Many teams assume LLM02 is purely a training-data problem — if you don't fine-tune on user conversations, you're safe.
Disclosure happens at the output layer too. A RAG system can retrieve another customer's document and hand it straight to the wrong user. An over-permissioned agent can read a database it shouldn't and just answer with what it found. None of that requires training on anything.
If your LLM can access sensitive data — through training, retrieval, or live API calls — it can disclose it. Training is only one of three paths.