AI 助手会从多份机密文件里拼出你不想让它说的结论
你给 AI 助手看三份文件，它可能把每份里的一小块信息拼起来，说出一个本不该说的结论——比如从病历、用药记录和保险单里推断出某人的病情。研究者用 30 个网络安全、医疗、军事场景做了 1 万多轮测试，发现最强的模型在看似无害的单文档提问下，也有 7% 的概率泄露这种「拼图式」结论；加上分类标签和聚合规则后，泄露率反而更高，达到 32%。更麻烦的是，AI 拒绝回答时，拒绝本身往往就暴露了那个敏感结论。这不是你明天能修好的 bug，而是当前 AI 系统在机密数据环境下的固有风险。
📄 原文摘要(英文)
Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect creates a critical risk for agents operating over confidential data. We quantify its realization with 30 synthetic cybersecurity, medical, and military examples, yielding 10,800 final answers from three LLM agents in controlled simulation and 1,440 answers from live agents in two open-source harnesses. Even under benign queries designed to be answerable from one document, GPT-5.6-Sol, the best performing model tested, discloses forbidden composites in 7.08% of answers (95% CI: 3.75-10.67%) in simulation, with worse disclosure rates in live harnesses. Adding visible classification headers and explicit aggregation rules reduces pooled disclosure rates substantially, yet unsafe disclosures persist in 32.37% of simulated answers (95% CI: 28.33-36.19%) across all intents despite these safeguards. Furthermore, increased refusals do not guarantee confidentiality, since significant refusals reveal the prohibited conclusion regardless. These results point to a troubling conclusion: sensitive data leaks via mosaic-style events are an observed confidentiality failure mode in the evaluated settings at non-negligible rates. They motivate stronger controls on what agents may infer and disclose in sensitive data environments with mixed-clearance users.