Newest papers

Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems

Daniel Ruiz, Luca Luceri, Emilio Ferrara · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30418 · cited by 0 works (OpenAlex) · open-access PDF

Arabic

يمكن لشركات LLM الحديثة الحصول على معلومات من البيانات المتوفرة، ثم إبلاغ النتائج ذات الصلة التي تم تجميعها من تلك البيانات. هذا تأثير الموساد يخلق خطرًا حاسمًا للشركات التي تعمل على البيانات ذات الصلة. نحن نقدر تحقيقها من خلال 30 مثالًا متكاملًا من الأمن السيبراني، والصحة، والعسكرية، مما يوفر 10،800 إجمالي الإجابة من ثلاثة شركات LLM في التثبيت المسموح به، و1440 إجمالي الإجابة من شركات حية في اثنين من العناوين مفتوحة المصدر. حتى تحت الأسئلة المفتوحة التي تم تصميمها لتلبية الإجابة من وثيقة واحدة، GPT-5.6-Sol، النموذج الأكثر كفاءة

Machine translation (Meta M2M100); the English original follows.

Abstract

Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect creates a critical risk for agents operating over confidential data. We quantify its realization with 30 synthetic cybersecurity, medical, and military examples, yielding 10,800 final answers from three LLM agents in controlled simulation and 1,440 answers from live agents in two open-source harnesses. Even under benign queries designed to be answerable from one document, GPT-5.6-Sol, the best performing model tested, discloses forbidden composites in 7.08% of answers (95% CI: 3.75-10.67%) in simulation, with worse disclosure rates in live harnesses. Adding visible classification headers and explicit aggregation rules reduces pooled disclosure rates substantially, yet unsafe disclosures persist in 32.37% of simulated answers (95% CI: 28.33-36.19%) across all intents despite these safeguards. Furthermore, increased refusals do not guarantee confidentiality, since significant refusals reveal the prohibited conclusion regardless. These results point to a troubling conclusion: sensitive data leaks via mosaic-style events are an observed confidentiality failure mode in the evaluated settings at non-negligible rates. They motivate stronger controls on what agents may infer and disclose in sensitive data environments with mixed-clearance users.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Confidentiality, Computer security, Internet privacy, Point (geometry), Computer science, Realization (probability)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange