MosaicLeaks: Addressing Privacy Leakage in Deep Research Agents
MosaicLeaks: Addressing Privacy Leakage in Deep Research Agents
Deep research agents that combine private local documents with external web retrieval face a significant privacy risk known as the "mosaic effect," where multiple seemingly benign external queries can be reassembled by an observer to reveal sensitive information. Hugging Face has introduced MosaicLeaks, a benchmark to measure this leakage, and Privacy-Aware Deep Research (PA-DR), an RL training method that reduces answer and full-information leakage from 34.0% to 9.9% while maintaining high task performance.
The Mosaic Effect and Privacy Leakage
The mosaic effect occurs when an agent's cumulative query log allows an adversary to infer private information, even if no single query explicitly reveals a secret. MosaicLeaks defines three levels of leakage based on what an adversary can infer from the web-query log:
- Intent leakage: The adversary can infer the private research goals or questions the agent is investigating.
- Answer leakage: The adversary can answer specific questions about private information using the query log, without having access to the private documents.
- Full-information leakage: The adversary can state verifiably true private claims without being prompted with specific questions.
The MosaicLeaks Benchmark
MosaicLeaks consists of 1,001 multi-hop research chains that interleave local enterprise documents and a controlled web corpus. The benchmark is designed to induce privacy leakage by requiring the agent to retrieve local information before it can form the next useful web query.
Chain Construction
Research chains are built in three stages:
- Seed private facts: Generating private QA pairs (metrics, dates, entities) from enterprise documents.
- Bridge documents: Using previous answers to retrieve new documents and generate subsequent questions, creating local-web dependencies.
- Validate chains: Ensuring answerability, retrievability, and that the previous answer is strictly necessary for the next hop.
The Failure of Prompt-Based Privacy
Attempts to prevent leakage through prompting (e.g., instructing the agent not to leak local information in web queries) proved inconsistent and often detrimental to performance. For the Qwen3-4B model, a privacy-aware prompt reduced answer/full-information leakage from 34.0% to 25.5%, but strict chain success dropped from 48.7% to 44.5%. The primary result of prompting was a reduction in the total number of web queries rather than the construction of safer queries.
Performance vs. Privacy Trade-off
Training an agent solely for task performance increases privacy risks. In tests with Qwen3-4B, training only for strict chain success raised the success rate from 48.7% to 59.3%, but simultaneously increased answer/full-information leakage from 34.0% to 51.7%. This happens because the model learns to pack more context into its queries to improve retrieval, which provides more fragments for an adversary to reassemble.
Privacy-Aware Deep Research (PA-DR)
PA-DR is an RL training method that optimizes for both task success and privacy using two distinct rewards:
1. Situational Task Reward
Instead of scoring a whole trajectory, PA-DR uses situational rewards that judge each model call against other calls made at the same stage and hop with the same information. This provides precise credit assignment for specific actions, such as planning a search for the correct source or selecting the correct document.
2. Learned Privacy Reward
A Qwen3-4B classifier estimates two risks for every web query: direct leakage of private information and the creation of a new mosaic leak when added to the existing log. The agent is penalized based on the larger of these two risks.
Results
PA-DR significantly reduces leakage without sacrificing the performance gains achieved through task-only training:
| Method | Strict chain success | Answer or full-information leakage |
|---|---|---|
| Base Qwen3-4B | 48.7% | 34.0% |
| Task reward | 59.3% | 51.7% |
| Task + PA-DR reward | 58.7% | 9.9% |
PA-DR achieves this not by searching less, but by removing revealing details (like specific metrics or dates) from the query text while still retrieving the correct public documents.
Training Efficiency
Situational rewards are significantly more sample-efficient than outcome-only RL. PA-DR reaches a 55% strict chain success rate using approximately 183k generated samples, compared to 963k samples required for outcome-reward training.
Scope and Limitations
MosaicLeaks is a controlled benchmark using synthetic enterprise documents and a fixed web corpus. While it demonstrates that privacy cannot be "prompted in" but must be "trained in," the results are specific to a single agent harness and multi-hop QA tasks. Further study is required for open-ended research and real-world deployments.