LLM Output Privacy Risk Assessment

Overview

Large language models (LLMs) present unique privacy risks that go beyond traditional ML systems. Because LLMs are trained on massive corpora that may contain personal data, they can memorise and reproduce verbatim training data — including names, email addresses, phone numbers, and other PII. Additionally, LLMs can hallucinate plausible but false personal data, creating defamation and accuracy risks. Prompt injection attacks can bypass safety guardrails to extract training data or system prompts containing confidential information. This skill provides a structured framework for assessing, mitigating, and monitoring privacy risks in LLM-generated outputs at Cerebrum AI Labs.

LLM Output Privacy Risk Categories

Risk 1: Training Data Memorisation

LLMs memorise training data, particularly sequences that appear multiple times or are distinctive. Extractable memorisation occurs when a model, given a prefix, completes the text with verbatim training data.

Factor	Impact on Memorisation Risk
Model size	Larger models memorise more (Carlini et al., 2023)
Data duplication	Repeated sequences are memorised at higher rates
Training epochs	More passes over data increase memorisation
Data distinctiveness	Unique sequences (names, numbers) are more extractable
Temperature at inference	Lower temperature increases verbatim reproduction

Regulatory concern: If a model reproduces personal data from training, this constitutes processing under GDPR Art. 4(2). The data subject has not consented to this output, and the controller must have a lawful basis for the disclosure.

Risk 2: PII Leakage in Generated Text

Even without verbatim memorisation, models can combine partial information to produce outputs containing personal data — email patterns, phone number formats with real area codes, or names associated with specific contexts.

Leakage Type	Example	Detection Method
Verbatim reproduction	Model outputs exact email address from training data	Exact match against known training PII
Recombination	Model combines real first name + real surname from different records	Named entity recognition + cross-reference
Pattern completion	Model generates plausible phone number matching real format	Regex + validation against real registries
Contextual leakage	Model associates real person with correct employer when prompted	Entity relationship extraction

Risk 3: Prompt Injection and Data Extraction

Adversarial prompts can cause models to bypass safety instructions and output training data, system prompts, or information about other users' conversations.

Attack Vector	Description	Mitigation
Direct prompt injection	User crafts prompt to extract training data ("Repeat your training data starting with...")	Input filtering + output monitoring
Indirect prompt injection	Malicious content in retrieved documents instructs model to leak data	Sanitise retrieved content + instruction hierarchy
System prompt extraction	Prompts designed to reveal system-level instructions	System prompt isolation + extraction detection
Multi-turn extraction	Gradual extraction across conversation turns	Conversation-level monitoring
Jailbreaking	Bypassing safety alignment to disable PII filters	Robust alignment + secondary output filter

Risk 4: Hallucinated Personal Data

LLMs can generate plausible but fabricated personal data — attributing false statements to real people, inventing credentials, or creating fictional but realistic-seeming personal records.

Hallucination Type	Privacy Risk	Legal Concern
False attribution	Model attributes a statement to a real person who never said it	Defamation, Art. 5(1)(d) accuracy principle
Fabricated credentials	Model invents qualifications for a real person	Accuracy, potential reputational harm
Fictional PII	Model generates realistic but fake personal details (e.g., social security numbers)	May match real individuals by coincidence
Confabulated relationships	Model invents relationships between real people	Art. 5(1)(d) accuracy, potential harm

EDPB position: EDPB Guidelines 04/2025 state that generating inaccurate personal data about identifiable individuals violates the accuracy principle (Art. 5(1)(d)) and may require the controller to implement effective rectification mechanisms.

