Large language models (LLMs) are increasingly deployed in high-stakes settings, yet they frequently violate contextual privacy by disclosing private information in situations where humans would exercise discretion. This raises a fundamental question: do LLMs internally encode contextual privacy norms, and if so, why do violations persist? We present the first systematic study of contextual privacy as a structured latent representation in LLMs, grounded in contextual integrity (CI) theory. Probing multiple models, we find that the three norm-determining CI parameters (information type, recipient, and transmission principle) are encoded as linearly separable and functionally independent directions in activation space. Despite this internal structure, models still leak private information in practice, revealing a clear gap between concept representation and model behavior. To bridge this gap, we introduce CI-parametric steering, which independently intervenes along each CI dimension. This structured control reduces privacy violations more effectively and predictably than monolithic steering. Our results demonstrate that contextual privacy failures arise from misalignment between representation and behavior rather than missing awareness, and that leveraging the compositional structure of CI enables more reliable contextual privacy control, shedding light on potential improvement of contextual privacy understanding in LLMs.
Figures & tables
Figure 1: Illustration of using CI-Parametric steering to mitigate contextual privacy leakage. In this scenario, the LLM must determine whether Nancy (the sender) is permitted to share Steve’s secret (the data subject) with Bob (the recipient).
Figure 2: Multi-dimensional privacy on CONFAIDE Tier 2. Left: PCA requires k=3 components to achieve best results; Right: Layer-wise AUROC of probe transfer vs. PCA (1st PC). The probe improves monotonically, while PCA rises only after layer 15.
Figure 3: Overview of CI-parametric steering.
Method
Leak. (%) ↓
NCR (%) ↑
PPI (%) ↑
No Steering
42.5
57.5
—
Additive
21.5
68.5
49.4
LoRRA
16.0
84.0
62.4
Rep Tuning
37.0
36.0
12.9
CI-Parametric
5.0
90.0
98.8
Table 1: Results on synthetic data.
CONFAIDE Tier 3
PrivaCI-Bench
Llama-3.1
Qwen-2.5
Mistral
Llama-2
Llama-3.1
Qwen-2.5
Mistral
Llama-2
No Steering
24.1
38.5
25.9
23.7
18.0
16.5
10.7
22.5
LoRRA
31.9
40.0
28.5
15.6
14.0
14.7
16.0
18.7
Rep Tuning
8.5
28.5
3.3
37.4
46.7
18.7
4.0
65.3
α=0.5
Add.
47.4
39.6
68.5
58.5
10.0
15.4
40.0
44.0
CI
2.6
33.0
5.2
27.4
15.3
12.7
2.4
18.7
Table 2: Leakage rate in % ( ↓ ) on CONFAIDE and PrivaCI-Bench.
Figure 4: CI-parameter ablation on CONFAIDE ( α=0.5 ).
Figure 5: Leakage as a function of α . CI-parametric steering is less sensitive to α on both synthetic (left) and CONFAIDE (right) datasets, while monolithic steering is highly sensitive.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Model
Dataset
Leak. ↓
Refuse
NCR ↑
Llama-3.1-8B
CONFAIDE T3 (270)
24.1%
70.4%
75.6%
Qwen-2.5-7B
CONFAIDE T3 (270)
38.5%
40.7%
61.5%
Mistral-7B
CONFAIDE T3 (270)
25.9%
55.6%
73.7%
Llama-2-7B
CONFAIDE T3 (270)
23.7%
30.4%
70.0%
Appendix
Table 3: Unsteered baselines illustrating the privacy awareness gap.
Steering Axis
Leak. (%) ↓
PPI ↑
No Steering
42.5
—
Info Type only
23.0
.459
Recipient only
18.5
.565
Trans. Principle only
27.5
.353
All CI params
0.5
.988
Appendix
Table 4: CI-parameter ablation on synthetic data (Llama-3.1-8B, α=1.0 ).
Figure 6: Pareto frontiers (NCR vs. leakage).
Figure 7: Subspace selectivity matrices.
α
Help.
Coh.
Rel.
No Steering
0
4.58
4.76
4.89
Monolithic
0.5
4.13
4.61
4.62
CI-Parametric
0.5
1.04
2.53
1.51
Monolithic
1.0
1.07
2.40
1.28
CI-Parametric
1.0
1.00
1.00
1.00
Appendix
Table 5: Utility evaluation on 200 Alpaca instructions (Llama-3.1-8B).
3-Param
5-Param
Steering Axis
Leak. ↓
PPI ↑
Leak. ↓
PPI ↑
No Steering
.425
—
.425
—
Info Type only
.230
.459
.500
− .176
Recipient only
.185
.565
.530
− .247
Trans. Principle only
.275
.353
.495
− .165
Data Subject only
—
—
.490
− .153
Appendix
Table 6: Three- vs. five-parameter CI steering on synthetic data (Llama-3.1-8B, α=1.0 ).
Dataset
α
3-Param Leak. ↓
5-Param Leak. ↓
CONFAIDE
0.5
.026
.000
1.0
.000
.167
PrivaCI
0.5
.153
.080
1.0
.000
.080
Appendix
Table 7: Results on CONFAID and PrivaCI-Bench (Llama-3.1-8B). Five-parameter steering shows marginal gains at low α but fails to eliminate leakage at higher α .
Privacy leakage in language models concerns how models expose training data, infer sensitive traits, or transmit private context through outputs and internal channels.