BackPersonal information in prompt
Personal information in prompt
Risk Domain
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
"Personal information or sensitive personal information that is included as a part of a prompt that is sent to the model."
Entity: Who or what caused the harm
Intent: Whether the harm was intentional or accidental
Timing: Whether the risk is pre- or post-deployment
Supporting Evidence (1)
1.
"If personal information or sensitive personal information is included in the prompt, it might be unintentionally disclosed in the models’ output. In addition to accidental disclosure, prompt data might be stored or later used for other purposes like model evaluation and retraining, and might appear in their output if not properly removed. "
Other risks from IBM (2025) (63)
Lack of training data transparency
6.5 Governance failureHumanUnintentionalPre-deployment
Uncertain data provenance
6.5 Governance failureHumanOtherPre-deployment
Data usage restrictions
7.3 Lack of capability or robustnessHumanUnintentionalPre-deployment
Data acquisition restrictions
7.3 Lack of capability or robustnessHumanUnintentionalPre-deployment
Data transfer restrictions
7.3 Lack of capability or robustnessHumanUnintentionalPre-deployment
Personal information in data
2.1 Compromise of privacy by leaking or correctly inferring sensitive informationAI systemUnintentionalPost-deployment