Extracting Knowledge from Tools in LLM Agents
2026-08-31 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors study how language model (LLM) agents that use external knowledge tools might unintentionally reveal the information from those tools through their answers. They identify two main problems: the agent might use the wrong tool, and important details in the queries can get lost. To fix this, they create ToolSiphon, a method that cleverly directs questions to the right tool and checks the answers to gather more information. Their tests show ToolSiphon can recover a lot of the original knowledge from different tools and datasets, even against some security defenses. This work highlights a new kind of privacy risk when using LLM agents with knowledge-based tools.
LLM agentsknowledge-based toolstool invocationknowledge extractiontool-selection uncertaintytool-argument compressionToolSiphonTool Contrastive AnalysisEvidence Chained Feedbacksemantic similarity
Authors
Chuanchao Zang, Jianing Wang, Wenyu Chen, Xiangtao Meng, Li Wang, Xinyu Gao, Yingkai Dong, Zheng Li, Shanqing Guo
Abstract
LLM agents commonly use knowledge-based tools and access their underlying files, databases, and search indexes through tool invocation. This integration improves agents' ability to provide domain-specific services but also introduces the risk of tool-mediated knowledge extraction: source content exposed to an agent for legitimate responses may be progressively recovered from its outputs, enabling reconstruction of the knowledge source behind a target tool. This paper systematically investigates this risk and identifies two challenges introduced by tool invocation: tool-selection uncertainty, where an agent may invoke a competing tool instead of the target tool, and tool-argument compression, where fine-grained query information may be lost when the agent generates tool arguments. To tackle these challenges, we propose ToolSiphon, a query-only extraction attack that introduces two complementary signals: a target-discriminative signal, implemented through Tool Contrastive Analysis, to steer queries toward the target tool; and a response-grounded factual signal, implemented through Evidence Chained Feedback, to mitigate argument compression and progressively expand extraction coverage. Across three types of knowledge-based tools and six domain-specific datasets, ToolSiphon recovers 74.3% of source records on average when coarse-grained information about non-target tools is available, with 83.2% textual recovery and 90.2% semantic similarity. Even without such information, it recovers 66.3% of source records. ToolSiphon also remains effective against representative defenses and on three real-world agent platforms.