Pith. sign in

REVIEW 4 major objections 5 minor 43 references

An adaptive randomized negotiation policy can hide private budgets from offer trajectories while still reaching agreement and preserving utility.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-10 20:44 UTC pith:ROF2MUC7

load-bearing objection Real side-channel problem and a usable adaptive-noise template, but the formal DP theorem does not cover the private-θ clipping used in the reported experiments. the 4 major comments →

arxiv 2607.06815 v1 pith:ROF2MUC7 submitted 2026-07-07 cs.CR

Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies

Barkha Rani This is my paper
classification cs.CR
keywords differential privacyautonomous agentsnegotiationside-channel attacksbehavioral privacyrandomized policiesoffer trajectories
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Cryptographic protections stop a counterparty from reading an agent’s private budget directly, but the shape of the concession path, timing, and number of rounds still leak that budget. This paper formalizes that side channel as behavioral differential privacy over sequences of offers and supplies a practical countermeasure: phase-adaptive Gaussian noise that is large early (when trajectories are most revealing) and shrinks near the deadline, followed by a deterministic safety clip that keeps every offer feasible. The same policy is proved to converge almost surely whenever the counterparty’s reservation value allows agreement, and to lose at most a quadratic term in the peak noise level relative to a deterministic baseline. On three thousand synthetic bilateral negotiations the mechanism cuts adversarial recovery of the private constraint by roughly half while keeping success rate and Nash surplus above ninety percent. The result shows that privacy, convergence, and utility can be obtained together rather than traded off.

Core claim

An adaptive stochastic negotiation policy that injects phase-dependent Gaussian noise and then clips for feasibility jointly satisfies (ε,δ)-differential privacy over observable offer traces (under a public-proxy clipping assumption), almost-sure convergence of the offer sequence when the counterparty’s reservation permits, and high negotiation utility; on 3,000 synthetic bilateral negotiations it reduces adversarial constraint-inference accuracy by 43–50 percent while keeping success rate and Nash surplus above 90 percent.

What carries the argument

The adaptive noise schedule σ_t = σ_max · (1 − t/T)^β together with a deterministic safety critic that clips each noisy offer into a feasible interval; the schedule concentrates randomization early, the critic restores feasibility, and the post-processing theorem carries the privacy guarantee through the clip.

Load-bearing premise

The formal privacy proof assumes the safety critic clips offers to a public ceiling that does not depend on the agent’s private budget; the experiments instead clip to the private budget itself.

What would settle it

Replace private-budget clipping with public-proxy clipping in the same 3,000-negotiation suite and re-train the three adversary models; if inference accuracy then rises back near the non-private baseline while success rate stays above 90 percent, the claimed joint privacy-utility guarantee fails under the evaluated configuration.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper formalizes behavioral privacy leakage in multi-round autonomous negotiation: private constraints (e.g., budgets) can be inferred from observable offer trajectories even when explicit values are cryptographically protected. It proposes an adaptive stochastic policy that adds phase-dependent Gaussian noise to a deterministic concession baseline, then applies a feasibility safety critic. The authors claim joint (ε,δ)-DP over offer traces (under a public-proxy clipping assumption), almost-sure convergence when the counterparty’s reservation permits, and an O(σ²_max) utility loss bound. On 3,000 synthetic bilateral negotiations, the mechanism reduces XGBoost/RF/NN inference accuracy by roughly 43–50% while reporting ≥90% success rate and Nash surplus at or above the non-private baseline.

