Contextual Candour: Role-Aware Graduated Disclosure for LLMs over Mixed-Sensitivity Contexts

Devansh Srivastav; David Pape; Samira Abedini; Lea Schönherr

cs.CROct 20, 2026

Contextual Candour: Role-Aware Graduated Disclosure for LLMs over Mixed-Sensitivity Contexts

Authors: Devansh Srivastav, David Pape, Samira Abedini, Lea Schönherr

Organizations: CISPA Helmholtz Center for Information Security, Saarbrücken, Germany

Abstract

LLMs increasingly operate over mixed-sensitivity contexts, where they must reason over information ranging from public to confidential while disclosing only what the user is authorised to receive. Existing approaches enforce access control as a binary decision: either fully answering or refusing, without regulating how much or what kind of information is revealed if access is granted, leading to over-refusal or unintended leakage. We introduce graduated disclosure, an access-control formulation in which the level of detail and sensitivity in a model's response is calibrated to the user's authorisation rather than treated as a grant-or-deny decision. We model graduated disclosure as a disclosure-aware generation problem and propose a reward-based optimisation framework that shapes responses toward level-appropriate abstractions while penalising unauthorised factual leakage, including paraphrases and approximations. We evaluate our approach on enterprise and clinical benchmarks and compare it with prompt-based, gating, and supervised baselines. Experiments show that our method substantially reduces information leakage while preserving correctness and utility. These results suggest that disclosure control must be integrated into the generation process itself to enable secure yet useful LLM deployments.

Figures & tables

	GRADIENT									MEDINOTE
	Qwen-2.5-14B			Llama-3.1-8B			Gemma-3-12B			Qwen-2.5-14B			Llama-3.1-8B			Gemma-3-12B
Method	Leak	Corr.	ADR	Leak	Corr.	ADR	Leak	Corr.	ADR	Leak	Corr.	ADR	Leak	Corr.	ADR	Leak	Corr.	ADR
Zero-shot Prompt	46.52	89.63	48.54	42.56	90.13	50.81	48.91	33.73	17.63	58.05	81.28	35.72	45.22	76.51	43.01	52.60	75.87	38.26
Gate	61.04	95.24	37.07	56.90	92.88	39.68	63.27	80.87	28.52	54.02	79.08	36.95	50.39	75.79	38.13	52.87	82.09	39.31
SFT	55.69	96.72	42.90	55.23	96.50	43.12	55.50	96.44	42.82	51.02	82.92	40.59	65.13	65.59	20.59	50.68	60.56	24.81
SFT + Prompt	34.01	23.45	16.84	37.72	22.19	14.03	30.34	21.09	15.42	52.48	68.87	32.68	45.96	65.00	34.73	50.64	16.43	06.70

Table 1: Graduated disclosure vs baselines across models on the GRADIENT and MEDINOTE. Our policy optimisation method uses GRPO and is labelled GRPO in the table. Values in %; Corr. = Correctness; best in bold.

	Zero-shot Prompt	GRPO with LLM Reward	GRPO without LLM Reward
Leak Rate	46.52	06.28	17.96
Correctness	89.63	96.39	92.14
ADR	48.54	90.34	83.92

Table 2: Effect of reward signal expressiveness using Qwen-2.5-14B on GRADIENT.

Panel of Figure 2 — Figure 2: Leak rate (%) by authorisation level evaluated across three models and five methods.

	Main Metrics (%)			Cross-Role Similarity ( $\downarrow$ )		Per-Role Numeric Specificity ( $\phi$ )				Per-Role Response Length (words)
Ablation	Leak	Correct	ADR	Jaccard	Cosine	Intern	Analyst	Manager	Executive	Intern	Analyst	Manager	Executive	Graduation
$R_{\text{full}}$	06.28	96.39	90.34	0.184	0.583	0.05	0.70	6.02	13.88	097.7	130.5	261.6	376.0	✓
$-R_{\text{format}}$	12.48	92.07	81.31	0.232	0.678	0.19	2.14	5.60	14.01	104.7	159.7	198.4	301.0	✓
$-R_{\text{leak}}$	31.20	94.60	64.94	0.223	0.690	0.60	2.98	2.54	11.37	093.1	152.0	149.8	274.3	$\times$
$-R_{\text{grad}}$	29.84	93.76	65.78	0.285	0.812	0.30	0.53	0.46	00.62	051.4	059.3	057.5	061.7	$\times$
$-R_{\text{route}}$	13.77	94.87	81.61	0.209	0.713	0.52	2.48	1.64	11.25	103.1	175.5	171.4	340.6	$\times$

