted;

[0127] S43. Capture the data stream based on the function corresponding to the data source node to obtain the data packet to be transmitted by the terminal.

[0128] The full data of the target assets refers to the complete set of data corresponding to the target user's assets in this privacy leak detection, covering all relevant data items, and serves as the benchmark for marking tainted data.

[0129] Tagged tainted data refers to unauthorized overexposure candidate data identified based on user intent data and full data of the target assets, and is a key monitoring target for subsequent risk assessment.

[0130] It should be noted that, in this stage, the present invention executes synthesized test prompts (i.e., executes user prompts) in a controlled agent runtime environment to reproduce the predetermined execution path. The core of the tracing mechanism lies in the fine-grained annotation of the data obtained by the data source function:

[0131] (1) Taint marking logic: Once the data source function (Source_func) returns the full dataset D_total, the system will identify all data elements that exceed the range of the specified user intent (D_int) and assign them taint labels (marked as target in the tracking log of this invention).

[0132] (2) Multi-observation point capture: To provide a deterministic view of data propagation, this invention captures data packets at three key observation points using the agent's runtime log (AgentTrace):

[0133] Source function (Source_func): Ensures that tainted data and user intent data D_int are properly isolated at the starting point;

[0134] Tool function (Tool_func): Tracks intermediate processing and observes the flow of taint tags between tools;

[0135] Terminal function (Sink_func): Intercepts and logs the final data packet delivered to an external third party to monitor whether taint candidate data persists in the function chain.

[0136] In this embodiment, following the previously generated set of executable user prompts, the agent executes each executable user prompt in the set sequentially, synchronously recording key information such as function call sequences, data processing nodes, and data flow trajectories during the execution of each prompt, and integrating them to form a complete agent runtime log. Combining the clearly defined user intent data (i.e., user-authorized compliant data) in the labeled target asset, and comparing it with the full data of the target asset, the excessively exposed candidate data in the full data that has not been marked as user intent data is identified as tainted data and marked, clarifying the scope of risk data that needs to be monitored. Taking the function corresponding to the pre-specified data source node as the starting point of data flow, the processing and transmission process of data between each function node is tracked throughout the entire process, and finally all data that the terminal node intends to output is captured, forming the data packet that the terminal intends to transmit. This invention provides a real and traceable analytical basis for subsequent screening of necessary data and determination of overexposed data based on majority vote consensus rules by fully recording the operation process of intelligent agents, accurately marking tainted data, and capturing data to be transmitted by terminals. It effectively solves the problems of unclear data flow trajectory and ambiguous definition of risk data in existing detection methods, helps to accurately distinguish between business-necessary data and overexposed data, and thus improves the accuracy of privacy leakage detection reports.

[0137] Step 105: Based on the majority vote consensus rule, the referee model is used to perform data screening and risk assessment based on the data packets to be transmitted by the terminal, the function description documents corresponding to the pre-specified terminal nodes, the user intent data in the labeled target assets, and the full data of the target assets, to generate the necessary data for the function, the overexposed dataset, and the risk assessment results corresponding to the overexposed dataset.

[0138] It should be noted that, based on the majority vote consensus rule, the referee model first loads the function description document corresponding to the pre-specified terminal node, clarifies the core business purpose and necessary data requirements of the terminal node function, and then combines the user intent data (user authorized compliance data) in the labeled target asset and the full data of the target asset to screen the necessity and risk of each data item in the data packet to be transmitted by the terminal. Through multiple rounds of judgment, a consensus result is formed, and finally the necessary data that is strongly related to the business function is selected, the unauthorized and non-business-necessary overexposed dataset is identified, and the risk assessment result corresponding to the overexposed dataset is generated.

[0139] Furthermore, step 105 may include the following sub-steps:

[0140] S51. Based on the data packets to be transmitted by the terminal, the function description documents corresponding to the pre-specified terminal nodes, and user intent data, construct data necessity determination prompt words;

[0141] S52. Input the data necessity determination prompts into the referee model to obtain the necessity determination results of multiple data items;

[0142] S53. Based on the majority vote consensus rule, select the target data item from the data packet to be transmitted by the terminal according to the necessity determination results of multiple data items, and integrate them into functionally necessary data.

[0143] S54. Based on the data packets to be transmitted by the terminal, the necessary data for the function, the user intent data, and the full data of the target assets, output the overexposure dataset.

