CMM D6: Data, Memory and RAG

Agentic AI Security CMM — D6 Data, Memory & RAG (Deep Dive)

Companion deep-dive to the CMM’s D6 domain, written under the recalibration method. The recalibration corrects a misweighting the regulated-FI stress test exposed. D6 was built around corpus poisoning, but the dominant deployment is a customer-service or member-facing RAG bot over internal data, where the live risk is oversharing and inference exposure: over-permissioned content surfaced or reconstructed for a user who should not see it (inference exposure). Poisoning needs an open or multi-writer corpus to land; oversharing needs only ordinary enterprise permission sprawl. The recalibration adds answer-time entitlement enforcement as the load-bearing L3 capability and grades the tooling plainly: the Microsoft data-governance stack is largely GA, and the work it implies remains a multi-quarter labor project that licensing alone does not discharge.

D6’s two risk families align with two NIST AI 600-1 GenAI Profile risk categories: oversharing and inference exposure are the §2.4 data-privacy concern, and corpus poisoning is the §2.8 information-integrity concern (Suggested Actions MS-2.7-007 for poisoning red-team and MS-2.5-005 for groundedness). The GenAI Profile establishes that both belong to GenAI risk management; this page supplies the graded controls and the recalibrated weighting between them.

Single-source grounding

The reframe and levels synthesize the recalibration method against the regulated-FI stress test plus the inference-exposure concept and vendor documentation. Tooling status is a May 2026 snapshot and will drift; treat the dated landscape as the perishable part.

Threat coverage

D6 is the primary domain for ASI06 (Memory & Context Poisoning) and a control surface for ASI04 (Supply Chain), and it carries Class 1 (insider — RAG and eval-harness integrity) and Class 4 (model-version — eval suite versioned independently). The customer-owned eval harness absorbs three classes at once — insider, APT, and model-version — which no other control in this domain does. See the Threat Taxonomy Reconciliation matrix and the threat classes.

The RAG-injection-scanning criterion names a scanner and not the route its evidence comes from. Document 5 of the OWASP AI Exchange specifies that route in its prompt-injection test procedure: attack inputs are presented to the insertion mechanism untrusted data uses — a retrieved document, a tool output, an augmented field — so every filtering, detection and insertion step on the augmentation path is exercised, which may require a dedicated testing API built to carry the input along it.¹ A scanner evidenced from the user channel alone has shown only that it stops direct injection; the augmentation path this domain owns stays untested. The route is a test method rather than a capability, so no rung above states it, and whether it belongs in a rung or in the assessor’s handbook is open.

Control landscape (dated)

The two risk families sit at different tooling maturity.

Capability	What ships today	Status (May 2026)
Data-risk / oversharing assessment	Microsoft Purview DSPM for AI; oversharing assessments	GA, rolling out Apr→May 20262
Answer-time / output controls	DLP for Microsoft 365 Copilot (sensitivity-label inheritance into responses); Azure AI Content Safety Groundedness Detection	DLP GA; Groundedness GA but English-only34
Retrieval-scope reduction	SharePoint Advanced Management / Restricted SharePoint Search; Restricted Content Discovery	RSS GA but capped at a fixed number of sites — a stopgap, “not scalable”; RCD in preview5
Poisoning / memory-integrity detection	Microsoft Defender prompt-injection and memory-injection detection	Developing; detective guidance short of turnkey GA
Corpus / document attestation	RAGShield, TrustRAG, Brain Git, SecureClaw	Not production — paper or research-grade OSS; do not credit as a control
Cross-source contradiction; per-doc cryptographic attestation	—	No vendor production answer as of May 2026

This grade corrects two errors in the CMM’s current D6 tooling map. That map under-weighted the GA assessment-and-labeling stack (DSPM for AI, label-aware DLP), and it over-credited exploratory tools (RAGShield/TrustRAG/Brain Git) as deployable controls.

The Microsoft ZT4AI Data pillar (least privilege / assume breach) supplies these controls — Purview answer-time entitlement, DSPM for AI oversharing assessment, and label-aware DLP — crosswalked to D6 in the 2026-Q2 ZT4AI review.

