Pith. sign in

REVIEW 3 major objections 4 minor 2 cited by

Towards Aligning Personalized Conversational Recommendation Agents with Users' Privacy Preferences

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Privacy control should be reframed as an alignment problem, in which AI agents learn users' contextual privacy preferences from feedback rather than waiting for users to manage consent.

desk verdict A grounded, honest position paper that reframes privacy control as CIRL alignment; the formal model is skeletal and the load-bearing stability assumption is untested, but the synthesis is useful and deserves peer review. read the letter →

arxiv 2508.07672 v1 pith:LTFMH6Q2 submitted 2025-08-11 cs.HC

Shuning Zhang , Ying Ma , Jingruo Chen , Simin Li , Xin Yi , Hewu Li This is my paper · ORCID
classification cs.HC
keywords privacyalignmentContextualIntegritycalculusCooperativeInverseReinforcementLearningconversationalrecommendationagentsprivacy-utilitytrade-offhuman-agentfatigue
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the standard privacy toolkit—consent dialogs, permission menus, notice-and-control—cannot handle AI agents, which act autonomously, remember across contexts, and collect data continuously. It proposes instead that privacy protection be treated as an alignment problem: agents start out ignorant of a user's privacy preferences and learn them over time from explicit and implicit feedback. The authors ground this in Contextual Integrity, which supplies the context of an interaction, and Privacy Calculus, which supplies the user's private valuation of an action, then formalize the learning loop with Cooperative Inverse Reinforcement Learning. If the reframing holds, users shift from being gatekeepers of every data request to being teachers who occasionally correct an agent that increasingly handles the privacy–utility trade-off on its own.

What carries the argument

The load-bearing object is the pair $(C, R_{\mathrm{user}}(C,a))$: Contextual Integrity supplies the context vector $C$ with its five normative parameters, and Privacy Calculus supplies the latent reward function $R_{\mathrm{user}}$ quantifying subjective utility minus privacy risk. The argument runs on a Cooperative Inverse Reinforcement Learning loop, in which the agent maintains a belief $P(R_{\mathrm{user}}|H)$, updates it via Bayes' rule on user feedback, and acts by maximizing expected reward while navigating the privacy–utility Pareto frontier. All privacy-control claims in the paper reduce to the learnability and optimization of this reward function.

What would settle it

A longitudinal field study would settle it: deploy a conversational recommender that learns privacy preferences from feedback and test its predictions on contexts users encounter later. If the learned model predicts users' choices no better than a static permission profile—or if users give systematically different answers in the same context on different occasions—the single-reward alignment target is not identifiable in practice.

Watch

Extended reading notes

Core claim

The paper's central move is to turn privacy management into a learning and optimization problem. Every situation is encoded as a context vector $C$ carrying the five Contextual Integrity parameters (data subject, sender, recipient, information type, transmission principle). Each action $a$ is parameterized by the data it touches and the processing it performs. The user's preference is a latent, personalized reward function $R_{\mathrm{user}}(C,a)$ expressing their privacy calculus: positive when perceived utility outweighs risk, negative when it does not. The agent maintains a belief $P(R_{\mathrm{user}}|H)$ over possible reward functions, updates it with Bayes' rule whenever the user gives

Load-bearing premise

The whole framework rests on the premise that a user's privacy choices can be captured as one stable, context-dependent value function that an agent can learn from noisy feedback; if preferences shift, contradict one another, or resist being elicited, the alignment target itself is not well defined.