[0144] S55. Determine the risk of privacy leakage of intelligent agents based on the overexposed dataset, and output the risk assessment results corresponding to the overexposed dataset.

[0145] The function description document corresponding to the pre-specified terminal node refers to the document that records the core business purpose, functional boundaries and required data range of the tool function corresponding to the terminal node, providing the core basis for determining the necessity of data items at the business level.

[0146] The necessity determination result of a data item refers to the judgment conclusion made by the adjudication model on whether a single data item in the data packet to be transmitted by the terminal is "necessary" or "non-necessary". Multiple such results form the basis for subsequent consensus screening.

[0147] Target data items refer to necessary data items that meet business requirements and have been authorized by users, selected based on majority vote consensus rules. They are the basic units that constitute the necessary data for the function.

[0148] Functionally necessary data refers to compliant data that is formed by integrating multiple target data items, is strongly related to the core business functions of the terminal node function, and complies with user authorization. It corresponds to "business-necessary data" in the existing technical issues.

[0149] It should be noted that, in order to determine whether the terminal transmission data D_trans constitutes a violation, this invention implements a multi-model voting consensus mechanism based on global privacy regulations (such as GDPR, CCPA, and PIPL). According to the definition of this invention, if the data falls outside the union of user intent data (D_int) and functionally necessary data (D_nec), it is determined to be excessive exposure.

[0150] (1) Identification of Functional Necessity Data: Although D_int is clearly defined in the prompt word synthesis stage, identifying D_nec requires a deep understanding of the principles of "data minimization" and "least privilege". To this end, this invention provides the transmitted data intercepted by the Sink, the user intent, and the metadata of the Sink function to a committee composed of multiple large language models;

[0151] (2) Multi-model consensus determination: The system uses security specifications extracted according to global privacy guidelines to prompt these models, requiring them to determine whether each data field is strictly necessary for the implementation of the Sink function. The final conclusion on D_nec is reached by a majority vote of the committee, which significantly reduces the bias of a single model and improves the detection accuracy;

[0152] (3) Judgment Conclusion Output: If the final transmitted data D_trans contains elements that do not belong to either D_int or D_nec, this invention will mark it as a risk of excessive data exposure according to the judgment formula D_OE=(D_trans \ (D_nec∪D_int))∩D_total. That is, based on the data packets to be transmitted by the terminal, the functionally necessary data, the user intent data, and the full data of the target assets, the excessive exposure dataset will be output, thereby outputting the detection result. Where \ represents the difference between sets, ∪ represents the union of sets, and ∩ represents the intersection of sets.

[0153] Specifically, based on the captured terminal's intended transmission data packets and related basic data, all data items within the intended transmission data packets are first extracted. Combined with the clearly defined business function requirements in the function description document corresponding to the pre-specified terminal node, and the user intent data (user-authorized compliant data) in the labeled target assets, a complete data necessity judgment prompt word is constructed, containing data item information, business function boundaries, and user authorization scope. This prompt word is input into the adjudication model, which performs multiple rounds of judgment on each data item from both business necessity and user authorization dimensions, obtaining multiple data item necessity judgment results. Based on the majority vote consensus rule, the conclusions of the majority agreement among multiple judgment results are statistically analyzed to filter out target data items in the terminal's intended transmission data packets that meet business requirements and have obtained user authorization. These target data items are then integrated to form functionally necessary data. Subsequently, the terminal's intended transmission data packets are compared with the functionally necessary data. After removing the functionally necessary data, authorized data is excluded based on user intent data, and data ownership is confirmed by comparing with the full data of the target assets. Finally, an unauthorized and non-business-essential over-exposed dataset is output. A risk assessment is performed on the over-exposed dataset, and the corresponding risk assessment result is output. This invention achieves accurate differentiation between functionally necessary data (business-essential data) and overexposed data through hierarchical judgment, consensus screening, and multi-dimensional verification. It solves the core pain point of existing detection methods, which suffer from unclear data differentiation due to the lack of systematic judgment logic. This provides a reliable basis for generating accurate detection reports and effectively improves the accuracy and credibility of the detection results of privacy leaks in intelligent agents.

[0154] Furthermore, step S55 may include the following sub-steps:

[0155] S551. Determine whether the overexposed dataset is an empty set;

[0156] S552. If the overexposed dataset is not an empty set, the risk assessment result is that there is a risk of overexposed data.