Cyera states its Protect phase strips sensitive fields out of a response before the response reaches somewhere it should not, which is a further vendor example of the answer-time / output-controls row above. Cyera’s on-premises database coverage (MySQL, MariaDB, Oracle RAC, MSSQL 2025, Db2 for i) extends the same classification control to more stores and adds no control to the row (Cyera Agent Guardian Release).

Capability-decoupled levels

Stated as capabilities per rule 1; the new answer-time enforcement thread runs from L3 to L5.

• L1 — Initial. No corpus provenance; no memory integrity; retrieval inherits source-system permissions with no oversharing review.
• L2 — Developing. Retrievals carry source labels; skills/plugins are reviewed manually; a sensitivity-labeling scheme exists on paper; a first oversharing / data-risk assessment has been run.
• L3 — Defined. Retrieval is bounded twice: by the asker, since answer-time enforcement respects per-user entitlements rather than source ACLs alone, and by the application, since the corpus and any fine-tuning data are scoped to the fields and records it needs. The bound holds across every derived copy — archive, vector store, embeddings — the validation corpus is held apart, and a groundedness check runs on answers. Per-source trust attribution, ingest-side injection and poisoning scanning, and cognitive file integrity cover the corpus itself.
• L4 — Managed. Agent memory becomes a governed store rather than working state, so every read and write is authorized and attributable and an incident is replayable from the log. Retrieval is weighted by provenance, poisoning detection reaches the SIEM, and responses are gated by sensitivity label under continuous oversharing posture management. Data decisions carry evidence: a removal is justified against measured effect on model performance, an upstream deletion propagates to everything derived from it, and an obfuscation records its residuals.
• L5 — Optimizing. Real-time corpus-drift detection; a documented, domain-appropriate poisoning-rate bound; cross-source contradiction detection; system-prompt confidentiality (canary tokens + SIEM alerting); continuous answer-time semantic-boundary enforcement that closes the retrieval path of inference exposure — need-to-know enforced at the knowledge layer and re-checked within a session; a quarterly rollback drill with a measured RTO.
• L5+ — Leading Edge. Cryptographically attested per-document signing and hash chain at ingest (no shipping product); a formal taint lattice for cross-source contradiction (research-stage); zero-knowledge proofs for sensitive retrievals.

The old D6 built L4 and L5 around cryptographic document attestation, which is the wrong spine for the common RAG shape. Attestation defends against poisoning the corpus, whereas the member-data bot fails by answering correctly from content the asker was not entitled to see. That deployment needs answer-time entitlement enforcement first, and attestation after it.

The validation-corpus clause grades an asset this domain already claimed and no rung reached. The threat-coverage section above assigns eval-harness integrity and an independently versioned eval suite to D6, and records that the customer-owned eval harness alone reaches the insider, APT, and model-version classes together. The ladder graded the retrieval corpus, the augmentation store, and agent memory, and left ungraded the corpus that defines what correct behaviour is. The Exchange supplies both the control and its bound: test data stored separately from training data and model artifacts, and kept less exposed than either, lets validation surface integrity problems while other parts of the system are compromised, and an attacker able to manipulate the model and the test data together makes the validation results untrustworthy.⁶ Response to a validation result sits in other domains — version pinning and the deprecation policy at D9 — and no domain holds the validation cadence itself. D7 L4 grades a security eval cadence whose stated scenarios are multi-turn and multi-session jailbreak and escape paths; correctness, robustness and fairness are named in no rung there, and no rung in this CMM grades a model-quality validation cadence. This rung protects the reference itself and grades nothing about how often it is run.

The structural criteria at L4 carry the weight the detector cannot. The Exchange states that distinguishing legitimate memory updates from adversarial poisoning at scale remains difficult, and names access control and write authorization as the compensating approach that bounds blast radius where detection is uncertain.⁷ The Exchange also describes cross-agent memory access without explicit authorization as lateral movement through shared state, which is why the partition boundary is graded alongside the detector; agent memory isolation carries the design and memory poisoning the attack shapes. Provenance records and read-boundary integrity checks add storage and latency, and an L4 assessment sees that cost priced.

