How a Research Prompt Becomes a Network Trace
A Web and Research Agent does not send a user's intention onto the network as one obvious message. It turns that intention into a chain of searches, page visits, evidence extraction, and follow-up decisions. This chapter follows that chain and identifies the part a passive observer can see: ordered destinations, timing, and coarse traffic features. The goal is to understand the trace as a produced artifact, not to treat it as an accidental collection of hostnames.
The distinction matters because the trace is shaped by the agent's control loop. A request that looks like one sentence to the user becomes a series of actions chosen by a language model and its browsing tools. The agent's choices determine which services appear, how widely it explores, and when it decides that the evidence is sufficient. The network does not need to see the private sentence if those choices retain enough structure to distinguish one class of task from another.
From one request to many destinations
The operating sequence begins with a natural-language request. The agent first interprets the goal and decomposes it into sub-questions or search tasks. It then sends queries, follows links, retrieves pages, extracts relevant material, and keeps notes or other intermediate state. The retrieved evidence can change the next action: an early source may suggest a new term, expose a gap, or make another source worth checking. The loop repeats until the agent judges that it has enough coverage to write a report.
That last step is important. A research agent is not merely a browser executing a fixed list of URLs. Its model participates in deciding what to do next. The browsing pattern therefore contains traces of both the subject matter and the agent's strategy for investigating it. Two prompts can use similar words but induce different source choices. Conversely, differently worded prompts can drive the agent toward similar categories of services and institutions.
Every action that leaves the machine contributes to an ordered record. The record can be described without seeing page contents: destination domain or IP, approximate time, and coarse payload size. The same domain may recur; several domains may arrive in a short burst; the order may show a path from general search to specialist sources; the sizes and pauses may distinguish retrieval from other traffic. None of these fields is a complete description of the user's goal. Together, they can form a pattern.
The study emphasizes the volume and regularity of this pattern. Its abstract gives a motivating range of 70–140 domains per request, while another description in the paper says that many sessions traverse 40–100 distinct domains. Those figures come from the study's characterization and should not be read as a universal specification for every agent. Their significance is structural: an agent that searches broadly creates more opportunities for an observer to correlate behavior with task types than a one-site lookup does.
The trace also contains incidental activity. Pages can load advertisements, trackers, consent services, or embedded resources that are not central to the research task. The study applies domain-based noise filtering to remove well-known advertising and tracking services. That choice makes the experiment closer to a prepared observer who can discard obvious clutter. It also marks a boundary: the results do not require every packet to be meaningful, but they do assume that enough task-relevant destinations remain after filtering.
The control loop creates turning points that matter to the trace. An initial search may lead to a broad set of sources. If the material leaves an important question unresolved, the agent expands its search and adds another cluster of destinations. If the evidence seems sufficient, it stops browsing and begins synthesis. The observer cannot see the internal test for “sufficient,” but can see the consequence of that test: a short session that ends after a narrow source set, or a longer session that branches into more specialized domains. In this sense, stopping is also behavior. It is not necessary for the observer to know the agent's exact state; the transition from exploration to silence can help characterize the session.
The loop can be represented as a sequence in which the user and the agent exchange a private request and report, while the observer sees the outward consequences of the agent's work.
The observer's view is not the agent's internal state. The observer cannot see why the model selected a source, what text it extracted, or which hypothesis it is considering. They see the sequence that those hidden decisions produce. This is a classic side-channel shape: the output is not the secret itself, but it is statistically related to the secret.
The observer's view is layered, not universal
The paper models a passive observer that may be a DNS resolver, an internet service provider, a VPN operator, an enterprise firewall, or another shared network operator. These positions do not expose identical information. A DNS-facing party may see names in DNS activity under the study's baseline. A network operator may combine IP destinations with TLS handshake metadata such as SNI and with timing or payload features. An enterprise firewall may observe only the traffic that crosses its own boundary. The study groups these positions because each can obtain some network-level view without reading the prompt or page contents, not because each sees the same fields.
The baseline observer can use domain-level identity, visit order, and coarse packet-level measurements. They cannot use full URL query strings, which might contain the user's exact search terms. They cannot inspect the retrieved HTML, the agent's intermediate queries, or the final report. This difference is what makes the attack interesting. It asks whether the remaining fields are still enough to recover useful meaning.
