Extraction of private training records
Statement (NASA form)
Given that memorisation attacks already recover unique strings from large models, there is a possibility of medical notes, source code, or identity documents coming back out resulting in a breach with no incident date, because the leak was the training run.
You cannot rotate a secret the model ingested in 2023.
Composite 15 = 3×4 + 3
Applicable mitigations
Controls · Hard fences on diagnosis, dosing, and triage language · Grounded, dated medical sources with uncertainty on the surface · Regulate high-stakes health modes as medical devices · Capability thresholds that cannot be open-released · Know-your-customer on high-end fine-tune clusters · Pair open release with synthesis and exploit screening upgrades · Short-lived, narrowly scoped tokens for every tool call · A real off-ramp that still functions