What Does a Similarity Leak Look Like?
Traditional cybersecurity tends to treat a secret as an object. It is a document, password, database record, piece of source code or collection of classified files. Once the object has been identified, security teams can restrict access to it, monitor where it travels and search for exact copies leaving the organization.
Large language models complicate that arrangement because a secret is not only an object. It is also an idea.
Imagine that a company is preparing to acquire a smaller competitor. The official acquisition plan is tightly controlled. However, the company has also posted several new jobs in the competitor’s city, requested regulatory advice from an outside law firm, moved members of its integration team onto an unnamed project and scheduled unusual travel for senior executives. None of these facts is necessarily sensitive on its own. Combined, they may reveal the acquisition.
Before generative AI, reconstructing that conclusion required a patient analyst. Today, a person can place those fragments into a model and ask it what is happening. The model may never retrieve the confidential acquisition plan. It may nevertheless produce a description that is functionally indistinguishable from it.
The secret has leaked through similarity.
Security in Meaning Space
Most conventional data-loss-prevention systems operate in what we might call token space. They search for a Social Security number, a project codename, a classified marking or a sequence of text copied from a sensitive document. These controls are useful, but they are built around an assumption that leaked information will resemble its source at the level of words or characters.
LLMs operate primarily in meaning space. They can translate, summarize, abstract, paraphrase and recombine. A user does not need to type, “Project Nightfall will launch on October 17.” He might instead ask the model to describe “the initiative scheduled to begin in mid-October after the new supplier receives final approval.” The words are different. The meaning may be nearly identical.
Leak through similarity occurs when information crosses a security boundary because it is semantically close enough to protected information to create the same practical harm. The output does not have to be an exact copy. It only has to tell the recipient substantially the same thing.
The important shift is that confidentiality can no longer be treated as a binary property of a file. Protected information occupies a neighborhood of related statements. A model can land inside that neighborhood through paraphrase, approximation or inference without reproducing the original source.
The Cognitive Security Verification Framework (CSVF) describes this broader problem as semantic leakage: the disclosure of protected meaning through paraphrase, translation, summarization, abstraction or inference. It also distinguishes semantic leakage from cross-domain inference, where individually permissible fragments become sensitive when combined.
“Close Enough” Can Be More Than Enough
Security professionals may reasonably ask how similar an output must be before it becomes a leak. There is no universal threshold.
For an intelligence organization, an approximate description of a facility’s purpose may be damaging even when its exact capabilities remain unknown. For a pharmaceutical company, identifying the likely mechanism of action behind an experimental drug may eliminate years of uncertainty for a competitor. For a technology company, a rough reconstruction of an internal system prompt or evaluation strategy may contain most of the commercially valuable insight.
This means leak through similarity should be evaluated according to operational equivalence rather than verbal equivalence. Would the recipient be able to make substantially the same decision, reproduce substantially the same capability or avoid substantially the same research cost after receiving the model’s output? If so, the fact that the model used different words provides little comfort.
The problem becomes more serious as AI systems gain access to longer context windows, persistent memory, internal repositories and external tools. Each connection expands the collection of fragments from which the model can build a conclusion. Security teams therefore need to consider not only what the model can retrieve during one prompt, but what it can accumulate across a session or across many sessions.
How the SenTeGuard Stack Addresses Similarity Leakage
Leak through similarity is not a single-product problem. It exists before deployment, during retrieval, at runtime and after a system changes. The SenTeGuard product family approaches those stages as parts of the same cognitive-security stack.
SenTeGuard: Runtime Enforcement and Batch Scanning
SenTeGuard sits between users and model endpoints, inspecting prompts and responses before information crosses the boundary. Conventional pattern matching remains important, but the platform adds semantic analysis intended to recognize when a user is describing a protected idea without copying its original language.
This is where similarity becomes an enforceable policy object. An organization can define sensitive concepts, prohibited outputs and contextual rules, then block, redact or flag interactions that approach those boundaries. SenTeGuard also records the interaction so that the organization can determine what was attempted, what policy was applied and what the model returned.
The objective is not to prohibit every conversation that mentions a sensitive subject. That would make the system unusable. The objective is to recognize when a prompt or output becomes close enough to protected meaning that intervention is justified.
Moyo: Finding What Is Already Reachable
Moyo asks a different question: what can an adversary already reconstruct?
Many organizations publish more than they realize. Job listings reveal technical priorities. Employee profiles reveal team composition. Procurement notices identify vendors. Conference presentations expose architecture. Photos reveal locations, equipment and schedules. Individually, these disclosures may appear harmless. Together, they can form a short path to a sensitive conclusion.
Moyo maps those paths. It tests what conclusions can be assembled from public or authorized sources, identifies which combinations create the greatest exposure and measures the distance, cost and reliability of the inference. The purpose is to discover the dangerous semantic neighborhood before a competitor, foreign intelligence service or criminal organization does.