[0157] S553. If the overexposed dataset is an empty set, the risk assessment result is no risk of overexposed data.

[0158] It should be noted that an empty set check is performed on the obtained overexposed dataset to determine whether it contains risky data items that are neither functionally necessary nor user-intended data. If the overexposed dataset is not empty, it indicates that the data packet to be transmitted by the terminal contains risky data that exceeds business requirements and user authorization. In this case, the risk assessment result is directly marked as having a risk of data overexposedness. If the overexposed dataset is empty, it indicates that all data in the data packet to be transmitted by the terminal is compliant data that meets business requirements and has been authorized by the user, and there is no risky data that exceeds the scope. In this case, the risk assessment result is marked as having no risk of data overexposedness. This invention, through the explicit judgment logic of the empty set check, directly links the existence of the overexposed dataset with the risk conclusion, providing a clear result output for privacy leakage detection and further strengthening the ability to distinguish between business-necessary data and overexposed datasets.

[0159] Step 106: Integrate the set of executable user prompts, the set of loop-free valid paths, the labeled target assets, user intent data, necessary functional data, data packets to be transmitted by the terminal, agent runtime logs, overexposure datasets, and risk assessment results to generate a data overexposure detection report.

[0160] It should be noted that, following the logical sequence of the detection process, the executable user prompt word set, the set of loop-free valid paths, the labeled target assets, user intent data, functionally necessary data, the data packets to be transmitted by the terminal, the agent's runtime logs, the overexposure dataset, and the risk assessment results are structurally integrated. First, the background and input basis of this detection are outlined; then, the data flow path and driving instructions are presented; next, the core processes of data labeling, filtering, and judgment are demonstrated; finally, the risk conclusions and key evidence are clarified, forming a complete data overexposure detection report that includes the detection background, flow path, data judgment, and risk results. This invention, by integrating the core data and judgment results of the entire process, makes the detection report traceable and complete, solving the problems of fragmented information and insufficient evidence in existing detection methods. It also clearly presents the distinction between business-necessary data and overexposure data, further improving the accuracy and credibility of privacy leakage detection reports and providing a clear reference for subsequent privacy compliance rectification.

[0161] For comparison of technical effectiveness, existing technologies can be referenced. Currently, academia and industry mainly use two types of solutions to audit the privacy and security of software systems. The first type is traditional program analysis methods, including static taint tracing and dynamic flow analysis techniques. For example, some research constructs control flow graphs (CFGs) by analyzing the source code or bytecode of applications and tracing the transmission path of sensitive information from the source to the sink. In the traditional Web API security field, some research also focuses on how to detect over-sharing issues in API return results through schema definitions. These methods perform well when dealing with traditional software with deterministic logic, but have significant limitations when facing LLMAgent: because the execution path of the agent is dynamically generated by internal model reasoning rather than predefined hard-coded logic, traditional tools struggle to capture this "semantic-driven" data flow.

[0162] The second category of solutions focuses on automated auditing and security detection frameworks for large language models and their ecosystems. For example, some research addresses privacy breaches induced by malicious prompts, using adversarial testing to assess agent security during attacks. Additionally, some recent work attempts to leverage large models as a judge (LLM-as-a-Judge), combining predefined privacy policy documents to audit agent behavior for consistency. While these solutions possess some semantic understanding capabilities, they still have shortcomings in complex, multi-step tool invocation scenarios: First, most existing solutions employ a "black-box testing" model, making it difficult to systematically traverse the agent's potential deep call chains; second, these methods typically lack deterministic activation mechanisms for data flow paths, failing to accurately trigger deep privacy violations in specific scenarios; finally, in the judgment phase, existing solutions often lack fine-grained privacy guidelines, making it difficult to accurately distinguish between "business-essential data" and "overexposed data."

[0163] Existing research still faces significant challenges in addressing the problem of excessive data exposure in LLM agents. Therefore, there is an urgent need to propose a method that can integrate structured path mapping, deterministic risk triggering, and fine-grained semantic auditing to support in-depth assessment of privacy compliance in cross-tool calls to LLM agents.

