You know how you can whisper something to a friend at a party, then thirty minutes later someone across the room casually references it — and you realize the whole room heard? That's what's happening inside LLM conversations. You tell the model your SSN during a tax-help turn, drift into recipe advice, and a later prompt — especially one that sounds persuasive or authoritative — can pull that secret right back out. PrivDrift is the first benchmark designed to measure exactly this failure mode. The paper's committed claim: user-disclosed secrets remain behaviorally recoverable through later prompts even after substantial conversational topic drift, and this leakage is persistent — it doesn't reliably decay with more drift. This isn't about training-data memorization or adversarial jailbreaks. It's about the model's in-context behavior during a single active conversation. The distinction matters because it means the threat model is different: the attacker doesn't need access to weights or training data, just a shared session or a well-timed follow-up prompt. The benchmark itself is cleanly constructed: 1,000 controlled multi-turn dialogues, each seeded with a specific secret (think passwords, medical details, financial info), followed by content-dense topic-drift turns, then standardized extraction probes of varying persuasion intensity. Across three LLMs with extended context windows, dialogue-level hybrid leakage ranged from 38.7% to 54.6%. That's not an edge case — that's a coin flip. Leakage varies strongly by model, secret type, and persuasion intensity, which tells you the problem isn't uniform but it's also not rare. The most consequential finding is the negative result: within the tested drift window, adding more topic drift does not reliably reduce leakage. If you hoped that burying a secret under enough unrelated conversation would make it go away, PrivDrift says no. The model's attention mechanism doesn't forget just because you changed the subject. This reframes the privacy risk from "how do we prevent immediate extraction" to "how do we handle persistent behavioral availability of disclosed information." Architecturally, this is a measurement paper, not a methods paper. The contribution is the benchmark and the empirical finding, not a new defense. The paper tests three unnamed LLMs with extended context windows — a limitation worth noting, since the specific models aren't identified in the abstract. The probing strategy uses persuasion-based extraction at varying intensities, which is a more realistic threat model than simple regurgitation prompts but less adversarial than state-of-the-art red-teaming. Integrity-wise, the controlled synthetic dialogue setup is both a strength and a limitation. The 1,000 dialogues provide statistical power, and the standardized probes enable fair comparison across models. But synthetic dialogues aren't real user conversations — the secrets are planted, the drift is scripted, and the probes are formulaic. Real conversations are messier, which could mean leakage is higher (natural disclosure is less guarded) or lower (real drift is more chaotic). The paper doesn't compare against any prior leakage benchmark because, to its credit, none existed for this specific threat model. The practical implication is immediate and uncomfortable: every system that allows multi-turn LLM conversations with user-disclosed sensitive information — medical chatbots, financial assistants, HR tools, therapy bots — has a latent privacy exposure that doesn't go away with topic changes. Session segmentation, explicit secret scrubbing, or context window management aren't optional niceties. They're load-bearing privacy infrastructure that most deployments haven't built.
