SNEAK: Evaluating Strategic Communication and Information Leakage in Large Language Models

Abstract: LLMs are increasingly deployed in multi-agent settings where communication must balance informativeness and secrecy. In such settings, an agent may need to signal information to collaborators while preventing an adversary from inferring sensitive details. However, existing LLM benchmarks primarily evaluate capabilities such as reasoning, factual knowledge, or instruction following, and do not directly measure strategic communication under asymmetric information. We introduce SNEAK (Secret-aware Natural language Evaluation for Adversarial Knowledge), a benchmark for evaluating selective information sharing in LLMs. In SNEAK, a model is given a semantic category, a candidate set of words, and a secret word, and must generate a message that indicates knowledge of the secret without revealing it too clearly. We evaluate generated messages using two simulated agents with different information states: an ally, who knows the secret and must identify the intended message, and a chameleon, who does not know the secret and attempts to infer it from the message. This yields two complementary metrics: utility, measuring how well the message communicates to collaborators, and leakage, measuring how much information it reveals to an adversary. Using this framework, we analyze the trade-off between informativeness and secrecy in modern LLMs and show that strategic communication under asymmetric information remains a challenging capability for current systems. Notably, human participants outperform all evaluated models by a large margin, achieving up to four times higher scores.

• The paper demonstrates that current LLMs achieve high utility in message generation while suffering from significant information leakage.
• It introduces the SNEAK benchmark, quantifying the trade-off between message informativeness for allies and identifiability to adversaries in a controlled one-shot setup.
• Empirical findings reveal that despite advanced techniques, LLMs still lag behind human performance in maintaining selective strategic communication.

SNEAK: Evaluating Strategic Communication and Information Leakage in LLMs

Motivation and Benchmark Overview

SNEAK analyzes a critical but underexplored capability in LLMs: generating utterances that selectively communicate information under conditions of asymmetric information. Unlike conventional benchmarks that focus on isolated reasoning, factual recall, or general instruction following, SNEAK formalizes and quantifies the trade-off between message utility (informativeness for a collaborator) and information leakage (identifiability by an adversary), reflecting application needs in collaborative tutoring, strategic consulting, and privacy-conscious dialogue. The benchmark operationalizes this paradigm using a controlled one-shot communication scenario inspired by the game "The Chameleon." Here, the LLM receives a semantic category, candidate word set, and secret, and must emit a short, natural message signaling knowledge of the secret to an ally while minimizing identifiability to the adversary.

Figure 1: Overview of the SNEAK benchmark, delineating the generation of a strategic message by an LLM and dual evaluation by ally (secret-informed) and chameleon (uninformed adversary) agents.

This setup abstracts away multi-turn dialogue and focuses rigorous evaluation on the subtleties of single-utterance strategic signaling, filling a gap left by multi-agent game benchmarks that do not directly measure utterance-level information dynamics.

Formal Task, Dataset, and Evaluation Protocol

Each SNEAK instance is defined by a semantic category $c$, a candidate set $W = \{w_1, ..., w_{|W|}\}$, and a specified secret $w_s \in W$. The model $f_\theta$ generates a message $m_\theta = f_\theta(c, W, w_s)$, which is then simultaneously subject to:

• Ally evaluation: The ally, with access to $w_s$ and a mixed set of correct and decoy messages, must select which message is most plausibly conditioned on knowing the secret.
• Chameleon evaluation: The adversary, informed only of $c$, $W$, and $m_\theta$, infers a probability distribution over $W$.

Performance decomposes into utility (normalized accuracy for the ally, measuring correct identification of $W = \{w_1, ..., w_{|W|}\}$0 over decoys) and leakage (normalized success of the chameleon in identifying $W = \{w_1, ..., w_{|W|}\}$1). The composite SoftScore is the product $W = \{w_1, ..., w_{|W|}\}$2, ensuring only messages that are simultaneously useful but ambiguous score highly.

Decoy messages are programmatically constructed for controlled experiments using WordNet-derived attributes and alternative LLM-generated distractors to ensure robustness. The benchmark's semantic coverage is broad, with 1,394 instances derived from 117 categories comprising prototypical and diverse word sets, thus precluding overfitting to narrow patterns.

Empirical Results

Utility–Leakage Trade-Off and Model Performance

Modern LLMs exhibit strong utility (e.g., ally recognition rates $W = \{w_1, ..., w_{|W|}\}$3–$W = \{w_1, ..., w_{|W|}\}$4\%), but this frequently coincides with excessive leakage, indicating that models' informative signals are too easily exploitable by adversarial listeners. No model approaches the high utility + low leakage regime realized by human communicators; notably, human participants surpass all LLMs on SoftScore (59.2 vs. maximum LLM SoftScore ≈ 40.8), with $W = \{w_1, ..., w_{|W|}\}$5 higher performance than the weakest models. This reveals a notable generalization failure in utterance-level pragmatic control for current generative models, despite their strong linguistic and factual competence.

