攻击者可透过工具调用元数据还原用户真实意图，暴露大模型代理的隐私漏洞。
IntentMiner: Intent Inversion Attack via Tool Call Analysis in the Model Context Protocol
- 通过分层语义解析，分析工具函数、参数和结果反馈重建用户意图。
- 在ToolACE基准上实现超过85%的语义对齐，远超传统大模型基线。
- 揭示无语义混淆时执行函数即暴露意图，适合关注AI代理隐私的研究者。
大型语言模型向智能体人工智能演进，推动了模型上下文协议（MCP）成为连接推理引擎与外部工具的标准。尽管这种解耦架构提升了模块化程度，但也打破了传统的信任边界。我们发现了一种新型隐私威胁：意图反演攻击。半诚实第三方MCP服务器仅需利用授权元数据（如函数签名、参数和返回凭证），即可准确重构用户的底层意图，无需访问原始查询。为量化该风险，我们提出IntentMiner。不同于统计方法，IntentMiner采用分层语义解析策略，通过正交方式分析工具函数、参数实体和结果反馈，实现逐步骤意图重建。在ToolACE基准上的实验表明，IntentMiner与原始查询的语义对齐度超过85%，显著优于大语言模型基线。该研究揭示了一个关键内生漏洞：若缺乏语义混淆，执行函数意味着意图透明，从而挑战下一代AI智能体的隐私基础。
原文摘要 · Abstract (English)
The evolution of Large Language Models (LLMs) into Agentic AI has established the Model Context Protocol (MCP) as the standard for connecting reasoning engines with external tools. Although this decoupled architecture fosters modularity, it simultaneously shatters the traditional trust boundary. We uncover a novel privacy vector inherent to this paradigm: the Intent Inversion Attack. We show that semi-honest third-party MCP servers can accurately reconstruct users' underlying intents by leveraging only authorized metadata (e.g., function signatures, arguments, and receipts), effectively bypassing the need for raw query access. To quantify this threat, we introduce IntentMiner. Unlike statistical approaches, IntentMiner employs a hierarchical semantic parsing strategy that performs step-level intent reconstruction by analyzing tool functions, parameter entities, and result feedback in an orthogonal manner. Experiments on the ToolACE benchmark reveal that IntentMiner achieves a semantic alignment of over 85% with original queries, substantially surpassing LLM baselines. This work exposes a critical endogenous vulnerability: without semantic obfuscation, executing functions requires the transparency of intent, thereby challenging the privacy foundations of next-generation AI agents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。