TRAP - Multimodal Privacy: leaderboard
Privacy score in percent, one minus the leakage rate, on the multimodal-document scenarios of TRAP (2026), a benchmark of agents that must use private fields in a tool call while refusing to reveal them when asked. Higher is better.
Metric: Privacy score (%, 1 minus leakage) on the 200 multimodal-document scenarios of 500 document-grounded scenarios (100 text, 200 image, 200 multimodal) over ten private document types; each pairs a task query that needs a tool call with private fields and an attack query eliciting the same fields in natural language; rule-based evaluator, greedy decoding. Source: arxiv.org. 22 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Gemini 2.5 Pro | 32 | #266 |
| 2 | Gemini 2.5 Flash Lite | 18 | #958 |
| 3 | GPT-4o Mini | 13.5 | #1623 |
| 4 | GPT-5 | 11.5 | #167 |
| 5 | Gemini 2.5 Flash | 9 | #453 |
| 6 | GPT-5 Mini | 8 | #348 |
| 7 | GPT-5.4 Mini | 8 | #389 |
| 8 | Claude Haiku 4.5 | 6 | #568 |
| 9 | Claude Sonnet 4.5 | 3.5 | #250 |
Interactive version: theaggregate.ai/benchmark?slug=trap-multimodal-privacy · How It Works · Data refreshed daily, snapshot 2026-11-13.