📌 Highlights
PrivacyTrace provides a controlled benchmark for asking how much persistent user information can be recovered from MCP tool-call traces when an observer cannot access conversations or internal reasoning.
The strongest headline result is that single-domain trace access raises average profile-inference ASR from 17.97% under prior-based guessing to 26.25%. Arguments and returned results are the main evidence channels, and linked four-domain traces reach 32.77% ASR.
The evidence is important but bounded: the benchmark is synthetic, exact identifiers are rarely recovered, and mitigation effectiveness is not evaluated.
- 4,000 trajectories across travel, health, shopping, and career learning.
- 17 target attributes per synthetic profile and 67,950 tool calls from 25 MCP servers.
- Arguments and results expose more profiling evidence than metadata and call order alone.
- Cross-session linkage increases risk, while exact names, phone numbers, emails, and government identifiers remain difficult to recover.
🎯 Introduction
LLM agents translate user requests into tool selections, arguments, and invocation sequences. MCP standardizes these interactions, but remote servers can observe the calls they serve without seeing the user's conversation or the agent's internal reasoning. The paper argues that these records are not merely operational metadata: geocoding results, requested travel times, transport modes, entities, and constraints can act as behavioral signals for sensitive attributes such as location, health condition, or religious affiliation.
Prior agent-privacy work has focused largely on whether agents acquire, transmit, or disclose sensitive data, while prior privacy-inference work has studied search logs, ratings, social activity, authored text, and network fingerprints. PrivacyTrace targets a different evidence source: semantic tool-call records exposed during legitimate MCP execution. Its objective is to measure persistent, multi-attribute profile inference across observer scopes, trace channels, domains, and attack protocols.
🔬 Methodology
The threat model assumes semi-honest observers that retain legitimately accessible traces and passively analyze them. A local observer sees calls routed to one endpoint; a global observer can see a complete task trace, and a linked observer can concatenate traces from multiple tasks for the same user. The trace representation is formalized as T=(c_1,...,c_n), where each call contains endpoint, tool information, arguments, and response. The observation operator then determines which calls and channels become attacker-visible.
The benchmark pipeline first samples candidate profiles from target-informed and uniform proposals, filters inconsistent candidates, generates synthetic identifiers, and calibrates candidate weights to 25 low-dimensional population margins with iterative proportional fitting. For each profile and each of four domains—travel, health, shopping, and career learning—a scenario planner creates a profile-conditioned task and hidden tool plan. A user simulator and evaluated agent then execute the task using real MCP tools; the system extracts server metadata, tool calls, arguments, responses, errors, and call order while excluding dialogue and internal reasoning.
Inference is evaluated through three paths. Prior-based guessing receives only the attribute schema. One-shot inference predicts every attribute directly from the visible trace. Two-stage inference first selects trace-supported attributes and proposes their values, then completes unresolved attributes from the partial profile. The resulting predictions are scored with attribute-specific rules, with semantic judging used only for unresolved cases and failed or unparseable generations counted as incorrect.
fig:methodology
Caption: Overview of PrivacyTrace. The benchmark constructs population-calibrated synthetic profiles and profile-conditioned scenarios, generates agent trajectories through real MCP tools, and evaluates profile inference using prior-based, one-shot, and two-stage attacks.
Why It Matters: The pipeline connects synthetic profile construction, real-tool execution, trace extraction, and controlled inference evaluation.
equation 1
Meaning: Defines the ordered trace record exposed to the observer.
equation 2
Meaning: Defines concatenation of linked traces across tasks or domains.
equation 3
Meaning: Defines the attacker-visible input under an observation configuration.
equation 4
Meaning: Defines one-shot complete-profile prediction.
📊 Experiments
PrivacyTrace contains 1,000 profiles, one trajectory per profile in each of four domains, 4,000 trajectories total, and 67,950 tool calls. Each profile has 17 target attributes. The default single-domain evaluation therefore contains 68,000 view-attribute slots, and average ASR measures the fraction of slots whose predictions satisfy the attribute-specific scoring rule; higher ASR means more successful profile inference and therefore greater privacy leakage.
For RQ1, single-domain trace access raises ASR from 17.97% with prior-based guessing to 26.25%, an 8.28-point increase. Pooled ASR is 24.24% for local-server views, 26.25% for single-domain views, and 32.77% for linked four-domain views. The paper also reports an association between call volume and inference success: 20.87% ASR for views with 1–5 calls, 29.26% for 21–40 calls, and 27.43% for 41 or more calls; the authors caution that these bins are observational and the 41+ group contains only 101 views.
Leakage varies by attribute and domain. Trace access reaches 57.73% ASR for citizenship and 50.03% for religious belief, while only 35 of 16,000 synthetic identifier predictions are correct: 34 names, one phone number, and no email address or government identifier. Single-domain ASR ranges from 21.57% for career learning to 31.86% for shopping, with travel at 28.33%, consistent with differences in the locations, products, budgets, and returned entities exposed by each domain.