The per-write provenance graded here is also a prerequisite one rung below it in another domain: D7 L3 requires every memory write to reach the action log carrying writer identity, session, and target partition, which are the same fields. The effective-score dependency rules carry the relation as a clause-level prerequisite with no schema representation, and D7 records the consequence: its L3 memory clause is unreachable below L4 here for any deployment with persistent agent memory. Whether that asymmetry becomes a D6-to-D7 cap or moves the D7 clause up a rung is open.

The entitlement thread running L3 to L5 has a boundary the ladder states nowhere else. Every rung in it consults an access model held beside the data — per-user entitlements checked at answer time at L3, sensitivity labels at L4, knowledge-layer need-to-know at L5. The OWASP AI Exchange states that once training data is embedded in a model, the access-right variations that governed the original data cannot be controlled any more.⁸ Data reaching the model through training or fine-tuning therefore sits outside the thread, and the wiki’s inference exposure page places that path inside the same risk class.

That path carries two threats, model inversion and membership inference, which the reconciliation matrix routes to this domain. The Exchange offers three routes against them.⁹ The first is SMALL MODEL, the only control in the entry specific to this pair, which constrains model capacity when the model is trained.¹⁰ The second is a set of four general input controls, which the standards-crosswalk matrix anchors to D2, D5 and D7. The third is sensitive data limitation (/go/datalimit/), which groups five data controls rather than input controls, four of them anchored by the crosswalk to this domain.¹¹ SMALL MODEL grades no rung here, because a deployment consuming a third-party model does not set that parameter and an organization fine-tuning its own model is making a development-time choice this CMM does not assess. This page therefore records the threat as ungraded with a named upstream control rather than as an L5 criterion; the mitigation the wiki does carry for it is differential privacy, which is subject to the same ownership boundary.

Sensitive data limitation is graded here. The minimization, retention and obfuscation clauses at L3 and L4 are the memorization-side control set for the same two threats, acting on the data before it reaches the model where SMALL MODEL acts on the model’s capacity.

Four controls sit on the far side of the ownership boundary this domain already draws: three of the Exchange’s five data-poisoning controls, plus the one control it names against broad poisoning. MORE TRAIN DATA increases the volume of benign data so that poisoned samples are outnumbered, at the stated cost of catastrophic forgetting and overfitting; TRAIN DATA DISTORTION adds noise or smoothing so that inserted triggers stop being recognized; TRAIN ADVERSARIAL reuses adversarial training against poisoning triggers built from slight alterations; and MODEL ENSEMBLE splits the training set across several models so a deviating output identifies a poisoned member (§3.1).^12131415 All four are set when a model is trained, so a deployment consuming a third-party model holds no instance of any of them and an organization fine-tuning its own model is making a development-time choice this CMM does not assess — the same reasoning that leaves SMALL MODEL ungraded above.

TRAIN DATA DISTORTION carries a control-ordering condition the others do not: distortion has no effect against an attacker with access to the training data after it has been distorted, so where the engineering environment is untrusted the control reaches only poisoning that happened outside it — collected at runtime or arriving through the supply chain — unless a separated training environment is established first.¹³ SEGREGATE DATA is that prerequisite, and no rung in this domain grades it. The remaining two of the five poisoning controls are graded: DATA QUALITY CONTROL is the ingest poisoning scan at L3 below, and POISON ROBUST MODEL is recorded at D8, because the Exchange states it can be applied to a model already trained and obtained externally.¹⁶

The Exchange states that limiting a retention period is a special form of data minimization (/go/shortretain/), so the L3 retention clause and the minimization clauses beside it grade one capability at two horizons rather than two capabilities.¹⁷ Two of the group’s five controls carry an ownership exception that narrows the boundary paragraph above. For DATA MINIMIZE and OBFUSCATE TRAINING DATA the Exchange allows the deployer to implement part of the control where better positioned, provided the provider communicates the requirement.¹⁸¹⁹ A control the source files at development time can therefore be owned by the deploying organization, and an assessment records which party holds which part rather than reading the development-time category as an exemption.

