Tagged:

15 posts

• Cross-Tenant Data Leakage in Multi-Tenant LLM Deployments: Incidents, Architecture, and What to Demand from Providers

  When an LLM service hosts multiple customers on shared infrastructure, failures in conversation isolation, prompt cache sharing, or conversation history storage can expose one customer's data to another. This post covers the documented failure modes, the March 2023 ChatGPT Redis incident, batch inference and system prompt bleed risks, and what enterprise architects should demand from LLM providers before trusting them with sensitive data.

  Jul 15, 2026 llm-security multi-tenant data-leakage inference-infrastructure privacy prompt-caching gdpr enterprise-security defense-patterns

• Prompt Cache Timing Attacks: Side-Channel Leakage in LLM API Infrastructure

  Major LLM providers cache prompt prefixes to reduce latency and cost — but shared cache infrastructure creates a timing side-channel. An attacker with access to a shared API key or multi-tenant deployment can measure whether a specific prefix is cached, leaking information about co-tenant system prompts and conversation context within the same cache namespace.

  Jul 15, 2026 side-channel prompt-injection inference-infrastructure cache-attacks llm-security privacy

• Model Inversion Attacks: Reconstructing Private Training Data from Model Confidence Scores

  A model's output probability scores are not neutral summaries — they encode information about the training data that produced them. Model inversion attacks exploit this to reconstruct representative training examples from API-level confidence values. This post covers the foundational Fredrikson et al. work, black-box and GAN-based variants, conditions for vulnerability, and how to distinguish this class from membership inference and training data extraction.

  Jul 13, 2026 privacy adversarial-ml model-inversion differential-privacy attack-defense training-data

• Privacy-Preserving AI Inference: Trusted Execution Environments, Homomorphic Encryption, and Confidential Computing

  When you submit a medical record to an AI API, can the cloud operator read it? TEEs, homomorphic encryption, and secure multi-party computation provide cryptographic and hardware-enforced confidentiality. This post explains what each actually guarantees — and what it doesn't.

  Jul 10, 2026 privacy confidential-computing trusted-execution-environments homomorphic-encryption secure-mpc healthcare-ai threat-modeling cryptography inference-privacy

• Training Data Extraction: How Attackers Query LLMs to Surface Memorized Private Content

  LLMs verbatim-memorize chunks of their training data, and a simple prefix-completion attack can surface phone numbers, email addresses, code, and cryptographic identifiers that appeared in the training corpus — no model internals required. This post covers the mechanics, landmark empirical results, and the practical defenses that actually reduce extraction risk.

  Jul 9, 2026 privacy training-data-extraction memorization llm-security carlini differential-privacy data-governance

• Differential Privacy in Practice: What the Math Guarantees (and What It Doesn't) for AI Training Data

  Differential privacy is the strongest mathematical privacy guarantee for ML training data — but the gap between formal ε-DP and deployed reality means many 'private' AI systems aren't nearly as private as advertised. This post bridges the math and the practice.

  Jul 6, 2026 privacy differential-privacy dp-sgd membership-inference training-data epsilon attack-defense llm-security

• Membership Inference Attacks: Detecting What Was in an AI Model's Training Data

  Membership inference attacks let adversaries determine—with significant accuracy—whether a specific data record was used to train a model. This post covers the attack mechanisms, why models leak this information, real-world threat scenarios, and how differential privacy and machine unlearning address (and fail to fully close) the gap.

  Jul 5, 2026 privacy membership-inference differential-privacy machine-unlearning attack-defense gdpr overfitting

• Gradient Inversion Attacks: Reconstructing Private Training Data from Model Updates

  Gradients are not safe summaries of training data. In federated learning and fine-tuning pipelines where model updates are shared, a malicious aggregator can run gradient inversion to recover original training samples with alarming fidelity — and the defenses have hard limits.

  Jul 4, 2026 federated-learning privacy gradient-inversion differential-privacy training-data attack-defense

• RAG Privacy Attacks: How Retrieval-Augmented Generation Pipelines Leak Private Documents

  RAG makes LLMs accurate by indexing private documents — but the retrieval pipeline introduces a new attack surface. Adversarial queries can extract document chunks, embedding inversions recover original text, and multi-tenant isolation can fail in ways that expose documents across access boundaries.

  Jul 4, 2026 rag privacy data-exfiltration vector-databases embeddings multi-tenant prompt-injection

• Machine Unlearning Security: When Forgetting Training Data Creates New Vulnerabilities

  Regulators are demanding AI systems forget specific training data. Attackers are figuring out how to weaponize that forgetting — through verification gaps, induced forgetting abuse, and unlearning as a path to alignment degradation.

  Jul 2, 2026 machine-unlearning privacy gdpr safety-alignment adversarial-ml model-security membership-inference

• Federated Learning Poisoning: The Aggregation Attack Surface

  FL aggregation is blind to participant intent. Malicious clients can embed backdoors or reconstruct private training data from gradients.

  Jul 1, 2026 federated-learning poisoning-attacks backdoor privacy threat-modeling defense-patterns gradient-attacks differential-privacy secure-aggregation

• VEGA: Zero-Knowledge Proofs for Digital Identity in the Age of AI Agents

  Microsoft Research's VEGA system generates cryptographic proofs from government credentials in 92ms — letting AI agents verify identity facts without ever seeing the underlying document.

  Jun 20, 2026 zero-knowledge-proofs digital-identity agent-security nhi-trust privacy cryptography

• 1,000 Breaches Later: The Disclosure Lag Is Worse Than Ever

  Troy Hunt's HIBP milestone analysis shows breach disclosure times are lengthening, not shrinking — driven by class-action fear, legal posturing, and regulatory carve-outs. The same dynamics will shape how AI incidents get disclosed.

  Jun 18, 2026 incident-response threat-modeling responsible-disclosure privacy defense-patterns

• The Privacy Cost of CAPTCHA-Free Browsing: Cloudflare Turnstile and WebGL Fingerprinting

  Cloudflare Turnstile promises a frictionless, CAPTCHA-free experience — but achieving that invisibly requires collecting a detailed hardware fingerprint via WebGL. Understanding what's traded for that convenience matters for anyone building or operating systems that respect user privacy.

  Jun 4, 2026 privacy fingerprinting bot-detection trust-and-privacy web-security

• No Auth Required: How a Healthcare RAG Chatbot Leaked 1,000 Patient Conversations

  Researchers used nothing but Chrome DevTools to extract the system prompt, full RAG configuration, knowledge base, and 1,000 stored patient conversations from a live medical chatbot. The exploit wasn't prompt injection — it was basic web application security failure.

  May 4, 2026 rag-security deployment-security privacy healthcare threat-modeling