提出隐私保护机制，防止智能体预执行工具调用泄露用户意图。
Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools
- 将预执行调用视为可撤销的观察行为，而非状态修改。
- 只有在调用前改变或屏蔽参数才能有效降低信息泄露。
- 适合关注AI代理隐私安全的研究者与开发者。
增强工具的语言智能体为隐藏延迟，会预执行可能的未来工具调用，但这些调用在代理未确定分支前已向外部服务泄露用户意图。任何接收到调用的观察者即使代理放弃该分支，仍保留该信息。问题在于时机而非授权：无提交时清理、只读限制或访问控制白名单无法撤回已接收的信息。我们称此类调用为“幽灵调用”，并提出推测性工具隐私合约，将提交前的观察视为独立于状态变更的一类首等效应。我们在原型运行时中实现该合约，并在三个数据集上评估十二种策略。结果显示，推测性分发会增加观察者对用户意图的推断；事后过滤、只读限制和访问控制白名单无法减少推断；只有在调用前改变或抑制调用参数或目标投影的即时策略才有效降低推断风险。
原文摘要 · Abstract (English)
Tool-augmented language agents speculatively issue likely future tool calls to hide latency, but those calls leak inferred user intent to external services before the agent commits to the branch. Every external observer that received the call retains the disclosure after the agent abandons the branch. Timing is the issue, not authorization: no commit-time cleanup, read-only restriction, or access-control allow-list unsends what an observer already holds. We call these invocations ghost tool calls and propose Speculative Tool Privacy Contracts, a runtime abstraction that treats observation before commitment as a first-class effect, distinct from state mutation. We implement the contracts in a prototype runtime and evaluate twelve policies across three corpora. Speculative dispatch increases what an observer can infer about user intent; post-hoc filters, read-only restrictions, and access-control allow-lists leave that inference intact; only issue-time policies that change or suppress the speculative call's argument or destination projection before dispatch reduce it.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。