[0164] In summary, existing research has made several valuable attempts in program security analysis and agent privacy auditing, but these works still have significant limitations in addressing the risk of excessive data exposure in Large Language Model Agents (LLM Agents):

[0165] (1) Mismatch of traditional program analysis tools: Existing static and dynamic analysis tools (such as control flow graph analysis, traditional taint tracking, etc.) are mainly designed for deterministic program paths. However, the data flow of an agent is dynamically arranged by the internal reasoning and planning of a large model. This non-deterministic "semantic dependency" is invisible to traditional tools that lack semantic understanding capabilities.

[0166] (2) Limitations of the existing audit framework in triggering and coverage: Current LLM security testing mostly adopts black-box or adversarial testing modes, lacking a structured mapping of the agent's functional execution space. This makes it difficult for the detection process to systematically traverse multi-hop, deep tool call chains, and cannot guarantee the coverage and deterministic triggering of potential leakage paths under complex business logic.

[0167] (3) Ambiguity in privacy boundary judgment criteria: Existing methods often lack fine-grained distinction between "user intent" and "functional necessity" when judging privacy breaches. The lack of a mechanism to transform legal regulations (such as the principle of data minimization) into calculable indicators makes it difficult to accurately identify excessively exposed data that, although generated by legitimate tools, actually exceeds the scope required for the task.

[0168] To address the aforementioned shortcomings and deficiencies, this invention provides a method for detecting privacy leaks in intelligent agent systems. It aims to solve the problem of deep privacy leaks caused by overly broad tool design paradigms and model inference filtering failures in complex task chains, particularly addressing the pain points that traditional security detection tools struggle to handle, such as the strong concealment of multi-hop function call chains and the non-deterministic nature of execution processes. To this end, this invention constructs a scene-aware cross-scene function call graph (FCG) by statically extracting tool metadata and scene semantics. This transforms the non-deterministic model planning space into a structured path mapping, explicitly mapping fine-grained data flow dependencies across tools, thereby achieving a systematic traversal of deeply hidden paths. Building upon this foundation, fine-grained prompt word synthesis technology generates test cases that precisely drive models into specific high-risk execution states, activating potential risk paths and ensuring the reproducibility and monitorability of data flow in complex tool call chains. Furthermore, a multi-model voting consensus mechanism based on global privacy guidelines is introduced, combined with runtime dynamic taint tracking. Through comparative analysis of user intent, tool requirements, and actual transmitted data, a high-precision compliance judgment pipeline is established. This effectively identifies and quantifies the risk of sensitive data transmission deviating from user intent during agent execution, ultimately achieving precise definition of "necessary data" and "overexposed data." Thus, this invention provides an automated, high-coverage, and privacy-compliant security auditing method for the LLM Agent ecosystem, offering a systematic automated auditing solution for building a trustworthy and compliant agent ecosystem.

[0169] Specifically, such as Figure 3 As shown, this invention mainly consists of three core modules: (a) intelligent agent cross-scenario data flow analysis, used to extract potential calling logic across scenarios and between tools; (b) cross-tool call chain user prompt word synthesis, used to transform abstract paths into executable test cases; and (c) data overexposure detection, used to track sensitive data flows and make compliance judgments at runtime.

[0170] The workflow of this invention is as follows: First, a scene-aware function call graph (FCG) is constructed through static analysis and semantic reasoning to identify all potential paths from the data source (Source) to the destination (Sink). Next, based on path information and a user asset database, fine-grained user prompts that can trigger specific call chains are synthesized, and the intent data for user authorization is explicitly defined. Subsequently, the prompts are executed in a controlled intelligent agent operating environment, and a taint tracking mechanism is used to record the flow of data at each tool node. Finally, by integrating a multi-model voting mechanism and combining it with privacy regulations, the transmitted data is audited, ultimately outputting an overexposure detection report.

[0171] In summary, this invention constructs a complete privacy leakage detection system for intelligent agents through the synergistic effect of three core technologies: First, by constructing a scene-aware function call graph (FCG) and a structured path mapping mechanism, it extracts tool metadata and combines it with model semantic reasoning to address the nondeterministic and dynamic programming characteristics of intelligent agent tool calls. This transforms the abstract planning space into a structured function call graph, enabling a systematic traversal of potential deep call chains and hidden paths of intelligent agents. This effectively solves the problem of insufficient coverage of privacy risk points under complex business logic by traditional black-box auditing methods. Second, based on this function call graph, through intent-driven fine-grained prompt word synthesis and deterministic risk triggering technology, it dynamically integrates FCG paths with the user asset library to synthesize highly guiding, high-fidelity test prompt words. Simultaneously, the synthesis process introduces a precise distinction between intent data (D_int) and overexposed candidate data, establishing a strict privacy boundary for agent execution and ensuring the deterministic activation and reproducibility of deep privacy violations in multi-hop tool call chains. Finally, relying on dynamic taint tracking and multi-model consensus compliance judgment pipelines, a multi-observation point operation trajectory capture mechanism covering "source-tool-terminal" is established. Dynamic taint labeling technology is used to track the flow status of sensitive data in the agent system in real time, and multi-model voting consensus judgment based on privacy specifications such as GDPR, CCPA, and PIPL is introduced. By accurately defining functionally necessary data (D_nec), semantic-level false alarms are effectively eliminated, ultimately achieving quantitative assessment and automated auditing of data overexposure risks.

