Each section below summarizes one paper's reported method, experiments, and limits from its full review. The studies use different tasks and metrics; their results are not directly comparable.
arXiv:2610.41885
How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces
PrivacyTrace studies whether Model Context Protocol tool-call traces can reveal persistent user attributes without exposing conversations or internal reasoning. It constructs 1,000 synthetic profiles, 4,000 trajectories across travel, health, shopping, and career-learning domains, and 67,950 tool calls from 25 real MCP servers. Across four LLM attackers, single-domain traces raise average attack success rate from 17.97% under prior-based guessing to 26.25%; arguments and returned results are the strongest evidence channels, while linked traces across four domains reach 32.77%. The benchmark shows that ordinary, protocol-valid tool telemetry can function as a behavioral side channel for profiling.
How it works
The threat model assumes semi-honest observers that retain legitimately accessible traces and passively analyze them. A local observer sees calls routed to one endpoint; a global observer can see a complete task trace, and a linked observer can concatenate traces from multiple tasks for the same user. The trace representation is formalized as T=(c_1,...,c_n), where each call contains endpoint, tool information, arguments, and response. The observation operator then determines which calls and channels become attacker-visible.
What the paper evaluates
PrivacyTrace contains 1,000 profiles, one trajectory per profile in each of four domains, 4,000 trajectories total, and 67,950 tool calls. Each profile has 17 target attributes. The default single-domain evaluation therefore contains 68,000 view-attribute slots, and average ASR measures the fraction of slots whose predictions satisfy the attribute-specific scoring rule; higher ASR means more successful profile inference and therefore greater privacy leakage. For RQ1, single-domain trace access raises ASR from 17.97% with prior-based guessing to 26.25%, an 8.28-point increase.
Limit to keep in view
The benchmark uses synthetic profiles, synthetic tasks, and simulated interactions; population calibration matches aggregate margins but does not establish behavioral realism or performance on consented real-user traces.
arXiv:2610.41998
SecPO: Principled Adversarial Training for Prompt Injection Security
SecPO addresses indirect prompt injection by combining a new Secure Preference Optimization loss with adaptive adversarial training. Instead of regularizing the defended model toward an insecure undefended model on injected inputs, SecPO uses the undefended model's response to the corresponding clean input as an oracle-like target. Strong injections are generated through concurrent search during training or reused from a released offline dataset. On Llama-3.1-8B and Qwen3.6-27B, the method sharply lowers adaptive attack success rates while retaining comparable benign utility across instruction-following, agentic, science, and mathematics benchmarks.
How it works
The training data begins with Cleaned-Alpaca instruction-following examples containing a trusted prompt and data field. The authors select 19,157 preference pairs, use a dedicated input role for untrusted data, and generate desirable and undesirable responses with the undefended model. Llama-3.1-8B-Instruct is trained with LoRA; Qwen3.6-27B additionally fine-tunes k_proj and o_proj. Both use one epoch, β = 0.1, and learning rate 1.6×10−4.
What the paper evaluates
The evaluation covers instruction following through SEP and AlpacaEval2; agentic tool calling through AgentDojo, AgentDyn, and DTaP-Bench-Indirect; science through MMLU-Pro and GPQA Diamond; mathematics through GSM8K and Minerva_Math; and visual prompt injections through DocVQA-based evaluations. Training uses Cleaned-Alpaca and PAIR search, while evaluation uses held-out Genetic and TAP search attacks plus the unseen RL-based PISmith attack. SEP adaptive evaluations use 1,024 examples and report Pass@800 for Genetic and TAP and pass@10 for PISmith.
