mlsanityData to 14 Oct 2026

Extracting Knowledge from Tools in LLM Agents

arXiv 2608.30288 ↗First posted 31 Aug 2026cs.CRcited by 0

On the map: LLM agents and tool use → Tool learning and function calling

Abstract (arXiv)

LLM agents commonly use knowledge-based tools and access their underlying files, databases, and search indexes through tool invocation. This integration improves agents' ability to provide domain-specific services but also introduces the risk of tool-mediated knowledge extraction: source content exposed to an agent for legitimate responses may be progressively recovered from its outputs, enabling reconstruction of the knowledge source behind a target tool. This paper systematically investigates this risk and identifies two challenges introduced by tool invocation: tool-selection uncertainty, where an agent may invoke a competing tool instead of the target tool, and tool-argument compression, where fine-grained query information may be lost when the agent generates tool arguments. To tackle these challenges, we propose ToolSiphon, a query-only extraction attack that introduces two complementary signals: a target-discriminative signal, implemented through Tool Contrastive Analysis, to steer queries toward the target tool; and a response-grounded factual signal, implemented through Evidence Chained Feedback, to mitigate argument compression and progressively expand extraction coverage. Across three types of knowledge-based tools and six domain-specific datasets, ToolSiphon recovers 74.3% of source records on average when coarse-grained information about non-target tools is available, with 83.2% textual recovery and 90.2% semantic similarity. Even without such information, it recovers 66.3% of source records. ToolSiphon also remains effective against representative defenses and on three real-world agent platforms.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Tool learning and function calling, one of 16 directions in LLM agents and tool use. Builds on 14 of its 51 references that are in the map. First posted on arXiv 31 Aug 2026.

Builds on

14 of 51 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025RAG-MCP: Mitigating Prompt Bloat in LLM Tool Selection via Retrieval-Augmented Generation6 May
  2. 2024WTU-EVAL: A Whether-or-Not Tool Usage Evaluation Benchmark for Large Language Models2 Jul

Other references · 12

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  2. 2024The Landscape of Emerging AI Agent Architectures for Reasoning, Planning, and Tool Calling: A Surveycited by 168
  3. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systemscited by 76
  4. 2025DeepAgent: A General Reasoning Agent with Scalable Toolsetscited by 71
  5. 2025LLM Agents for Education: Advances and Applicationscited by 59
  6. 2023ToolTalk: Evaluating Tool-Usage in a Conversational Settingcited by 45
  7. 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applicationscited by 37
  8. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  9. 2025Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queriescited by 19
  10. 2026ADAM: A Systematic Data Extraction Attack on Agent Memory via Adaptive Queryingcited by 5
  11. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  12. 2026Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agentscited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Toolshed: Scale Tool-Equipped Agents with Advanced RAG-Tool Fusion and Tool Knowledge Bases
  2. 2026ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Covering
  3. 2025ToolScope: Enhancing LLM Agent Tool Use through Tool Merging and Context-Aware Filtering
  4. 2025ToolTweak: An Attack on Tool Selection in LLM-based Agents
  5. 2025Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools
  6. 2026Agents Trust Tools Too Much: Measuring Reliance on Unreliable Tools
  7. 2025GRETEL: A Goal-driven Retrieval and Execution-based Trial Framework for LLM Tool Selection Enhancing
  8. 2026Tools Are Not Islands: Set-Level Tool Retrieval for LLM Agents via Query-Conditioned Hyperedge Prediction