search

OWASP / www-project-top-10-for-large-language-model-applications

OWASP Foundation Web Respository
Other
524 stars 134 forks source link

LLM06 Sensitive Information Disclosure, risk and probability instead of impact #267

Closed ricsirigu closed 7 months ago

ricsirigu commented 8 months ago

In the Example Attack Scenarios section, the third point

Personal data such as PII is leaked into the model via training data due to either negligence from the user themselves, or the LLM application. This case could increase the risk and probability of scenario 1 or 2 above.

I think should changed as follows:

Personal data such as PII is leaked into the model via training data due to either negligence from the user themselves, or the LLM application. This case could increase the impact of scenario 1 or 2 above.

GangGreenTemperTatum commented 8 months ago

hey @ricsirigu , thanks for reaching out! whilst i think all three worded statements are valid, i'm a fan of reducing content and wording so gladfully accepted once we have a v2 directory spun up and started phase 2 officially, i'll get this one updated. TYIA!