Two sources bound minimization from different directions, and the tighter of the two sets what an assessor asks for. The Exchange records that AI models often tolerate reduced feature sets and incomplete data better than traditional applications, which loosens the utility bound on how much can be removed without functional loss.¹⁸ Microsoft’s SDL post records that purpose limitation and data minimization become harder to enforce once a platform blends structured and unstructured data, tools, APIs and agents into one surface.²⁰ Both propositions hold of the same system, and they name different bounds: utility and enforcement. Enforcement is the tighter one here, so the rungs above ask for evidence that a reduction is held across the derived copies — corpus, embeddings, fine-tuning set — and not for evidence that the model still performs. Both bounds sit at the L3-to-L4 boundary this domain already grades: L3 states the scope, and L4 shows the scope held across the copies.

The obfuscation clause at L4 states its own residual and its own scope. The Exchange’s two stated limitations are that removing or obfuscating personal data is often insufficient, because identity can be induced from other retained data such as locations, times, visited websites and timestamped activity, and that token-based approaches add risk if their mapping tables are compromised.¹⁹ The access model over those tables is conventional secret protection, which the Exchange places outside its own scope and which no domain of this CMM grades; the rung carries it as a stated condition and grades no control over it. The control is scoped to training data throughout, so the clause reaches fine-tuning data supplied by the organization and does not extend to the retrieval corpus, which the entitlement thread and the augmentation-store clause cover instead.

Assessor detail per level

L1, L2, L5, and L5+ are graded from their statements above. The two rungs below carry criteria an assessor checks item by item, each list stating what its own rung adds.

Grading is cumulative: Level N requires every Level N–1 control plus the new criteria at Level N (the CMM), so a rung is met only where every rung below it is met.

Each criterion takes one of four verdicts. Met and not met are read from the evidence the criterion names. Not applicable is recorded where the deployment holds no instance of what the criterion governs, and the reduced scope is recorded as an intentional trade-off in the effective-score strategic-rationale field. Unanswerable is recorded where the instance exists and no available evidence settles the question; the rung stays open and the assessment names what would close it. A criterion that can be not applicable states that condition alongside the criterion. The lists below hold criteria only; a paragraph after a list carries maturity or market commentary and states no criterion.

L3 detail

• Per-source trust attribution.
• RAG-injection scanning.
• An ingest poisoning scan with its method and thresholds recorded. Newly added samples and samples already in the corpus are both analysed for deviation from expected distributions, by a named method — statistical deviation and outlier detection, spectral signatures over the covariance of learned feature representations, activation clustering, Reject on Negative Impact, or gradient fingerprinting — and the scan carries two thresholds rather than one, the higher filtering a sample out of the corpus and the lower raising an alert for investigation.²¹ The method’s fitness is established against a poisoned-dataset benchmark rather than asserted, since the Exchange scopes appropriateness to the poisoning threat model in play.²¹
• Hashing for cognitive file integrity over identity and system-prompt files.
• The augmentation store inside the classification and protection scope, with access control, encryption, and retention minimization applied to the vector database and its embeddings as well as to the source archive. The augmentation-store clause extends the entitlement criterion beside it to the store’s own copy of the data: remediating the document archive without its vector projection leaves an unclassified copy of the corpus behind a separate access model, and the OWASP AI Exchange records that the vectors are themselves extractable and that augmentation data should be assumed to reach the output.²²
• Corpus and fine-tuning scope. The retrieval corpus and any data the organization supplies for fine-tuning are scoped to the fields and records the application needs, with identifiers retained only to service data-removal requests or lifecycle management listed and excluded from training.¹⁸
• Answer-time access enforcement respects per-user entitlements rather than source ACLs alone, with oversharing remediated on the reachable corpus; a groundedness check runs on answers.
• The validation corpus held apart. The corpus the model is validated against is held apart from the training data and the model artifacts, under an access model at least as restrictive as either, so an attacker reaching the model or the data behind it does not thereby reach the baseline that model is measured against.⁶ The separation answers a second threat on the same artifact: the Exchange scopes development-time data leak to train or test data and states that either can be confidential because it holds personal data or intellectual property, so an exposed validation corpus is a confidentiality breach and not only a compromised reference (/go/devdataleak/).²³

