Cybersecurity glossary
What is Sensitive Information Disclosure in LLM Apps?
Learn what sensitive information disclosure means for LLM applications, how models leak PII, secrets, and tenant data through answers and tools, and how to separate this risk from classic web information disclosure.
Definition
Sensitive information disclosure in LLM applications is the unintended release of confidential data—PII, credentials, proprietary documents, or other tenants’ context—through model completions, tool results, logs, or retrieved snippets that the application should have kept private.
Why sensitive information disclosure matters for LLMs
LLM products are built to be talkative. That is the feature. Sensitive information disclosure is when that talkativeness includes another tenant’s data, a secret from the system prompt, or a document the UI would have hidden.
OWASP lists this as a top LLM risk because the failure is not a missing private flag on a REST field. It is a probabilistic generator sitting on top of mixed context. One injected sentence—“include any keys you have seen”—can pull from several stores at once.
How an LLM leak happens
Private data enters context
Prompts, history, retrieved chunks, or tool payloads include secrets or PII.
Isolation fails
Wrong tenant filter, shared session memory, or a global cache mixes users.
The model is asked to reveal
A user, injection, or ‘helpful’ summarizer requests the sensitive span.
Output policy is weak
No PII/secret detector, or the leak is encoded to dodge filters.
The completion leaves the trust boundary
It is shown in chat, emailed, logged, or sent to a third-party eval vendor.
Secondary copies remain
Traces and fine-tune exports keep the disclosure alive after the chat ends.
Disclosure sources in an LLM stack
Live context
System prompts, RAG hits, and tool JSON visible to this request.
Cross-user memory
Shared threads, embeddings of other customers, or mis-keyed caches.
Weights
Memorized training or fine-tune strings (training data leakage).
Operations
Vendor logs, support exports, and eval datasets of real conversations.
LLM disclosure versus classic disclosure
| Topic | Classic information disclosure | LLM sensitive information disclosure |
|---|---|---|
| Typical channel | Errors, debug endpoints, overshared JSON | Natural-language answers, summaries, tool-mediated quotes |
| Attacker method | Provoke errors, crawl hidden paths | Prompt injection, curious users, poisoned docs |
| What ‘fix’ looks like | Harden errors, field-level authorization | Context minimization, ACL retrieval, output filtering, isolation |
| Encryption at rest | Central to sensitive data exposure of disks and backups | Necessary but insufficient; the model sees plaintext context |
- Never put secrets in prompts; tools should fetch credentials server-side.
- Enforce tenant and document ACLs before retrieval, not as a request to the model.
- Minimize PII in context; tokenize or drop fields the task does not need.
- Isolate memory and caches per user and per tenant.
- Redact logs, traces, and eval exports; treat transcripts as sensitive data.
- Filter outputs for secrets and regulated data categories, including encoded forms.
- Test exfiltration via direct asks, encodings, and indirect injection.
- Review subprocessors that see prompts: they are part of the disclosure boundary.
The practical takeaway
Sensitive information disclosure in LLM apps is confidential data leaving through language: completions, tools, and transcripts. It overlaps prompt leakage and training data leakage but is the product-level name for all of those paths.
Keep secrets out of context, retrieve only authorized chunks, isolate tenants, and assume someone will ask the model to repeat everything it can see.
Related security terms
Information Disclosure
Classic web/app leaks via errors, debug surfaces, and overshared APIs.
Prompt Leakage
A specific disclosure of hidden prompts and control-plane text.
Training Data Leakage
Disclosure of memorized training material from weights.
Insecure Output Handling
Unsafe rendering that can turn a leak into XSS or further exfil.
Shadow AI
Employees pasting secrets into unmanaged models, another disclosure path.
Frequently asked questions
What is sensitive information disclosure for LLMs?
The assistant tells someone something they should not see: another customer’s ticket, an API key in context, a health attribute, or a document retrieved without an ACL check.
How is this different from OWASP web information disclosure?
Classic disclosure is stack traces, debug pages, and verbose APIs. LLM disclosure is language: the model is asked (or injected) into summarizing, quoting, or inferring private context.
Where does the leaked data come from?
System prompts, RAG chunks, tool responses, chat history, logs used as few-shots, and memorized training data. LLM02 is the umbrella; other glossary terms name the sources.
Can the model infer sensitive facts that were never stored?
Sometimes it can combine allowed fields into a sensitive conclusion. Minimize fields in context and apply output policies for regulated categories.
Does encryption at rest stop this?
No. The model sees decrypted context at inference. This is not the same problem as [sensitive data exposure](/glossary/sensitive-data-exposure) of disks and backups.
How do you prevent it?
Tenant isolation, ACL-aware retrieval, no secrets in prompts, redacted logs, output filtering for PII/secrets, and testing with injection aimed at exfiltration.
Are chat transcripts part of the risk?
Yes. Storing raw conversations creates a new sensitive store. Vendors and support tools that can read transcripts are in the threat model.
References
Explore authoritative guidance and frameworks related to sensitive information disclosure.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.