Editorial extensions

If this is right

  • If an agent can learn $R_{\mathrm{user}}$, privacy settings become dynamic predictions rather than static grants; the agent can default to privacy-respecting behavior without asking for permission every time.
  • The interaction model shifts from one-time notice-and-consent to ongoing bidirectional negotiation: the agent communicates privacy-relevant trade-offs, the user responds, and the agent refines its model.
  • Pareto-frontier navigation gives a principled way to resolve the privacy–utility trade-off: the agent does not maximize either objective alone but chooses the point on the frontier that matches the user's learned preferences.
  • Explicit privacy questions should become rare, reserved for novel contexts or high-stakes actions where the agent's belief is uncertain, thereby reducing privacy fatigue and notification overload.
  • The five challenges identified in the paper—manipulative consent-seeking, explanations that leak sensitive inferences, interface fatigue, trust erosion, and privacy of the learned preference model itself—become the concrete research agenda for making the framework operational.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The formalization suggests a concrete evaluation target: measure whether a learned $R_{\mathrm{user}}(C,a)$ predicts users' held-out privacy choices better than a static permission profile or a simple 'no memory' policy; if it does not, the alignment loop adds cognitive cost without demonstrable benefit.
  • The single-reward assumption may need extension to time-varying or hierarchical preference models, since the paper itself notes the privacy paradox and the difficulty users have articulating preferences; non-stationary preferences would make a single latent reward function underspecified.
  • The same loop could generalize beyond conversational recommendation to other agent memory decisions, such as negotiating what the agent retains, forgets, or shares; the paper's memory-extraction examples hint at this but do not develop it.
  • Section 4.5's call for local processing and federated learning implies an architectural consequence the paper leaves implicit: the learned preference model should be treated as a sensitive artifact whose storage and transmission need the same privacy guarantees as the data it describes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This position paper argues that conventional notice-and-consent privacy management is inadequate for autonomous, personalized AI agents, and proposes reframing privacy protection as a problem of human-agent alignment. Drawing on Contextual Integrity (CI) and Privacy Calculus, the authors formalize the alignment target as a latent, context-dependent user reward function R_user(C,a), and describe a CIRL-style loop in which the agent communicates privacy trade-offs, receives explicit or implicit feedback, updates a Bayesian belief over R_user, and selects an action by maximizing expected reward. The paper illustrates the workflow with a restaurant-recommendation scenario and identifies five implementation challenges (ethical manipulation, XAI privacy dilemmas, interface usability, trust, and privacy of the alignment process itself). The contribution is primarily conceptual, with no implementation, simulation, or user study.

Significance. If the framework is accepted as a research program, it provides a useful synthesis of CI, Privacy Calculus, and CIRL for the usable-privacy community, and it names concrete, under-explored problems (e.g., the XAI privacy dilemma and the privacy of preference modeling). The paper is honest about its position-paper status and explicitly calls for human-centered benchmarks and preference-elicitation research. Its strengths are the reframing of privacy control as a dynamic alignment problem, the connection to existing privacy theory, and a workable illustrative scenario. The main limitations are that the formal model is skeletal rather than a validated technical framework, and the central stability assumptions are in tension with the paper's own cited evidence on privacy paradox, fatigue, and preference plasticity. These issues are load-bearing for the claimed 'alignment objective,' so substantial clarification is needed before the contribution can be evaluated as a working formalization.