Significance. Behavioral side channels in agentic negotiation are a timely and under-addressed problem as LLM agents enter insurance, procurement, and similar high-stakes settings. Framing the problem as DP over constraint-space adjacency and offer-trace distributions is a useful conceptual contribution, and the adaptive noise schedule plus safety critic is a concrete, implementable design. The empirical attack reductions (Table 2) and the explicit convergence/utility theorems (Theorems 2–3) give the work substance beyond a pure threat note. If the formal–empirical gap on clipping is closed and evaluation is strengthened, this would be a solid systems/security contribution complementary to cryptographic negotiation protocols.

major comments (4)
  1. [Theorem 1, Remark after Theorem 1; Algorithm 1 / Eq. (5); Sec. 7.3] Theorem 1 and its Remark condition the end-to-end (ε,δ)-DP certificate on clipping to a public proxy ceiling θ̄ ≥ θ independent of the private constraint, so that post-processing preserves privacy. Algorithm 1, Eq. (5), Sec. 4.4, and all reported experiments instead clip to private θ. Sec. 7.3 correctly notes that private-θ clipping can itself leak the ceiling. The joint claim that the evaluated mechanism “guarantees (ε,δ)-DP” therefore does not hold under the stated theorem; either re-evaluate with public-proxy clipping, or supply the refined adjacency analysis left to future work so the formal certificate covers the system whose attack and utility numbers are reported.
  2. [Sec. 5.1, Tables 2–4, Sec. 7.5] The 3,000 traces are generated from the same deterministic concession family used as the non-private baseline (Eq. 2, Sec. 5.1), with adversaries trained on that family. This risks overstating the 43–50% inference drop (Table 2) relative to more heterogeneous real concession behavior. At minimum, report results under alternative generative concession models (e.g., time-dependent, opponent-reactive, or non-power-law schedules) and include bootstrap CIs or seed variance for Tables 2–4; Sec. 7.5 already flags the latter as planned.
  3. [Sec. 4.5, Eqs. (6)–(7); Remark (Practical Floor on σ_t); Sec. 6.4] Privacy accounting is incomplete for the claimed certificate. Eq. (7) uses the conservative approximation ε_t = Δ/σ_t rather than the standard Gaussian calibration; the schedule drives σ_t → 0, and only a practical floor σ_min = 0.05 is mentioned in a remark. Advanced composition is cited but not clearly applied to any reported ε, and Sec. 6.4 acknowledges that ε_total may be large. For the formal half of the joint claim to be meaningful, report concrete (ε,δ) under advanced/Rényi composition for the experimental (T, σ_max, σ_min) settings, and state whether those budgets are the ones corresponding to Tables 2–4.
  4. [Sec. 3.3; Eq. (2); Tables 3–4; Theorem 3; Sec. 5.4] Nash surplus is defined as NS = o_T / θ (Sec. 3.3) and treated as a quantity to maximize (Tables 3–4, Theorem 3). Under the buyer-style concession of Eq. (2) and the insurance example (offers increasing toward a private budget), higher o_T/θ means a worse deal for the protected agent. The reported rise in NS with σ_max is then hard to interpret as “utility,” and the asymmetric-clipping explanation (Sec. 5.4) does not resolve the direction of preference. Clarify agent role (buyer vs seller), redefine surplus consistently with that role (e.g., (θ − o_T)/θ for a buyer), and restate utility goals and Theorem 3 accordingly.
minor comments (5)
  1. [Table 1, Sec. 2.3] Table 1 marks “Standard DP” as protecting explicit data and only “Partial” behavioral privacy; a one-sentence justification in Sec. 2.3 would help, since classical DP does not target negotiation traces.
  2. [Figs. 1–3, Sec. 5.3] Figures 1–3 are described in captions but the manuscript text does not always map axes/units (e.g., whether accuracy is tolerance-based |θ̂−θ|<0.05) back to the figure panels; add that mapping in the figure notes.
  3. [Sec. 4.7] The multi-issue extension (Sec. 4.7) is only sketched; either move it fully to future work or give a minimal sensitivity/covariance construction so it does not read as an unsubstantiated claim.
  4. [Sec. 3–4] Minor notation: Δ is both adjacency bound and sensitivity; T is both max rounds and (implicitly) horizon in composition. A short notation table would reduce ambiguity.
  5. [Sec. 2] Related work on MAGPIE [22] and concurrent device-native negotiation [35] is appropriately cited; ensure arXiv identifiers and any camera-ready updates remain consistent.

