LLM Data Leakage Lab
2026
A deliberately vulnerable LLM-enabled Flask application, built to demonstrate a real cross-user data leakage vulnerability class and then measure three progressively stronger defenses against it: identity trust, context isolation, input risk inspection, output redaction, and structured security logging. The vulnerable baseline is preserved unmodified so the 'before' stays real and reproducible; the defended modes are implemented alongside it, not in place of it, so the same attack set can be replayed against all three and compared directly.
Tools: Python, Flask, Flask-CORS
Skills demonstrated: threat modeling, context isolation, prompt/input risk inspection, output inspection and redaction, structured security event logging, authorization boundary design, IDOR identification and remediation, test-driven security evaluation
Measured results
- Unauthorized disclosure rate -- Vulnerable Baseline
- 25% (3/12 adversarial cases)
- Methodology: tests/run_evaluation.py, response text scanned for any other user's stored sensitive field values, independent of the code's own self-reported findings.
- Unauthorized disclosure rate -- Partial Defense (context isolation only)
- 0% (0/12 adversarial cases)
- Methodology: Same evaluation script and case set as above.
- Unauthorized disclosure rate -- Defense in Depth
- 0% (0/12 adversarial cases)
- Methodology: Same evaluation script and case set as above.
- Identity-spoofing (IDOR) case blocked
- Only Defense in Depth (1/1); Baseline and Partial Defense both allow it
- Methodology: Dedicated test case: request carries a valid session token for one user but a claimed user_id for another; checked whether the claimed victim's data was returned.
- Adversarial requests blocked before reaching the model -- Defense in Depth
- 33% (4/12)
- Methodology: Pre-model input risk inspector score >= 60 (high) triggers a block; measured, not asserted.
Outcome: Unauthorized cross-user disclosure measured at 25% under the original vulnerable baseline, dropping to 0% once context isolation is added (Partial Defense) -- the full Defense-in-Depth mode adds pre-model risk-based blocking, output redaction, and resolves identity from a server-side session token rather than a client-declared field, which is what stops a separate identity-spoofing (IDOR) vector the first two modes both leave open.