Beyond PII: How Users Attempt to Estimate and Mitigate Implicit LLM Inference
This addresses privacy risks for users interacting with LLMs, but it is incremental as it builds on prior demonstrations of inference risks.
The study investigated how users estimate and mitigate implicit personal attribute inference by LLMs from text, finding that participants performed slightly better than chance at anticipating risks and their rewrites were effective in only 28% of cases.
Large Language Models (LLMs) such as ChatGPT can infer personal attributes from seemingly innocuous text, raising privacy risks beyond memorized data leakage. While prior work has demonstrated these risks, little is known about how users estimate and respond. We conducted a survey with 240 U.S. participants who judged text snippets for inference risks, reported concern levels, and attempted rewrites to block inference. We compared their rewrites with those generated by ChatGPT and Rescriber, a state-of-the-art sanitization tool. Results show that participants struggled to anticipate inference, performing a little better than chance. User rewrites were effective in just 28\% of cases - better than Rescriber but worse than ChatGPT. We examined our participants' rewriting strategies, and observed that while paraphrasing was the most common strategy it is also the least effective; instead abstraction and adding ambiguity were more successful. Our work highlights the importance of inference-aware design in LLM interactions.