Sensitive information disclosure
A model surfaces training, fine-tuning, or retrieval-sourced sensitive data in its output.
- critical
- data-protection
- privacy
- owasp-llm
How it happens
A model trained, fine-tuned, or given retrieval access on sensitive data surfaces it in a response, bypassing the access controls that would normally gate that data.
Why it matters
Standard input-side access controls don't constrain what a model can say once it has seen the data at training or inference time.
Mitigation
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Regulatory context
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| OWASP Top 10 for LLM Applications | LLM02 | Sensitive Information Disclosure |