The incidents from Parts 2 and 3 mapped to the defenses in Part 4.
🔓
PII Leakage / Redis bug (OpenAI, March 2023)
Best addressed by Robust Input Validation (verify returned data belongs to the requester) and Secure System Configuration (fix the underlying caching misconfiguration). Neither requires touching the model itself — the failure was entirely in the application layer.
Best addressed by Differential Privacy (add noise to exposed scores) and Strict Access Controls (rate-limit how many scored queries any one source can make).
🏢
Business Data Disclosure / Samsung (April 2023)
Best addressed by User Education (specific guidance before the paste happens) and Data Sanitization on the consumer side — neither is a model fix, both are process fixes.
📚
Training Data Memorization / Poem attack (Nasr et al., 2023)
Best addressed by Tokenization and Redaction before training, plus Differential Privacy on outputs to blunt verbatim extraction even if some memorization slips through.
🎯
Targeted Prompt Injection / Slack AI (PromptArmor, 2024)
Best addressed by Restrict Data Sources (scope retrieval to the requester's actual permissions) — this is also where LLM01's prompt injection mitigations overlap directly with LLM02.
No Single Mitigation Covers Everything
That's why OWASP lists six categories. Some incidents are application bugs, some are training-pipeline gaps, some are access-control failures, and one is squarely a prompt injection problem wearing an LLM02 hat. Layer the defenses — don't pick one.