MosaicLeaks: How Deep Research Agents Leak Private Information Through Queries

Deep research agents that combine private local documents with web retrieval create a subtle privacy risk: the mosaic effect. An agent working through a multi-hop question might issue a series of seemingly innocuous web queries, but an adversary watching the outbound query log can reassemble those fragments into sensitive enterprise information. MosaicLeaks formalizes this as a new benchmark of 1,001 multi-hop research chains that interleave local and web sub-questions, measuring three levels of leakage: intent (what the agent is investigating), answer (whether the queries can answer a given private question), and full-information (whether the observer can discover private facts without being prompted).

Across tested models, agents frequently leaked private information. Simply prompting the agent not to leak had inconsistent effects and often hurt task performance. More strikingly, training the agent solely for task performance made leakage worse: strict chain success rose from 48.7% to 59.3%, but answer/full-information leakage climbed from 34.0% to 51.7%. The core tension is that a more informative query is better for retrieval and worse for privacy. The authors propose Privacy-Aware Deep Research (PA-DR), a reinforcement learning method with two components: a situational task reward that assigns credit per model call rather than per full rollout, and a learned privacy reward that penalizes both direct leakage and mosaic leakage in the query log.

PA-DR raises strict chain success to 58.7% while cutting answer/full-information leakage to 9.9% — lower than the untrained base model’s 34.0%. The agent does not become safer by searching less; it issues more web queries but drops revealing details like specific metrics or dates. The situational rewards are also more sample-efficient, reaching the same task performance with roughly 5-6x fewer generated training samples. The takeaway for builders is that privacy in agentic systems cannot be prompted in — it must be trained in, by measuring and rewarding how queries are constructed over the course of a multi-hop chain.