Table 3: Leave-one-out ablation on GRADIENT (Qwen-2.5-14B). Graduation: ✓if both

\phi

and response length increase monotonically across all authorisation levels.

Appendix figures & tables23 assets

Supplementary material from the paper’s appendix.

Appendix

#	Layer	Content
1	Public	Title, basic description, general purpose
2	Summary	High-level metrics, trends, non-sensitive aggregates
3	Detailed	Specific numbers, breakdowns, customer segments
4	Operational	Costs, timelines, resource allocation, headcount
5	Technical	Technical specifications, architecture, performance metrics
6	Strategic	Competitive positioning, market share, strategic rationale

Appendix

Table 4: GRADIENT: Information Layers

Role	Description	Layers	Detail Level
Intern	Entry-level staff	1	basic
Business Analyst	Mid-level analyst	1–3	moderate
Department Manager	Senior operational role	1–6	detailed
C-Level Executive	Full access	1–8	comprehensive

Appendix

Table 5: GRADIENT: Roles and Layer access.

#	Layer	Content
1	Identification	Patient ID, name (synthetic), age, sex
2	Visit Overview	Visit reason, presenting symptoms, discharge status
3	Medical History	Pre-existing conditions, allergies, lifestyle factors, psychological history
4	Symptom Details	Symptom intensity, localisation, duration, aggravating factors
5	Diagnostics	Medical examinations, diagnostic test results
6	Treatment Plan	Medications, dosages, surgeries, treatment response

Appendix

Table 6: MEDINOTE: Information Layers.

Role	Description	Layers	Detail Level
Administrative Staff	Front desk, scheduling	1–2	basic
Clinical Support Staff	Ward boys, attendants	1–4	moderate
Medical Staff	Nurses, doctors	1–6	comprehensive

Appendix

Table 7: MEDINOTE: Roles and Layer access.

$K_{sc}$	Reward Reliability	Judge-Induced Reward SD
1	0.959	2.133
2	0.965	2.089
3	0.977	1.706
4	0.982	1.516
5	0.986	1.347

Appendix

Table 8: Reward stability under repeated judging. Reward reliability measures agreement between independent

K_{sc}

samples, while judge-induced reward SD measures variation in the reward assigned to the same completion.

$K_{sc}$	Mean Reward	Reward SD
1	-3.19	11.39
2	-3.07	11.33
3	-2.97	11.27
4	-2.97	11.28
5	-2.93	11.26

Appendix

Table 9: Reward distribution across different self-consistency sample counts. Mean and standard deviation are computed over the same 360 frozen completions.

	GRADIENT			MEDINOTE
Level	$\delta_{\ell}$	$\gamma_{\ell}$	$\kappa_{\ell}$	$\delta_{\ell}$	$\gamma_{\ell}$	$\kappa_{\ell}$
basic	0.25	1.0	0.50	0.25	1.0	0.50
moderate	0.15	0.8	0.30	0.15	0.8	0.25
detailed	0.12	0.9	0.15	–	–	–
comprehensive	0.10	0.8	0.05	0.10	0.8	0.05

Appendix

Table 10: Routing and dominance parameters for each disclosure level:

\delta_{\ell}

is the required margin,

\gamma_{\ell}

the dominance scaling, and

\kappa_{\ell}

the bias.

