Agent Mosaic paper: LLM agents leak confidential conclusions pieced together from allowed documents
A paper listed on Hugging Face, "Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems", looks at what it calls the mosaic effect. Modern LLM agents can retrieve information from documents they are allowed to access, and then disclose a sensitive conclusion assembled from those pieces. The paper describes this as a critical risk for agents operating over confidential data.
To measure how often it happens, the work uses 30 synthetic examples drawn from cybersecurity, medical and military settings. These produced 10,800 final answers from three LLM agents in a controlled simulation, plus 1,440 answers from live agents in two open-source harnesses.
The best performing model tested, GPT-5.6-Sol, still disclosed forbidden composites in 7.08% of simulated answers (95% CI: 3.75-10.67%), and that was under benign queries designed to be answerable from a single document. In the live harnesses its disclosure rates were worse, though the text gives no figure for them.
Safeguards help but do not close the gap. Adding visible classification headers and explicit aggregation rules reduces pooled disclosure rates substantially. Even so, unsafe disclosures persisted in 32.37% of simulated answers (95% CI: 28.33-36.19%) across all intents.
The paper also reports that more refusals do not guarantee confidentiality: a significant share of refusals reveal the prohibited conclusion anyway.
The authors conclude that mosaic-style leaks are an observed confidentiality failure mode in the evaluated settings, at non-negligible rates. They say the results motivate stronger controls on what agents may infer and disclose in sensitive data environments with mixed-clearance users.
Key facts
- The "mosaic effect": an agent reads documents it may access, then discloses a sensitive conclusion assembled from them.
- The test set was 30 synthetic cybersecurity, medical and military examples: 10,800 answers from three LLM agents in simulation and 1,440 answers from live agents in two open-source harnesses.
- GPT-5.6-Sol, the best model tested, disclosed forbidden composites in 7.08% of simulated answers (95% CI: 3.75-10.67%) even under benign single-document queries, and did worse in live harnesses.
- With classification headers and explicit aggregation rules added, unsafe disclosures still appeared in 32.37% of simulated answers (95% CI: 28.33-36.19%).
- More refusals do not guarantee confidentiality, since significant refusals reveal the prohibited conclusion regardless.
Why it matters
Most access controls ask whether a user may read a given document. This paper points at a different gap: an agent that can read several permitted documents may combine them into a conclusion that the user was never meant to receive. The authors call this the mosaic effect and describe it as a critical risk for agents working over confidential data. They report it as an observed failure mode, not a hypothetical one, in the settings they evaluated.
Who it affects
The paper frames the concern around sensitive data environments with mixed-clearance users, where different people are allowed to see different things. Its examples come from cybersecurity, medical and military settings. Anyone deploying LLM agents that retrieve from document stores in such environments is the intended audience.
How to use it
The paper's practical takeaway is about controls. Adding visible classification headers and explicit aggregation rules reduced pooled disclosure rates substantially, so those are the two safeguards it tested. The authors say the results motivate stronger controls on what agents may infer and disclose. No further mitigation is described, and no fix is claimed.
How solid is it
This is a preprint on a Hugging Face papers page, and the figures come from the paper's own abstract. The evidence rests on 30 synthetic examples, 10,800 simulated answers from three LLM agents and 1,440 live answers from two open-source harnesses. The headline rates carry 95% confidence intervals: 7.08% (3.75-10.67%) for GPT-5.6-Sol in simulation and 32.37% (28.33-36.19%) for the safeguarded runs. The GPT-5.6-Sol result is cited from the paper itself, not from an official model release.
Risks and caveats
The examples are synthetic, and no real-world incident of a mosaic leak is reported. The 7.08% figure applies to the best model in simulation only; the live-harness rates are described only as worse, with no numbers. The pooled rate before safeguards is not given, so the size of the improvement is not quantified. The other two simulated agents and the two harnesses are not named in the text. The authors scope their conclusion to the evaluated settings, so the rates should not be read as general. They also warn that refusing more is not a reliable defence, because many refusals reveal the prohibited conclusion anyway.
“increased refusals do not guarantee confidentiality, since significant refusals reveal the prohibited conclusion regardless”
— Agent Mosaic paper (Hugging Face papers listing)