[0172] Compared with existing technologies, this invention integrates scene-aware function call graph (FCG) construction, intent-driven deterministic prompt word synthesis, and a dynamic taint auditing mechanism based on multi-model consensus. In contrast, existing technologies mainly rely on traditional program analysis tools or black-box adversarial testing for large models. The former cannot handle the non-deterministic "semantic-driven" data flow of agents, while the latter is difficult to systematically traverse deep call chains and has ambiguous judgment criteria, resulting in low detection coverage and high false positive rates. The advantages of this invention are specifically reflected in the following three aspects: Specifically, it has stronger hidden path coverage capabilities. Traditional static analysis tools are limited by hard-coded control flow and cannot identify the inter-tool logical dependencies dynamically generated by large language models. However, this invention, by constructing a scene-aware function call graph (FCG), transforms the non-deterministic model planning space into a structured path mapping, thereby systematically discovering privacy leakage risks hidden deep within complex toolchains; secondly, the detection process is more... Automation and determinism: Existing technologies often rely on random sampling or manually written prompts when testing agents, leading to the randomness of triggering leakage behaviors. This invention, through intent-driven fine-grained prompt synthesis technology, can generate test payloads that precisely drive agents into specific high-risk paths, realizing a fully automated pipeline from path discovery to risk triggering to compliance determination. This significantly improves the reproducibility of detection results and the integrity of the evidence chain while ensuring audit efficiency. Finally, its semantic auditing accuracy is higher. Existing large-model security auditing solutions often lack fine-grained standards when judging privacy leaks, making it difficult to distinguish between normal business data and excessively exposed data. This invention introduces a dynamic taint propagation algorithm and a multi-model voting consensus mechanism for large-model agents. It can accurately define functionally necessary data (D_nec) in conjunction with global privacy regulations, effectively identifying sensitive information transmitted through legitimate tool interfaces but exceeding the scope of user intent, and further accurately detecting privacy leaks.

[0173] In this embodiment of the invention, a method for detecting privacy leaks in intelligent agents is provided. The method involves acquiring an intelligent agent toolset and target user assets, and using a referee model and predefined type compatibility rules to construct a call graph based on the intelligent agent toolset, generating a cross-tool function call graph. The target user assets are then split into fine-grained data items to obtain labeled target assets. A breadth-first search algorithm is used to integrate data based on the cross-tool function call graph, labeled target assets, and pre-specified data source nodes and terminal nodes, outputting a set of executable user prompts and a set of acyclic valid paths. The intelligent agent generates runtime logs and terminal-to-be-transmitted data packets based on the functions corresponding to the pre-specified data source nodes, labeled target assets, the set of executable user prompts, and the full data of the target assets corresponding to the target user assets. Based on majority vote consensus rules, a referee model is used to perform data filtering and risk assessment based on the terminal-to-be-transmitted data packets, the function description documents corresponding to the pre-specified terminal nodes, user intent data in the labeled target assets, and the full data of the target assets, generating functionally necessary data packets. The data, the overexposed dataset, and the corresponding risk assessment results are integrated to generate an overexposed data detection report. Based on this approach, the invention constructs a call graph using predefined type compatibility rules and a referee model, ensuring a structured mapping of call logic between agent tools. This is achieved by accurately extracting acyclic valid paths using a breadth-first search algorithm, laying a clear foundation for subsequent data flow tracking. Fine-grained segmentation and labeling of target user assets clarifies the boundaries of user intent data, providing a core basis for distinguishing data types. Utilizing majority vote consensus rules, combined with terminal node function descriptions, user intent data, and full target asset data, multi-dimensional judgments are made to accurately filter out functionally necessary data, thereby clarifying the scope of overexposed data and distinguishing between "business-essential data" and "overexposed data," thus improving the accuracy of the privacy leak detection report.