major comments (3)
  1. [Section 3.3 / Section 3.4.3] The alignment objective assumes a stable latent reward R_user(C,a) and a stationary observation model f ∼ P(f|R_user,C). This is load-bearing because the Bayesian update P(R_user|H,f) ∝ P(f|R_user,C)·P(R_user|H) converges to 'true' preferences only under that assumption. However, the paper's own narrative undermines it: §3.1 cites the privacy paradox and privacy fatigue, and §5.2 states that preferences are shaped by awareness of risks. The interactive loop in Fig. 1 means that the agent's chosen action can change the user's future context and sensitivity, so f is not conditionally independent of past actions given R_user. For example, a user who refuses chat-history access may become more cautious about similar requests. Without modeling this closed-loop dynamics, the posterior can be an artifact of the agent's own interventions and the alignment objective is underspecified. Please eith
  2. [Section 3.4.4] The paper claims that choosing a* = argmax_a E_{P(R_user|H)}[R_user(C,a)] is 'equivalent to navigating the privacy-utility Pareto frontier.' This is not justified: the objective is a scalar expectation, so it selects a single point and does not generate a Pareto set. The later proposal in §4.3 to offer users a curated set of options along the Pareto frontier requires a multi-objective formulation (e.g., constrained optimization or a sweep over trade-off parameters) that is absent from the formalization. Please clarify the relationship among R_user, privacy, utility, and the Pareto frontier, or revise the claim that maximizing R_user constitutes Pareto navigation.
  3. [Section 3.3 / Section 3.4] The formalization is illustrative rather than a working model. The context vector C, action parameterization a(d,p), feedback likelihood P(f|R_user,C), and the function space over R_user are all left unspecified, and no inference algorithm is given. In addition, the action-selection rule is myopic; CIRL typically requires planning over information gain, and the later appeal to active learning (§6.1) is not integrated into the formalism. For a position paper this is acceptable, but the current text overstates the degree of formalization. Please label these components explicitly as schemata or provide one concrete instantiation with an identifiability condition.
minor comments (4)
  1. [Figure 1 / Section 3.4] The text describes a four-step loop, but the figure caption lists five numbered stages (including the user's internal privacy calculus as a separate stage). Please reconcile the numbering to avoid confusion.
  2. [Section 3.1] Typo: 'the user the their data's journey' should be 'the user and their data's journey.'
  3. [Section 6.1] Typo: 'these can serves as powerful' should be 'these can serve as powerful.'
  4. [Section 5.2] The sentence 'For agents, especially for LLMs, estimating the privacy, the utility, and optimizing trade-offs may be feasible...' is cumbersome; consider splitting it for readability.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the formalization is an explicitly proposed modeling framework, and the self-citations are peripheral rather than load-bearing.

full rationale

This is a position paper, not an empirical derivation. The formal machinery in §3.2–§3.4 (context vector C, reward R_user(C,a), belief P(R_user|H), Bayesian update, Pareto-frontier action selection) is introduced as a proposed way to frame privacy management; it is not claimed to be derived from data. No parameter is fitted and no quantity is predicted from a fitted model, so the fitted-input-called-prediction pattern does not apply. R_user is explicitly an operationalization of Privacy Calculus ('Privacy Calculus Theory defines the user’s objective. We operationalize this concept as the user’s latent and personalized reward function'), and the alignment objective a* = argmax E[R_user] is the definition of alignment in the framework, not a theorem drawn from exogenous premises; this is a modeling choice and does not constitute an equivalence concealed as a result. The Bayesian update in §3.4.3 is a standard identity, with the assumption that feedback is a noisy observation of R_user stated as such. The paper contains self-citations ([48],[49],[50]), but they support background motivational claims (agent behavior unpredictability, memory-risk awareness, Pareto-frontier UI design) and are not used to justify the central alignment premise or to exclude alternative formalizations; hence they are not load-bearing. The weaknesses identified by the skeptical reader—potential endogeneity of preferences in the interactive loop (§5.2), manipulation (§4.1), XAI privacy dilemma (§4.2), and privacy of alignment (§4.5)—are acknowledged open problems and model-adequacy concerns, not circularity. Accordingly, no circular step can be exhibited by quote and reduction.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper introduces no fitted constants or new entities. Its assumptions are the applicability of two established privacy theories and of CIRL; these are domain assumptions rather than ad hoc inventions. The latent reward function R_user is a modeling device borrowed from inverse reinforcement learning, not a new physical or conceptual entity.