The poisoning scan’s residual is stated at the source and belongs in the assessment beside the result. False positives remove rare but valid samples and can cost model accuracy; false negatives occur where a poisoned sample resembles normal data; and a sophisticated attacker can design poisoned samples to sit inside the normal distribution, which reduces the reach of any purely anomaly-based approach (§3.1.1).²¹ The Exchange also directs that where thresholds consistently fail to separate poisoned from benign samples, alternative or complementary controls are the better answer, so a program reporting a tuned scan with no separation reports a control that is running rather than a control that is working.

L4 detail

• Trust-weighted retrieval (provenance scoring).
• Memory partitioning, write authorization, and provenance. Memory is partitioned with per-agent and per-session read and write authorization, every write carries provenance (source, writer identity, timestamp, partition), entries are integrity-verified before entering an agent’s active context, agent context is reviewed and reset at session boundaries, and memory state changes are logged append-only and immutably for incident replay.⁷
• A memory- and context-poisoning detector wired to the SIEM, with its coverage stated across both poisoning classes, and a documented PoisonedRAG-class defense.²⁴ The Exchange divides poisoning into sabotage, which produces unwanted results for regular inputs, and targeted or backdoor poisoning, which fires only on specific inputs; sabotage is comparatively easy to detect because it shows on ordinary traffic, and a backdoor evades review because a model holds no code to inspect, its parameters are unreadable to a human, and testing runs on normal cases the trigger avoids by design (§3.1.1).²⁵ A detector graded here evidences its rate against the second class, since ordinary quality monitoring already surfaces the first.
• The detection stack held under the same protection as what it measures. The poisoning detector’s logic, its thresholds, and the baseline distributions it compares against are access-controlled and integrity-checked, so an attacker reaching the ingest pipeline does not thereby reach the check on it.²¹ This is the validation-corpus argument at L3 applied to the detector rather than to the reference data.
• Measured-effect justification and upstream propagation. Removal decisions are justified against measured effect on model performance — correctness, robustness, fairness — rather than asserted, and deletions or corrections applied to upstream source data propagate into the training and augmentation datasets derived from it,¹⁸ on a record linking a source record to the corpus entries and embeddings derived from it.
• Obfuscation with residuals recorded. Where the organization fine-tunes, exposure-restricted fields that cannot be removed are obfuscated, the mapping tables of any token-based approach are held under an access model at least as restrictive as the data they reverse, and the Exchange’s two stated residuals are recorded.¹⁹
• Continuous oversharing posture management, sensitivity-label inheritance into outputs, and label-aware DLP gating of responses; state rollback tested.

Right-sizing by deployment shape

Deployment shape	Realistic D6 target	Why
Member / customer-service RAG bot over internal data	L3 → L4	Oversharing is the live risk: entitlement enforcement + remediation + groundedness. Poisoning controls are low-yield on a closed, single-writer corpus
RAG over open / multi-writer or web corpus	L4 → L5	Now poisoning is in scope: trust-weighted retrieval, drift detection, contradiction flagging earn their cost
Agent with long-lived memory	add L4 memory-integrity	Context/memory poisoning and rollback become first-order regardless of corpus shape
No-retrieval tool agent	L2	Little of D6 applies; record the reduced scope as an intentional trade-off
Coding agent over a repository	L3	The repository is the retrieved corpus, and it is multi-writer and attacker-reachable

A coding agent is a retrieval agent, and the repository is the corpus

Filing coding agents under “no-retrieval tool agent” understates D6 for this shape. GuardFall delivered its payloads through injected READMEs, compromised Makefiles, and malicious MCP servers, and the CI credential exposure arrived in a pull-request comment. The D6 controls that apply are the multi-writer-corpus ones — source-trust attribution and boundary marking between repository content and instructions — plus cognitive file integrity over the instruction files themselves, since CLAUDE.md-class files are corpus and configuration at once.

