Basically you don't reference "leaked" material at all. That would be confirming its accuracy and lending provenance. The last thing you want to do is verify it.

Other things you don't want to do is acknowledge that you are also privy to such information. These things are actually tied together bit by bit. While it might be assumed that a senator on the armed forces committee has access, it could be unknown which of his aides does his classified work.

Some of this is the origin of the "can neither confirm nor deny" phrase. While it may be obvious to everyone that the CIA won't tell you who the spies are, they also won't tell you who isn't a spy, even when it is completely obvious.

Some of the classified stuff may be at the very edge of marginal speculation, but it adds up, like a logic puzzle or a giant game of Clue.