Data Leakage Prevention — References

The classical models of confidentiality as a property that must survive computation, and the evidence that a model emits material from its training as well as from its context.

Confidentiality as a property of a flow

• Secure Computer Systems: Mathematical Foundations — David E. Bell and Leonard J. LaPadula, MITRE Corporation, 1973. The formal confidentiality model in which a subject may not read above its level or write below it, and the origin of the observation that controlling reads without controlling writes controls nothing. Cited by name.
• A Lattice Model of Secure Information Flow — Dorothy E. Denning, Communications of the ACM,
  1976. Classifications as a lattice, with the rule that the output of a computation takes the least upper bound of its inputs, which is the formal statement of what a derivation must do to a label. Cited by name.
• Language-Based Information-Flow Security — Andrei Sabelfeld and Andrew C. Myers, IEEE Journal on Selected Areas in Communications, 2003. The survey of enforcing such flows mechanically, and the distinction between explicit flows and the implicit ones that survive every content-based filter. Cited by name.

Models as a disclosure channel

• Quantifying Memorization Across Neural Language Models — Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramèr and Chiyuan Zhang, International Conference on Learning Representations, 2023. The measured relationship between memorisation and model scale, duplication, and context length, which is the basis for treating anything placed in a training corpus as potentially recoverable. Cited by name.
• Scalable Extraction of Training Data from (Production) Language Models — Milad Nasr and colleagues, 2023. Extraction against deployed, aligned systems rather than research checkpoints, which is the version of the result that applies to a product decision about fine-tuning on customer data. Cited by name.

Classification obligations

• Guide to Protecting the Confidentiality of Personally Identifiable Information — NIST Special Publication 800-122. Cited here for its confidentiality impact levels, which are the most widely reusable published scheme for assigning a sensitivity label that a propagation rule can then carry. Cited by name.

No verified reference is recorded for recipient-aware egress checking in language-model systems, for canary seeding as a leakage measurement, or for label propagation through retrieval and summarisation pipelines. The information-flow literature describes what should happen; no published work measures what happens in a deployed assistant.