How Much Can Tool Calls Reveal About You?
Privacy Leakage from Tool-Call Traces

Donghang Duan1,2,*, Qingyu Liu1,*, Yifei Liu1,3, Na Zou1, Xia Hu1, Dongrui Liu1,†
1Shanghai Artificial Intelligence Laboratory
2University of Electronic Science and Technology of China
3The University of Sydney

* Equal contribution.   † Corresponding author.

Code Data Paper
Illustrative privacy side channel: private user–agent interactions produce observable tool-call traces that support inference of location, health conditions, and religious affiliation.

PrivacyTrace studies user-profile inference from tool-call traces, without access to user conversations.

Abstract

Large language model (LLM)-based agents interact with external tools through protocols such as the Model Context Protocol (MCP), producing tool-call traces that may expose behavioral signals about users. In this work, we systematically study the risk of user-profile inference from MCP tool-call traces, where observers infer user attributes from protocol-valid tool interactions without access to user conversations. We introduce PrivacyTrace, a benchmark containing 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, generated with real MCP tools from 25 servers. Experiments with four mainstream LLM attackers show that tool-call traces enable a 26.25% attack success rate for profile inference, compared with 17.97% from prior-based guessing. Further analysis reveals that tool arguments and returned results provide the main trace-grounded evidence, while linking traces across sessions further amplifies profiling risk. These findings demonstrate that MCP tool-call traces can act as effective behavioral side channels for user profiling, motivating the development of privacy-aware mechanisms for agent-tool interactions. Code and data are available at the code repository.

PrivacyTrace Benchmark

PrivacyTrace pipeline: population-calibrated profile and scenario construction, real MCP agent trajectories, and prior-based, one-shot, and two-stage profile inference.
PrivacyTrace constructs synthetic profiles and task scenarios, generates agent trajectories through real MCP tools, and evaluates profile inference with prior-based, one-shot, and two-stage attacks.

PrivacyTrace pairs known synthetic profiles with tool-call traces from real MCP services. Each of the 1,000 profiles is used for one task in each domain, producing 4,000 agent trajectories. The agent sees only the information disclosed by the simulated user; the observer sees a specified view of the tool trace.

Benchmark domains and tools
DomainExample toolsTrajectories
TravelMaps, weather, attractions, flights1,000
HealthBiomedical literature, drugs, nutrition1,000
ShoppingPlaces, web search, product research1,000
Career & learningJobs, papers, documentation, learning resources1,000

The benchmark covers 17 personal attributes, 25 MCP servers, and 67,950 tool records. The released data include synthetic profiles, task scenarios, complete agent trajectories, attack predictions, and evaluation results.

Environment design · Profile construction

Results

Trace access and observer scope

Full tool traces increase Semantic ASR from 17.97% under prior-based guessing to 26.25%. Linking traces across four domains reaches 32.77%, showing how information accumulates across user activities.

Profile-inference results across trace access, observer scope, and visible-call volume. Full-trace ASR is 26.25%; linked four-domain ASR is 32.77%.
Trace access, observer scope, and visible-call volume shape profile inference. Observer-scope summaries pool slots separately within each scope; the view populations differ.

Evidence in tool traces

Arguments and returned results contribute the strongest trace-grounded evidence. Adding arguments improves ASR by 13.18 percentage points over metadata and sequence alone.

ObservationSemantic ASR
Prior-based guessing17.97%
Metadata + sequence14.53%
+ tool arguments27.71%
+ returned results24.54%
Full tool trace26.25%

Arguments and results rows each include metadata and sequence.

Trace channels

Semantic content in arguments and returned results supports stronger inference than metadata and call order alone.

Semantic ASR by channel: metadata and sequence 14.53%, adding arguments 27.71%, adding results 24.54%, and the full tool catalog 26.25%.

Main results · Channel analysis

Code and Data

The environment setup, data construction pipeline, and evaluation scripts are available in the GitHub repository.

The complete dataset is hosted on Hugging Face. Submit an access request on the dataset page; downloads are available after manual approval by the authors.