The lethal-trifecta test lowers the target level directly here: a bot with no private-data access and no exfiltration path does not need the full answer-time enforcement stack. Removing the sensitive-retrieval capability costs less than controlling it.

Cost model

Level	Licensing	Operational labor	Run-rate
L2	~0 for an E5 + Copilot tenant (DSPM for AI, DLP, Content Safety are in entitlements)	the first assessment + a labeling scheme	—
L3	~0 incremental	the dominant cost: a multi-quarter oversharing-remediation project	classification / scan consumption
L4	~0 incremental	continuous posture management + detector tuning + SIEM integration	SIEM ingest for detector signals
L5	mostly off-stack for contradiction / attestation gaps	drift-bound justification, rollback drills, semantic-boundary tuning	streaming-scan + retrieval-check cost

For an incumbent the licensing line is near zero, and the real spend is the remediation labor. Microsoft frames it as a three-stage blueprint that runs remediate, then guardrails, then regulate, over a five-phase loop of inventory, classify, triage, remediate, and lock. Vendor walkthroughs cite 40–60 IT-hours over about four weeks,²⁶ but those are small-tenant figures and do not scale linearly; at enterprise scale the Restricted SharePoint Search site cap forces genuine remediation rather than a search-scope shortcut. Plan two-to-four quarters and one-to-two FTE-equivalent, recurring. New content re-introduces oversharing, so the project never fully closes.

Customer critiques folded in

• “D6 is over-built around poisoning for our member-data bot.” Addressed: oversharing / inference exposure is now the L3 spine for the closed-corpus shape; poisoning controls move up to L4/L5 and to open-corpus shapes.
• “Microsoft is our weakest plane for data.” Reframed: the assessment-and-labeling tooling is GA and capable. The genuine weaknesses are narrower. Remediation is a labor project no tool performs; Restricted SharePoint Search is a capped stopgap and Restricted Content Discovery is still in preview; Groundedness Detection is English-only; and cross-source contradiction detection and per-document attestation have no vendor production answer.
• “The cost was invisible.” Addressed: the cost model names the multi-quarter remediation project and marks licensing near-zero for an E5 + Copilot shop.

Open questions

• Answer-time semantic entitlement at scale. Whether sensitivity-label-granular DLP is sufficient, or whether true knowledge-layer authorization (Knostic-class) is required, is unresolved.
• Restricted Content Discovery GA timing versus the procurement windows of regulated buyers who cannot deploy preview features.
• Defender memory-injection detector maturity — likely detective guidance today, not a turnkey GA control.
• No FI-specific grounding. GLBA / FFIEC data-governance expectations are where the forthcoming crosswalk will bite hardest; this page does not yet map to them.
• No enterprise data-governance-labor benchmark. The remediation-effort estimate is directional, drawn from small-tenant vendor figures.
• Continuous validation does not reach backdoor poisoning. The Exchange states that continuous validation is typically unsuitable against backdoor poisoning, because such attacks trigger on very specific inputs a test set would not normally contain and are often built to pass validation tests.⁶ The L3 clause above protects the reference corpus and grades nothing about its coverage, and no rung here grades trigger discovery. A program presenting clean validation results against a protected test set has evidence about drift and permanent behavioural change, and no evidence about a trigger it never sampled. §3.1.1 states the same limit from the attacker’s side: a backdoor is built to pass regular testing, which is the intention behind choosing a trigger that normal inputs do not contain.²⁵
• No domain requires the lineage the propagation clause depends on. The L4 clause requires upstream deletions and corrections to reach the training and augmentation datasets derived from the source data, and checking that requires a record linking a source record to the corpus entries and embeddings derived from it. No rung in this CMM requires that record. L3 above places the augmentation store inside classification scope and grades no lineage, and D8 grades provenance for runtime artifacts rather than for data records. A program satisfies the clause only by building the record itself, which is why the clause carries the requirement rather than assuming it.
• Detection versus structure for memory integrity. The Exchange concedes that separating legitimate memory updates from poisoning at scale remains difficult, and directs the compensating effort to partition access control and write authorization.⁷ Whether a program holding the structural controls and no detector should grade L4 is the calibration question the new criteria raise.

