Beyond What Users Disclose: Measuring Inferential Privacy Risk in Conversational LLMs

LLM-based conversational agents have become integral to everyday personal and professional computing, with users routinely disclosing personal information to obtain assistance with tasks ranging from content generation to decision support. Although the privacy literature has long recognized inferential risk from data linkage, the widespread adoption of LLM-powered systems that retrieve and integrate external data sources has transformed it from a theoretical concern into a practical and personalized threat. These systems can infer sensitive attributes from conversational context alone, and far more when augmented with externally retrieved third-party data, widening the gap between what users believe they share and what the system can infer. In this paper, we propose a measure of this privacy risk, operationalized as the lift in the probability of inferring a sensitive attribute value relative to a baseline prior, and we validate it in a user study, examining how users respond to the presence of external data. We quantify the risk empirically through a between-subjects user study ($N=565$) using PRISE, a real-time Privacy Risk Inference System with provenance-based Explainability for LLMs that shows users, in real time, which attributes the system infers about them and whether each inference is drawn from their own messages or from externally retrieved data. We found that external data retrieval substantially amplified inferential privacy risk across most attribute types, with marital status showing a 51\% lift and age group a 32\% lift, even when users disclosed little identifying information. These results establish that external data-augmented conversational systems pose an inferential privacy risk that is both measurable and practically significant, and that explainability mechanisms can serve as a necessary awareness layer complementing technical privacy protections.