What data leakage risks should you consider when adding an LLM feature to an existing product?

beginner

Re-explain

An LLM feature creates a new outbound path for data inside your trust boundary. Check each route it can take:

Third-party API calls send prompt text, files and customer records to the provider. Use zero-retention and no-training terms, and send only the fields a task needs.
Prompt and trace logs copy user content into observability tools. Redact before writing, keep retention short and restrict access.
Retrieval-augmented generation (RAG) can pull documents the asking user may not open, and the answer repeats them. Filter by that user's permissions at query time.
Fine-tuning on customer data can make a shared model memorize it and repeat it to other tenants. Eval sets copied from customer data can leak when stored or shared. Get consent, and keep tenants separate.

Rewriting in plainer words…

This answer doesn't lend itself to a diagram - it reads best . No credits were charged.

Why there's no diagram: “”

The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓

The diagram below the answer is the concept . Jump to it ↓

Tailored explanation · switch back to · ·

What should the new diagram focus on?

How well did you know this?

AI:

Saved in this browser - sign in to keep your review list.

How should your speech become text?

Listening… your words appear above as you speak - tap Stop when you're done.

Recording · cr - tap Stop & transcribe when you're done.

Transcribing with AI…

Voice:

Keep going - a few more words and AI can grade it.

Interview lens How interviewers actually use this question

How would you enforce the asking user's permissions when RAG retrieves documents? Store permission or tenant metadata on each chunk and filter in the retrieval query. Sync it when access changes. A prompt rule is not access control.
How do you keep prompt and trace logs useful for debugging without making them a leak? Redact before the write, log metadata instead of full text where you can, keep retention short, restrict access, and count the log store as user data.
How would you design PII redaction for prompts sent to a third-party model API? Detect PII before the call, swap in placeholders, restore them on your side after. Detectors miss things, so send fewer fields as well.
In a multi-tenant product, where can one tenant's data reach another through the LLM feature? Shared vector indexes without tenant filters, response caches shared across tenants, fine-tuned models trained on mixed data, and shared eval sets.
What would you do before fine-tuning a model on customer data? Get consent, scrub PII from the training set, train per tenant if data can't be shared, and probe the tuned model for memorized records before release.

An LLM feature opens a new outbound path for data that used to stay inside your trust boundary, so I'd walk every route that data can take.
The obvious one is the provider API. Prompts, files and customer records all go to them, so I'd get zero-retention and no-training terms and send only the fields the task needs.
Then logs. Prompt and trace logging copies user content into observability tools, so I'd redact before writing, keep retention short and restrict who can read them.
RAG is the easy one to miss. Retrieval can pull a document the asking user isn't allowed to open, and the answer repeats it, so I filter by that user's permissions at query time.
Fine-tuning on customer data can make a shared model memorize it and repeat it to other tenants, and eval sets copied from it can leak too, so get consent and keep tenants separate.
The limit is that zero-retention terms only cover the provider hop. Logs, retrieval, fine-tuning and eval data all stay on your side, so they need your own controls.

Treats zero-retention terms as the whole answer Those terms cover only the provider hop. Logs, RAG retrieval, fine-tuning and eval sets leak on your side, and each needs its own control.
Trusts the prompt to hide documents the user can't see An instruction not to reveal a file is not access control, and a rephrased question can get past it. Filter by the user's permissions in the retrieval query.
Forgets the team's own prompt and trace logs Trace logging makes a second copy of user content in another tool. Say you redact before writing, keep retention short and restrict access.
Assumes a fine-tuned model holds no raw data Models can memorize training records and repeat them. A shared tuned model can hand one tenant's data to another, so get consent and keep tenants separate.

Interview lens

Likely follow-ups, what you can say, and the weak answers to avoid.

Want a quick review of the fundamentals? See the AI Security & Guardrails cheatsheet.

Pro · $10/mo

Full answers, code samples, and AI explanations that go simpler or deeper. Cancel anytime.