Concept dictionary
Data Leakage
Data leakage is the unintended exposure, transfer, or disclosure of information to a person, system, model, or destination that is not authorized to receive it.
Note that machine-learning practitioners use the same phrase for a different problem: information from test or future data leaking into training, which makes a model look more accurate than it really is. This entry covers the disclosure sense.
- Review state
- Reviewed in POC
- Freshness
- Current
- Version
- 3
Also called
- Data Leakage
- Information Leakage
Remember it this wayInformation crossed a boundary it was not meant to cross.
In plain language
Leakage can happen through prompts, logs, outputs, training data, retrieval systems, integrations, exports, or access mistakes. The information may be visible immediately or recoverable later.
Why it matters
AI workflows often copy information across several services and contexts. Each handoff can change retention, access, and disclosure risk.
Example
An employee pastes client records into an unapproved public assistant whose service terms permit retention beyond the intended task.
Common misconception
Data leakage is not limited to a public breach. Sending information to an unauthorized internal tool or unintended model context is also leakage.
Related terms
Sources
- NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigationsauthoritative treatment of privacy, inference, extraction, and information-disclosure attacks on AI systems.
Learn more
- Start with [[sensitive-information|Sensitive Information]] and examine every [[handoff|Handoff]].