ToolSiphon Reconstructs 74.3% of the Knowledge Base Behind an Agent's Tool Using Only Queries

arXiv 2608.30288·high signalXBlueskyLinkedInCopy link

Tool-mediated knowledge extraction recovers the source content behind an agent's knowledge tool purely from its responses, and ToolSiphon solves the two obstacles that made this unreliable: tool-selection uncertainty, via Tool Contrastive Analysis that steers queries to the target tool, and tool-argument compression, via Evidence Chained Feedback. Across three tool types and six domain-specific datasets it recovers 74.3% of source records on average with 83.2% textual recovery and 90.2% semantic similarity, dropping only to 66.3% without any information about competing tools. It stays effective against representative defenses and on three real-world agent platforms, which makes any RAG-backed tool a data-exfiltration channel by default.