assumptions (5)
  • domain assumption Contextual Integrity theory accurately describes privacy norms
    Used to define the context vector C and the normative landscape; introduced in Section 3.2.
  • domain assumption Privacy Calculus theory accurately describes user disclosure decisions as weighing benefits against risks
    Operationalized as the latent reward function R_user(C,a); introduced in Section 3.2.
  • domain assumption User feedback is a noisy observation of the latent reward function
    Required for the Bayesian belief update in Section 3.4.3; without it the CIRL loop cannot converge.
  • domain assumption An LLM-based agent can estimate privacy costs, utility, and navigate the Pareto frontier
    Stated as feasible in Section 5.2, but the paper itself questions whether the agent's trade-off matches the user's.
  • domain assumption The CIRL framework applies to human-agent privacy negotiation
    Used as the formal foundation in Section 3.2; no argument or evidence is given that CIRL's cooperative model transfers to this setting.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Aligning Personalized Conversational Recommendation Agents with Users' Privacy Preferences." pith.science (2026). https://pith.science/paper/LTFMH6Q2

@misc{pith2026250807672,
  author       = {Pith},
  title        = {Pith review of: Towards Aligning Personalized Conversational Recommendation Agents with Users' Privacy Preferences},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LTFMH6Q2}},
  note         = {Machine review of arXiv:2508.07672}
}
read the original abstract

The proliferation of AI agents, with their complex and context-dependent actions, renders conventional privacy paradigms obsolete. This position paper argues that the current model of privacy management, rooted in a user's unilateral control over a passive tool, is inherently mismatched with the dynamic and interactive nature of AI agents. We contend that ensuring effective privacy protection necessitates that the agents proactively align with users' privacy preferences instead of passively waiting for the user to control. To ground this shift, and using personalized conversational recommendation agents as a case, we propose a conceptual framework built on Contextual Integrity (CI) theory and Privacy Calculus theory. This synthesis first reframes automatically controlling users' privacy as an alignment problem, where AI agents initially did not know users' preferences, and would learn their privacy preferences through implicit or explicit feedback. Upon receiving the preference feedback, the agents used alignment and Pareto optimization for aligning preferences and balancing privacy and utility. We introduced formulations and instantiations, potential applications, as well as five challenges.

Figures

Figures reproduced from arXiv: 2508.07672 by the authors.

Figure 1
Figure 1. The framework illustrates an interactive four-step loop for aligning an AI agent with user privacy preferences. (1) [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. An example case for the alignment. The process begins when the user makes their request. Rather than immediately processing it, the agent’s first step is to recognize the social context and transparently communicate the resulting privacy trade-offs. It understands that a query for an “anniversary dinner” implies a need for a high-quality recommendation, but also that providing one may involve using sensitive persona… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Exploring the Interaction of Explanation Styles, Context, and Trust of AI Privacy Redaction in AI-mediated Interactions

    cs.HC 2026-07 conditional novelty 5.5 of 10

    Explanation preferences for AI privacy redaction vary systematically with domain and redaction amount; giving users their preferred styles raises trust over random or no explanations.

  2. Autonomous Information Seeking: A Roadmap for Agentic Recommender Systems

    cs.IR 2026-07 accept novelty 5.0 of 10

    Agentic recommender systems are organized by agent role (assisted, as-recommender, as-simulator) crossed with autonomy levels L2–L5, yielding a roadmap of architectures, evaluation limits, and open challenges.

Reference graph

Works this paper leans on

57 extracted references · 45 canonical work pages · cited by 2 Pith papers

  1. [1]

    Noura Abdi, Xiao Zhan, Kopo M Ramokapane, and Jose Such. 2021. Privacy norms for smart home personal assistants. In Proceedings of the 2021 CHI conference on human factors in computing systems . 1–14

    work page 2021

  2. [2]

    Ashwaq Alsoubai, Reza Ghaiumy Anaraky, Yao Li, Xinru Page, Bart Knijnenburg, and Pamela J Wisniewski. 2022. Permission vs. app limiters: profiling smartphone users to understand differing strategies for mobile privacy management. In Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems . 1–18

    work page 2022

  3. [3]

