Is Encryption Enough? Uncovering Privacy Risks Hidden in LLM Agent Traffic

Why Encryption May Still Leak Privacy

Traditional AI privacy discussions focus on prompt leakage, chat logs, or tool call data. The cited paper shows that even when payloads are encrypted, observable traffic metadata—size, direction, timing—can reveal what the user is doing.

Agent Interaction Patterns Create Distinct Traffic Signatures

Unlike simple chatbots, LLM agents perform multi‑step tasks: searching, code generation, image creation, etc. Each step generates characteristic traffic bursts (e.g., request‑response cycles, large image streams). These meta‑features form a “traffic fingerprint” that can be observed without breaking encryption.

AGENTPRINT Framework and Experimental Method

The authors introduce AGENTPRINT, which extracts only unencrypted metadata such as packet count, volume, upstream/downstream direction, and temporal variations. The experiment proceeds in three steps: (1) design prompts that trigger core agent capabilities (search, code, image); (2) capture network traffic and derive features; (3) train classifiers to infer the agent behavior or identify the specific agent.

Results: High Accuracy in Behavior and Identity Recognition

Using the extracted features, the classifier achieves 94.1% accuracy (macro‑average F1 = 0.924) for distinguishing agent behavior types, and 86.7% accuracy (macro‑average F1 = 0.866) for identifying the exact agent in a closed‑set mixed‑traffic scenario.

Long‑Term Profiling Threats

Beyond single sessions, repeated observations allow an adversary to build stable behavior profiles. The study demonstrates profession inference: in simulated users, top‑3 profession prediction reaches 73.9% accuracy; in real‑user tests with 49 participants, the top‑3 accuracy is 69.1%.

Conclusion

LLM agents transform from chat tools to task executors, producing richer traffic patterns that can be fingerprinted. Encryption protects content but not behavioral metadata. Future AI‑privacy discussions must consider whether traffic patterns enable inference of user habits and identities.