A useful way to reason about the trace is to separate three kinds of signal. Identity signal concerns where the agent connects: domains, IP addresses, or names exposed during connection setup. Sequence signal concerns order and co-occurrence: which destinations appear together and how the session moves among them. Temporal and volume signal concerns when connections occur, how closely they cluster, and how much traffic is exchanged. The paper collects all three at trace level, but its results do not say that every signal contributes equally in every experiment.
These categories are analytical, not isolated channels. A destination can become more informative because it follows a particular search service, appears after a burst of general sources, or recurs when the agent is checking evidence. Timing can help separate a deliberate research cascade from unrelated activity, even when it does not improve the paper's main prompt-recovery score. Payload size can distinguish a small lookup from a larger retrieval without exposing the retrieved text. The value comes from the relationship among fields, which is why protecting one field while leaving the surrounding sequence unchanged may reduce precision without removing the inference path.
In fact, the study reports that domain-only traces are already informative, while adding timing to domains produces no consistent prompt-recovery gain in its particular evaluation. URL-level visibility produces stronger recovery because a full URL can carry more task-specific detail than a domain alone. These comparisons should be read as experimental results, not as a general ranking that makes timing irrelevant. A different agent, observer, or classifier could use temporal structure differently. The safe conclusion is that reducing one feature does not automatically neutralize the others.
This layered view also explains why encryption is not a single switch. If page contents are encrypted, the observer may lose the text while retaining destination and volume information. If a handshake hides one name, the observer may still see an IP address, the timing of a connection, or the repeated pattern of connections to a service. If DNS information is hidden from one party, another party may still observe the resulting transport behavior. The privacy question must always be phrased as: which observer, which field, and which correlation remain?
The study's partial-visibility experiments make the same point from the other direction. The researchers mask portions of the domain trace to approximate a resolver, CDN, reverse proxy, load balancer, or other observer with an incomplete view. Less visibility lowers prompt-recovery performance, but it does not erase useful signal immediately. The paper reports that report utility remains nearly unchanged as visibility is reduced to 10 percent in its evaluation, while utility begins to fall at very low visibility such as 2–5 percent. This creates an uncomfortable asymmetry: some domains may add little to the report while still giving an observer more material to classify.
The numbers depend on how the traces are masked and how utility is scored. A CDN that aggregates services, for example, does not simply delete a random percentage of domains. A network that encrypts DNS may change the observer's fields rather than reveal a random subset. The experiment therefore supplies a gradient model, not a deployment simulator. It supports the judgment that partial observation can still matter, while leaving the exact residual risk dependent on architecture and vantage point.
Why agent activity can stand out
Human browsing and agent browsing both generate network traces, but they are produced by different control processes. A person may pause to read, change direction, abandon a page, or revisit a familiar source. A research agent can issue a dense series of related requests as it follows a retrieval-and-synthesis loop. Its activity may have more destinations, shorter intervals, and a more repeatable relationship between one action and the next. That regularity gives an observer a chance to identify agent-like traffic before attempting a topic-level inference.
The paper tests this distinction by clustering agent traces with human sessions using timing, burstiness, and domain-transition features. It reports cluster purity from 0.86 to 1.0 across topics and 97.9 percent global classification accuracy under that setup. The result does not establish that an arbitrary network operator can recognize every local agent, nor that the same classifier will transfer unchanged to a different WRA. It does establish that the operating pattern can be sufficiently distinctive in a controlled comparison to become part of the privacy threat.
That distinction has an architectural consequence. The agent's browsing policy is not merely a performance detail. Breadth, source diversity, retries, and stopping rules influence the amount and shape of the emitted metadata. A system that visits more sources may improve coverage, but it also creates a larger and more attributable footprint. A system that hides the prompt from a remote model but performs all retrieval locally may move sensitive information away from the provider while making the local network the place where behavior is most visible.
The observer still faces uncertainty. Incidental traffic can obscure the pattern. Multiple users may share endpoints. CDNs and reverse proxies may collapse many services into fewer visible domains. The observer may see only part of the session or fail to link sessions over time. These factors reduce confidence and are why the study evaluates partial visibility rather than assuming a perfect view. They do not change the causal mechanism: if task-relevant agent actions remain correlated with the request, an inference model has something to learn.
The next problem is therefore not how to describe a trace, but how to turn it into a prediction. The study answers that question with a two-stage attack: build proxy traces tied to known prompts or persona traits, then apply a task-specific model to a new observed session. To understand the meaning of the reported scores, the trace must be treated as the model's input—and its missing fields must remain part of the interpretation.