How an Observer Reconstructs Intent Without Seeing the Prompt
The network-level leakage study is not claiming that a passive observer can read a local agent's private prompt. It asks a harder systems question: can an observer build a model that maps the agent's outward trace back to the user's task or longer-term traits? This chapter explains that mapping as a two-stage pipeline and then defines what “recovery” means. The distinction matters because a useful functional reconstruction can be a privacy failure even when no sentence is reproduced word for word.
A trace becomes useful for inference only when it is connected to labels. The observer needs examples in which known prompts or known persona attributes produced agent traces, and they need a way to apply what was learned to a new session. The study therefore separates preparation from observation. That separation makes the attack more realistic than an imagined omniscient classifier, while also making its assumptions visible.
From proxy behavior to a live prediction
The first stage constructs a proxy dataset. The attacker starts with prompts that are public or generated from a persona profile, runs a research agent on them, records the resulting domain-level traces, and links each trace to the prompt or traits that produced it. The attacker can filter incidental advertising and tracking domains, just as the study does, so that the model is trained on features more likely to reflect the research task.
The second stage begins when the observer encounters a new trace. The attacker does not need the new prompt as a label; the point is to infer it. A task-specific inference model receives the visible sequence—possibly incomplete or filtered—and produces either a reconstructed prompt or a set of predicted traits. In symbolic terms, the model learns a relationship between a known task and its observed behavior during preparation, then applies that relationship to an unknown task during the attack.
This division creates an important condition for success: the proxy traces must resemble the target traces closely enough for the learned relationship to transfer. The attacker needs some knowledge of the agent's general browsing capabilities, source-selection tendencies, or orchestration style. If a target agent searches in a completely different way from the one used to build the proxy data, a domain sequence may no longer mean the same thing. The paper demonstrates feasibility under selected agents and models; it does not remove this dependence on background preparation.
There are several interfaces in that pipeline, and each can fail differently. Prompt generation can produce an input that is too vague to make the agent browse, or so detailed that it supplies the answer in advance. Trace collection can include incidental domains that drown out the task signal. Filtering can remove a useful destination as well as an advertisement. Model construction can overfit to a small set of examples. Online observation can be incomplete because a resolver, CDN, or network boundary hides some destinations. A successful inference therefore depends on the interaction of prompt realism, agent behavior, trace representation, and visibility—not on a single clever prediction step.
The model-construction choice also affects how the attacker uses the labels. In-context learning can place a small set of trace-and-prompt examples beside a new trace at inference time. Fine-tuning can instead adapt model parameters using the proxy pairs. Both approaches are attempts to express the same mapping, but they have different sensitivity to example diversity, model capacity, and operational cost. The study compares such strategies under its benchmark conditions; the important point here is that the passive observer may have an offline preparation phase that the target never notices.
The prompt-recovery and trait-inference paths share the same basic architecture but use different labels. For prompt recovery, one session is paired with a prompt. The output is a natural-language reconstruction intended to preserve the original task's function. For trait inference, several prompts across several sessions are associated with a persona's latent attributes. The output is not a new research question but a trait vector: predictions about stable or semi-stable characteristics that may not have been stated in any one prompt.
That difference changes the privacy threat. A single prompt-recovery prediction can reveal that the user is investigating a sensitive medical, financial, legal, or personal issue right now. Trait inference requires more observation and some way to associate sessions, but it can reveal a broader profile. The trace is no longer being used only to explain one episode; it becomes evidence about the person who generated many episodes.
The study uses three public TREC query collections for prompt recovery. It reserves 20 prompts from each collection for testing and uses the remaining material for training or in-context examples. The queries are rewritten or adapted where necessary so that they induce meaningful multi-page research behavior rather than a trivial one-page answer. For trait inference, the researchers sample 50 profiles from a 997-profile PERSONA subset, select five traits per profile, and generate three to five prompts across seven sessions. Three personas provide in-context examples, while 35 age-filtered personas are used for testing.
These details are not merely dataset bookkeeping. They determine what the results mean. The prompt experiment tests whether fresh traces produced by agents can be mapped to held-out tasks. The trait experiment tests whether a limited week-like history can support predictions about synthetic people. Neither experiment is a live survey of how accurately an arbitrary organization can profile an arbitrary population. The datasets make the causal question testable while leaving real-world transfer as an open issue.
The selected agents also represent different sources of variation. GPT Researcher is an autonomous research system designed for multi-hop investigation. Browser-Use automates a local browser and is configured to make several page visits. AutoGen is instrumented for both prompt and trait experiments and produces noisier traffic that includes advertisements and trackers. A proprietary deep-research service supplies a comparison point, although its browsing is remote rather than locally visible in the same way. The point of the comparison is not to crown one product. It is to show that orchestration and browsing strategy shape the trace alongside the underlying language model.
