Review Data Leakage

Data leakage is the unintended exposure, transfer, or disclosure of information to a person, system, model, or destination that is not authorized to receive it. Note that machine-learning practitioners use the same phrase for a different problem: information from test or future data leaking into training, which makes a model look more accurate than it really is. This entry covers the disclosure sense.

Leakage can happen through prompts, logs, outputs, training data, retrieval systems, integrations, exports, or access mistakes. The information may be visible immediately or recoverable later.

AI workflows often copy information across several services and contexts. Each handoff can change retention, access, and disclosure risk.

An employee pastes client records into an unapproved public assistant whose service terms permit retention beyond the intended task.

Data leakage is not limited to a public breach. Sending information to an unauthorized internal tool or unintended model context is also leakage.

Information crossed a boundary it was not meant to cross.

* [[sensitive-information|Sensitive Information]] * [[sanitized-information|Sanitized Information]] * [[data-privacy-and-gdpr|Data Privacy and GDPR]] * [[prompt-injection|Prompt Injection]] * [[handoff|Handoff]]

* [NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations](https://doi.org/10.6028/NIST.AI.100-2e2025) — authoritative treatment of privacy, inference, extraction, and information-disclosure attacks on AI systems.

* Start with [[sensitive-information|Sensitive Information]] and examine every [[handoff|Handoff]].