Are Multimodal Agents Aware of Privacy? LoRA Adaptation for Authorized Physiological Sensing

Multimodal agents can infer physiological information from facial video, directly or through sensing tools, but capability does not imply authorization. We study this gap as an inference-time privacy problem and audit whether authorization is established before rPPG-based heart-rate inference. A supporting audit of widely used multimodal assistants shows that some capable systems estimate heart rate from neutral requests without first checking authorization. In a controlled Qwen2.5-VL-3B-Instruct environment, the base model invoked physiological sensing in all five tested authorization conditions. An authorization-aware LoRA adapter withheld sensing in all four conditions without valid trusted authorization—missing authorization, explicit non-consent, free-text consent, and invalid trusted authorization—and executed the protected rPPG route only after valid trusted authorization. Under explicit non-consent, however, it requested authorization rather than explicitly refusing, revealing a remaining semantic limitation. These results show that authorization-aware adaptation can gate physiological tool use at inference time and motivate privacy-aware multimodal agents for sensitive physiological sensing.