PaperlayerView exact revision on arXiv

Source-linked AI summary

Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies

Barkha Rani

arXiv:2607.06815v1cs.CR

TL;DR

Behavioral traces can reveal private negotiation constraints despite cryptographic protection. The paper develops an adaptive randomized policy with formal privacy and convergence guarantees, reducing adversarial inference accuracy by 43–50% while achieving a 90.4% negotiation success rate in 3,000 synthetic bilateral negotiations.

  • Problem

    Existing cryptographic defenses protect explicit constraint data but do not address inference from observable negotiation behavior, including offers, concessions, timing, and convergence.

  • Method

    The paper formalizes behavioral differential privacy and develops an adaptive randomized policy with phase-calibrated noise, feasibility-preserving post-processing, and convergence guarantees.

  • Results

    43–50% reduction in adversarial inference accuracy and a 90.4% negotiation success rate were observed across 3,000 synthetic bilateral negotiations while maintaining non-private utility levels.

  • Takeaways & Limitations

    The results support behavioral privacy protection in single-issue bilateral negotiation without sacrificing convergence, negotiation success, or non-private utility levels.

  • Takeaways & Limitations

    The threat model assumes a passive adversary, while active adversaries probing constraints through strategic offers remain an important direction for future work.

Abstract

from arXiv · show

Autonomous negotiation agents are increasingly deployed in high-stakes settings such as insurance and procurement. While cryptographic techniques protect explicitly disclosed constraint values, they fail to address a subtler threat: behavioral privacy leakage, where an adversary infers private constraints from observable negotiation dynamics such as concession trajectories, timing, and convergence patterns. This paper investigates behavioral differential privacy in multi-round negotiation protocols. We design an adaptive stochastic negotiation policy that jointly guarantees $(\varepsilon, δ)$-differential privacy, almost-sure convergence of the offer sequence (reaching agreement when the counterparty's reservation value permits), and high negotiation utility. Evaluated on 3,000 synthetic bilateral negotiations, our mechanism reduces adversarial inference accuracy by 43-50% while maintaining a negotiation success rate and utility above 90%, demonstrating that strong privacy guarantees can be achieved without significant loss of performance.

1 Introduction

Behavioral privacy leakage arises because observable negotiation dynamics can reveal private constraints despite cryptographic protection. This paper formalizes behavioral differential privacy for sequential negotiations and proposes a mechanism balancing privacy, convergence, and utility.

  • Problem: Observable offer sequences, concession trajectories, response timing, and convergence speed form a behavioral side channel for inferring private constraints.Cryptographic protection of explicit data does not prevent inference from negotiation behavior.
  • Problem: Behavioral privacy leakage has not been formally studied in sequential negotiation, while existing privacy-preserving negotiation work protects explicit constraints and static differential privacy does not transfer directly.The paper identifies a gap between cryptographic constraint protection and multi-round behavioral inference.
  • Contributions: The paper formalizes behavioral differential privacy over observable negotiation traces and develops a mechanism satisfying (ε, δ)-DP while converging almost surely and preserving high negotiation utility.The formalization uses constraint-space adjacency capturing budget proximity and applies privacy guarantees to observable offer-sequence distributions.
  • Empirical validation: 43–50% lower adversarial inference accuracy is achieved relative to a non-private baseline across 3,000 synthetic bilateral negotiations.The evaluation uses negotiations generated from the proposed model.
  • Empirical validation: 90.4% negotiation success rate is maintained while non-private utility is maintained or slightly improved.The mechanism is evaluated in settings where the counterparty’s reservation value can permit agreement.

2 Related Work

Prior work establishes capable autonomous negotiators, cryptographic protection of disclosed constraints, differential privacy for static settings, and game-theoretic negotiation foundations, but leaves behavioral inference in sequential negotiation unresolved. This paper addresses that gap by formalizing privacy, convergence, and adversarial-evaluation requirements together.

  • Foundation-model agents and LLM-based negotiators exhibit sophisticated collaborative and strategic behavior, but prior systems do not mitigate privacy risks from observable negotiation behavior.
  • Cryptographic methods protect actual negotiation constraints, yet they do not prevent inference from concession trajectories, response timing, and convergence patterns.
  • Differential privacy offers calibrated-noise mechanisms and composition theorems, but existing formulations target static databases or training rather than sequential strategic interactions.
  • Inference attacks and side-channel studies show that observable outputs and implementation behavior can leak private information, while related negotiation work does not formalize inference over sequential traces or provide convergence-preserving defenses.
  • Nash bargaining, Rubinstein’s alternating-offers model, and mechanism design provide foundations for rational bilateral negotiation and incentive-compatible protocols.
  • No prior work simultaneously formalizes negotiation-space DP adjacency, provides convergence guarantees under randomization, and validates defenses against adversarial inference in synthetic bilateral negotiations.

