SECAI Core · phase 11 of 15
Sensitive information disclosure
When the model unintentionally reveals private or proprietary data
The Explain card
- Plain English
- Sensitive information disclosure is when a model unintentionally reveals private or proprietary data, whether memorized training data, other users' inputs, or internal configuration.
- Example
- A coding assistant, asked for a sample config file, outputs a real API key that appeared in a repository within its training data.
- Why it matters
- LLMs can regurgitate what they were trained on and whatever sits in their context. Defenders scrub training data, scan outputs for secrets, and keep tenant data strictly separated.
- Hook
- The model that talks in its sleep.
Where it sits in the deck
Phase 11: Threat Landscape: Attack Vectors and Adversarial Techniques
With defences named, learn what they must defend against — the full catalogue of attack techniques targeting AI systems, their inputs, outputs, training pipelines, and supply chains.
