arXiv cs.CL· Donghang Duan, Qingyu Liu, Yifei Liu, Na Zou, Xia Hu, Dongrui Liu·· 11 小时前AI 评分42
研究：MCP 工具调用轨迹可推断用户画像，攻击成功率达 26.25%
How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces
AI 导读
研究者提出 PrivacyTrace 基准，用 25 个服务器的真实 MCP 工具生成 1,000 个合成用户画像和 4,000 条智能体轨迹，测试从工具调用轨迹推断用户属性的风险。四个主流 LLM 攻击者的画像推断攻击成功率达 26.25%，高于基于先验猜测的 17.97%。工具参数与返回结果是主要证据来源，跨会话关联轨迹会进一步放大画像风险。
正文 · 原文
Abstract:Large language model (LLM)-based agents interact with external tools through protocols such as the Model Context Protocol (MCP), producing tool-call traces that may expose behavioral signals about users. In this work, we systematically study the risk of user-profile inference from MCP tool-call traces, where observers infer user attributes from protocol-valid tool interactions without access to user conversations. We introduce PrivacyTrace, a benchmark containing 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, generated with real MCP tools from 25 servers. Experiments with four mainstream LLM attackers show that tool-call traces enable a 26.25% attack success rate for profile inference, compared with 17.97% from prior-based guessing. Further analysis reveals that tool arguments and returned results provide the main trace-grounded evidence, while linking traces across sessions further amplifies profiling risk. These findings demonstrate that MCP tool-call traces can act as effective behavioral side channels for user profiling, motivating the development of privacy-aware mechanisms for agent-tool interactions. Code and data are available at this https URL.
| Comments: | 24 pages, 12 figures, 8 tables, including references and appendices |
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL) |
| Cite as: | arXiv:2610.41885 [cs.CR] |
| (or arXiv:2610.41885v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.41885 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Donghang Duan [view email]
[v1]
Fri, 30 Oct 2026 15:30:23 UTC (3,133 KB)
来源：arXiv cs.CL · arxiv.org