This means that a trace is not a universal encoding of a topic. It is an encoding of a topic as filtered through a particular agent stack. The same request may produce different domains if one system uses a search API, another opens a browser, or a third relies more heavily on its internal knowledge. It may also produce different levels of exposure if one orchestrator stops after a few sources and another continues until it has a broad evidence base. A prepared attacker can exploit a stable stack, but a deployment that changes its search provider, model, browser policy, or stopping rule may invalidate part of the learned mapping. This is a meaningful limitation, but it is also an architectural lesson: privacy exposure is coupled to the way the system performs research.
What counts as recovering a prompt
A literal text match would be a poor privacy test. A user can express “compare Italy and Spain's digital-nomad visas” differently from an observer's reconstruction, while both prompts still send an agent toward the same government sources and answer the same practical question. Conversely, two sentences can share many words while asking the agent to do different work. The study therefore evaluates behavioral alignment rather than relying on wording alone.
Its OBELS framework—Ontology-aware Behavioral Leakage Scores—turns a prompt into structured triplets of intent, source type, and entity. Intent describes the high-level action, such as learning, comparing, planning, or booking. Source type describes the category of information or service sought, such as a health database, visa process, academic field, or travel service. Entity identifies the topic that gives the task its subject, such as a country, symptom, treatment, institution, or dish.
The triplet representation lets the evaluation ask four separate questions. Functional equivalence asks whether the reconstructed prompt expresses the same high-level task. Domain-type equivalence asks whether it would engage the same class of services or information sources. Semantic equivalence asks whether the central entities and concepts line up. Entity-granularity tolerance asks whether a difference in specificity changes the practical meaning—for example, a country compared with two cities inside it.
Each dimension is scored from 0.0 to 1.0. Keeping the dimensions separate prevents one kind of match from hiding another kind of loss. A reconstruction might preserve the goal of finding treatment information but miss the specific condition. It might identify the correct country while losing the particular visa process. It might match a health-related source category while substituting a different medical entity. Those distinctions matter because privacy harm can occur at several levels of precision.
The dimensions also support different judgments about sensitivity. In a low-stakes travel task, functional and source-type alignment may be enough to show that the observer understood the user's practical goal. In a medical task, losing the exact entity may still leave the most sensitive fact intact, while a broad category may reveal less than the original. The metric does not decide those value judgments for the reader. It makes the preserved and missing parts visible so that the risk can be discussed at the right level of detail.
OBELS also explains why the phrase “the prompt was not recovered” can be misleading. If an observer can infer the task, source category, and central entity well enough to direct an agent toward similar information, the user's functional intent has been exposed even if the observer cannot quote the original wording. The study's own example makes this concrete: a broad question about work visas across southern Europe can be behaviorally close to a more specific comparison of Italian and Spanish digital-nomad visas, despite a lower textual resemblance.
The framework does not turn a score into a direct measure of harm. Its values depend on abstracting prompts into triplets and applying standardized language-model judgments. Sentence embeddings and a generic LLM judge are reported alongside OBELS because they capture other forms of similarity, but none of the measures alone tells us how a real person would be affected. OBELS is useful because it aligns the evaluation with the attacker's stated goal—recovering what the agent is trying to do—while its interpretation still needs the study's data and threat-model boundaries.
The same caution applies to trait inference. Trait predictions are evaluated with metrics suited to the attribute: numeric traits use normalized error, ordinal traits use distance, categorical traits use exact or semantic matching, and free-text traits use semantic overlap. A score therefore means “agreement under the chosen trait-specific measure,” not proof that a person possesses an attribute in the ordinary social sense. The study's results can show that synthetic trait signals are recoverable under its setup; they cannot establish that every predicted attribute is true or that a deployment should act on an uncertain inference.
The two-stage design also clarifies what a passive observer does not get for free. They must collect or obtain proxy behavior, choose an inference model, decide which traffic is noise, and cope with missing destinations or agent differences. The observer may be highly capable, but the paper's claim is not that network metadata contains a self-explanatory label. It is that the behavior can be sufficiently structured for a prepared model to learn a useful correspondence.
That distinction will matter when the numerical results are read. A high functional score supports the claim that the observer can recover task-level knowledge under the experiment's conditions. It does not mean the complete prompt was reconstructed, that the result transfers to every WRA, or that the observer can infer all traits equally well. The next step is to apply these definitions to the reported measurements while keeping the proxy-data, synthetic-persona, and evaluator choices in view.