    Noah Apthorpe, Yan Shvartzshnaider, Arunesh Mathur, Dillon Reisman, and Nick Feamster. 2018. Discovering smart home internet of things privacy norms using contextual integrity. Proceedings of the ACM on interactive, mobile, wearable and ubiquitous technologies 2, 2 (2018), 1–23

    work page 2018

  4. [4]

    I know even if you don’t tell me

    Sumit Asthana, Jane Im, Zhe Chen, and Nikola Banovic. 2024. " I know even if you don’t tell me": Understanding Users’ Privacy Preferences Regarding AI-based Inferences of Sensitive Information for Personalization. In Proceedings of the 2024 CHI Conference on Human Factors in Computing Systems . 1–21

    work page 2024

  5. [5]

    Devasheesh P Bhave, Laurel H Teo, and Reeshad S Dalal. 2020. Privacy at work: A review and a research agenda for a contested terrain. Journal of Management 46, 1 (2020), 127–164

    work page 2020

  6. [6]

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21) . 2633–2650

    work page 2021

  7. [7]

    Chaoran Chen, Zhiping Zhang, Bingcan Guo, Shang Ma, Ibrahim Khalilov, Sim- ret A Gebreegziabher, Yanfang Ye, Ziang Xiao, Yaxing Yao, Tianshi Li, et al

    work page

  8. [8]

    Chaoran Chen, Daodao Zhou, Yanfang Ye, Toby Jia-jun Li, and Yaxing Yao. 2025. CLEAR: Towards Contextual LLM-Empowered Privacy Policy Analysis and Risk Generation for Large Language Model Applications. In Proceedings of the 30th International Conference on Intelligent User Interfaces . 277–297

    work page 2025

Show all 57 references
  1. [9]

    Xi Chen, Zhiyang Zhang, Fangkai Yang, Xiaoting Qin, Chao Du, Xi Cheng, Hangxin Liu, Qingwei Lin, Saravan Rajmohan, Dongmei Zhang, et al. 2024. AI Delegates with a Dual Focus: Ensuring Privacy and Strategic Self-Disclosure. arXiv preprint arXiv:2409.17642 (2024)

    2024 arXiv

  2. [10]

    Hanbyul Choi, Jonghwa Park, and Yoonhyuk Jung. 2018. The role of privacy fatigue in online privacy behavior. Computers in Human Behavior 81 (2018), 42–51

    2018

  3. [11]

    Yusra Elbitar, Soheil Khodayari, Marian Harbach, Gianluca De Stefano, Bal- azs Csaba Engedy, Giancarlo Pellegrino, and Sven Bugiel. 2025. Permission Rationales in the Web Ecosystem: An Exploration of Rationale Text and De- sign Patterns. In Proceedings of the 2025 CHI Conferen...

    2025

  4. [12]

    Zheran Fang, Weili Han, and Yingjiu Li. 2014. Permission based Android security: Issues and countermeasures. computers & security 43 (2014), 205–218

    2014

  5. [13]

    Daniel Franzen, Saskia Nuñez von Voigt, Peter Sörries, Florian Tschorsch, and Claudia Müller-Birn. 2022. Am i private and if so, how many? communicating privacy guarantees of differential privacy with risk communication formats. In Proceedings of the 2022 ACM SIGSAC Conference...

    2022

  6. [14]

    Alisa Frik, Juliann Kim, Joshua Rafael Sanchez, and Joanne Ma. 2022. Users’ expectations about and use of smartphone privacy and security settings. In Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems . 1–24

    2022

  7. [15]

    Andrew Gambino, Jinyoung Kim, S Shyam Sundar, Jun Ge, and Mary Beth Rosson

  8. [16]

    Armin Gerl, Bianca Meier, and Stefan Becher. 2020. Let users control their data– privacy policy-based user interface design. In Human Interaction and Emerging Technologies: Proceedings of the 1st International Conference on Human Interaction and Emerging Technologies (IHIET 20...

