Understand this story
Shanghai AI Laboratory's AgentDoG team, together with the University of Electronic Science and Technology of China and the University of Sydney, released the research "To What Extent Can Tool Calls Expose You? Privacy Leakage from Tool Call Traces," and built the PrivacyTrace benchmark. The study used 1,000 synthetic users and 25 real MCP servers to produce 4,000 traces and a total of 67,950 tool call records, having four models—DeepSeek-V4-Flash, GPT-5.5, Gemini-3-Flash, and MiniMax-M3—infer 17 user attributes from the traces alone. The results show that the attack success rate rose from 17.97% for blind guessing to 26.25% for single-domain traces, and reached 32.77% after chaining across four domains, with nationality (57.73%) and religious belief (50.03%) the most severely leaked. Ablation experiments show that tool parameters contribute the most; adding parameters alone raised the rate from 14.53% to 27.71%. Based on this, the paper proposes three defense directions—obfuscation, minimization, and severing cross-service associations—but states that they have not yet been experimentally validated.
AI-generated from public reports
Developments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Nov 4
TMTPost · AGI
Shanghai AI Laboratory Releases PrivacyTrace Benchmark to Quantify Privacy Leakage in Agent Tool-Calling Traces
Shanghai AI Laboratory, together with the University of Electronic Science and Technology of China and the University of Sydney, released the study "How Much Can Tool Calling Expose You?", building the PrivacyTrace benchmark. Using 1,000 synthetic users and 25 real MCP servers, they produced 4,000 traces comprising 67,950 tool-call records in total, and had four models—DeepSeek-V4-Flash, GPT-5.5, Gemini-3-Flash, and MiniMax-M3—infer 17 user attributes from the traces alone. The results show that the attack success rate rose from 17.97% for blind guessing to 26.25% for single-domain traces, and reached 32.77% after chaining across four domains, with nationality (57.73%) and religious belief (50.03%) being the most severely leaked. Ablation experiments show that tool parameters contribute the most; adding parameters alone raised the rate from 14.53% to 27.71%. Based on this, the paper proposes three defense directions—obfuscation, minimization, and severing cross-service correlations—but states that they have not yet been experimentally validated.