LLM02:2025Sources
← Back to lesson
Sources & Attribution
Everything in this lesson, sourced.
Every incident, CVE, and research paper mentioned in LLM02:2025 — Sensitive Information Disclosure — traced back to where it came from.
Framework License

This lesson is built on the OWASP Top 10 for Large Language Model Applications (2025), released under Creative Commons Attribution-ShareAlike 4.0. Definitions, vulnerability categories, mitigation structure, and attack scenarios are drawn directly from this framework. Real-world incidents and research are independent factual reporting, cited individually below.

01
Primary Framework
The structure this entire lesson is built on
OWASP Top 10 for LLM Applications 2025 — LLM02: Sensitive Information Disclosure
OWASP Foundation · Released 2025 · CC BY-SA 4.0
Cited for: Core definition, 3 vulnerability categories, 6 mitigation categories (12 techniques), 3 official attack scenarios
genai.owasp.org →
02
CVEs — Official Records
Formally catalogued vulnerabilities referenced in this lesson
CVE-2019-20634 — Proof PuddingCVSS 3.1: 3.7
Proofpoint Email Protection · Model extraction / inversion attack
Cited for: Proprietary algorithm exposure, slides 11, 21, 25. OWASP's canonical example for this category. Also catalogued as AVID-2023-V009.
NVD record →
03
Confirmed Incidents
Real-world events verified against primary or first-party sources
OpenAI ChatGPT Redis Bug — March 20, 2023Company Disclosure
OpenAI · redis-py library bug · Disclosed March 24, 2023
Cited for: PII leakage, unintentional data exposure scenario, slides 10, 14, 23, 25
OpenAI disclosure →
Samsung ChatGPT Leak — March–April 2023Reported Incident
Samsung Semiconductor · 3 engineers · Source code and meeting transcripts pasted into ChatGPT within ~20 days of internal ban being lifted
Cited for: Sensitive business data disclosure, user education mitigation, slides 12, 22, 25. Originally reported by The Economist Korea; corroborated by CIO Dive and TechRadar.
CIO Dive →
Slack AI Indirect Prompt Injection — August 20, 2024Researcher Disclosure
PromptArmor · Responsibly disclosed to Slack · Private channel data exfiltration via planted public channel instruction
Cited for: Targeted prompt injection scenario, access controls mitigation, slides 15, 20, 25
PromptArmor disclosure →
04
Academic Research
Peer-reviewed and preprint research cited in this lesson
Scalable Extraction of Training Data from (Production) Language ModelsResearch Paper
Nasr et al. · Google DeepMind, Cornell, UW, CMU, UC Berkeley, ETH Zurich · arXiv:2311.17035 · Disclosed to OpenAI Aug 30, 2023 · Published Nov 28, 2023
Cited for: Training data memorization, "repeat poem forever" attack, data leak via training scenario, tokenization mitigation, slides 13, 16, 24, 25
arXiv:2311.17035 →
AVID-2023-V009 — Proof Pudding (moohax & monoxgas)Vulnerability Report
AI Vulnerability Database · Will Pearce & Nick Landers · DerbyCon 2019 presentation: "42: The answer to life, the universe, and everything offensive security"
Cited for: Proof Pudding model extraction mechanics, slide 11
AVID database →
Built on the OWASP LLM Top 10:2025 framework under CC BY-SA 4.0.
Found an error or outdated link? Let us know.