Privacy

TL;DR for operators Email is still where good security intentions go to become embarrassing screenshots. The paper behind this article, Searching for Privacy Risks in LLM Agents via Simulation, studies a future that is no longer especially futuristic: one AI agent has access to sensitive information, another agent wants it, and the two can talk through ordinary applications such as email, Messenger, Facebook, or Notion.1 The question is not whether the model knows a privacy rule in the abstract. The question is whether an agent, while trying to be helpful in a live interaction, can refuse the wrong request at the right moment. ...

TL;DR for operators Deletion sounds simple until the deleted record has already shaped millions of model parameters. The clean answer is to retrain the model without that record. The operational answer is usually less glamorous: nobody wants to burn a full training cycle every time a user, regulator, data-quality team, or security analyst says, “Remove this.” ...

TL;DR for operators Enterprise LLM safety is often discussed as if the main question is whether the model has been trained to “behave”. That is the comforting version of the story. It is also too small. IBM’s OneShield paper argues for a different operating model: treat safety as a separate, model-agnostic guardrail layer that sits around the LLM, runs multiple specialised detectors in parallel, and then applies explicit policy decisions through a separate policy manager.1 In plain business terms, OneShield is less like teaching the model good manners and more like installing a configurable safety-control plane around every AI interaction. Glamorous? Not especially. Operationally useful? Very much so. ...

TL;DR for operators Adapters look small. The privacy surface is not. The paper behind LoRA-Leak argues that LoRA fine-tuning does not magically protect the records used to specialise a language model.1 Even though LoRA trains only low-rank adapter weights while leaving the base model frozen, the resulting model can still leak membership information: an attacker may infer whether a given sample was part of the fine-tuning dataset. ...

TL;DR for operators Users do not experience an AI product as a theorem. They experience it as a bargain. They give data, attention, labour, trust, prompts, feedback, documents, creative work, behavioural traces, and sometimes money. In return, they expect useful output, lower friction, safer decisions, visibility, compensation, privacy, or at least not being quietly turned into unpaid infrastructure. The bargain may be explicit. More often, because apparently we enjoy building planetary-scale systems on implied consent and vibes, it is not. ...

TL;DR for operators When an LLM leaks sensitive, copyrighted, or otherwise forbidden information, the obvious repair is to fine-tune it away from the bad answer. That sounds sensible until you notice the small operational comedy: the remediation process keeps using the very answer it is supposed to remove. The paper behind this article proposes Partial Model Collapse (PMC), a machine unlearning method that avoids directly optimising on ground-truth forget answers. Instead, PMC asks the model the sensitive question, samples multiple responses from the model itself, selects a response that is less like the model’s original answer, and fine-tunes on that self-generated response while also training on retain data to preserve general utility.1 ...

TL;DR for operators CoRAG is not “RAG, but with more documents.” It is a way to let multiple organizations train a shared retrieval-augmented model while keeping their labeled question-answer data local. That matters because labels are usually the expensive, sensitive, commercially revealing part. Market documents, manuals, policies, public reports, and technical references are often easier to share than the annotations that say which answer was correct, for whom, and under what business condition. Tiny distinction. Large legal bill avoided. ...

TL;DR for operators Month-end close is not where small firms discover their love of manual labour. It is where invoices arrive half-labelled, clients reply with attachments named final_final_real.xlsx, and a senior accountant spends expensive hours doing work that is intellectually closer to sorting laundry than advising a business. The practical AI opportunity for small accounting and professional service firms is not “give everyone a chatbot and hope the profession becomes futuristic by Friday.” The better architecture is a cost-aware, privacy-first workflow: classify the task, remove or mask sensitive data where possible, retrieve the right firm knowledge, route the easy work to cheap or local tools, escalate uncertain cases to stronger models, and keep humans in charge of outputs that affect filings, financial statements, tax positions, or client advice. ...