Technical Summary: MosaicLeaks: Privacy Risks in Querying-in-the-Open for Deep Research Agents

Problem Definition

Deep research agents are increasingly deployed to synthesize information from private enterprise documents and external tools (e.g., web search, cloud APIs). While this capability enhances task performance, it introduces a critical privacy risk: agents may leak sensitive internal information through their external tool calls. This risk is exacerbated by the mosaic effect, a phenomenon where individual queries appear benign in isolation but reveal sensitive attributes when aggregated by an adversary over time.

Existing benchmarks and mitigation strategies largely fail to address this specific context. Prior work focuses on personal attributes or single-hop tasks, while deep research benchmarks often treat local and external information sources as parallel rather than interdependent. Consequently, agents are not trained to recognize that external queries dependent on local context can reconstruct private data.

Methodology

1. The MosaicLeaks Benchmark

The authors introduce MosaicLeaks, a benchmark comprising 1,001 multi-hop deep research tasks designed to force privacy leakage.

• Data Construction: The dataset interleaves local enterprise documents (sourced from DRBench) and public web content (sourced from BrowseComp-Plus). Tasks are structured as multi-hop chains where the answer to a local sub-question serves as a critical entity for the subsequent web query (e.g., Local $\to$ Web $\to$ Local).
• Adversarial Setup: An adversary model (StepFun-3.5-Flash) observes only the cumulative sequence of web queries generated by the agent. It does not see the local documents or the agent's internal reasoning.
• Leakage Metrics: Privacy leakage is evaluated across three increasing levels of severity:
  1. Intent Leakage: Can the adversary predict the specific research questions the agent is pursuing?
  2. Answer Leakage: Can the adversary answer specific private questions about the enterprise documents given the query sequence?
  3. Full-Information Leakage: Can the adversary generate verifiable, true factual claims about the enterprise documents without being prompted with specific questions?

2. Baseline Evaluation

The authors evaluated six open-source models (including Qwen3, StepFun, GPT-OSS, and Gemma) on MosaicLeaks.

• Findings: Models frequently leaked information at all three levels.
• Prompting Limitations: Naive zero-shot prompting (instructing agents to avoid leakage) reduced leakage slightly but failed to eliminate it. In some cases, it merely reduced the number of queries rather than improving the privacy of the query text.
• Performance vs. Privacy Trade-off: Training agents solely for task performance using Reinforcement Learning (RL) improved accuracy but significantly worsened privacy leakage, as agents learned to include more specific (and thus leaky) details in their queries to ensure retrieval success.

3. Proposed Solution: Privacy-Aware Deep Research (PA-DR)

To address the leakage-performance trade-off, the authors propose PA-DR, a Reinforcement Learning framework that optimizes for both task success and privacy preservation.

• Situational Rewards: Unlike standard outcome-based RL which provides a single reward at the end of a trajectory, PA-DR uses situational rewards to provide dense credit assignment. Rewards are calculated per-hop and per-stage (Plan, Choose) based on whether the agent retrieved the correct document source or selected the gold document.
• Privacy Penalty: A lightweight binary classifier (trained on 26,734 labeled examples) estimates the probability of leakage given a batch of web queries. The reward function incorporates a penalty derived from this classifier:
  • Direct Leakage: Penalizes the current batch of queries if they leak information on their own.
  • Mosaic Leakage: Penalizes the current batch based on how much it contributes to the cumulative leakage of the entire trajectory.
  • The final privacy reward is defined as $r_{privacy} = -\max(c_{direct}, c_{mosaic})$, where costs are derived from the classifier's predicted leakage probability.
• Training: The framework trains the Qwen3-4B-Instruct model using PipelineRL, jointly optimizing for the situational task rewards and the privacy penalty.

Key Results

• Performance Gains: Training with PA-DR improved the strict chain success rate of Qwen3-4B-Instruct from 48.7% (baseline) to 58.7%.
• Privacy Reduction: The same training reduced Answer and Full-Information Leakage from 34.0% to 9.9%.
• Combined Optimization: When combined with a privacy-aware prompt, the PA-DR model achieved 59.3% chain accuracy with only 7.6% leakage.
• Behavioral Analysis: Unlike prompting, which reduced leakage by simply making fewer queries, PA-DR trained models made more queries but with text that was semantically less revealing. The models learned to retrieve necessary documents while omitting specific metrics (e.g., "15%") or answer types from the query text, breaking the semantic link an adversary needs to reconstruct private facts.
• Comparison: PA-DR pushes the Pareto frontier, achieving higher accuracy and lower leakage simultaneously compared to models trained only for task performance or those using standard outcome-based RL.

Significance and Contributions

The paper makes three primary contributions:

1. MosaicLeaks Benchmark: A new evaluation framework that explicitly tests deep research agents on multi-hop questions with strong local-external information dependencies, capturing the mosaic effect in enterprise settings.
2. Empirical Analysis: A demonstration that standard deep research agents frequently leak enterprise data and that optimizing solely for task performance exacerbates this risk. It also shows that prompting-based interventions are insufficient for this task.
3. PA-DR Framework: A principled formulation of privacy-aware agent training as a joint objective. By using a learned privacy classifier to provide dense credit assignment over per-query and mosaic-level leakage, the authors show that it is possible to train agents that are both highly accurate and privacy-preserving.

The authors conclude that while current agents are prone to mosaic leakage, RL-based training with situational privacy rewards offers a viable path toward deploying deep research agents in sensitive enterprise environments without compromising data security.