Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems
Daniel Ruiz, Luca Luceri, Emilio Ferrara
ACL Rolling Review
cs.CR, cs.AI, cs.CL
2026-10-22
LLM agents assemble individually cleared documents into forbidden conclusions; benign queries leak 7.08% on GPT, and safeguards leave 32.37% disclosing.
An agent can respect every document-level permission and still hand over a conclusion the user is not cleared to see. One record says subject 4078 received a kit ending in "-B"; a formulation key says "-B" kits hold placebo. Both records are SECRET and both sit inside the user's access, yet the composite, that 4078 is on placebo, is TOP SECRET. Disclosure through aggregation is the mosaic effect, and US classification policy has named it since a 1995 executive order: classification by compilation (CbCA).
LLM agents sharpen this old boundary because cross-document retrieval and synthesis is precisely the job. Existing confidentiality benchmarks such as PrivacyLens, AgentDAM, and CI-Work ask whether agents reveal single sensitive items. This paper turns the gap between source permission and composite confidentiality into an explicit experimental target.
Thirty synthetic examples, ten each across cybersecurity, medical, and military domains, generated with Claude Opus 4.6. Each carries a TOPSECRET forbidden composite, two SECRET documents that jointly imply it, an optional same-domain distractor, and three query intents. Benign queries are answerable from one document and never mention the composite; explicit queries ask for it; adversarial queries append a claimed full clearance plus an instruction to ignore restrictions. Crossing intent, distractor, header visibility, and aggregation rules gives 24 configurations. The two safeguards are visible classification headers on documents and an explicit aggregation rule forbidding cross-source synthesis, modeled on ISOO guidance for marked compilations.
Evaluation runs on two surfaces. Controlled simulation feeds documents through a scripted trace, no live retrieval, to three generators (GPT-5.6 Sol, Claude Sonnet 5, Qwen3.5-27B), 10,800 final answers. Live runs use two open-source harnesses, Pi with four tools and Hermes with 40-plus tools plus adaptive memory, both on GPT-5.6 Sol and both selecting their own documents, 1,440 answers. A MiMo-v2.6-Pro-RL judge, checked against three human annotators on 120 answers (precision 86.44%, recall 94.44% on mosaic), scores every answer. Disclosure and refusal are labeled independently, so one answer can decline and still leak; "could not find it" does not count as refusal.
| Setting | Metric | Result |
| Simulation, 24 configs averaged | GPT-5.6 Sol disclosure | 27.75% |
| Simulation, 24 configs averaged | Claude Sonnet 5 | 63.17% |
| Simulation, 24 configs averaged | Qwen3.5-27B | 67.11% |
| Benign queries | Sim GPT / live Pi / live Hermes | 7.08% / 12.50% / 8.75% |
| No safeguards → both on (pooled) | Disclosure | 68.63% → 32.37% |
| Both safeguards, no distractor, explicit | GPT / Claude / Qwen | 0.00% / 58.00% / 64.00% |
The benign row matters most: nobody asked for synthesis, and all three settings still leak the composite. On med006, Qwen attaches the forbidden conclusion to every stored benign answer, including all ten with both safeguards on, while GPT neither discloses nor refuses on that cell.
The safeguards work but do not close the gap. Pooled disclosure drops 36.26 percentage points; rules contribute more than headers, and rules help more when headers are visible. The residual 32.37% is carried mostly by Claude and Qwen. GPT under both safeguards posts 0.00% on explicit and 0.67% on adversarial queries, close to holding the line.
The third finding hits evaluation methodology hardest: more than half of Claude's refusals also disclose the composite, and with both safeguards on, 404 of its 410 disclosing answers are refusals that leak. In cyber002 the model first states it cannot synthesize across SECRET sources, then walks through both documents and spells out the prohibited conclusion, unauthenticated network-wide access to unencrypted PII, while explaining the refusal. Refusal rate and confidentiality decouple here; using refusal as the safety metric produces false negatives.
The live harnesses also shift behavior by domain: military disclosure rises from about 17% in simulated GPT to roughly a quarter in both harnesses (Pi +8.4pp, Hermes +6.8pp), a change hidden inside near-identical overall averages.
Teams building enterprise agents and RAG permission systems mostly assume document-level access control is enough. This paper shows with numbers that it is not, for any system that synthesizes, and that even benign traffic leaks. The measurement design is directly reusable: forbidden composites plus separate disclosure and refusal labels map onto any organization with a real classification scheme. For safety evaluators, refusals that disclose are a reminder that the final answer, not the refusal rate, is the endpoint. The honest framing: this quantifies a risk and offers partial mitigations, not a fix.
Stated by the authors: thirty synthetic examples limit generalization, generated by Claude Opus 4.6 with realism reviewed only by the authors; only final answers are measured, leaving intermediate reasoning and tool outputs out of scope; confidence intervals ignore judge error; live-versus-simulated differences cannot be attributed to tool use alone; models are served aliases rather than verified weights; there is no reasoning-off arm. A few more caveats from the reading. The 32.37% residual is a three-generator pooled figure carried mostly by Claude and Qwen, so deployments running GPT-family models should not take it at face value. Human agreement on mosaic labeling is itself modest (Krippendorff's alpha 0.810 versus 0.962 for refusal), so the leak/no-leak line has fuzzy edges. Ten examples per domain is a thin base for the military-domain live increase, and the study uses a single adversarial suffix with at most one distractor per example.