AI 时代最私密的对话，可能不是你发出的那一句，而是 Agent 帮你发起的那一次工具调用。
你让 AI 助手查下周去伦敦的路线，它顺手调了地图服务；你让它整理体检报告，它连上了健康数据库。你和它的对话内容，理论上只有你和模型厂商能看到。但上海人工智能实验室 AgentDoG 团队最近发布的一项研究提醒我们：即便对话全程保密，AI Agent 在后台调用工具时留下的“作业痕迹”，也足以让观察者拼出你住哪里、信什么教、身体怎么样，勾出一幅相当完整的画像，虽然猜不出你的名字。
这项题为《工具调用能在多大程度上暴露你？来自工具调用轨迹的隐私泄露》的研究，由上海人工智能实验室联合电子科技大学、悉尼大学完成，构建了一个叫 PrivacyTrace 的基准，系统量化了这层此前被忽视的风险。结论并不玄学，而是一组可复现的数字。
（论文地址：https://arxiv.org/abs/2610.41885）
有人可能会问：AI 圈天天在谈隐私，这研究有什么新鲜的？新鲜就新鲜在攻击面。过去的安全研究盯的是两类问题：一是 Agent 会不会主动索取不该拿的数据，二是恶意工具会不会骗 Agent 泄密。而这项研究里的所有工具都规规矩矩，协议调用完全合法，没有任何一方“作恶”，风险却照样存在。它是数字隐私史上一个熟悉剧本的最新版本：二十年前，一份匿名化的搜索日志，让用户仅凭搜索关键词就被认出了真实身份；十多年前，Facebook 上的点赞暴露了性取向和政治倾向；现在，轮到 Agent 的工具调用了。
一场没有对话的“读心术”
先说清楚攻击者的位置。在大模型 Agent 的主流架构里，模型通过 MCP（Model Context Protocol，模型上下文协议）这类标准接口去调用外部工具：地图、日历、健康服务、购物平台。每次调用都会生成一条记录，包含工具名、传入的参数、返回结果和调用顺序，这就是所谓“工具调用轨迹”（tool-call traces）。
关键在于：工具服务器看不到你和 Agent 的对话，却能完整看到这些调用记录。而一个架在中间的网关或聚合平台，甚至能看到你所有任务的全部轨迹。研究者把这两类观察者分别称为“本地观察者”和“全局观察者”。这些都是半诚实（semi-honest）观察者：它们老老实实完成本职工作，只是顺手“多看了一眼”自己本来就有权限看到的数据。这恰恰是最难防范的一类，因为它不违反任何规则。
举个例子。你让 Agent 规划下周的通勤和办事路线，轨迹里会出现目的地的地理编码结果、出行时间和交通方式。单独看每一条都平平无奇，但这些线索组合在一起：目的地落在伦敦某医院区域，出行严格避开安息日，从周五日落到周六夜间一律只步行，一个旁观的服务器就能推断出：你可能居住在伦敦，患有慢性肾病，信仰犹太教。你一个字都没说过，但你的行为替你说了。
PrivacyTrace：给一千个虚拟用户做“CT”
要量化这种风险，最大的障碍是拿不到真实的隐私数据。没人愿意把自己的病历交给研究者做攻击实验。团队的做法是合成：他们参考联合国、世界银行、UNESCO、国际劳工组织等机构的人口统计分布，用迭代比例拟合（IPF）生成 1,000 个统计上贴近真实人口结构的虚拟用户，每个用户带 17 项属性，包括国籍、年龄、职业、宗教信仰、身心健康、收入等。
接着，围绕旅行、健康、购物、职业学习四个领域，用 25 个真实 MCP 服务器的真实工具执行任务，产出 4,000 条 Agent 轨迹、共 67,950 条工具调用记录。最后让四个主流大模型（DeepSeek-V4-Flash、GPT-5.5、Gemini-3-Flash、MiniMax-M3）扮演“攻击者”，只看轨迹、不看对话，去推断这 17 项属性。
这个设计巧妙的地方在于对照：攻击者如果只拿到属性清单去“盲猜”，是基线；拿到轨迹后再猜，多出来的那部分准确率，就是轨迹泄露的净证据。为了公平，评分采用强制预测：17 项属性每项都必须给出答案，猜错算错，语义匹配由另一个未接触轨迹的裁判模型裁定，模糊地带一律判错。整套流程对每个攻击者一视同仁。
还有个现实的细节：四位攻击者的成绩其实相差不大，从 25.29% 到 28.32%，但成本天差地别。论文估算的成本里，GPT-5.5 跑完全部实验约 1,080 美元，DeepSeek-V4-Flash 只要约 46 美元，效果几乎持平。换句话说，发动这类画像攻击的门槛，比大多数人想象的低得多。
数字说话：26.25% 意味着什么
实验结果：盲猜的攻击成功率（ASR）是 17.97%，而拿到单域轨迹后升到 26.25%，净增 8.28 个百分点。换算下来，17 项属性平均只猜对四到五项，比盲猜多猜对一两项：够拼出轮廓，远够不到看穿。
更值得注意的是观察者范围的影响：单个 MCP 服务器只能看到 24.24%，单个域是 26.25%，而把同一个用户跨四个领域的会话串联起来，成功率跳到 32.77%。可见范围越大，画像越清晰。需要说明，论文同时提醒这三个数字来自三组不同的统计口径，只能视为关联而非因果；同一口径的配对实验里，从单服务器视角扩大到单域视角，成功率实际只提升 3.09 个百分点。
分属性看，泄露最严重的是国籍（57.73%）和宗教信仰（50.03%），出行和购物类任务的泄露明显高于职业学习。也有让人松口气的部分：精确身份标识很难猜。16,000 个标识符预测槽里，只有 35 次猜对，其中 34 次是姓名、1 次是电话号码，邮箱和政府身份标识的正确次数为零。轨迹泄露的是“画像”，不是“身份”。
泄露从哪里来：参数比结果更“多嘴”
拆开轨迹的四个组成部分（元数据、调用顺序、参数、返回结果）逐一消融，答案很清楚：工具参数贡献最大。只有元数据和调用顺序时，成功率仅 14.53%，甚至低于盲猜；加入参数后飙到 27.71%，净增 13.18 个百分点；换成只加入返回结果，升到 24.54%，净增 10.01 个百分点。参数确实是信息量最大的通道。
道理不难理解：参数是 Agent 替你做出的选择。你查什么地址、问什么药、预算设多少，全写在参数里。返回结果里常夹带与用户无关的候选项：完整轨迹 26.25% 反而低于只看参数的 27.71%，论文对此的解读是，返回内容既可能印证参数里的线索，也可能稀释它们，两种机制目前还无法区分。一个耐人寻味的细节是：哪怕服务器只看到请求参数、完全看不到返回内容，泄露也几乎不打折扣。这给防御指了一条明路：与其纠结返回数据，不如先管好请求参数。
研究还验证了一种“两段式”攻击：先从轨迹里挑出有证据支撑的属性，第一阶段只选中了 17.06% 的属性槽，但选中部分的准确率高达 45.90%；再用这些局部画像去推断剩余属性，把整体成功率撑到 25.83%，与一次性攻击的 26.25% 几乎持平，且约四分之三的正确预测相互重合。换句话说，少量有证据支撑的线索确实能带动后续推断：用局部画像补全剩余属性，能把这部分推断的准确率从 18.48% 提升到 21.78%，净增 3.30 个百分点。不过论文也明确指出，这一增益部分来自模型先验，并不能证明真实攻击者就是沿着“先锚定、再推理”的路径工作的。
痕迹不会说谎，但可以少留
需要强调的是，这项研究用的是合成用户和真实工具的组合，虚拟用户的行为未必完全等同真人，26.25% 也远不是“一眼看穿”的程度。但它的价值在于证伪了一个普遍的安全假设：“对话保密 = 用户隐私安全”。在 Agent 时代，这个等式不再成立。
从越权获取、外传敏感数据，到提示注入、工具投毒，业界对 MCP 安全的讨论多集中在这些具体风险上，而这项研究揭示的是更安静的一类风险：没有任何一方作恶，一切调用都符合协议，画像照样可以被拼出来。结合近期行业内陆续出现的 Agent 安全产品与治理实践，工具调用的“留存”与“关联”正在成为值得重视的合规议题。
论文给出的防御方向也很具体，可以概括为三道闸门。
第一道是模糊化：对查询参数做降噪处理，让请求不必携带高精度的位置、时间和身份线索，比如把“步行 14 分钟到某医院”泛化成“市中心出行”。第二道是最小化：限制轨迹的保存时长和内容颗粒度，日志留存越久，风险敞口越大。第三道：切断跨服务的会话关联，别让一个用户在四个不同服务器上的痕迹能被串成一条线。不过论文同时声明，三类防御的有效性都还没有经过实验验证，目前只是方向性建议。
对企业用户来说，这份研究还有一层部署层面的启示。随着 Agent 走进办公流程，员工每一次授权 Agent 连接新工具，都在无形中扩大公司的行为数据暴露面。安全团队的传统思路是守住“数据和模型”，现在恐怕得加一条：守住“调用”。工具网关的可观测性和隐私审计，是本文在论文之外的引申，正在成为 Agent 时代安全架构中值得补上的一环。
Agent 越能干，留下的脚印越密。它替你跑腿的每一步，都是一份指向你的行为档案。它留下的每一道痕迹，都可能成为日后画像的证据。（本文首发钛媒体APP，作者 | AGI-Signal，编辑 | 焦燕）
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
The most intimate conversation of the time, perhaps not the one you sent, but the one that Agent helped you start with.