In other words, SenTeGuard watches the boundary from the inside. Moyo approaches it from the outside.
CSVF: Defining What Must Remain Unreachable
A company cannot govern similarity leakage if it has not defined what counts as failure. CSVF provides the framework for doing so.
The framework asks organizations to inventory their information domains, specify which joins among those domains are permitted and define Unreachable Statement Classes: categories of conclusions an AI system must not be able to produce reliably. It then provides draft metrics for testing those claims, including Leakage Event Rate, Domain Inference Risk and Crawl-Resilience Score.
This transforms a vague promise—“our AI does not leak sensitive information”—into a testable claim. Which meanings are protected? Which sources could be combined to reach them? How often does the system cross the boundary? Does the boundary continue to hold after the model, prompt, retrieval configuration or toolset changes?
CSVF supplies the map and measurement system. SenTeGuard and Moyoguard provide mechanisms for enforcing and testing the resulting boundaries.
Examples
Microsoft’s “New Bing” Revealed Its Hidden System Prompt
When Microsoft launched the first version of Bing Chat in 2023, users quickly discovered that carefully crafted prompts could persuade the model to reveal portions of its hidden system prompt, internally codenamed Sydney. Attackers did not have access to Microsoft’s source code or internal documentation. Instead, they asked the model questions about its own behavior until it reconstructed and revealed instructions that were intended to remain private.
Although the output was not necessarily a byte-for-byte copy of Microsoft’s internal configuration, it was close enough to reveal confidential implementation details. From a security perspective, this illustrates that protecting a prompt file is insufficient if an attacker can reconstruct its contents through interaction with the model itself.
Samsung Engineers Accidentally Exposed Proprietary Source Code
In 2023, Samsung temporarily restricted employee use of ChatGPT after engineers pasted proprietary semiconductor source code, debugging information and meeting notes into the service while seeking programming assistance.
The concern was not merely that OpenAI received copies of the text. Once proprietary information enters an external LLM, future prompts may be capable of eliciting summaries, explanations or functionally equivalent descriptions of that information. Even if the original code is never reproduced verbatim, a sufficiently similar explanation may provide competitors with valuable intellectual property.
This is a classic example of why organizations must protect semantic content rather than merely preventing file exfiltration.
Public OSINT Reveals Classified Programs Without Classified Documents
Intelligence analysts routinely reconstruct sensitive military activities using only publicly available information. Satellite imagery, procurement contracts, LinkedIn profiles, patent filings, shipping manifests, conference presentations and job advertisements are individually harmless. Together, they can reveal the location of secret facilities, the capabilities of new weapons systems or the existence of classified research programs.
No classified document has leaked. Instead, the sensitive conclusion emerges from the semantic relationship between many publicly available facts. Modern LLMs dramatically accelerate this process by identifying relationships across thousands of disparate sources that would previously have required weeks of manual analysis.
This is precisely the type of cross-domain inference that CSVF is designed to identify and measure.
AI Coding Assistants Can Infer Proprietary Architectures
Suppose an engineer asks an internal coding assistant:
“How should I implement authentication the same way our payment service does?”
The assistant may not retrieve the underlying authentication design document. Instead, it may synthesize an answer from architecture diagrams, internal documentation, code comments, engineering discussions and previous implementations.
The resulting explanation may accurately describe proprietary architectural decisions without reproducing any single protected artifact. A competitor receiving the same explanation could implement a nearly identical system despite never seeing the original documentation.
From the standpoint of traditional DLP, nothing has leaked because no protected document was copied. From the standpoint of cognitive security, the organization’s intellectual property has effectively crossed the security boundary through similarity.
These examples illustrate why AI security must evolve beyond detecting copied strings or protected files. The relevant question is no longer “Did the model reproduce a secret?” It is “Did the model enable someone to reach substantially the same conclusion?” Once meaning—not merely text—is treated as the protected asset, leak through similarity becomes a measurable security problem rather than an abstract AI concern.
Protecting Ideas, Not Merely Files
The central lesson is simple. An organization can successfully protect every restricted document and still lose the idea contained within them.
LLMs lower the cost of moving between related statements. They can transform a secret into a summary, a summary into an implication and several implications into a protected conclusion. The resulting output may share none of the original wording while preserving most of its value.
Security must therefore move beyond searching for copied strings. It must identify protected meanings, understand the neighborhoods around them, test the paths by which they become reachable and enforce boundaries throughout the AI workflow.
That is the role of the SenTeGuard stack. Moyoguard discovers what is inferable. CSVF defines and measures the boundary. Joseki:WrapperHub packages the intended behavior and its evaluations. SenTeGuard enforces the boundary when people and models interact.
Network security protects the systems through which information moves. Cognitive security must protect what the information means.