	GRADIENT		MEDINOTE
Level	$\phi$	$\psi_{2}$	$\phi$	$\psi_{2}$
basic	$[0,4]$	$[0.00,0.12]$	$[0,5]$	$[0.00,0.10]$
moderate	$[3,10]$	$[0.00,0.25]$	$[4,12]$	$[0.00,0.20]$
detailed	$[8,20]$	$[0.15,0.40]$	–	–
comprehensive	$[12,30]$	$[0.30,1.00]$	$[10,25]$	$[0.30,1.00]$

Appendix

Table 11: Level-specific bounds used by

R_{\text{bound}}

: each entry is the range

[L^{\ell},U^{\ell}]

allowed for

\phi

and

\psi_{2}

at that disclosure level.

Domain	Level	Constraints
GRADIENT	basic	$m_{1}\geq 0.70$
	moderate	$m_{1}\geq 0.55,\ \phi\geq 3$
	detailed	$m_{2}\geq 0.40,\ m_{3}\geq 0.15,\ \phi\geq 8,\ \psi_{\text{strat}}\geq 0.15$
	comprehensive	$m_{3}\geq 0.15,\ \phi\geq 12,\ \psi_{\text{strat}}\geq 0.30$
MEDINOTE	basic	$m_{1}\geq 0.70$
	moderate	$m_{2}\geq 0.60,\ \phi\geq 4$

Appendix

Table 12: Hurdle constraints

\mathcal{H}_{\ell}

used by

R_{\text{hurdle}}

Domain	Level	$n_{\min}^{\ell}$	$n_{\max}^{\ell}$
GRADIENT	basic	30	150
	moderate	50	200
	detailed	100	400
	comprehensive	150	600
	refuse	15	60
MEDINOTE	basic	30	150

Appendix

Table 13: Length ranges (in words) used by

R_{\text{len}}(y,\ell)

		Target $\mu_{\ell}$						Tolerance $\varepsilon_{\ell}$
Domain	Level	$m_{1}$	$m_{2}$	$m_{3}$	$\phi$	$\psi_{1}$	$\psi_{2}$	$m_{1}$	$m_{2}$	$m_{3}$	$\phi$	$\psi_{1}$	$\psi_{2}$
GRADIENT	basic	0.90	0.08	0.02	1	0.05	0.02	0.15	0.12	0.08	2.0	0.12	0.08
	moderate	0.70	0.25	0.05	6	0.20	0.08	0.18	0.15	0.10	3.0	0.15	0.12
	detailed	0.25	0.50	0.25	12	0.45	0.25	0.18	0.18	0.12	4.0	0.15	0.15
	comprehensive	0.20	0.30	0.50	18	0.60	0.50	0.15	0.15	0.12	6.0	0.12	0.12
MEDINOTE	basic	0.90	0.08	0.02	2	0.05	0.02	0.15	0.12	0.08	2.0	0.12	0.08

Appendix

Table 14: Target profiles

\mu_{\ell}

and tolerance vectors

\varepsilon_{\ell}

Zero-shot Prompt
Judge	Leak Rate	Correctness	ADR
GPT-4.1-Nano	46.52	89.63	48.54
Mistral-Small-4	51.18	90.18	44.49
GRPO
Judge	Leak Rate	Correctness	ADR
GPT-4.1-Nano	6.28	96.39	90.34

Appendix

Table 15: Cross-judge evaluation on GRADIENT using Qwen-2.5-14B.

Baseline	GRADIENT	MEDINOTE
Zero-shot	52.0	47.9
Gate	48.5	50.3
SFT	50.2	62.3
SFT + Prompt	56.1	63.1

Appendix

Table 16: Win rate (%) of GRPO vs baselines. Higher indicates GRPO preferred.

GRADIENT
Model	Leak Rate	Correctness	ADR
Mistral Large 3	28.70	92.45	65.52
GPT-5.1	17.92	96.02	79.18
GRPO Qwen-2.5-14B	6.28	96.39	90.34
MEDINOTE
Model	Leak Rate	Correctness	ADR

Appendix

Table 17: Comparison with frontier prompt-based baselines. Metrics in percentages (%).