Notes

Footnotes

1. OWASP AI Exchange — Testing against prompt injection, retrieved 2026-08-19. Document 5, step 4 of the test procedure: attack inputs are presented to the insertion mechanisms untrusted data reaches the system through, tool outputs among them, which may require a dedicated testing API so the input follows that route through the filtering, detection and insertion mechanisms on it. ↩

2. Microsoft Learn — DSPM for AI, 2026. Capability and GA rollout window for Purview Data Security Posture Management for AI. ↩

3. Microsoft Learn — DLP for Microsoft 365 Copilot, 2026. Sensitivity-label inheritance and response gating for Copilot. ↩

4. Microsoft Learn — Groundedness detection (Azure AI Content Safety), 2026. Groundedness-with-correction; language coverage. ↩

5. Microsoft Learn — Restricted Content Discovery, 2026. Preview-stage discovery-scope control complementing RSS. ↩

6. OWASP AI Exchange — CONTINUOUS VALIDATION, retrieved 2026-08-19. Test-data management and protection (storage separate from training data and model artifacts, lower exposure than either), the Limitations statement that validation results are untrustworthy where an attacker manipulates both model and test data, and the stated unsuitability against trigger-based backdoor poisoning. ↩ ↩² ↩³

7. OWASP AI Exchange — AUGMENTATION DATA INTEGRITY, retrieved 2026-08-18. ↩ ↩² ↩³

8. OWASP AI Exchange — Disclosure of sensitive data in model output, retrieved 2026-08-19. The statement that original access-right variations cannot be controlled once training data is embedded in the model. ↩

9. OWASP AI Exchange — Model inversion and membership inference, retrieved 2026-08-19. The two attack definitions, the overfitting relationship, the ATLAS / OWASP ML / NIST AI 100-2 identifiers, and the entry’s control list, of which only SMALL MODEL is specific to these two threats. ↩

10. OWASP AI Exchange — SMALL MODEL, retrieved 2026-08-19. The capacity argument and the ISO/IEC coverage gap. ↩

11. OWASP AI Exchange — General controls for sensitive data limitation, retrieved 2026-08-20. The group thesis — reduce the impact of confidentiality and integrity threats by limiting the amount and variety of data and the duration for which it is kept — and the five controls it holds: DATA MINIMIZE, ALLOWED DATA, SHORT RETAIN, OBFUSCATE TRAINING DATA, DISCRETE. ↩

12. OWASP AI Exchange — MORE TRAIN DATA, retrieved 2026-08-20. Increasing benign data, including through data augmentation, to outnumber poisoned samples; the stated risks of catastrophic forgetting and overfitting; and the statement that the control applies only during training, with fine-tuning on additional benign data as the variant for an already-trained model. ↩

13. OWASP AI Exchange — TRAIN DATA DISTORTION, retrieved 2026-08-20. Distortion by noise, smoothing, or JPEG compression to render inserted triggers unrecognizable; complete removal of input fields as a special form; the statement that the control applies only during training; and the Risk-Reduction Guidance that it has no effect against an attacker with access to the training data after distortion, so under zero trust in the engineering environment it reaches only poisoning originating outside it unless a separated training environment is created. ↩ ↩²

14. OWASP AI Exchange — TRAIN ADVERSARIAL, retrieved 2026-08-20. The statement that adversarial training is a control against evasion attacks and also helps against data-poisoning trigger attacks based on slight alterations of training data, with the altered-stop-sign example. ↩

15. OWASP AI Exchange — MODEL ENSEMBLE, retrieved 2026-08-20. The category line “development-time AI engineer control - including specific runtime implementation”; deployment as an ensemble over a randomly split training set so a deviating output signals possible manipulation; and the stated effectiveness bound that the approach weakens as the share of poisoned samples rises. ↩

