Search papers, labs, and topics across Lattice.
This paper investigates the risks associated with knowledge extraction from tools used by LLM agents, identifying two key challenges: tool-selection uncertainty and tool-argument compression. To address these issues, the authors introduce ToolSiphon, a novel query-only extraction attack that leverages Tool Contrastive Analysis and Evidence Chained Feedback to enhance query precision and mitigate information loss. The results demonstrate that ToolSiphon can recover an average of 74.3% of source records across various tools and datasets, showcasing its effectiveness even against established defenses and real-world platforms.
ToolSiphon can recover over 74% of source knowledge from LLM agents, revealing the hidden risks of tool-mediated knowledge extraction.
LLM agents commonly use knowledge-based tools and access their underlying files, databases, and search indexes through tool invocation. This integration improves agents' ability to provide domain-specific services but also introduces the risk of tool-mediated knowledge extraction: source content exposed to an agent for legitimate responses may be progressively recovered from its outputs, enabling reconstruction of the knowledge source behind a target tool. This paper systematically investigates this risk and identifies two challenges introduced by tool invocation: tool-selection uncertainty, where an agent may invoke a competing tool instead of the target tool, and tool-argument compression, where fine-grained query information may be lost when the agent generates tool arguments. To tackle these challenges, we propose ToolSiphon, a query-only extraction attack that introduces two complementary signals: a target-discriminative signal, implemented through Tool Contrastive Analysis, to steer queries toward the target tool; and a response-grounded factual signal, implemented through Evidence Chained Feedback, to mitigate argument compression and progressively expand extraction coverage. Across three types of knowledge-based tools and six domain-specific datasets, ToolSiphon recovers 74.3% of source records on average when coarse-grained information about non-target tools is available, with 83.2% textual recovery and 90.2% semantic similarity. Even without such information, it recovers 66.3% of source records. ToolSiphon also remains effective against representative defenses and on three real-world agent platforms.