GRADIENT
Model	Leak Rate	Correctness	ADR
Qwen-2.5-14B	33.81	88.11	58.12
Llama-3.1-8B	31.93	84.46	57.57
Gemma-3-12B	37.28	78.70	48.66
MEDINOTE
Model	Leak Rate	Correctness	ADR

Appendix

Table 18: Post-generation filtering performance across models on GRADIENT and MEDINOTE. The same model is used for both generation and the second-pass filtering step.

	Seed
Configuration	3407	1872	5126	Mean $\pm$ SD
Leak Rate
$R_{\text{full}}$	6.28	4.55	7.31	$6.05\pm 1.39$
$-R_{\text{leak}}$	31.20	32.53	32.66	$32.13\pm 0.81$
$-R_{\text{route}}$	13.77	14.21	14.03	$14.00\pm 0.22$
Correctness

Appendix

Table 19: Multi-seed robustness for the full reward and two representative ablations on GRADIENT using Qwen-2.5-14B. Mean and standard deviation are computed over three training seeds.

	Numeric Specificity				Response Length
Run	Intern	Analyst	Manager	Executive	Intern	Analyst	Manager	Executive
GRPO (standard inference)	0.05	0.70	6.02	13.88	097.7	130.5	261.6	376.0
Zero-shot (standard inference)	1.93	6.20	6.15	8.33	095.6	117.4	117.4	136.9
GRPO (50-word limit)	0.01	0.32	1.60	2.17	027.0	027.8	032.5	034.8
Zero-shot (50-word limit)	1.71	1.38	2.49	2.34	027.6	029.6	029.1	034.1

Appendix

Table 20: Per-role numeric specificity and response length under standard and 50-word-constrained inference on GRADIENT using Qwen-2.5-14B.

	Main metrics (%)			Cross-role sim.
Method	Leak $\downarrow$	Correctness $\uparrow$	ADR $\uparrow$	Jaccard $\downarrow$	Cosine $\downarrow$
Standard inference
Zero-shot	46.52	89.63	48.54	0.445	0.862
GRPO	06.28	96.39	90.34	0.184	0.583
50-word limit
Zero-shot	23.88	92.05	70.58	0.454	0.815

Appendix

Table 21: Performance and cross-role similarity under standard and concise-response inference on GRADIENT using Qwen-2.5-14B. Lower similarity indicates greater differentiation across authorisation levels.

Panel of Figure 7 — Figure 7: Leakage rate under adversarial probing. Each cell shows the count of unauthorised disclosures (out of 100 Intern-level queries).

Evaluation Signal	Fleiss’ $\kappa$	Human–Judge Agreement (%)
Leak Detection	82.21	96.66
Correctness	86.66	93.33
Pairwise Preference	85.81	80.00

Appendix

Table 22: Human validation of LLM judges. Inter-annotator agreement (Fleiss’

\kappa

) and agreement between LLM judges and human consensus.

Model and snapshot	License
Open-weight models (accessed via Unsloth with vLLM)
Qwen-2.5-14B Alibaba (2024) facfb1bad6443964128be460ff6c98928a4ad4ab	Apache-2.0
Llama-3.1-8B MetaAI (2024) a2856192dd7c25b842431f39c179a6c2c2f627d1	Llama Community License
Gemma-3-12B Google (2025) 9478e665381f42974aa06177b019352fb6291876	Gemma Terms of Use
API models (accessed via the provider’s API)
GPT-4.1-Nano OpenAI (2025b) gpt-4.1-nano-2025-04-14	OpenAI Terms of Use

Appendix

Table 23: LLMs used in this study with version and access details. The snapshot identifier is shown below each model name.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 327 papers

Aug 21, 2026

Personalized Privacy Control in LLMs via Attention Head Intervention

The rise of agentic AI enables LLMs to access diverse user data, raising critical privacy concerns. Prior work on contextual privacy studies whether LLMs regulate information disclosure according to context-dependent norms. However, acceptable disclosure boundaries may vary across users even within the same context. To address this limitation, we introduce personalized privacy, which incorporates user-specific disclosure preferences into privacy control. We further present P3Bench~(Personalized Privacy Preservation Benchmark), a novel benchmark extending contextual privacy policies with personalized disclosure policies. Experiments show that prompt-based policies fail to reliably enforce personalized privacy policies, with Qwen2.5-7B and Gemma3-4B showing average policy ignorance ratios of 51.25% and 74.28%, respectively. Finally, to address this problem, we propose Repair, a robust inference-time attention head intervention method that adjusts disclosure behavior toward policy-consistent responses. Our method significantly improves adherence to user-specific privacy preferences by reducing cases where the model fails to follow the given policy.