Circularity Check

0 steps flagged

No circularity: theorems are standard Gaussian DP + composition + post-processing applied to a novel adjacency; empirical attack reductions are measured by separate ML models, not forced by construction or self-citation.

full rationale

The derivation chain does not reduce any claimed result to its inputs by construction. Theorem 1 invokes the ordinary Gaussian mechanism (noise scale σ_t, sensitivity Δ) plus sequential composition and the post-processing theorem under an explicit public-proxy clipping assumption; the algebra is the textbook one and does not redefine ε in terms of the target privacy metric. Theorems 2–3 likewise follow from Borel–Cantelli and a second-order Taylor expansion of Nash surplus; neither equates the conclusion to a fitted quantity. Empirically, adversaries (XGBoost, RF, NN) are trained on deterministic baseline traces and evaluated on independent randomized traces; the 43–50 % drop is a measured accuracy difference, not a parameter fitted on the same data and then re-labeled a prediction. The choice σ_max = 0.25 is disclosed via ablation (Table 4) under an explicit utility constraint; it is ordinary hyper-parameter selection, not a self-definitional loop. Synthetic data are generated from the baseline concession family (Eq. 2) solely to create a controlled simulation; this is a modeling choice, not a circular derivation. No load-bearing self-citations, uniqueness theorems imported from the same authors, or ansatz smuggled via prior work appear. The acknowledged mismatch between the public-proxy hypothesis of Theorem 1 and the private-θ clipping used in experiments is a scope gap, not circularity. The paper is therefore self-contained against its own stated benchmarks.

Axiom & Free-Parameter Ledger

6 free parameters · 6 axioms · 2 invented entities

The central claim rests on standard DP composition and Gaussian mechanism theorems, a domain model of bilateral concession, and several paper-specific modeling choices (phase-adaptive noise, private clipping in experiments, synthetic data generator, hand-chosen σ_max/β/floor). Formal DP further requires a public-proxy clip not used empirically. No new physical entity is postulated; the ‘safety critic’ and ‘behavioral DP’ framing are definitional constructs for the mechanism.

free parameters (6)
  • σ_max = 0.25 (primary reported setting)
    Peak noise level; primary privacy–utility knob. Ablation Table 4; σ_max=0.25 selected as best balance for the 43–50% inference reduction claim.
  • β (noise decay exponent)
    Controls how fast σ_t shrinks with t/T in Eq. (3); shapes early vs late privacy cost and convergence.
  • α (baseline concession exponent)
    Shapes deterministic offer path Eq. (2); defines the non-private trajectory adversaries learn from.
  • T (max rounds) = 3 (example in Remark on σ floor)
    Horizon for composition and noise schedule; example accounting uses T=3 with σ floor.
  • Δ (adjacency / sensitivity) = 1.0
    Global sensitivity set to 1.0 for unit adjacency on constraint space; drives ε_t=Δ/σ_t.
  • σ_min (noise floor) = 0.05
    Practical floor so final-round ε_t stays finite when schedule would hit σ_T=0; used in all reported experiments.
axioms (6)
  • standard math Gaussian mechanism and sequential/advanced composition yield (ε,δ)-DP for the noisy offer map under bounded sensitivity Δ.
    Invoked in Sec. 4.5 and Theorem 1 via Dwork–Roth-style arguments.
  • standard math Post-processing: deterministic clipping of noisy offers does not increase the DP privacy loss when the clip bound is independent of private θ.
    Used to carry privacy through the safety critic (Sec. 4.4, Theorem 1).
  • ad hoc to paper Safety critic clips to a public proxy ceiling θ̄ ≥ θ (not private θ) for the formal end-to-end DP certificate.
    Explicit assumption of Theorem 1; experiments instead clip to private θ.
  • domain assumption Bilateral single-issue negotiation with monotonic concession baseline and passive adversary observing full offer/timing traces.
    Threat model Sec. 3 and problem formulation Sec. 4.1; multi-issue left future.
  • domain assumption Synthetic offer dynamics from literature-inspired parameters adequately stand in for real procurement/insurance negotiations for attack evaluation.
    Sec. 5.1 justifies 3,000 synthetic negotiations in place of scarce real logs.
  • domain assumption Almost-sure convergence when σ_max < θ − o_min and counterparty reservation lies in [o_min, θ].
    Theorem 2 conditions; empirical 90.4% success interpreted as fraction where condition holds.
invented entities (2)
  • Behavioral differential privacy (constraint-space adjacency over offer-trace distributions) no independent evidence
    purpose: Name and formalize DP adjacency on private budgets/constraints rather than datasets, applied to sequential negotiation traces.
    Contribution 1; standard DP applied with a novel adjacency domain, not a new physical object.
  • Phase-adaptive negotiation noise schedule σ_t = σ_max(1−t/T)^β plus safety critic no independent evidence
    purpose: Calibrate randomization by round and restore feasibility while aiming to preserve DP via post-processing.
    Core mechanism Sec. 4.3–4.4; engineering construct evaluated only inside this paper’s simulations.

