Skip to main content

CCC.GenAI.TH03: Sensitive Information Disclosure

Threat ID:CCC.GenAI.TH03
Title:Sensitive Information Disclosure
Description:

Sensitive data can be memorised by the model from user interaction or training and may then be leaked to unintended and unauthorised parties by querying the model, for example through crafted prompts.

Related Capabilities

IDTitleDescription
CCC.Core.F02Encryption at Rest Enabled by DefaultThe service automatically encrypts all data using industry-standard cryptographic protocols prior to being written to a storage medium.
CCC.Core.F06Access ControlThe service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes.
CCC.GenAI.F22Data ControlEnsures prompts, model outputs, embeddings, and training data fed by customers are not used to train foundation models.
CCC.GenAI.F22Data ControlEnsures prompts, model outputs, embeddings, and training data fed by customers are not used to train foundation models.

External Mappings

Reference IDEntry IDStrengthRemarks
FINOS-AIGF
AIR-RC-001
0
Information Leaked To Hosted Model
FINOS-AIGF
AIR-SEC-002
0
Information Leaked to Vector Store
FINOS-AIGF
AIR-RC-023
0
Intellectual Property (IP) and Copyright
SAIF
SDD
0
Sensitive Data Disclosure
OWASP-LLM-TOP10
LLM02:2025
0
Sensitive Information Disclosure
MITRE-ATLAS
AML.T0057
0
LLM Data Leakage

Controls

IDTitleObjectiveControl FamilyThreat MappingsGuideline MappingsAssessment Requirements
CCC.GenAI.C01Model Input Filtering and SanitisationInspect and validate input before it is passed to a GenAI model in order to filter or sanitise adversarial queries and prevent sensitive data leakage. Data
2
8
2
CCC.GenAI.C02Model Output Filtering and SanitisationInspect and validate GenAI model output before passing it to users, applications or plugins in order to filter or sanitise insecure or unreliable output and prevent sensitive data leakage. Data
5
7
2
CCC.GenAI.C03Data Provenance and Source VettingEnsure that all data for training, fine-tuning or RAG comes from trusted, approved sources and is authorised for the intended purposes in order to prevent the initial introduction of malicious content or leaked sensitive data. Data
2
3
2
CCC.GenAI.C04Sanitisation of Ingested DataValidate and sanitise all data ingested by GenAI systems from extenal sources or internal knowledge bases, whether for training, conversion to vector embeddings, or real-time retireval, in order to remove or redact poisoned or sensitive data before further processing. Data
2
3
2