[0174] Please see Figure 4 , Figure 4 This is a structural block diagram of a detection system for privacy leakage of intelligent agents provided in Embodiment 2 of the present invention.

[0175] This invention provides a detection system for privacy leaks of intelligent agents, comprising:

[0176] The acquisition module 401 is used to acquire the agent toolset and target user assets, and to construct a call graph based on the agent toolset using a referee model and predefined type compatibility rules to generate a cross-tool function call graph;

[0177] The splitting module 402 is used to perform fine-grained data item splitting on the target user's assets to obtain the labeled target assets;

[0178] Output module 403 is used to integrate data based on cross-tool function call graph, labeled target assets, and pre-specified data source nodes and terminal nodes using a breadth-first search algorithm, and output a set of executable user prompt words and a set of acyclic valid paths.

[0179] The generation module 404 is used to generate the agent runtime log and the terminal to be transmitted data packet by the agent based on the function corresponding to the pre-specified data source node, the labeled target asset, the set of executable user prompt words and the full data of the target asset corresponding to the target user asset.

[0180] The filtering and judgment module 405 is used to filter and judge data based on the majority vote consensus rule and the judge model, according to the data packet to be transmitted by the terminal, the function description document corresponding to the pre-specified terminal node, the user intent data in the labeled target asset, and the full data of the target asset, and to generate the functional necessary data, the overexposed dataset, and the risk assessment results corresponding to the overexposed dataset.

[0181] The integration module 406 is used to integrate the executable user prompt word set, the acyclic valid path set, the labeled target assets, user intent data, functionally necessary data, the data packets to be transmitted by the terminal, the agent runtime log, the over-exposure dataset, and the risk assessment results to generate a data over-exposure detection report.

[0182] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the system and modules described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0183] This invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program; when the computer program is executed by the processor, the processor performs the steps of the detection method for privacy leakage of intelligent agents as described in the above embodiments.

[0184] This invention also provides a computer-readable storage medium storing a computer program / instructions thereon, which, when executed by a processor, implements the steps of the method for detecting privacy leakage of intelligent agents as described in the above embodiments.

[0185] This invention also provides a computer program product, including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, wherein when the program instructions are executed by a computer, the computer performs the steps of the detection method for privacy leakage of intelligent agents as described in the above embodiments.

[0186] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0187] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0188] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0189] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0190] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting privacy leaks in intelligent agents, characterized in that, include: Acquire the intelligent agent toolset and target user assets, and construct a call graph based on the intelligent agent toolset using a referee model and predefined type compatibility rules to generate a cross-tool function call graph; The target user assets are then broken down into fine-grained data items to obtain the labeled target assets. A breadth-first search algorithm is used to integrate data based on the cross-tool function call graph, the labeled target assets, and pre-specified data source nodes and terminal nodes, outputting a set of executable user prompts and a set of acyclic valid paths, including: The breadth-first search algorithm is used to traverse the cross-tool function call graph to extract multiple sets of acyclic valid paths from the data source node to the terminal node; The core verbs and objects corresponding to adjacent nodes in each acyclic effective path in the set of acyclic effective paths are concatenated to obtain multiple call edge abstract instructions, which are then integrated with the labeled target assets to obtain the integrated content. The integrated content is input into the referee model to generate a set of executable user prompt words; The agent generates runtime logs and data packets to be transmitted by the terminal based on the functions corresponding to the pre-specified data source nodes and the set of executable user prompts. Based on the majority vote consensus rule, the referee model uses the data packets to be transmitted by the terminal, the function description document corresponding to the pre-specified terminal node, the user intent data in the labeled target asset, and the full data of the target asset to perform data filtering and risk assessment, generating functionally necessary data, an overexposed dataset, and risk assessment results corresponding to the overexposed dataset, including: Based on the data packet to be transmitted by the terminal, the function description document corresponding to the pre-specified terminal node, and the user intent data, construct data necessity determination prompt words; The necessary data determination prompts are input into the referee model to obtain necessary data determination results for multiple data items; Based on the majority vote consensus rule, target data items are selected from the data packets to be transmitted by the terminal according to the necessity determination results of multiple data items, and integrated into functionally necessary data. Based on the data packets to be transmitted by the terminal, the necessary data for the function, the user intent data, and the full data of the target asset, an overexposure dataset is output. Based on the overexposed dataset, the risk of privacy leakage of the intelligent agent is determined, and the risk assessment result corresponding to the overexposed dataset is output. The executable user prompt set, the acyclic valid path set, the labeled target assets, the user intent data, the functionally necessary data, the data packets to be transmitted by the terminal, the agent runtime logs, the overexposure dataset, and the risk assessment results are integrated to generate a data overexposure detection report.