You asked AI's assistant to check the route to London next week, and it moved the map service; you let it organize the medical report, and it's connected to the health database. Your conversation with it is theoretically only visible to you and the model manufacturer. But a recent study by the AgentDoG team in Shanghai reminds us that, even if the conversation was confidential, the “work trail” that AI Agent left on the backstage when he called the tool was enough to allow observers to spell out where you live, what you believe, how you're doing, how you're doing, and a fairly complete picture, though you can't guess your name.
To what extent can tool call expose you? The study from the tool call track of privacy leaks, which was completed by the Shanghai Joint Electronic Technology Laboratory, University of Sydney, built a benchmark called PrivacyTrace, a layer of previously neglected risks that the system quantization had previously addressed. The conclusions are not gratuitous, but rather a set of figures that can be reproduced.
(Thesis addresses: https://arxiv.org/abs/2610.41885)
Some might ask, "Ai, talk about privacy every day. What's new? Fresh in front of the attack. Past security research has focused on two types of questions: whether Agent would voluntarily ask for data that he should not have taken, and whether malicious instruments would deceive Agent. And all the tools in this study are disciplined, the protocol is perfectly legal and no one “dos harm” and the risk is present. It is the latest version of digital privacy history that is familiar with the script: Twenty years ago, an anonymous search log allowed users to identify themselves by searching for keywords alone; more than a decade ago, the slogan on Facebook exposed sexual orientation and political orientation; now, it was Agent ' s tool call.
A mind reading without dialogue
First, the location of the attackers is clear. In the mainstream architecture of LLMAgent, the model calls for external tools through standard interfaces such as MCP (Model Context Protocol, Model context Protocol): maps, calendars, health services, shopping platforms. Each call generates a record containing a tool name, input parameters, return results and call sequence, known as the “tool-call trail” (tool-call tracks).
The key is that the tool server can't see you talking to Agent, but can see the call records in their entirety. And a gateway or assembly platform in the middle can even see the entire trajectory of all your missions. These two categories of observers were referred to by researchers as “local observers” and “global observers”, respectively. These are semi-honest observers: they do their job honestly, and they simply “look more” themselves with permission data. This is precisely the most difficult category to prevent, as it does not violate any rule.
Take an example. You let Agent plan the commuting and routing next week, and there will be geo-coding results, travel times and traffic patterns in the trajectory. It's easy to look at every single item alone, but these clues come together: The destination was in a hospital area in London, travelling strictly to avoid the Sabbath, walking only from Friday sundown to Saturday night, and a bystander server can deduce that you may live in London, suffer from chronic kidney disease, and believe in Judaism. You didn't say a word, but you did.
PriceTrace: "CT" for 1,000 virtual users
The greatest obstacle to the risk of quantization is the unavailability of real privacy data. Nobody wants to give their medical records to researchers for attack experiments. The team ' s approach is to synthesize: they draw on the demographic distribution of the United Nations, the World Bank, UNESCO, the International Labour Organization, etc., and produce 1,000 virtual users with an iterative ratio close to the real population structure, each with 17 attributes, including nationality, age, occupation, religious beliefs, physical and mental health, income, etc.
Then, around the four areas of travel, health, shopping and vocational learning, 25 real MCP servers were used to carry out their tasks, producing 4,000 Agent tracks and 67,950 tool call records. Finally, four mainstream LLMs (DeepSeek-V4-Flash, GPT-5.5, Gemini-3-Flash, MiniMax-M3) were allowed to play the role of “aggressors” by looking only at the tracks and not looking at the conversation and deduce the 17 attributes.
The cleverness of the design lies in the contrast: if the attackers only get a list of attributes to “blind guess”, it is the baseline; when they get the tracks, the additional accuracy is the net evidence of the trajectory leak. For the sake of equity, mandatory predictions are used: each of the 17 attributes must be answered, miscalculated, semantics matched by another adjudicative model of unexposed trajectory, and vague areas must be miscalculated. The whole set of processes treats each attacker equally.
There is also a realistic detail: the performance of the four attackers was not very different, from 25.29 per cent to 28.32 per cent, but at varying cost. Of the estimated cost of the paper, GPT-55 ran the entire experiment at approximately US$ 1,080 and DeepSeek-V4-Flash had almost the same effect for just about US$ 46. In other words, the threshold for launching such an attack is much lower than most would have imagined.
Number speaking: 26.25% What does it mean?
Experimental results: The blind guess attack on success rate (ASR) was 17.97 per cent, while the uni-domain trajectory reached 26.25 per cent, a net increase of 8.28 percentage points. convert came down, 17 properties averaged only four to five, one or two more than blind: enough to spell out the contours, far from seeing through.
