What the Evidence Actually Establishes

The WRA leakage problem can now be treated as an evidence chain rather than a collection of alarming examples. A private request produces agent behavior; some of that behavior becomes a network trace; a passive observer sees only a portion of it; a prepared model converts that view into an inference; and an evaluation method determines what the inference preserves. The useful judgment is not simply that “metadata leaks,” but which link is being observed, which link is being modeled, and how far the evidence allows the conclusion to travel.

This distinction is essential before reading the study's scores. A domain sequence is an observation. A reconstructed health-related task is an inference. A functional-equivalence score is a benchmark result. A claim that every local agent exposes every user's private intent would be a deployment generalization. Those statements may be related, but they do not have the same evidentiary status.

A trace becomes a claim through several transformations

Start with the hidden input. For prompt recovery, it is the user's request. For trait inference, it is a set of latent attributes that influence several requests over time. The local agent transforms that input into searches, page visits, source choices, and stopping decisions. The network exposes some resulting fields: destination identity, order, timing, or coarse traffic size. The observer does not receive the hidden input or the agent's internal reasoning as a direct record.

The next transformation is representational. The attacker turns the visible activity into the form their model can use. They may remove obvious advertising and tracking domains, preserve the order of task-relevant destinations, and handle a trace that is incomplete. The model then produces a prediction. In the prompt case, the prediction is a natural-language task. In the trait case, it is a set of attributes with scores or categorical values.

Only after that prediction comes evaluation. The evaluator asks whether the output matches the target under a chosen definition. OBELS asks whether intent, source category, entity, and specificity align. A trait metric asks whether a numeric, ordinal, categorical, or free-text attribute is close under the rule appropriate to that type. The score is therefore not a property of the raw trace alone. It is the result of a trace, a visibility model, an inference model, a target label, and an evaluation rule interacting.

Consider how the same observed event can support claims of different strength. Seeing a clinical-trial domain is a direct observation about a destination. Saying that the user is researching a treatment is an inference about intent. Saying that the inference model preserves 0.7 of a functional score is a benchmark result. Saying that a particular person has a diagnosis would go beyond all three unless the evidence contained something more direct. The chain is not academic bookkeeping: each step adds interpretation, and each added interpretation needs its own boundary.

A useful counterfactual is to change one link at a time.