MosaicLeaks: Can your research agent keep a secret?

Source: HuggingFace Date: 2026-06-18 URL: https://huggingface.co/blog/ServiceNow/mosaicleaks

Summary

ServiceNow Research published MosaicLeaks, a study of privacy leakage in research agents that combine private enterprise documents with public web search. The “mosaic effect” occurs when individually benign search queries, viewed in aggregate by an observer of outbound traffic, reconstruct sensitive internal facts — internal metrics, dates, named entities — that no single query would reveal. Critically, naive task-performance fine-tuning made leakage worse (34.0% → 51.7% answer/full-information leakage), while privacy-aware deep research training (PA-DR) using reinforcement learning on query construction patterns reduced leakage to 9.9% while maintaining task success at 58.7%. The finding: privacy cannot be prompted in; it must be trained in.

Implications

• Governance/safety — agentic privacy as a systems problem. MosaicLeaks demonstrates that the privacy boundary for an agent operating on private data is not the agent’s final output but every intermediate action (each search query, each API call) that touches external infrastructure. Enterprise deployments of research agents need to treat outbound query patterns as a data-loss vector, not just the response the agent returns to the user.
• Agentic engineering patterns — RL for behavioral constraints. The PA-DR result (RL on query construction beats instruction prompting for privacy compliance) is an instance of a broader pattern: behavioral constraints that matter for production deployment — safety, privacy, cost — are better enforced through training than through system prompts. This has direct implications for how agentic systems are fine-tuned and evaluated before enterprise release.
• Fine-tuning/quantization. The finding that standard task-performance fine-tuning degrades privacy is a concrete risk for teams that fine-tune public base models on private enterprise corpora and then deploy those models in agentic contexts with internet access. The PA-DR training methodology is a candidate mitigation, but it requires RL infrastructure and privacy-labeled training data that most teams do not have off the shelf.