For RQ2, metadata and call order alone reach 14.53% ASR, below the 17.97% schema-only prior baseline. Adding arguments reaches 27.71%, a 13.18-point gain over the metadata-and-sequence condition; adding returned results reaches 24.54%, a 10.01-point gain. The complete trace reaches 26.25%, so the channel effects are overlapping rather than additive. For RQ3, Stage 1 selects 17.06% of slots at 45.90% precision; on 56,179 unresolved slots, completion improves from 18.48% prior-based ASR to 21.78%, and final two-stage ASR is 25.83% versus 26.25% for one-shot inference. Correct two-stage predictions overlap with one-shot predictions 74.96% of the time.
fig:overall-effect
Caption: Trace access.
Why It Matters: This result figure visualizes the increase in profile-inference success when trace evidence is available.
fig:attribute-asr-main
Caption: Target attributes.
Why It Matters: The attribute breakdown distinguishes recoverable behavioral attributes from highly specific identifiers.
fig:completion-main
Caption: Partial-profile completion.
Why It Matters: The figure isolates the gain from conditioning completion on attributes selected as trace-supported.
Attacker ASR and estimated costs
Caption: Attacker ASR and estimated costs.
| Attacker | ASR | Cost |
|---|---|---|
| MiniMax-M3 | 25.29% | $63.70 |
| DeepSeek-V4-Flash | 26.25% | $46.49 |
| GPT-5.5 | 27.78% | $1,079.88 |
| Gemini-3-Flash | 28.32% | $155.13 |
Why It Matters: The four attackers achieve comparable ASR on the same 4,000 single-domain views, supporting cross-model robustness of the leakage measurement.
🔮 Conclusion
The paper's central conclusion is that MCP tool-call traces can serve as effective behavioral side channels for user profiling. In the benchmark, single-domain traces improve profile inference over prior-based guessing, semantic arguments and returned results provide the strongest evidence, broader observer access increases ASR, and linked traces across domains amplify the available signal.
The results also qualify the threat. Exact identifiers are rarely recovered, the two-stage attack's improvement over prior completion is modest, and the benchmark relies on synthetic users and tasks. Nevertheless, the study shows that privacy exposure does not require malicious tools or direct access to user conversations; legitimate operational traces can be sufficient for nontrivial attribute inference.
🛠️ Future Research Improvements
The most direct next step is validation on consented real-user interactions or carefully governed enterprise traces. Such work should test whether the leakage patterns observed with population-calibrated synthetic profiles survive realistic user behavior, tool choice, correction, hesitation, and task repetition.
The paper identifies query obfuscation, reduced exposure of tool-call content, shorter trace retention, and restricted cross-session linkage as possible defenses, but leaves their effectiveness unmeasured. Future studies should evaluate these interventions jointly for privacy reduction, task success, latency, cost, and failure modes.
Further work should also vary the attribute schema, observer position, trace serialization, attacker model, and scoring protocol to separate general privacy leakage from benchmark-specific effects.
🏭 Potential Industry Use Scenarios
MCP server operators could use the benchmark's local-server view to audit how much user profiling is possible from the calls and results they independently retain. This is especially relevant for services handling location, health, shopping, financial, or employment-related tasks.
Agent gateways and enterprise observability platforms could apply the linked-view threat model to decide whether traces may be joined across domains or sessions. Practical controls could include field-level redaction, shorter retention, access separation between servers, and policies that prevent unnecessary propagation of sensitive arguments and returned results.
Tool and schema designers could treat arguments and result bodies as privacy-sensitive application data rather than neutral execution metadata. The paper supports this direction conceptually, but deployment-specific utility and compliance benefits remain to be demonstrated.
💬 Critical Analysis
The study's main strength is the separation of observer scope, trace channel, application domain, and inference protocol. Executing profile-conditioned tasks through real MCP tools gives the traces more operational structure than a purely text-synthetic benchmark, while the prior baseline and channel ablations make the incremental value of trace evidence measurable. The four-attacker comparison also reduces concern that the headline result is tied to one model.
The main validity threat is behavioral realism. Synthetic profiles are calibrated to population margins, but aggregate demographic matching does not ensure that generated tasks and tool choices resemble real users. The benchmark also uses a fixed 17-attribute schema and a forced-prediction protocol, so the reported ASR should be interpreted as a controlled measurement rather than a direct estimate of production compromise probability.
The causal interpretation of trace length is appropriately limited because call-count bins arise from naturally occurring trajectories. Likewise, the two-stage analysis supports a behavioral account of sparse trace-supported clues followed by completion, but cannot establish that one-shot models use that internal process. Finally, exact identifiers being difficult to recover should not be read as evidence that traces are safe: the stronger results for citizenship, religious belief, and other non-identifier attributes demonstrate a different and practically important privacy failure mode.