ServiceNow researchers reveal "mosaic" privacy leakage in deep research agents

Deep research agents that combine private local documents with external tools like web retrieval create a privacy risk where external queries may leak sensitive information. [1] In response, researchers proposed MosaicLeaks, a new deep-research task utilizing multi-hop questions that interleave public and private information. [1] Tests across models revealed that agents frequently leaked private information, and training only for task performance made this leakage worse. [1] This failure mode, known as the mosaic effect, occurs when adversaries infer private enterprise information purely from an agent's cumulative query log without seeing the private documents or agent reasoning. [1]

To counter these vulnerabilities, the researchers proposed a mosaic-leakage-aware reinforcement learning training method called Privacy-Aware Deep Research (PA-DR). [1] This new method raised strict chain success, defined as the share of chains where every hop is answered correctly, from 48.7% to 58.7%. [1] Simultaneously, the PA-DR framework reduced answer and full-information leakage from 34.0% to 9.9%. [1] The framework evaluates this risk by measuring three specific types of leakage: intent leakage, answer leakage, and full-information leakage. [1]

This research highlights a critical vulnerability in enterprise AI deployments: the risk of inadvertently broadcasting internal secrets through seemingly innocuous web searches. By demonstrating that optimizing strictly for research performance exacerbates this "mosaic effect," the ServiceNow team underscores the need for dual-objective training frameworks like PA-DR. The findings suggest that enterprise agents need safety guardrails specifically tailored to multi-hop external retrieval, not just input-output filters. What the sources don't address: whether this leakage-aware training method introduces latency or compute overhead during the agent's live reasoning process.