pith-pipeline@v1.1.0-grok45 · 15606 in / 4125 out tokens · 46374 ms · 2026-07-10T20:44:00.954704+00:00 · methodology

0 comments
read the original abstract

Autonomous negotiation agents are increasingly deployed in high-stakes settings such as insurance and procurement. While cryptographic techniques protect explicitly disclosed constraint values, they fail to address a subtler threat: behavioral privacy leakage, where an adversary infers private constraints from observable negotiation dynamics such as concession trajectories, timing, and convergence patterns. This paper investigates behavioral differential privacy in multi-round negotiation protocols. We design an adaptive stochastic negotiation policy that jointly guarantees $(\varepsilon, \delta)$-differential privacy, almost-sure convergence of the offer sequence (reaching agreement when the counterparty's reservation value permits), and high negotiation utility. Evaluated on 3,000 synthetic bilateral negotiations, our mechanism reduces adversarial inference accuracy by 43-50% while maintaining a negotiation success rate and utility above 90%, demonstrating that strong privacy guarantees can be achieved without significant loss of performance.

Figures

Figures reproduced from arXiv: 2607.06815 by Barkha Rani.

Figure 1
Figure 1. Figure 1: Privacy budget analysis. Top-left: ε vs utility. Top-right: ε vs adversary accu￾racy. Bottom-left: Privacy-utility Pareto frontier. Bottom-right: ε vs negotiation success rate [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Experimental results. Top-left: Privacy-utility tradeoff. Top-right: Adversary model comparison under baseline and randomized policies. Bottom-left: Multi-metric comparison across privacy settings. Bottom-right: Privacy vs convergence speed. Theorem 1 (Behavioral Differential Privacy). Assume the safety critic clips offers to a public proxy ceiling ¯θ ≥ θ rather than to the private constraint θ itself. The… view at source ↗
Figure 3
Figure 3. Figure 3: Privacy budget composition analysis. Top-left: Total privacy budget accumu￾lation under different composition theorems. Top-right: Adaptive vs fixed per-round privacy cost. Bottom-left: Adaptive noise decay σt = σmax(1 − t/T) β for different β. Bottom-right: Comparison of composition theorems across round counts. Proof. The Nash surplus is a smooth function of the final agreed value. By Taylor expansion ar… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

43 extracted references · 43 canonical work pages · 3 internal anchors

  1. [1]

    In: CCS (2016)

    Abadi, M., et al.: Deep learning with differential privacy. In: CCS (2016)

    work page 2016

  2. [2]

    AgentSims: An Open-Source Sandbox for Large Language Model Evaluation

    Abdelnabi, S., et al.: LLM-powered multi-agent systems. arXiv preprint arXiv:2308.04026 (2023)

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  3. [3]

    Autonomous Agents and Multi-Agent Systems (2016)

    Baarslag, T., et al.: Learning about the opponent in automated bilateral negotia- tion. Autonomous Agents and Multi-Agent Systems (2016)

    work page 2016

  4. [4]

    In: FOCS (2011)

    Brakerski, Z., Vaikuntanathan, V.: Efficient fully homomorphic encryption from LWE. In: FOCS (2011)

    work page 2011

  5. [5]

    In: USENIX Security (2003)

    Brumley, D., Boneh, D.: Remote timing attacks are practical. In: USENIX Security (2003)

    work page 2003

  6. [6]

    In: USENIX Security (2021)

    Carlini, N., et al.: Extracting training data from large language models. In: USENIX Security (2021)

    work page 2021

  7. [7]

    In: ICLR (2023)

    Carlini, N., et al.: Quantifying memorization across neural language models. In: ICLR (2023)

    work page 2023

  8. [8]

    In: USENIX Security (2024)

    Debenedetti, E., et al.: Privacy side channels in machine learning systems. In: USENIX Security (2024)

    work page 2024

  9. [9]

    Founda- tions and Trends in Theoretical Computer Science (2014)

    Dwork, C., Roth, A.: The algorithmic foundations of differential privacy. Founda- tions and Trends in Theoretical Computer Science (2014)

    work page 2014

  10. [10]

    In: TCC (2006)

    Dwork, C., et al.: Calibrating noise to sensitivity in private data analysis. In: TCC (2006)

    work page 2006

  11. [11]

    In: EUROCRYPT (2006)

    Dwork, C., et al.: Our data, ourselves: Privacy via distributed noise generation. In: EUROCRYPT (2006)

    work page 2006

  12. [12]

    In: FOCS (2010)

    Dwork, C., et al.: Boosting and differential privacy. In: FOCS (2010)

    work page 2010

  13. [13]

    In: CCS (2015)

    Fredrikson, M., et al.: Model inversion attacks that exploit confidence information. In: CCS (2015)

    work page 2015

  14. [14]

    Improving Language Model Negotiation with Self-Play and In-Context Learning from AI Feedback

    Fu, Y., et al.: Improving language model negotiation with self-play. arXiv preprint arXiv:2305.10142 (2023)

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  15. [15]

    In: CCS (2018)

    Ganju, K., et al.: Property inference attacks on fully connected neural networks. In: CCS (2018)

    work page 2018

  16. [16]

    In: STOC (2009) 18 B

    Gentry, C.: Fully homomorphic encryption using ideal lattices. In: STOC (2009) 18 B. Rani

    work page 2009

  17. [17]

    Cambridge University Press (2004)

    Goldreich, O.: Foundations of Cryptography: Volume 2. Cambridge University Press (2004)

    work page 2004

  18. [18]

    SIAM Journal on Computing (1989)

    Goldwasser, S., et al.: The knowledge complexity of interactive proof systems. SIAM Journal on Computing (1989)

    work page 1989

  19. [19]

    In: EURO- CRYPT (2016)

    Groth, J.: On the size of pairing-based non-interactive arguments. In: EURO- CRYPT (2016)

    work page 2016

  20. [20]

    In: ICLR (2024),https://openreview.net/forum?id=VtmBAGCN7o

    Hong, S., et al.: MetaGPT: Meta programming for a multi-agent collaborative framework. In: ICLR (2024),https://openreview.net/forum?id=VtmBAGCN7o

    work page 2024

  21. [21]

    In: NeurIPS (2020)

    Jagielski, M., et al.: Auditing differentially private machine learning. In: NeurIPS (2020)

    work page 2020

  22. [22]

    arXiv preprint arXiv:2510.15186 (2025)

