Here's a thinking process:
1. **Analyze User Input:**
- **Role:** Frank, excited, passionate tech-savvy news curator on Evil Source forums.
- **Task:** Rewrite the provided source article into a FULL, in-depth, exciting forum post.
- **Critical Rules:**
- Write exactly 1 to 3 PARAGRAPHS.
- Each paragraph: 4-8 sentences forming a complete thought. Never less than 4.
- Include EVERY detail, fact, insight from the source article.
- Be EXCITING and passionate — like you just discovered this and can't wait to share.
- Add your own commentary, opinions, and reactions throughout.
- Include ALL key information: who, what, when, where, why, how, specs, prices, dates.
- Use line breaks between paragraphs to organize.
- If additional source links are provided, reference them naturally.
- End with: 'Source: <original URL>'
- Make this the DEFINITIVE version.
- NEVER write less than one full paragraph.
- **Source Material:** "MosaicLeaks: Can your research agent keep a secret?" by Alexander Gurung & Rafael Pardinas (ServiceNow), published June 18, 2026 on Hugging Face. Covers privacy leakage in deep-research agents, the "mosaic effect," three leakage measures (intent, answer, full-information), dataset construction (1,001 multi-hop chains, DRBench-style local docs, BrowseComp-Plus web docs, 559/98/344 split), agent harness (Plan, Choose, Read, Resolve tools), prompt engineering fails, RL training for task performance actually increasing leakage (48.7% -> 59.3% success but 34.0% -> 51.7% leakage), and the proposed solution PA-DR (Privacy-Aware Deep Research) which improves strict chain success from 48.7% to 58.7% while cutting leakage from 34.0% to 9.9%.
2. **Deconstruct Source & Extract Key Details:**
- **Authors/Date/Publisher:** Alexander Gurung & Rafael Pardinas (ServiceNow), published June 18, 2026 on Hugging Face.
- **Core Problem:** Deep-research AI agents combine private local docs with public web tools, creating a "mosaic effect" where benign-looking web queries collectively leak private enterprise secrets.
- **Example:** MediConn agent searches about cloud migration, Jan 2024 security disclosure, vendor attack. Combined, they reveal "MediConn migrated 70% of infrastructure to cloud by Jan 2025."
- **Leakage Measures:** Intent leakage (adversary infers research goals), Answer leakage (adversary answers specific private questions from query logs), Full-information leakage (adversary states verifiable private claims without prompts).
- **Dataset:** MosaicLeaks = 1,001 multi-hop research chains over local enterprise docs + controlled web corpus. Interleaves local/web sub-questions. Split: 559 training, 98 validation, 344 held-out test. Construction: seed private facts -> bridge documents -> validate chains.
- **Agent Harness:** Adapted from DRBench. Tools: Plan (search queries), Choose (select docs), Read (answer hops in parallel), Resolve (answer/read more/plan). Evaluated via normalized string matching per hop.
- **Naive Fixes:** Prompting "don't leak" only slightly reduces leakage (e.g., Qwen3-4B: 34.0% -> 25.5%) but hurts performance (48.7% -> 44.5% strict chain success) and just makes agents query less, not safer.
- **RL Training Paradox:** Training purely for task success boosted strict chain success from 48.7% to 59.3%, but leakage skyrocketed from 34.0% to 51.7% because richer queries help retrieval but expose more private context.
- **Solution:** Privacy-Aware Deep Research (PA-DR) RL method. Raises strict chain success from 48.7% to 58.7% while slashing answer/full-information leakage from 34.0% to 9.9%.
- **Source URL:** https://huggingface.co/blog/ServiceNow/mosaicleaks
3. **Draft - Paragraph 1: The Hook & The Problem (Excitement, Core Concept, Example, Leakage Types)**
*Goal:* Introduce the concept excitedly, explain the mosaic effect, give
1. **Analyze User Input:**
- **Role:** Frank, excited, passionate tech-savvy news curator on Evil Source forums.
- **Task:** Rewrite the provided source article into a FULL, in-depth, exciting forum post.
- **Critical Rules:**
- Write exactly 1 to 3 PARAGRAPHS.
- Each paragraph: 4-8 sentences forming a complete thought. Never less than 4.
- Include EVERY detail, fact, insight from the source article.
- Be EXCITING and passionate — like you just discovered this and can't wait to share.
- Add your own commentary, opinions, and reactions throughout.
- Include ALL key information: who, what, when, where, why, how, specs, prices, dates.
- Use line breaks between paragraphs to organize.
- If additional source links are provided, reference them naturally.
- End with: 'Source: <original URL>'
- Make this the DEFINITIVE version.
- NEVER write less than one full paragraph.
- **Source Material:** "MosaicLeaks: Can your research agent keep a secret?" by Alexander Gurung & Rafael Pardinas (ServiceNow), published June 18, 2026 on Hugging Face. Covers privacy leakage in deep-research agents, the "mosaic effect," three leakage measures (intent, answer, full-information), dataset construction (1,001 multi-hop chains, DRBench-style local docs, BrowseComp-Plus web docs, 559/98/344 split), agent harness (Plan, Choose, Read, Resolve tools), prompt engineering fails, RL training for task performance actually increasing leakage (48.7% -> 59.3% success but 34.0% -> 51.7% leakage), and the proposed solution PA-DR (Privacy-Aware Deep Research) which improves strict chain success from 48.7% to 58.7% while cutting leakage from 34.0% to 9.9%.
2. **Deconstruct Source & Extract Key Details:**
- **Authors/Date/Publisher:** Alexander Gurung & Rafael Pardinas (ServiceNow), published June 18, 2026 on Hugging Face.
- **Core Problem:** Deep-research AI agents combine private local docs with public web tools, creating a "mosaic effect" where benign-looking web queries collectively leak private enterprise secrets.
- **Example:** MediConn agent searches about cloud migration, Jan 2024 security disclosure, vendor attack. Combined, they reveal "MediConn migrated 70% of infrastructure to cloud by Jan 2025."
- **Leakage Measures:** Intent leakage (adversary infers research goals), Answer leakage (adversary answers specific private questions from query logs), Full-information leakage (adversary states verifiable private claims without prompts).
- **Dataset:** MosaicLeaks = 1,001 multi-hop research chains over local enterprise docs + controlled web corpus. Interleaves local/web sub-questions. Split: 559 training, 98 validation, 344 held-out test. Construction: seed private facts -> bridge documents -> validate chains.
- **Agent Harness:** Adapted from DRBench. Tools: Plan (search queries), Choose (select docs), Read (answer hops in parallel), Resolve (answer/read more/plan). Evaluated via normalized string matching per hop.
- **Naive Fixes:** Prompting "don't leak" only slightly reduces leakage (e.g., Qwen3-4B: 34.0% -> 25.5%) but hurts performance (48.7% -> 44.5% strict chain success) and just makes agents query less, not safer.
- **RL Training Paradox:** Training purely for task success boosted strict chain success from 48.7% to 59.3%, but leakage skyrocketed from 34.0% to 51.7% because richer queries help retrieval but expose more private context.
- **Solution:** Privacy-Aware Deep Research (PA-DR) RL method. Raises strict chain success from 48.7% to 58.7% while slashing answer/full-information leakage from 34.0% to 9.9%.
- **Source URL:** https://huggingface.co/blog/ServiceNow/mosaicleaks
3. **Draft - Paragraph 1: The Hook & The Problem (Excitement, Core Concept, Example, Leakage Types)**
*Goal:* Introduce the concept excitedly, explain the mosaic effect, give