Cross-tenant and cross-session leakage

What it is

AI systems keep state in more places than conventional applications: response caches, conversation memory, retrieval indexes, and models fine-tuned on particular customers' data. Each is a place where separation between users must be enforced, and where it is commonly assumed. Leakage is the appearance of one party's data in another's session. Disclosure of sensitive data to the party it belongs to, or to outsiders generally, is covered in sensitive information disclosure.

How it happens

• A cached response to one user is served to another who asked something similar.
• Conversation memory is keyed in a way that mixes users.
• A model fine-tuned on several customers' data reproduces one customer's content for another.
• A shared retrieval index returns another tenant's documents.

Why it matters

It is a confidentiality breach and usually a personal data breach, with notification duties. For a supplier serving several organisations it also breaks the basic undertaking that customers' data is kept apart.

Warning signs

• Users report seeing content that is not theirs.
• Cache keys do not include the user or tenant.
• One model or index serves several customers with no tested partition.
• Separation relies on instructions to the model.

Who owns it

The system owner is accountable for separation. Engineering implements it in every stateful component. Security tests it; the data protection officer is involved in any failure.

In practice

To reduce cost, a firm caches answers to common questions asked of its account assistant. The cache key is the question text. A customer asks for their recent transactions and receives the list that was generated for the previous person who asked. The same pattern generalises to any optimisation that reuses outputs across users.