# LLM02 - Sensitive Information Disclosure

> LLM inadvertently reveals confidential data from training data or retrieved context.

- **Category**: Owasp Llm
- **Subcategory**: top10_2025
- **Canonical URL**: https://designpattern.fyi/owasp_llm/llm02_sensitive_info_disclosure/

---

## Description
'**Intent**: Prevent LLMs from leaking sensitive information such as PII, financial records, or internal system details.

**Context**: LLMs may memorize and reproduce sensitive data from training sets or RAG contexts. Users can craft queries to extract this information through targeted prompting.

**Solution**: Implement output filtering for sensitive data patterns. Apply data sanitization in RAG pipelines. Use differential privacy techniques. Limit training data exposure. Apply PII detection and redaction.'



## Use Cases
Use when LLMs process or have access to sensitive data through training, fine-tuning, or retrieval augmented generation.





## Trade-offs


### Advantages

- Protects user privacy

- Prevents regulatory violations

- Reduces data breach risk

- Maintains trust




### Considerations & Drawbacks

- May reduce model usefulness

- PII detection has false negatives

- Training data leaks are hard to prevent







---
**Reference**: [Original Source](https://genai.owasp.org)