3 Threat Model

The threat model considers a passive external adversary that observes complete negotiation traces and infers private constraints from behavioral signals without directly observing or influencing the agent. Behavioral differential privacy requires statistically indistinguishable offer-sequence distributions for nearby constraints while preserving negotiation effectiveness, with active-adversary extensions left for future work.

  • 3 Threat Model: A passive external adversary observes the full message sequence but does not participate in or interfere with negotiations.The adversary does not directly observe the agent’s private constraint θ.
  • 3 Threat Model: The observable trace includes offers, inter-round timing, final agreement and outcome, and total rounds to convergence.These signals expose temporal, trajectory, concession, and convergence leakage about urgency, reservation-value proximity, private budgets, and constraint tightness.
  • 3 Threat Model: Adversaries train A: τ ↦ θ̂ on historical negotiations, using XGBoost, random forests, or neural networks to infer θ.The predictive models map observable negotiation traces to estimates of the private constraint.
  • 3 Threat Model: Behavioral differential privacy requires statistically indistinguishable observable offer sequences for constraint pairs satisfying |θ−θ′| ≤ Δ.The mechanism applies (ε, δ)-differential privacy over traces, with adjacency defined on the constraint space rather than datasets.
  • 3 Threat Model: 90% is the minimum negotiation success rate, Nash surplus must retain at least 90% of the deterministic baseline, and convergence time must not exceed 1.5× baseline.Nash surplus is defined as NS = o_T/θ, the ratio of final agreed value to the private constraint.
  • 3 Threat Model: The framework focuses on passive trace observers; extending guarantees to active, adaptive, or repeated-interaction adversaries remains future work.Such adversaries could probe private constraints by adapting negotiation strategies or exploiting multiple negotiations.

4 Methodology

The methodology randomizes negotiation offers to protect private constraints while preserving almost-sure convergence and high utility. It combines phase-adaptive noise, feasibility post-processing, and composed privacy accounting over observable traces.

  • Design objectives: The mechanism targets (ε, δ)-differential privacy over observable negotiation traces, almost-sure offer convergence, and high utility relative to the deterministic baseline.Agreement is reached when the counterparty’s reservation value permits.
  • Baseline policy: The deterministic baseline concedes monotonically toward private constraint θ, reaching θ at t = T and fully revealing θ through its trajectory.The baseline is optimal in expectation but exposes the private constraint behaviorally.
  • Adaptive randomization: The policy concentrates adaptive randomization in diagnostic opening rounds and tapers noise near convergence to protect utility when agreement is imminent.σmax sets peak randomization, while β > 0 controls temporal noise decay.
  • Safety and feasibility: A deterministic safety critic clips noisy offers to enforce feasibility, preserving privacy through post-processing while acknowledging that clipping to θ can itself leak the constraint.Clipping to a public proxy value ¯θ ≥ θ is identified as an alternative.
  • Privacy accounting: Round-wise privacy costs are aggregated through sequential composition, with Advanced Composition addressing the unbounded cost produced by naive εt = ∆/σt accounting as σt → 0.The per-round budget depends on noise magnitude and offer-function sensitivity.

5 Experimental Evaluation

The mechanism is evaluated on 3,000 synthetic bilateral negotiations against multiple inference adversaries and privacy budgets. It reduces behavioral inference while preserving negotiation utility, success, and robustness to adaptive attackers.

  • Dataset and Evaluation Setup: 3,000 synthetic bilateral negotiations were generated with uniformly sampled private constraints θ from [$2, 000, $8, 000].The simulations model concession behavior, bounded rationality, and temporal dynamics resembling procurement and insurance negotiations.
  • Dataset and Evaluation Setup: Three adversaries—XGBoost, Random Forest, and Neural Network—were trained on deterministic traces and evaluated on randomized-mechanism traces.Each adversary was trained on N = 2, 000 negotiations; an adaptive meta-learning adversary was additionally evaluated.
  • Privacy Results: 43.2%, 43.1%, and 50.5% reductions in adversarial inference accuracy were achieved against XGBoost, Random Forest, and Neural Network, respectively.The evaluation used the randomized mechanism with σmax = 0.25; a naïve mean-prediction baseline achieved approximately 10% accuracy.
  • Utility Results: 0.908 Nash surplus, compared with 0.890 for the deterministic baseline, was achieved alongside a 90.4% negotiation success rate.Average convergence time increased by 1.43×, remaining below the 1.5× utility constraint.
  • Adaptive-Adversary Robustness: 34.1% versus 32.5% inference accuracy shows that an adaptive meta-learning adversary improved accuracy by only 1.6% over the standard neural network adversary.The result supports strong privacy against adversaries adapting to the randomized mechanism.