Output Privacy Risk Assessment Framework

Assessment Dimensions

Dimension	Weight	Scoring Criteria
Memorisation exposure	25%	Model size, training data PII density, deduplication status
PII leakage likelihood	25%	Output modality, user interaction pattern, PII filter coverage
Prompt injection resilience	20%	Input validation, instruction hierarchy, extraction testing results
Hallucination risk	15%	Factual grounding, attribution verification, entity linking
Monitoring coverage	15%	Real-time PII detection, logging, alerting, human review

Risk Scoring

Score Range	Risk Level	Action Required
0-20	Low	Standard monitoring; annual review
21-40	Moderate	Enhanced PII filtering; quarterly review
41-60	Elevated	Mandatory output scanning; human review for sensitive queries
61-80	High	Restrict deployment scope; implement guardrails before production
81-100	Critical	Do not deploy; fundamental architecture changes required

Mitigation Measures

Pre-Deployment Mitigations

Measure	Description	Effectiveness
Training data deduplication	Remove duplicate sequences to reduce memorisation	High for verbatim memorisation
PII scrubbing of training data	Detect and remove/mask PII before training	High but incomplete (novel PII patterns missed)
Differential privacy training	Train with DP-SGD to bound memorisation	High theoretical guarantee; accuracy trade-off
RLHF safety alignment	Train model to refuse PII-generating requests	Moderate; can be bypassed by jailbreaking
Instruction tuning	Fine-tune model to follow safety instructions	Moderate; requires robust instruction hierarchy

Runtime Mitigations

Measure	Description	Effectiveness
Output PII scanner	NER-based scanner detecting PII in outputs before delivery	High for known PII patterns
Regex PII filter	Pattern matching for emails, phones, SSNs, credit cards	High for structured PII
Input prompt classifier	Classify incoming prompts for injection/extraction attempts	Moderate; adversarial prompts evolve
Retrieval grounding	Ground outputs in retrieved documents to reduce hallucination	Moderate; depends on retrieval quality
Rate limiting	Limit query volume to slow extraction attacks	Low-moderate; raises cost of attack
Conversation monitoring	Analyse multi-turn conversations for progressive extraction	Moderate; complex to implement

Post-Deployment Monitoring

Monitor	Metric	Alert Threshold
PII detection rate	% of outputs flagged by PII scanner	>0.1% of outputs in any 1-hour window
Prompt injection detection	% of inputs classified as injection attempts	>0.5% of inputs in any 1-hour window
User reports of PII exposure	Count of user-reported PII incidents	Any confirmed report
Extraction pattern detection	Repeated similar queries from same user/IP	>10 similar extraction-pattern queries per session
Hallucination complaints	Reports of false personal information	Any confirmed report about real individuals

Cerebrum AI Labs — LLM Output Privacy Controls

Architecture

User Input → Input Filter → LLM → Output PII Scanner → Delivery
                │                         │
                ▼                         ▼
         Prompt Injection          PII Detected?
         Classifier                  │
                │                YES → Redact + Log + Alert
             Block/Allow         NO  → Deliver + Log

PII Detection Categories for Output Scanning

PII Type	Detection Method	Action on Detection
Email addresses	Regex + validation	Redact and log
Phone numbers	Regex + country format validation	Redact and log
National ID numbers	Country-specific regex patterns	Block output + alert
Credit card numbers	Luhn algorithm + regex	Block output + alert
Physical addresses	NER + geocoding validation	Redact and log
Person names + context	NER + co-occurrence with other PII	Flag for review
Medical information	Medical NER + PHI patterns	Block output + alert

Enforcement Relevance

• EDPB Guidelines 04/2025: Controllers deploying LLMs must assess memorisation risk and implement measures to prevent unlawful disclosure of personal data in outputs.
• Garante v. OpenAI (2023): Italian DPA ordered temporary ban partly due to lack of age verification and data accuracy concerns in ChatGPT outputs. Required implementation of output filtering.
• EDPB ChatGPT Taskforce Report (2024): Recommended that LLM providers implement technical measures to minimise inaccurate personal data in outputs and provide effective rectification mechanisms.
• CNIL AI Action Plan (2024): French DPA guidance emphasises that LLM outputs containing personal data constitute processing, requiring lawful basis and compliance with data quality principles.

Integration Points

• ai-model-privacy-audit: Memorisation testing is part of the model privacy audit
• ai-data-subject-rights: Rectification of hallucinated data, erasure requests
• ai-transparency-reqs: Disclosure that system is AI-generated, accuracy limitations
• ai-deployment-checklist: Output privacy controls verified before deployment