Back to the MIT repository
2. Privacy & Security3 - Other

Proprietary data

Access to sensitive company data [473]

Source: MIT AI Risk Repositorymit1410

ENTITY

2 - AI

INTENT

2 - Unintentional

TIMING

3 - Other

Risk ID

mit1410

Domain lineage

2. Privacy & Security

186 mapped risks

2.1 > Compromise of privacy by leaking or correctly inferring sensitive information

Mitigation strategy

1. Deploy real-time Data Loss Prevention (DLP) with Semantic Analysis: Institute advanced DLP solutions and inline AI gateway security controls to dynamically inspect, classify, and redact proprietary information within both user prompts and model responses. This establishes an essential technical barrier to prevent the unintentional or malicious exfiltration of sensitive organizational data. 2. Enforce the Principle of Least Privilege and Robust Access Controls: Implement stringent Role-Based Access Control (RBAC) to ensure AI models and their associated users can only access the minimum proprietary data necessary for their defined task. Complement this with end-to-end encryption for all sensitive data utilized by the AI system, both at rest and in transit, to mitigate risks associated with unauthorized access. 3. Integrate Privacy-Preserving Techniques in the Machine Learning Lifecycle: Apply data anonymization, pseudonymization, and differential privacy during data preprocessing to safeguard individual records. Furthermore, utilize rigorous, non-overlapping data splitting methodologies and train models to minimize overfitting, thereby reducing the probability of model memorization and subsequent inference-based leakage of proprietary training data.