Reproduce “IntentMiner: Intent Inversion Attack via Tool Call Analysis in the Model Context Protocol” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Yunhao Yao, Zhiqiang Wang, Haoran Cheng, Yihang Cheng, Haohua Du, Xiang-Yang Li
IntentMiner demonstrates that a semi-honest third-party MCP server can infer a user’s underlying objective from ordinary tool documentation, call parameters, and returned results without seeing the original prompt or altering execution. Evaluated on 1,043 ToolACE tool-use interactions, it achieved intent-alignment scores up to 0.8552 and improved alignment by 16.73% over general LLM baselines, exposing privacy risks across medical, legal, and financial tasks.
Key insights
- Tool metadata that is necessary for normal MCP execution can collectively disclose more than a broad task category, including sensitive entities, conditions, dates, identifiers, and intended decisions.
- Call parameters provide the strongest specificity: removing call-statement analysis caused especially large drops in semantic similarity and entity recovery, while removing any module reduced alignment by roughly 13.97%–21.88%.
- Privacy protection for agent systems must address inference from legitimate tool traces, not only direct prompt exposure or malicious manipulation; suggested defenses include encryption, anonymization middleware, and semantic obfuscation.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.