For Heads-of · Practitioner
Sensitive information disclosure
A model surfaces training, fine-tuning, or retrieval-sourced sensitive data in its output.
- critical
- data-protection
- privacy
- owasp-llm
How it happens
A model trained, fine-tuned, or given retrieval access on sensitive data surfaces it in a response, bypassing the access controls that would normally gate that data.
Why it matters
Standard input-side access controls don't constrain what a model can say once it has seen the data at training or inference time.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| OWASP Top 10 for LLM Applications | LLM02 | Sensitive Information Disclosure |