cs.CR提交于 2026-11-02已译

工具调用能泄露多少你的信息？工具调用轨迹的隐私泄露

How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces

Donghang Duan · Qingyu Liu · Yifei Liu · Na Zou · Xia Hu · Dongrui Liu

中文摘要

基于大语言模型（LLM）的智能体通过 Model Context Protocol（MCP）等协议与外部工具交互，产生的工具调用轨迹可能暴露用户的行为信号。系统研究从 MCP 工具调用轨迹推断用户画像的风险：观察者无需访问用户对话，仅凭协议合法的工具交互即可推断用户属性。提出 PrivacyTrace 基准，包含 1,000 个合成用户画像与 4,000 条智能体轨迹，覆盖四个领域，由来自 25 个服务器的真实 MCP 工具生成。四个主流 LLM 攻击者实验显示，工具调用轨迹使画像推断攻击成功率达 26.25%，而基于先验的猜测为 17.97%。进一步分析表明，工具参数与返回结果是轨迹证据的主要来源，跨会话关联轨迹会进一步放大画像风险。这些发现表明 MCP 工具调用轨迹可作为有效的用户画像行为侧信道，需要为智能体-工具交互开发隐私感知机制。代码与数据见 https://github.com/AI45Lab/PrivacyTrace。

关键要点

01研究 MCP 工具调用轨迹在无对话访问下推断用户画像的隐私风险
02构建 PrivacyTrace 基准：1,000 个合成用户画像、4,000 条轨迹、25 个真实 MCP 服务器
03四个主流 LLM 攻击者画像推断成功率达 26.25%，高于先验猜测的 17.97%
04工具参数与返回结果是主要证据来源，跨会话关联轨迹进一步放大风险

解读

尚无解读。

原始英文摘要

arXiv:2610.41885v1 Announce Type: cross Abstract: Large language model (LLM)-based agents interact with external tools through protocols such as the Model Context Protocol (MCP), producing tool-call traces that may expose behavioral signals about users. In this work, we systematically study the risk of user-profile inference from MCP tool-call traces, where observers infer user attributes from protocol-valid tool interactions without access to user conversations. We introduce PrivacyTrace, a benchmark containing 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, generated with real MCP tools from 25 servers. Experiments with four mainstream LLM attackers show that tool-call traces enable a 26.25% attack success rate for profile inference, compared with 17.97% from prior-based guessing. Further analysis reveals that tool arguments and returned results provide the main trace-grounded evidence, while linking traces across sessions further amplifies profiling risk. These findings demonstrate that MCP tool-call traces can act as effective behavioral side channels for user profiling, motivating the development of privacy-aware mechanisms for agent-tool interactions. Code and data are available at https://github.com/AI45Lab/PrivacyTrace.