Junseok Kim, Nakyeong Yang, Kyomin Jung

IPAI, Seoul National University · Max Planck Institute for Software Systems

Privacy-Preserving Language Models Personalized Language Model Alignment Causal Interventions in Language Models

Ask PDF

Sep 28, 2026

Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs

Large language models (LLMs) are increasingly deployed in privacy-critical domains (e.g., healthcare, finance, and government), but their propensity to memorize and disclose personally identifiable information (PII) poses serious security and compliance risks. Existing defenses typically force a trade-off between model utility, privacy protection, and access to fine-tuned private knowledge. We propose LoRA-Oriented Control via Keyed Entry Tokens (Locket), a practical framework that embeds fine-grained, policy-driven access control directly into LLM generation. Locket trains a set of lightweight LoRA (Low-Rank Adaptation) adapters, each encoding a distinct access policy (e.g., full reveal, partial redaction via PII masking, or reveal under a specified differential privacy level). A compact gating module is trained to associate a learned keyed entry token with exactly one LoRA adapter via sequence-level hard routing; the presence of a valid token acts as an authorization key that unlocks corresponding private knowledge, while an invalid or absent token triggers a privacy-preserving adapter that redacts or sanitizes sensitive content. This design ensures Locket remains fully compatible with off-the-shelf LLMs, supporting scalable deployment while satisfying regulatory and privacy requirements. We evaluate Locket across multiple datasets (Enron, ECHR, Yelp) and a diverse set of state-of-the-art LLMs, including Qwen3 (1.7B and 8B), Meta's Llama-3.2 (1B and 3B), and Google's Gemma-2-2B. Our extensive experiments demonstrate that, when the correct token is provided, Locket preserves perplexity comparable to fine-tuning on raw data (without any defense). Conversely, when the token is missing or invalid, it substantially reduces PII leakage while maintaining utility and perplexity on par with strong baseline defenses.

Mohamed Shaaban, Mohamed Elmahallawy

School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA

LLM Security Privacy Leakage in Language Models Privacy-Preserving Language Models

Ask PDF

Oct 21, 2026

Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems

Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect creates a critical risk for agents operating over confidential data. We quantify its realization with 30 synthetic cybersecurity, medical, and military examples, yielding 10,800 final answers from three LLM agents in controlled simulation and 1,440 answers from live agents in two open-source harnesses. Even under benign queries designed to be answerable from one document, GPT-5.6-Sol, the best performing model tested, discloses forbidden composites in 7.08% of answers (95% CI: 3.75-10.67%) in simulation, with worse disclosure rates in live harnesses. Adding visible classification headers and explicit aggregation rules reduces pooled disclosure rates substantially, yet unsafe disclosures persist in 32.37% of simulated answers (95% CI: 28.33-36.19%) across all intents despite these safeguards. Furthermore, increased refusals do not guarantee confidentiality, since significant refusals reveal the prohibited conclusion regardless. These results point to a troubling conclusion: sensitive data leaks via mosaic-style events are an observed confidentiality failure mode in the evaluated settings at non-negligible rates. They motivate stronger controls on what agents may infer and disclose in sensitive data environments with mixed-clearance users.

Daniel Ruiz, Luca Luceri, Emilio Ferrara

Information Sciences Institute University of Southern California Los Angeles, CA, USA

LLM Agent Security Privacy Leakage in Language Models Privacy Protection for LLM Agents

Ask PDF

Abstract

LLM Security

Explore similar work

Personalized Privacy Control in LLMs via Attention Head Intervention

Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs

Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems