arXiv cs.CL· Daniel Ruiz, Luca Luceri, Emilio Ferrara·· 13 小时前AI 评分52
Agent Mosaic：智能体式 LLM 系统中的机密泄露识别
Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems
AI 导读
论文提出智能体式 LLM 系统的“马赛克效应”机密泄露问题，即智能体从可访问文档中检索信息后拼出敏感结论并披露。研究用 30 个网络安全、医疗和军事合成案例，在受控模拟中从三个 LLM 智能体获得 10,800 条最终答案，并在两个开源 harness 的在线智能体上获得 1,440 条答案。
正文 · 原文
Abstract:Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect creates a critical risk for agents operating over confidential data. We quantify its realization with 30 synthetic cybersecurity, medical, and military examples, yielding 10,800 final answers from three LLM agents in controlled simulation and 1,440 answers from live agents in two open-source harnesses. Even under benign queries designed to be answerable from one document, GPT-5.6-Sol, the best performing model tested, discloses forbidden composites in 7.08% of answers (95% CI: 3.75-10.67%) in simulation, with worse disclosure rates in live harnesses. Adding visible classification headers and explicit aggregation rules reduces pooled disclosure rates substantially, yet unsafe disclosures persist in 32.37% of simulated answers (95% CI: 28.33-36.19%) across all intents despite these safeguards. Furthermore, increased refusals do not guarantee confidentiality, since significant refusals reveal the prohibited conclusion regardless. These results point to a troubling conclusion: sensitive data leaks via mosaic-style events are an observed confidentiality failure mode in the evaluated settings at non-negligible rates. They motivate stronger controls on what agents may infer and disclose in sensitive data environments with mixed-clearance users.
| Comments: | 16 pages, 9 figures, submitted to ACL Rolling Review, October 2026 cycle |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2610.30418 [cs.CR] |
| (or arXiv:2610.30418v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.30418 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Daniel Ruiz [view email]
[v1]
Wed, 21 Oct 2026 20:25:11 UTC (227 KB)
来源：arXiv cs.CL · arxiv.org