2. The method for detecting privacy leakage of intelligent agents according to claim 1, characterized in that, The process of constructing a call graph based on the agent toolset using a referee model and predefined type compatibility rules to generate a cross-tool function call graph includes: Traverse the function list of the intelligent agent toolset to generate multiple ordered function pairs; Extract the return value type of the predecessor function in each ordered function pair and the input parameter type of the target function in each ordered function pair; Based on the return value type and input parameter type of each ordered function pair, the ordered function pairs are filtered for type compatibility according to the predefined type compatibility rules to obtain multiple type-compatible ordered function pairs; For each type-compatible ordered function pair, construct semantic verification prompts and input each semantic verification prompt into the adjudication model to obtain the judgment result corresponding to each type-compatible ordered function pair; Any type-compatible ordered function pair whose judgment result is yes is considered a semantically coherent legal function pair. Extract the core verbs and object entities of each semantically coherent legal function pair, and generate call edges; Map each tool function in the intelligent agent toolset to a node, and set a virtual entry node; By integrating multiple nodes, the virtual entry node, and the call edge, a cross-tool function call graph is constructed.

3. The method for detecting privacy leakage of intelligent agents according to claim 1, characterized in that, The process of generating an agent runtime log and a data packet to be transmitted by the terminal based on the function corresponding to the pre-specified data source node and the executable user prompt word set includes: The agent executes each executable user prompt word in the executable user prompt word set one by one to obtain the agent runtime log; Data stream capture is performed based on the function corresponding to the data source node to obtain the data packet to be transmitted by the terminal.

4. The method for detecting privacy leakage of intelligent agents according to claim 1, characterized in that, The process of determining the privacy leakage risk of the intelligent agent based on the overexposed dataset and outputting the risk assessment result corresponding to the overexposed dataset includes: Determine whether the overexposed dataset is an empty set; If the overexposed dataset is not an empty set, then the risk assessment result is that there is a risk of overexposed data. If the overexposed dataset is an empty set, then the risk assessment result is no risk of overexposed data.

5. A detection system for privacy leakage of intelligent agents, applied to the detection method for privacy leakage of intelligent agents as described in claim 1, characterized in that, include: The acquisition module is used to acquire the intelligent agent toolset and target user assets, and to construct a call graph based on the intelligent agent toolset using a referee model and predefined type compatibility rules to generate a cross-tool function call graph; The splitting module is used to perform fine-grained data item splitting on the target user assets to obtain the labeled target assets; The output module is used to integrate data based on the cross-tool function call graph, the labeled target assets, and the pre-specified data source nodes and terminal nodes using a breadth-first search algorithm, and output an executable user prompt word set and an acyclic valid path set; The generation module is used to generate the agent runtime log and the terminal to be transmitted data packet by the agent based on the function corresponding to the pre-specified data source node and the executable user prompt word set. The filtering and judgment module is used to perform data filtering and risk judgment based on the majority vote consensus rule and the judge model according to the data packet to be transmitted by the terminal, the function description document corresponding to the pre-specified terminal node, the user intent data in the labeled target asset, and the full data of the target asset, and to generate functionally necessary data, over-exposed dataset, and risk assessment results corresponding to the over-exposed dataset. The integration module is used to integrate the executable user prompt word set, the acyclic valid path set, the labeled target assets, the user intent data, the functionally necessary data, the data packets to be transmitted by the terminal, the agent runtime log, the overexposure dataset, and the risk assessment results to generate a data overexposure detection report.

6. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the detection method for privacy leakage of intelligent agents as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the method for detecting privacy leaks of intelligent agents as described in any one of claims 1-4.

8. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, wherein when the program instructions are executed by a computer, the computer performs the steps of the method for detecting privacy leaks of intelligent agents as described in any one of claims 1-4.

Images