More noteworthy is the impact of the range of observers: single MCP servers can only see 24.24 per cent, while individual domains are 26.25 per cent, while success rate jumps to 32.77 per cent by connecting conversations of the same user across four domains. The greater the visibility, the clearer the picture. It needs to be noted that the paper at the same time reminded the three figures from three different sets of statistical calibres, which can only be seen as related rather than causal; in a single-server lens, the success rate actually increased by only 3.09 percentage points in a single-server lens.
In terms of attribution, the most significant disclosures were in the areas of nationality (57.73 per cent) and religious beliefs (50.03 per cent), and in the areas of travel and shopping, the leaks were significantly higher than those of professional studies. There is also a relief: precise identification is hard to guess. Of the 16,000 indicator slots, only 35 guesses were given, of which 34 were by name, 1 was by telephone and the correct number of mailboxes and government identifiers was zero. The tracks reveal “images”, not “identity”.
Where did the leak come from? Parameters are more "spatial" than results
The four components (metadata, order of call, parameters, return results) of the cleavage of the trajectories are dissolved one by one, and the answer is clear: the tool parameters contribute most. success rate was only 14.53 per cent, or even less than blind guesses, when the metadata and the order of calls were used; the addition of parameters surged to 27.71 per cent, resulting in a net increase of 13.18 percentage points; and the addition of only the return result increased to 24.54 per cent, resulting in a net increase of 10.01 percentage points. Parameters are indeed the most informative conduits.
It's not hard to understand: the parameter is the choice Agent made for you. What's your address, what's your medication, how much is your budget? Return results are often accompanied by candidates not related to the user: 26.25 per cent of the whole trajectory is lower than the 27.71 per cent of the parameter only, which is interpreted in the paper to mean that the return content may prove the clues in the parameter or may dilute them, and the two mechanisms are not currently distinguishable. One interesting detail is that even if the server sees only the requested parameters, does not see the return at all, and the leak is barely compromised. This points the way to defence: rather than fix the return data, the request parameters should be handled first.
The study also validated a “two-part” attack: firstly, the evidence-supported attribute was selected from the trajectory, with only 17.06 per cent of the attribute slots selected in the first stage, but the accuracy of the selected section was as high as 45.90 per cent; then the partial image was used to infer the residual properties, bringing the overall success rate to 25.83 per cent, almost identical to 26.25 per cent of the one-time attack, and approximately three quarters of the correct predictions coincided with each other. In other words, a small amount of evidence-supported leads to subsequent inferences: the completion of residual properties with a partial image can increase the accuracy of this extrapolation from 18,48% to 21,78%, with a net increase of 3.30 percentage points. The paper made it clear, however, that part of this gain came from a pre-model test and did not prove that the real assailants were working along the “stamped, deduced” path.
The tracks don't lie, but they can be kept away.
It is important to emphasize that the study uses a combination of synthetic users and real tools, that virtual users are not necessarily acting exactly the same as real people, and that 26.25 per cent is not much of a “eye through”. But its value lies in the perjury of a universal security assumption: “Dialogue confidentiality = user privacy security”. In the Age of Age, this equation no longer exists.
From ultra vires access to sensitive data, to the injection of tips, to the poisoning of tools, the industry's discussion of MCP security has focused on these specific risks, and the study has revealed a more quiet type of risk: no one has done anything wrong, all calls are consistent with the agreement, and pictures can be spelled out. The “retention” and “connection” of tool call is becoming a subject of attention for compliance in the context of the recent emergence of Agent safety products and governance practices in the interior of the industry.
The defence direction given in the paper is also specific and can be summarized as three gates.
The first is blurring: noise-mitigation of query parameters so that requests do not have to carry high precision location, time and identity clues, such as “walking 14 minutes to a hospital” to be generalized to “go downtown”. The second is minimization: the longer the trajectory is preserved and the more the content particles, the longer the log stays, the greater the risk exposure. Third: Cut off cross-service session connections and do not allow a user's mark on four different servers to form a line. At the same time, however, the paper stated that the effectiveness of each of the three types of defence had not been tested on an experimental basis and was currently a point-oriented proposal.
For business users, the study also has a layer of inspiration at the deployment level. As Agent entered the office process, every time the employee authorized Agent to connect to a new tool, the exposure of the company's behavioural data was intangible. The traditional idea of the security team is to hold on to “data and models” and now I am afraid to add: hold on to “call”. The observability and privacy audit of the tool gateway is an addition to the paper and is becoming a worthy link in the Agent-era security architecture.
The more capable Agnes is, the more he leaves his footprints. Every step of your leg, it's a behavioral file pointing to you. Every trace it leaves may be evidence of future portraits. (This article starts with titanium media app, by | AGI-Signal, editor | Joo Yon)
Auto-fetched and translated by AI Atlas. All rights belong to the original author.