---
title: "MosaicLeaks: Can your research agent keep a secret?"
description: "MosaicLeaks examines privacy leakage in deep-research agents that combine private enterprise documents with external web retrieval. Queries that appear harmless individually can reveal sensitive facts when an observer combines them over multiple hops, producing intent, answer, or full-information leakage. The benchmark contains 1,001 multi-hop chains interleaving local and web questions, and compares baseline behavior with task-only reinforcement learning and Privacy-Aware Deep Research (PA-DR). Task-only training raises strict chain success from 48.7% to 59.3% but increases answer/full-information leakage from 34.0% to 51.7%, whereas PA-DR reaches 58.7% success with 9.9% leakage by rewarding stage-specific decisions and penalizing query-level privacy risk. The evaluation is controlled, using synthetic enterprise documents, a fixed web corpus, three company contexts, and one multi-hop question-answering harness."
---

# MosaicLeaks: Can your research agent keep a secret?

[Hugging Face](https://yomu.fyi/company/hugging-face) · Alexander Gurung, Rafael Pardinas · Jun 18, 2026

**Type:** Benchmark

## Summary

MosaicLeaks examines privacy leakage in deep-research agents that combine private enterprise documents with external web retrieval. Queries that appear harmless individually can reveal sensitive facts when an observer combines them over multiple hops, producing intent, answer, or full-information leakage. The benchmark contains 1,001 multi-hop chains interleaving local and web questions, and compares baseline behavior with task-only reinforcement learning and Privacy-Aware Deep Research (PA-DR). Task-only training raises strict chain success from 48.7% to 59.3% but increases answer/full-information leakage from 34.0% to 51.7%, whereas PA-DR reaches 58.7% success with 9.9% leakage by rewarding stage-specific decisions and penalizing query-level privacy risk. The evaluation is controlled, using synthetic enterprise documents, a fixed web corpus, three company contexts, and one multi-hop question-answering harness.

## Context

Deep-research agents increasingly combine private local documents with external tools such as web retrieval. Their outbound queries can expose private research intent or facts because an observer can combine fragments across a query log, even when no individual query reveals the complete information. The benchmark is designed to measure this mosaic effect in multi-hop tasks that interleave public and private information.

## Approach / What changed

MosaicLeaks constructs 1,001 multi-hop chains from enterprise documents and a controlled web corpus, with bridge entities linking successive local and web questions. PA-DR combines situational task rewards for decisions at each research stage with a learned privacy reward that estimates direct and cumulative mosaic-leakage risk in web queries, penalizing the larger risk.

## Takeaways

- Task-only reinforcement learning raises strict chain success from 48.7% to 59.3%, but increases answer/full-information leakage from 34.0% to 51.7%.
- PA-DR achieves 58.7% strict chain success and reduces answer/full-information leakage to 9.9%, while issuing more web queries than the base model.
- Situational rewards reach comparable task performance with roughly 5–6 times fewer generated training samples than outcome-only reinforcement learning, and PA-DR retains that sample-efficiency benefit.

**Tags:** [LLMs](https://yomu.fyi/topic/llm), [Machine Learning](https://yomu.fyi/topic/machine-learning), [Privacy](https://yomu.fyi/topic/privacy)

- Source: [Hugging Face](https://huggingface.co/blog/ServiceNow/mosaicleaks)
- Source URL: https://huggingface.co/blog/ServiceNow/mosaicleaks
- Ingested by Yomu: 2026-08-29T01:50:48.558Z

[Read original post](https://huggingface.co/blog/ServiceNow/mosaicleaks)