MosaicLeaks: Can your research agent keep a secret?

Summary

Deep research agents that combine private enterprise documents with external web retrieval face a distinctive privacy risk known as the mosaic effect. Individual queries may appear innocuous, yet an observer with access only to the cumulative query log can reconstruct sensitive internal facts by piecing together fragments across multiple hops. MosaicLeaks formalizes this threat in a controlled benchmark of 1,001 multi-hop research chains that deliberately interleave local documents with public web sources, forcing agents to retrieve private context before they can issue useful external queries.

The benchmark supplies a fixed agent harness built around four tools—Plan, Choose, Read, and Resolve—and evaluates leakage through three graduated metrics. Intent leakage reveals the underlying research question, answer leakage supplies enough detail to answer a known private question, and full-information leakage allows an adversary to state previously unknown private facts. Across tested models, agents routinely produced such leakage even when instructed not to.

Standard reinforcement learning that optimizes solely for task success improves strict chain success—the fraction of trajectories in which every hop is answered correctly—from 48.7 % to 59.3 %, yet simultaneously raises answer and full-information leakage from 34.0 % to 51.7 %. The performance gain stems from richer queries that carry private details forward, exactly the behavior that amplifies mosaic leakage.

Privacy-Aware Deep Research (PA-DR) counters this trade-off with two complementary rewards. A situational task reward scores each tool call against other calls made at the identical stage and hop, providing precise credit assignment without a separate value model. A learned privacy classifier then penalizes queries that either directly expose private content or increase mosaic risk when added to the existing log. The resulting policy lifts strict chain success to 58.7 % while lowering answer and full-information leakage to 9.9 %—below the level observed in the untrained base model—by issuing more web queries that omit revealing specifics such as metrics or entity identifiers.

The work also shows that simply prompting agents to avoid leakage yields only modest and inconsistent reductions, often at the cost of task performance. Because the benchmark uses synthetic documents and a fixed web corpus, its quantitative results are best read as evidence that leakage can be measured and trained against rather than as a direct estimate of risk in open deployments.

Why it matters

Directly addresses production challenges for ML Engineers building agents: privacy leakage via queries, balancing accuracy vs. data exposure, and sample-efficient RL training. Strong quantitative benchmarks and actionable training recipe. EU GDPR relevance for Dutch enterprises handling sensitive data.