    2020

  9. [17]

    Nitesh Goyal, Minsuk Chang, and Michael Terry. 2024. Designing for Human- Agent Alignment: Understanding what humans want from their agents. In Ex- tended Abstracts of the CHI Conference on Human Factors in Computing Systems . 1–6

    2024

  10. [18]

    Ryan Greenblatt, Carson Denison, Benjamin Wright, Fabien Roger, Monte Mac- Diarmid, Sam Marks, Johannes Treutlein, Tim Belonax, Jack Chen, David Du- venaud, et al. 2024. Alignment faking in large language models. arXiv preprint arXiv:2412.14093 (2024)

    2024 arXiv

  11. [19]

    Eric Horvitz. 1999. Principles of mixed-initiative user interfaces. In Proceedings of the SIGCHI conference on Human Factors in Computing Systems . 159–166

    1999

  12. [20]

    Hannah J Hutton and David A Ellis. 2023. Exploring user motivations behind ios app tracking transparency decisions. In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems . 1–12

    2023

  13. [21]

    Alon Jacovi, Ana Marasović, Tim Miller, and Yoav Goldberg. 2021. Formalizing trust in artificial intelligence: prerequisites, causes and goals of human trust in AI. In Proceedings of the 2021 ACM conference on fairness, accountability, and transparency. 624–635

    2021

  14. [22]

    Adam DI Kramer, Jamie E Guillory, and Jeffrey T Hancock. 2014. Experimental evidence of massive-scale emotional contagion through social networks. Pro- ceedings of the National Academy of Sciences 111, 24 (2014), 8788–8790

    2014

  15. [23]

    Robert S Laufer and Maxine Wolfe. 1977. Privacy as a concept and a social issue: A multidimensional developmental theory. Journal of social Issues 33, 3 (1977), 22–42

    1977

  16. [24]

    Hyunsoo Lee, Yugyeong Jung, Hei Yiu Law, Seolyeong Bae, and Uichin Lee. 2024. PriviAware: Exploring Data Visualization and Dynamic Privacy Control Support for Data Collection in Mobile Sensing Research. In Proceedings of the 2024 CHI Conference on Human Factors in Computing Sy...

    2024

  17. [25]

    Bin Liu, Jialiu Lin, and Norman Sadeh. 2014. Reconciling mobile app privacy and usability on smartphones: Could user privacy profiles help?. In Proceedings of the Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Zhang et al. 23rd international conference on World wide w...

    2014

  18. [26]

    Rongjun Ma, Caterina Maidhof, Juan Carlos Carrillo, Janne Lindqvist, and Jose Such. 2025. Privacy Perceptions of Custom GPTs by Users and Creators. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems . 1–18

    2025

  19. [27]

    Ying Ma, Zhanna Sarsenbayeva, Jarrod Knibbe, and Jorge Goncalves. 2025. Ex- ploring the effects of location information on perceptions of news credibility and sharing intention. International Journal of Human-Computer Studies 193 (2025), 103378

    2025

  20. [28]

    Ying Ma, Shiquan Zhang, Dongju Yang, Zhanna Sarsenbayeva, Jarrod Knibbe, and Jorge Goncalves. 2025. Raising Awareness of Location Information Vulnerabilities in Social Media Photos using LLMs. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems . 1–14

    2025

  21. [29]

    Kirsten Martin and Helen Nissenbaum. 2016. Measuring privacy: An empirical test using context to expose confounding variables. Colum. Sci. & Tech. L. Rev. 18 (2016), 176

    2016

  22. [30]

    Kirsten Martin and Katie Shilton. 2016. Why experience matters to privacy: How context-based experience moderates consumer privacy expectations for mobile applications. Journal of the Association for Information Science and Technology 67, 8 (2016), 1871–1882

    2016

  23. [31]