16. OWASP AI Exchange — POISON ROBUST MODEL, retrieved 2026-08-20. The Applicability statement that the control can be applied to an already-trained model including one obtained from an external source; pruning and clean-data fine-tuning as the two strategies and fine-pruning as their combination; and Selective Amnesia’s two steps, its ~0.1%-of-training-data requirement, its ~30× speed-up over training from scratch on MNIST, and its independence from prior knowledge of the trigger pattern. ↩

17. OWASP AI Exchange — SHORT RETAIN, retrieved 2026-08-20. The statement that limiting the retention period of data can be seen as a special form of data minimization. ↩

18. OWASP AI Exchange — DATA MINIMIZE, retrieved 2026-08-20. Applicability across data collection, preparation, training, evaluation and runtime logging; the exception where the deployer is better positioned to implement part of the control and the provider communicates the requirement; the implementation bullets on removing data elements that do not materially affect model performance in correctness, robustness or fairness, retaining certain identifiers only to support data-removal requests or lifecycle management while excluding them from training, and updating training datasets to reflect removals or corrections made in upstream source data; and the Particularity that AI models often tolerate reduced feature sets and incomplete data better than traditional applications. ↩ ↩² ↩³ ↩⁴

19. OWASP AI Exchange — OBFUSCATE TRAINING DATA, retrieved 2026-08-20. The development-time AI engineer category; the same deployer exception DATA MINIMIZE carries; the risk-reduction statement that obfuscation reduces the likelihood that training data can be reconstructed or linked back to individuals, with residual risk including access to token mapping tables; and the two stated limitations — identity may be induced from other retained data such as locations, times, visited websites and timestamped activity, and token-based approaches introduce additional risk if mapping tables are compromised. ↩ ↩² ↩³

20. Microsoft SDL — Microsoft Security Blog, Yonatan Zunger, 2026-02-03. The statement that AI systems blend structured and unstructured data, tools, APIs and agents into a single platform, and that purpose limitation and data minimization become harder to enforce as a result. ↩

21. OWASP AI Exchange — DATA QUALITY CONTROL, retrieved 2026-08-20. The Objective of identifying anomalous or manipulated samples before they influence model behaviour; the Applicability statement that the control cannot be applied retroactively to a trained model and may be more suitable for the deployer where training-data pipelines or supply chains are externally managed; the five named detection methods (statistical deviation and outlier detection, spectral signatures over covariance of learned feature representations, activation clustering, Reject on Negative Impact, gradient fingerprinting); the filter-versus-alert threshold split; the direction to protect detection mechanisms and their data against manipulation; the Particularity that standard data quality checks are insufficient because data may be maliciously altered; and the Limitations on false positives, false negatives, and poisoned samples designed to blend into the normal distribution. ↩ ↩² ↩³ ↩⁴

22. OWASP AI Exchange — Direct augmentation data leak, retrieved 2026-08-18. ↩

23. OWASP AI Exchange — Development-time data leak, retrieved 2026-08-25. Unauthorized access to train or test data through a data leak of the development environment, with the stated impact a confidentiality breach of sensitive train/test data; the statement that training or test data can be confidential because it is sensitive data such as personal data, or intellectual property; and the three routes named — the development environment where engineers work with real data, training data collected at runtime making a live system an attack surface, and cloud-hosted or externally managed GenAI models to which training data must travel. ↩

24. PoisonedRAG (USENIX Security 2025), 2025. Knowledge-corruption attack class against retrieval-augmented generation. ↩

25. OWASP AI Exchange — Data poisoning, retrieved 2026-08-20. The five manipulation routes (storage, transit, change at the supplier before or after training, and manipulation of operational data entry feeding into training), each also executable by an insider; the statement that manipulated data can be training data or in-context-learning data used to augment input; the two categories, targeted or backdoor poisoning and sabotage; and the detectability asymmetry — sabotage surfaces on regular inputs while a backdoor evades review because a model holds no reviewable code, its parameters are unreadable, and testing runs on normal cases. ↩ ↩²

26. Microsoft Learn — Restricted SharePoint Search, 2026. Site-count limit and remediation-effort guidance for oversharing control. ↩