Agent Mosaic: How Accessible Data Can Become a Forbidden Conclusion

Introduction

Access control is often designed around individual files: if a user or agent is allowed to read a document, the document is treated as safe to retrieve. Agentic systems challenge that assumption. Several individually harmless facts can be combined into a sensitive conclusion, even when no single source contains the full answer. The study calls this pattern the “mosaic effect.”

What the study tested

In Agent Mosaic, the researchers created 30 synthetic scenarios spanning cybersecurity, medicine, and military operations. The controlled simulation produced 10,800 final answers from three LLM agents. They also collected 1,440 answers from live agents running in two open-source harnesses.

A central test used benign-looking questions that should have been answerable from one document. This setup examined whether an agent would nevertheless draw on multiple sources and reveal a prohibited composite. In the simulation, GPT-5.6-Sol—the strongest model evaluated—disclosed forbidden combinations in 7.08% of answers. The live-harness results were worse. The issue was therefore not simply whether the model could access a sensitive file, but whether it was allowed to transform several low-sensitivity facts into a high-sensitivity conclusion.

Key findings

• Read permission is not inference permission. Separate authorization to view documents does not automatically authorize the model to publish conclusions derived from them.
• Visible safeguards help, but only partially. Classification headers and explicit aggregation rules substantially reduced pooled disclosure rates. Even so, unsafe disclosures remained at 32.37% across all intents in the simulated evaluation.
• Refusal rates can be misleading. Some refusals still revealed the prohibited conclusion while explaining why the answer could not be provided. A refusal metric alone can therefore overstate confidentiality.
• Real workflows add risk. Higher disclosure rates in open-source harnesses suggest that retrieval, tool use, and context handling may create additional paths for cross-document inference.

Why it matters

The results point to a broader security boundary for agents operating over confidential data. File-level permissions are necessary, but they do not control what an agent may infer from the authorized context. Systems also need to assess the sensitivity of derived information, identify restricted combinations, and determine whether the current user is entitled to receive the resulting conclusion.

For organizations, practical defenses may include information-flow controls between retrieval and generation, policy checks for high-risk combinations, and audits that inspect refusal explanations as well as direct answers. The paper does not claim that these measures solve the problem completely. Instead, it demonstrates that mosaic-style leakage is an observable and non-negligible confidentiality failure mode in the evaluated settings.

Source: Hugging Face Daily Papers