Limit to keep in view
The experiments assume the agent receives a clear trusted-versus-untrusted role distinction; cases where the model must infer trust or decide whether an instruction in data is aligned are outside the stated problem scope.
arXiv:2611.04289
When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation
This paper shows that multi-agent debate can reverse the safety behavior of individually aligned language models when retrieved Web evidence mixes safe guidance with latent hazards. SafeConflict-Bias fixes the query and evidence while varying majority pressure, authority cues, and confidence asymmetry across 700 counterfactual instances. Standard MAD raises unsafe adoption from 0.0% in neutral or isolated settings to as high as 100.0%, suppressing safe minority evidence. RiskTrace-Debias adds evidence-first precommitment, social-metadata masking, and consistency-gated arbitration at inference time, reducing reported worst-case unsafe adoption to at most 2.0% across four model backbones while producing provenance traces.
How it works
The system receives a query q and an evidence set E containing heterogeneous Web snippets. M agents inspect assigned evidence partitions over conversational rounds, and a centralized arbiter maps the query, evidence, and transcript to one of safe_answer, safe_refusal, or unsafe_adoption. The threat model does not alter retrieved documents, model weights, or the arbiter prompt with an explicit jailbreak; it manipulates the social configuration S through majority sway, authority deference, and confidence bias.
What the paper evaluates
The experiments evaluate SafeConflict-Bias across 700 instances: 100 base cases multiplied by seven social conditions. The primary controlled study uses deepseek-chat, while cross-model validation uses qwen-plus, gpt-4o, and qwen2.5-32b-instruct. All debates use five agents, three phases, and 15 turns. Baselines are Vanilla LLM, Self-Reflection, Standard MAD, and RiskTrace-Debias. Metrics include Unsafe Adoption Rate, Final Unsafe Rate, counterfactual social-bias deltas Δmaj, Δauth, and Δconf, Mitigation Ignored Rate, Safe Minority Suppression Rate, Over-Refusal Rate, and Parse Error Rate.
Limit to keep in view
The main evaluation uses snippet retrieval, five-agent complete-graph debates, and a controlled set of 100 curated Web conflicts; the paper does not establish performance on dynamic communication topologies, multimodal browsing, or heterogeneous model collectives.
arXiv:2611.01976
Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security
ETUDE (Exploiting Tool Updates for Direct Execution) studies a tool-update gap in LLM agents: a tool can pass admission checks while benign, then receive an update that inherits its identity and permissions without equivalent re-verification. The updated implementation preserves the advertised interface and normal function but performs unauthorized operations inside its own runtime, without needing adversarial instructions or additional model-issued tool calls. In the authors’ evaluation across seven agent frameworks, three workloads, multiple backends, and three tool utilities, ETUDE reports 97.6% attack success rate (ASR) alongside 95.9% legitimate task completion rate (TCR).
How it works
ETUDE starts with a benign implementation A(v1) that passes admission, then adopts A(v2) through the framework’s native update mechanism. The malicious version keeps the same interface and expected normal output, but inserts unauthorized operations into the existing handler. Those operations execute with the tool process’s existing permissions and are isolated with exception handling so their failure need not break the legitimate task. The evaluation crosses two delivery stages and two execution paths.
What the paper evaluates
The main benchmarks are seven agent frameworks—Gemini CLI, Codex CLI, Claude Code, DeepSeek Harness, OpenCode, Pi, and Goose—and three tool functionalities: Markdown cleaning, CSV statistics, and ICS generation. The three workloads test synthetic credential disclosure, an unauthorized test API order, and local file modification. RQ1 uses GLM-5.3-Flash; RQ2 compares GLM-5.3-Flash, Qwen-3.8-27B, and DeepSeek-V4-Flash with thinking enabled and disabled for DeepSeek; RQ3 varies tool functionality across four frameworks.
Limit to keep in view
The attacks use researcher-authored tools in controlled environments rather than modifying real open-source tools in the wild; transfer to complex production tools remains uncertain.
Read the full reviews
- How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces · arXiv:2610.41885
- SecPO: Principled Adversarial Training for Prompt Injection Security · arXiv:2610.41998
- When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation · arXiv:2611.04289
- Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security · arXiv:2611.01976
Source note: findings and limitations above come from the linked full paper reviews. Follow each original arXiv paper for the authors' complete methods and results.