    Kristopher Micinski, Daniel Votipka, Rock Stevens, Nikolaos Kofinas, Michelle L Mazurek, and Jeffrey S Foster. 2017. User interactions and permission use on android. In Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems. 362–373

    2017

  24. [32]

    Pardis Emami Naeini, Sruti Bhagavatula, Hana Habib, Martin Degeling, Lujo Bauer, Lorrie Faith Cranor, and Norman Sadeh. 2017. Privacy expectations and preferences in an{IoT} world. In Thirteenth symposium on usable privacy and security (SOUPS 2017). 399–412

    2017

  25. [33]

    Ivoline Ngong, Swanand Kadhe, Hao Wang, Keerthiram Murugesan, Justin D Weisz, Amit Dhurandhar, and Karthikeyan Natesan Ramamurthy. 2025. Protect- ing users from themselves: Safeguarding contextual privacy in interactions with conversational agents. arXiv preprint arXiv:2502.18...

    2025 arXiv

  26. [34]

    Helen Nissenbaum. 2004. Privacy as contextual integrity. Wash. L. Rev. 79 (2004), 119

    2004

  27. [35]

    Helen Nissenbaum. 2011. A contextual approach to privacy online. Daedalus 140, 4 (2011), 32–48

    2011

  28. [36]

    Neel Patel, Reza Shokri, and Yair Zick. 2022. Model explanations with differential privacy. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency. 1895–1904

    2022

  29. [37]

    Marc Serramia, William Seymour, Natalia Criado, and Michael Luck. 2023. Pre- dicting Privacy Preferences for Smart Devices as Norms. In Proceedings of the 2023 International Conference on Autonomous Agents and Multiagent Systems . 2262–2270

    2023

  30. [38]

    Yijia Shao, Tianshi Li, Weiyan Shi, Yanchen Liu, and Diyi Yang. [n. d.]. Priva- cyLens: Evaluating Privacy Norm Awareness of Language Models in Action. In The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track

  31. [39]

    I’m not con- vinced that they don’t collect more than is necessary

    Tanusree Sharma, Lin Kyi, Yang Wang, and Asia J Biega. 2024. " I’m not con- vinced that they don’t collect more than is necessary":{User-Controlled} Data Minimization Design in Search Engines. In 33rd USENIX Security Symposium (USENIX Security 24). 2797–2812

    2024

  32. [40]

    Fuming Shih, Ilaria Liccardi, and Daniel Weitzner. 2015. Privacy tipping points in smartphones privacy preferences. In Proceedings of the 33rd Annual ACM Conference on Human Factors in Computing Systems . 807–816

    2015

  33. [41]

    Yan Shvartzshnaider, Schrasing Tong, Thomas Wies, Paula Kift, Helen Nis- senbaum, Lakshminarayanan Subramanian, and Prateek Mittal. 2016. Learning privacy expectations by crowdsourcing contextual informational norms. In Pro- ceedings of the AAAI Conference on Human Computation...

    2016

  34. [42]

    Ari Ezra Waldman. 2020. Cognitive biases, dark patterns, and the ‘privacy paradox’. Current opinion in psychology 31 (2020), 105–109

    2020

  35. [43]

    Bo Wang, Weiyi He, Pengfei He, Shenglai Zeng, Zhen Xiang, Yue Xing, and Jiliang Tang. 2025. Unveiling privacy risks in llm agent memory. arXiv preprint arXiv:2502.13172 (2025)

    2025 arXiv

  36. [44]

    Allison Woodruff, Vasyl Pihur, Sunny Consolvo, Laura Brandimarte, and Alessan- dro Acquisti. 2014. Would a Privacy Fundamentalist Sell Their DNA for 1000 ... If Nothing Bad Happened as a Result? The Westin Categories, Behavioral Intentions, and Consequences. In 10th Symposium ...

