AI-related data leakage happens through two distinct mechanisms that get treated as one problem but need two different fixes. Retrieval leakage is a search system serving a document above the requester’s clearance; the data never left the store, so fixing the query filter closes the leak immediately. Fine-tuning leakage is different in kind: the model absorbs facts directly into its own weights during training, and research on training-data extraction has repeatedly shown those facts can be prompted back out, sometimes verbatim, from users who were never meant to see them.
The second mechanism is the one that catches organisations off guard, because it isn’t reversible the way a permission fix is. A document’s access can be revoked after the fact; a fact baked into a model’s weights during fine-tuning cannot be selectively deleted, only removed by retraining without it.
The practical rule: never fine-tune on data you wouldn’t be comfortable handing to every employee who has access to the model. Anything more sensitive belongs in a permission-aware retrieval layer instead, where access can still be closed.