QuasiLeak-Bench found privacy disclosures in combinations of harmless-looking cues

A privacy filter that looks only for addresses, names or identity numbers can miss a disclosure assembled from several harmless-looking details. QuasiLeak-Bench constructed messages in which a recipient could combine clues from different sentences or paragraphs to infer an attribute the sender's policy was intended to hide. The target of detection was the complete evidence group and implied attribute, not a single toxic or secret string.

The authors used synthetic profiles and policy-controlled messages, which allowed exact labels for more than nine thousand cross-clue groups. A specialized smaller model improved performance relative to prompted general models in their constructed held-out tests, but the result does not prove that its rewrites preserve meaning for real users or prevent reidentification using external records. A generated message that removes one obvious clue may still carry the same implication through another combination.

The relevant agent boundary is publication of a message on behalf of a principal. The checker must compare what the recipient can infer against what the sender authorized, while preserving legitimate communication. A false-positive-heavy filter can protect against some disclosures by suppressing useful content, so both leakage and message utility require independent measurement.