Writing text, programming, data-assisted troubleshooting: AI language models open up real potential for companies and the people who work in them. But it is worth looking closely at how they are used: whether they are effective, and whether they are secure. Cloud-based LLMs, in particular, carry data-protection risk.
What narrowin is building
narrowin develops frameworks and prototypes for the secure and trustworthy use of LLMs: through anonymisation, and through local, "on-prem" deployments that let a company keep control of its own data. As part of an innovation project funded by the Swiss federal agency Innosuisse, the Cyber Regulatory Co-Pilot, narrowin works with FHNW to investigate the key problems in this area and the solutions to them.
The motivation is not only compliance. By taking data protection and security seriously, companies can strengthen customer trust, reduce real security risk, and meet data-protection regulation, instead of trading one against the others.
The risk is not just the company name
It is tempting to assume that stripping out the company name and a few obvious identifiers makes a prompt safe to send to a public tool like ChatGPT. It does not. Even with the names removed, the data can still give the company away, in at least five ways:
-
01
IP address tracking
An individual IP address may not name a company, but patterns in IP addresses can be correlated with specific organisations, especially when they belong to an office or a corporate VPN.
-
02
Correlation of questions and data
The content and context of the questions carry clues. Specific terminology, project details or industry-specific information can be enough to deduce the company, or at least the sector it operates in.
-
03
Accidental disclosure
Employees may inadvertently share sensitive information, or ask questions that reveal it: strategies, internal processes, financial figures, intellectual property.
-
04
Data aggregation over time
Many queries from the same company, gathered over time, aggregate into a detailed picture of its operations, challenges and strategies. That accumulated data is valuable and sensitive in its own right.
-
05
Provider-side security risk
There is always a risk of a data breach or misuse at the cloud provider. If the provider's systems are compromised, the data employees shared can be exposed with them.