    Juneja, G., Pasupulati, J.N.S., Albalak, A., Hua, W., Wang, W.Y.: MAGPIE: A benchmark for multi-AGent contextual prIvacy evaluation. arXiv preprint arXiv:2510.15186 (2025)

    work page arXiv 2025

  23. [23]

    In: ICML (2015)

    Kairouz, P., et al.: The composition theorem for differential privacy. In: ICML (2015)

    work page 2015

  24. [24]

    Foundations and Trends in Machine Learning (2021)

    Kairouz, P., et al.: Advances and open problems in federated learning. Foundations and Trends in Machine Learning (2021)

    work page 2021

  25. [25]

    In: CRYPTO (1996)

    Kocher, P.: Timing attacks on implementations of Diffie-Hellman, RSA, DSS. In: CRYPTO (1996)

    work page 1996

  26. [26]

    In: CRYPTO (1999)

    Kocher, P., et al.: Differential power analysis. In: CRYPTO (1999)

    work page 1999

  27. [27]

    In: NeurIPS (2023)

    Li, G., et al.: CAMEL: Communicative agents for mind exploration. In: NeurIPS (2023)

    work page 2023

  28. [28]

    In: AISTATS (2017)

    McMahan, B., et al.: Communication-efficient learning of deep networks from de- centralized data. In: AISTATS (2017)

    work page 2017

  29. [29]

    Econometrica (1983)

    Myerson, R.: Mechanism design by an informed principal. Econometrica (1983)

    work page 1983

  30. [30]

    Econometrica (1950)

    Nash, J.: The bargaining problem. Econometrica (1950)

    work page 1950

  31. [31]

    In: IEEE S&P (2021)

    Nasr, M., et al.: Adversary instantiation: Lower bounds for differentially private machine learning. In: IEEE S&P (2021)

    work page 2021

  32. [32]

    Cambridge University Press (2007)

    Nisan, N., et al.: Algorithmic Game Theory. Cambridge University Press (2007)

    work page 2007

  33. [33]

    In: ICLR (2018)

    Papernot, N., et al.: Scalable private learning with PATE. In: ICLR (2018)

    work page 2018

  34. [34]

    Richards, T.: AutoGPT: An autonomous GPT-4 experiment (2023)

    work page 2023

  35. [35]

    Device-Native Autonomous Agents for Privacy-Preserving Negotiations

    Roy, J., Singh, S.K.: Device-native autonomous agents for privacy-preserving ne- gotiations. arXiv preprint arXiv:2601.00911 (2026)

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  36. [36]

    Econometrica (1982)

    Rubinstein, A.: Perfect equilibrium in a bargaining model. Econometrica (1982)

    work page 1982

  37. [37]

    In: IEEE S&P (2017)

    Shokri, R., et al.: Membership inference attacks against machine learning models. In: IEEE S&P (2017)

    work page 2017

  38. [38]

    In: ICLR (2024)

    Staab, R., et al.: Beyond memorization: Violating privacy via inference. In: ICLR (2024)

    work page 2024

  39. [39]

    In:CCS (2022)

    Tramèr,F., etal.:Truthserum: Poisoning machine learningmodels. In:CCS (2022)

    work page 2022

  40. [40]

    In: FOCS (1986)

    Yao, A.: How to generate and exchange secrets. In: FOCS (1986)

    work page 1986

  41. [41]

    In: ICLR (2023)

    Yao, S., et al.: ReAct: Synergizing reasoning and acting in language models. In: ICLR (2023)

    work page 2023

  42. [42]

    In: CSF (2018)

    Yeom, S., et al.: Privacy risk in machine learning. In: CSF (2018)

    work page 2018

  43. [43]

    In: CVPR (2020)

    Zhang, Y., et al.: The secret revealer: Generative model-inversion attacks. In: CVPR (2020)

    work page 2020