USC paper quantifies LLM agent 'mosaic' confidentiality leaks

A new paper from USC's Information Sciences Institute puts a number on how often an LLM agent will leak a confidential conclusion it has assembled from fragments that look harmless on their own: 7.08% of answers from the best-performing model tested, under queries deliberately written to be answerable from a single document.

The paper, Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems, runs 30 synthetic scenarios drawn from cybersecurity, medical and military domains. The simulation produces 10,800 answers from three LLM agents, with another 1,440 answers collected from live agents inside two open-source harnesses. The best performer, called GPT-5.6-Sol in the paper, "discloses forbidden composites in 7.08% of answers (95% CI: 3.75-10.67%) in simulation, with worse disclosure rates in live harnesses."

The obvious fixes do not close the gap. Adding visible classification headers and explicit aggregation rules "reduces pooled disclosure rates substantially, yet unsafe disclosures persist in 32.37% of simulated answers (95% CI: 28.33-36.19%) across all intents despite these safeguards," the authors write.

Refusing to answer is not a clean exit either. "Significant refusals reveal the prohibited conclusion regardless," the authors note; the pattern of what the model declines to say can itself tell the asker that a sensitive composite exists.

The abstract reports pooled numbers. Per-model and per-domain disclosure rates are not stated in the summary itself.