    2014

  37. [45]

    Tong Wu, Ashwinee Panda, Jiachen T Wang, and Prateek Mittal. [n. d.]. Privacy- Preserving In-Context Learning for Large Language Models. In The Twelfth International Conference on Learning Representations

  38. [46]

    Yijia Xiao, Yiqiao Jin, Yushi Bai, Yue Wu, Xianjun Yang, Xiao Luo, Wenchao Yu, Xujiang Zhao, Yanchi Liu, Quanquan Gu, et al. 2024. Large Language Models Can Be Contextual Privacy Protection Learners. In Proceedings of the 2024 Conference on Empirical Methods in Natural Languag...

    2024

  39. [47]

    Yaqing Yang, Tony W Li, and Haojian Jin. 2024. On the Feasibility of Predicting Users’ Privacy Concerns using Contextual Labels and Personal Preferences. In Proceedings of the 2024 CHI Conference on Human Factors in Computing Systems . 1–20

    2024

  40. [48]

    Shuning Zhang, Jingruo Chen, Jiajing Gao, Zhiqi Gao, Xin Yi, and Hewu Li. 2025. Characterizing Unintended Consequences in Human-GUI Agent Collaboration for Web Browsing. arXiv preprint arXiv:2505.09875 (2025)

    2025 arXiv

  41. [49]

    Ghost of the past

    Shuning Zhang, Lyumanshan Ye, Xin Yi, Jingyu Tang, Bo Shui, Haobin Xing, Pengfei Liu, and Hewu Li. 2024. " Ghost of the past": identifying and resolving privacy leakage from LLM’s memory through proactive user interaction. arXiv preprint arXiv:2410.14931 (2024)

    2024 arXiv

  42. [50]

    Shuning Zhang, Xin Yi, Haobin Xing, Lyumanshan Ye, Yongquan Hu, and Hewu Li. 2024. Adanonymizer: Interactively Navigating and Balancing the Duality of Privacy and Output Performance in Human-LLM Interaction. arXiv preprint arXiv:2410.15044 (2024)

    2024 arXiv

  43. [51]

    Zhiping Zhang, Bingcan Guo, and Tianshi Li. 2024. Privacy Leakage Overshad- owed by Views of AI: A Study on Human Oversight of Privacy in Language Model Agent. arXiv preprint arXiv:2411.01344 (2024)

    2024

  44. [52]

    Guoshenghui Zhao and Eric Song. 2024. Privacy-Preserving Large Language Models: Mechanisms, Applications, and Future Directions. arXiv preprint arXiv:2412.06113 (2024)

    2024 arXiv

  45. [53]

    Xuejun Zhao, Wencan Zhang, Xiaokui Xiao, and Brian Lim. 2021. Exploiting explanations for model inversion attacks. In Proceedings of the IEEE/CVF interna- tional conference on computer vision . 682–692

    2021

  46. [54]

    Jijie Zhou, Eryue Xu, Yaoyao Wu, and Tianshi Li. 2025. Rescriber: Smaller-LLM- Powered User-Led Data Minimization for LLM-Based Chatbots. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems . 1–28

    2025

  47. [55]

    Hui Zhu, Carol XJ Ou, Willem-Jan AM van den Heuvel, and Hongwei Liu. 2017. Privacy calculus and its utility for personalization services in e-commerce: An analysis of consumer decision-making. Information & Management 54, 4 (2017), 427–437

    2017

  48. [2016]

    In Proceedings of the 2016 CHI Conference Extended Abstracts on Human Factors in Computing Systems

    User disbelief in privacy paradox: Heuristics that determine disclosure. In Proceedings of the 2016 CHI Conference Extended Abstracts on Human Factors in Computing Systems. 2837–2843

    2016

  49. [2025]

    arXiv preprint arXiv:2504.11281 (2025)

    The Obvious Invisible Threat: LLM-Powered GUI Agents’ Vulnerability to Fine-Print Injections. arXiv preprint arXiv:2504.11281 (2025)

    2025 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.