SNEAK: Evaluating Strategic Communication and Information Leakage in Large Language Models

1. Problem Statement

Large Language Models (LLMs) are increasingly deployed in multi-agent environments where communication must balance informativeness (helping collaborators) and secrecy (preventing adversaries from inferring sensitive details). This creates a challenge known as the assistance dilemma or strategic signaling under asymmetric information: an agent must signal knowledge of a secret to a collaborator without revealing that secret to an uninformed observer.

Current LLM benchmarks (e.g., MMLU, GSM8K) primarily evaluate reasoning, factual knowledge, or instruction following in single-agent settings. They fail to measure a model's ability to control information leakage when communicating with other agents who possess different information states. There is a lack of standardized frameworks to evaluate whether models can generate messages that are useful to an "ally" but ambiguous to an "adversary."

2. Methodology: The SNEAK Benchmark

The authors introduce SNEAK (Secret-aware Natural language Evaluation for Adversarial Knowledge), a benchmark inspired by the party game The Chameleon.

Task Definition

The task is a one-shot asymmetric communication game involving:

• Inputs: A semantic category $c$, a set of candidate words $W$, and a specific secret word $w_s \in W$.
• Generator: A language model $f_\theta$ observes $(c, W, w_s)$ and generates a short natural language message $m$.
• Agents:
  • The Ally: Knows the secret word $w_s$. Given the category, candidates, and a set of messages (including the generated one and decoys), the ally must identify which message corresponds to the secret.
  • The Chameleon (Adversary): Does not know the secret. Given the category, candidates, and the message, the chameleon must infer the secret word from the candidate set.

Evaluation Metrics

The framework decomposes communication performance into two complementary metrics:

1. Utility: Measures how well the message communicates to the ally. It is the probability the ally assigns to the correct message, normalized against random guessing.
2. Leakage: Measures how much information the message reveals to the adversary. It is the probability the chameleon assigns to the correct secret word, normalized against random guessing.

To capture the trade-off, the authors define a SoftScore:
$$\text{SoftScore}(m) = \text{Utility}(m) \times (1 - \text{Leakage}(m))$$
This multiplicative score rewards messages that are highly useful to the ally while minimizing information leakage to the adversary. A stricter BinaryScore is also used, counting a success only if the ally ranks the message highest and the chameleon does not rank the secret highest.

Dataset and Setup

• Source: Derived from 117 semantic categories (concrete and abstract) from category production norms.
• Scale: 1,394 benchmark instances.
• Decoys: For the ally task, 5 semantically related "decoy" messages are generated without access to the secret word to serve as negative examples.
• Evaluation Protocol: Uses three independent LLMs (Mixtral, Llama, Qwen) as simulated agents to ensure robustness and reduce bias from a single evaluator.

3. Key Contributions

1. SNEAK Benchmark: The first benchmark specifically designed to evaluate selective information sharing in LLMs, covering diverse semantic domains.
2. Behavioral Evaluation Framework: A novel approach that decomposes communication into Utility and Leakage, enabling objective, reproducible measurement of strategic signaling capabilities.
3. Empirical Analysis: A comprehensive study of modern LLMs (including GPT-5, Claude, DeepSeek, Llama, etc.) revealing a persistent inability to balance these competing objectives compared to human performance.

4. Results

The authors evaluated a wide range of instruction-tuned models (Open and Closed source) and compared them against baselines and human participants.

• Human vs. Model Performance: Human participants significantly outperform all evaluated models, achieving up to 4× higher SoftScores. Humans achieve high utility (91.26) while maintaining low leakage (33.81).
• The Utility-Leakage Trade-off: Modern LLMs generally exhibit a strong trade-off. Models that achieve high utility (e.g., DeepSeek-V3.2, Mixtral-8x22B) tend to incur high leakage.
  • Example: DeepSeek-V3.2 achieved 98.52 Utility but 75.42 Leakage.
  • Example: Humans achieved 91.26 Utility with only 33.81 Leakage.
• Inference-Time Scaling: Methods like Chain-of-Thought (CoT), Self-Enhanced Test-Time Scaling (SETS), and Recursive Message Refinement (RMR) were tested.
  • While CoT and SETS improved utility, they often increased leakage or failed to improve the composite SoftScore significantly.
  • RMR showed some promise in reducing leakage for specific models (e.g., Gemma-3) but often at the cost of utility.
• Semantic Analysis:
  • Abstract vs. Concrete: Abstract categories allowed for better selective communication (higher SoftScore) than concrete ones, likely because abstract concepts permit more indirect associative hints.
  • Message Types: Messages based on intrinsic properties (entity relations) and contextual associations (temporal/situational) performed best. Messages relying on broad taxonomic relations (e.g., synonyms) were often too ambiguous for allies or too obvious for adversaries.

5. Significance and Conclusion

• Gap in Capabilities: The study highlights a critical gap in current LLMs: while they are excellent at generating informative content, they struggle with strategic communication—the ability to modulate information flow based on the listener's knowledge state.
• Safety and Privacy: The ability to control information leakage is crucial for applications in privacy-preserving communication, tutoring (hinting without giving answers), and secure multi-agent systems.
• Future Directions: SNEAK provides a controlled environment to study these behaviors. The results suggest that current models lack the "Theory of Mind" or pragmatic reasoning required to navigate the tension between being helpful and being secretive.

In summary, SNEAK demonstrates that while LLMs can generate high-quality messages, they currently lack the strategic nuance to communicate effectively in asymmetric information settings, often revealing too much information to unintended observers.