6 Theoretical Guarantees

The section establishes formal privacy, almost-sure convergence, and utility guarantees for the randomized negotiation policy, while identifying deployment and accounting limitations. Convergence and agreement are guaranteed under a reservation-value condition, whereas privacy certification depends on public-proxy clipping and a positive noise floor.

  • Privacy Guarantee: Gaussian noise limits how private-constraint changes affect observable negotiation traces, yielding per-round (ε_t, δ_t)-DP and a total budget through sequential composition.For adjacent constraints with |θ − θ′| ≤ ∆, the offer sensitivity is bounded by ∆ and ε_t = ∆/σ_t.
  • Privacy Guarantee: The formal end-to-end certificate requires public-proxy clipping; private-θ clipping is used experimentally and needs refined adjacency analysis because of additional leakage.Public-proxy clipping makes the safety critic’s clip step a deterministic function of public information, while the recommended deployment configuration replaces private-θ clipping.
  • Privacy Guarantee: The practical noise floor σ_t ≥ σ_min = 0.05 keeps every per-round privacy cost finite, avoiding the infinite final-round cost caused by σ_T = 0.The issue arises under σ_t = σ_max(1 − t/T)^β, which gives σ_T = 0 at the final round.
  • Convergence Guarantee: Under σ_max < θ − o_min, the safe offer sequence converges almost surely to a fixed point in [o_min, θ] within finite expected rounds.Agreement occurs whenever the counterparty’s reservation value lies within this interval; the empirical success rate is 90.4%.
  • Utility Guarantee: The expected utility loss from randomization is bounded by O(T · σ^2_max), while empirical Nash surplus rises monotonically with σ_max under asymmetric clipping.The theoretical bound is worst-case and does not preclude practical utility gains from preserved downward improvements and bounded upward deviations.
  • Privacy Guarantee: The privacy certificate can have large absolute ε_total values, so empirical reductions in adversarial inference accuracy complement the worst-case leakage bound.The certificate is evaluated against the chosen adjacency structure and paired with empirical privacy measurements under realistic negotiation conditions.

7 Discussion

The discussion positions behavioral differential privacy as complementary to cryptographic privacy, while identifying deployment tradeoffs, limitations, and directions for extending the mechanism. It also interprets public randomization as a possible commitment device that may influence counterparty behavior.

  • Privacy Design: Behavioral differential privacy obscures inference from offer dynamics, whereas cryptographic mechanisms prevent disclosed values from revealing private constraints; together they provide defense-in-depth.The two approaches address different threat surfaces: transmitted information versus observable negotiation behavior.
  • Limitations: σmax ≥1.0 preserves privacy but may reduce negotiation success rates toward the 90% threshold, limiting margin for time-critical applications.Privacy and utility therefore require calibration to the deployment context.
  • Limitations: Clipping offers to [omin, θ] can reveal the seller’s private constraint through an observable ceiling, motivating clipping to a public proxy value ¯θ ≥θ.Early-round noise makes direct inference difficult, but the safety critic remains an open improvement target.
  • Game-Theoretic Interpretation: The noise parameter σmax acts as a commitment device because publicly randomized behavior signals unreliable inference and may encourage more cooperative counterparty strategies.The equilibrium implications of this interpretation remain to be formally analyzed.
  • Future Work: Open challenges include multi-issue and multi-party extensions, larger real-world datasets beyond 3,000 simulated negotiations, tighter Rényi DP analysis, and stronger threat models.The current formulation addresses single-issue bilateral negotiation, and εtotal may be large in absolute terms.

8 Conclusion

The paper formalizes behavioral privacy leakage in agentic negotiation as inference of private constraints from observable dynamics despite cryptographic protection. It presents a randomized mechanism combining differential privacy, convergence guarantees, high utility, adaptive noise, and feasibility enforcement.

  • 8 Conclusion: Behavioral privacy leakage arises when adversaries infer private constraints from observable negotiation dynamics despite cryptographic protection of explicit constraint data.The threat is framed as complementary to existing cryptographic privacy defenses.
  • 8 Conclusion: The randomized negotiation mechanism provably satisfies (ε, δ)-differential privacy over observable traces while guaranteeing almost-sure offer-sequence convergence and high negotiation utility.These guarantees are stated jointly for the proposed mechanism.
  • 8 Conclusion: Adaptive phase-calibrated noise and a safety critic enforcing per-round feasibility through deterministic post-processing form the mechanism’s core technical contribution.The noise schedule adapts to negotiation phase, while the critic preserves feasibility at each round.
  • 8 Conclusion: The author declares no competing interests relevant to the article’s content.This disclosure concerns conflicts of interest.
Loading 2607.06815v1…