MosaicLeaks - Privacy Leakage: leaderboard
How much private enterprise information a deep-research agent leaks through its web queries on MosaicLeaks (Gurung et al., 2026): the share of rollouts in which a StepFun-3.5-Flash adversary that sees only the queries answers a private question or states a true private claim. Percent of 344 test tasks, mean of three runs with the default agent prompt; lower is better.
Metric: Privacy leakage (%; share of rollouts whose web queries let a StepFun-3.5-Flash adversary answer a private question or state a true private claim about the enterprise documents, mean of three runs; default prompt; lower is better). Source: arxiv.org. Saturation forecast: Around February 2027. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Gemma 4 31B (IT) | 9.7 | #343 |
| 2 | Qwen 3 8B | 33.4 | #1838 |
| 3 | Qwen 3 4B Instruct | 34 | #1660 |
| 4 | Step 3.5 Flash | 39.6 | #508 |
| 5 | GPT-OSS-20B | 42.9 | #1150 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=mosaicleaks-privacy-leakage · How It Works · Data refreshed daily, snapshot 2026-11-12.