Figure 2: Utility–leakage trade-off across models. Marker size indicates SoftScore; the dashed empirical Pareto frontier clarifies that models achieving high utility invariably incur high leakage, in contrast to the superior human baseline.

The empirical frontier (Figure 2) demonstrates that even models employing advanced inference-time scaling—Chain-of-Thought (CoT), Self-Enhanced Test-Time Scaling (SETS), and Recursive Message Refinement (RMR)—nudge performance along this trade-off but do not substantially break the utility-leakage correlation. For example, the RMR technique improves secrecy on some generators (Gemma, Qwen), but is consistently accompanied by a utility reduction, showing that indirectness does not always equate to more effective selective communication.

Human–Model Alignment and Robustness

Evaluations were cross-validated across multiple LLM-based ally and chameleon agents (Mixtral, Llama, Qwen). Score variance and rank order consistency are high (Spearman ρ > 0.90), and there is no evidence of systematic same-model bias. A human annotation study further validates the modeling: human-LLM agreement on ally decision tasks reaches 88.9% (up to 91.7% for majority judgments), and correlation of model evaluation probabilities with human vote shares is $W = \{w_1, ..., w_{|W|}\}$6 for the ally and $W = \{w_1, ..., w_{|W|}\}$7 for the chameleon task, supporting SNEAK’s pragmatic reliability as a scalable, reproducible surrogate of human strategic interpretation.

Figure 3: Evaluation self-bias analysis; LLM-based evaluators show negligible and non-systematic deviation when judging their own generations, demonstrating calibration and protocol robustness.

Sensitivity and Semantics

Performance sensitivity analysis shows predictable monotonic effects: increasing the candidate set size $W = \{w_1, ..., w_{|W|}\}$8 reduces leakage but does not impair utility, while increasing decoy set size $W = \{w_1, ..., w_{|W|}\}$9 reduces utility but not leakage, confirming SNEAK's tight experimental control.

Figure 4: Sensitivity of Gemma-3-27B to the cardinality of candidate sets and decoy messages, confirming the benchmark’s parametric tunability.

Semantic analysis of message types reveals that contextually diagnostic and feature-based associations (rather than direct synonyms or category terms) yield the best selective communication—mirroring patterns in human pedagogy and theory-of-mind reasoning. However, even here, LLMs overuse generically informative strategies, with many “safe” category-level hints insufficiently indirect for high SoftScore.

Comparative Positioning and Limitations

Relative to contemporary benchmarks (e.g., MMLU, MT-Bench, and recent multi-agent games), SNEAK is uniquely positioned in its joint measurement of asymmetric information effects, explicit utility-leakage trade-off, and utterance-level evaluation within a single-turn, controlled setting. Unlike SocialMaze and Mini-Mafia, which evaluate multi-turn coordination but not message discrimination or leakage, SNEAK isolates message generation as the core locus of strategic control.

The main limitation is its abstraction from real, open-ended dialog dynamics and the reliance on model-based judges for evaluation. Nevertheless, human validation and decoy ablation suggest these constraints do not substantially compromise its conclusions. Future extensions may incorporate multi-turn, dynamic games and richer context, integrating theory-of-mind modeling and adversarial training for improved generalization.

Practical and Theoretical Implications

SNEAK demonstrates that even the most capable LLMs to date lack pragmatic control to reliably balance context-sensitive informativeness and secrecy, a cornerstone for deploying agents in settings that implicitly require privacy, pedagogical restraint, or strategic signaling. The results encourage focused research into amortized pragmatic reasoning, the integration of explicit theory-of-mind modules, and scalable joint optimization of utility and leakage during training.

On the practical side, the explicit behavioral metrics and evaluation protocol are readily adaptable for safety auditing, red-teaming, and the development of LLMs in domains requiring high assurance of privacy-preserving behavior (e.g., education, law, financial consulting), as well as in mechanisms where selective signaling is desirable or necessary.

Conclusion

SNEAK offers a rigorous, reproducible benchmark for strategic communication under asymmetric information in LLMs. Evaluations expose that despite high communicative competence, current models conflate informativeness with identifiability, suffering high information leakage even as they score highly on classical utility metrics. This exposes a fundamental gap between LLM and human selective communication capabilities and motivates future research at the intersection of computational pragmatics, adversarial robustness, and multi-agent alignment (2603.29846).