2026生成式 AI 数据安全报告：风险与缓解措施 OWASP GenAI Data Security Risks and Mitigations 2026

OWASPGenAIDataSecurity

RisksandMitigations2026

Version1.0March2026

Page2

Theinformationprovidedinthisdocumentdoesnot,andisnotintendedto,constitutelegaladvice.All

informationisforgeneralinformationalpurposesonly.Thisdocumentcontainslinkstootherthird-partywebsites.SuchlinksareonlyforconvenienceandOWASPdoesnotrecommendorendorsethecontentsofthethird-partysites.

LicenseandUsage

ThisdocumentislicensedunderCreativeCommons,CCBY-SA4.0Youarefreeto:

●Share—copyandredistributethematerialinanymediumorformat

●Adapt—remix,transform,andbuilduponthematerialforanypurpose,evencommercially.

●Underthefollowingterms:

○Attribution—Youmustgiveappropriatecredit,providealinktothelicense,andindicateifchangesweremade.Youmaydosoinanyreasonablemannerbutnotinanywaythat

suggeststhelicensorendorsesyouoryouruse.

○AttributionGuidelines-mustincludetheprojectnameaswellasthenameoftheassetReferenced

■OWASPTop10forLLMs-GenAIRedTeamingGuide

●ShareAlike—Ifyouremix,transform,orbuilduponthematerial,youmustdistributeyourcontributionsunderthesamelicenseastheoriginal.

Linktofulllicensetext:

/licenses/by-sa/4.0/legalcode

Page3

TableofContent

DocumentScopeandObjectives5

WhatisDataSecurityintheGenAIContext?6

DSPMforGenAI(AI-DSPM)9

GenAIDataRisks13

DSGAI01—SensitiveDataLeakage15

DSGAI02—AgentIdentity&CredentialExposure20

DSGAI03—ShadowAI&UnsanctionedDataFlows24

DSGAI04—Data,Model&ArtifactPoisoning28

DSGAI05—DataIntegrity&ValidationFailures34

DSGAI06—Tool,Plugin&AgentDataExchangeRisks37

DSGAI07—DataGovernance,Lifecycle&ClassificationforAI

Systems42

DSGAI08—Non-Compliance&RegulatoryViolations46

DSGAI09—MultimodalCapture&Cross-ChannelDataLeakage50

DSGAI10—SyntheticData,Anonymization&TransformationPitfalls

54

DSGAI11—Cross-Context&Multi-UserConversationBleed59

DSGAI12—UnsafeNatural-LanguageDataGateways(LLM-to-

SQL/Graph)63

DSGAI13—VectorStorePlatformDataSecurity67

Page4

DSGAI14—ExcessiveTelemetry&MonitoringLeakage71

DSGAI15—Over-BroadContextWindows&PromptOver-Sharing74

DSGAI16—Endpoint&BrowserAssistantOverreach78

DSGAI17—DataAvailability&ResilienceFailuresinAIPipelines82

DSGAI18—Inference&DataReconstruction86

DSGAI19—Human-in-the-Loop&LabelerOverexposure90

DSGAI20—ModelExfiltration&IPReplication93

DSGAI21—Disinformation&IntegrityAttacksviaDataPoisoning96

Acknowledgements101

OWASPGenAISecurityProjectSponsors102

ProjectSupporters103

Page5

DocumentScopeandObjectives

Theobjectiveandscopeofthisdocumentistoprovideafocusedlensonthedatasecurityrisksand

mitigationsspecifictoLLMs,GenAIandAgenticAIApplications.ThisdocumentisnotintendedtoserveasanOWASPTop10guide,norisitdesignedtoreplacetheOWASPDataSecurityTop10.Thisisan

evolutionandupdateofthe

LLMandGenAIDataSecurityBestPracticesGuide

publishedinFebruaryof2025.ItisdesignedtobealignedwithandsupporttheOWASPTop10forLLMsandAgenticAITop10withcross-referencestorelatedrisksandresources.

Thesingle“LLMandGenAIDataSecurityBestPracticesGuide”isbeingbrokenintotwodocuments,the

enumerationoftherisksandmitigations(thisdocument),andacompaniondocumentonimplementationofbestpracticestoimproveaccessibilityandreadabilitywhileaccountingfortherapidrevisionsinGenAIandAgenticAIrelatedrisks.Thegoalisnottoduplicaterisksidentifiedelsewherebuttoprovideaspecific

listingforthoseriskstieddirectlytoLLM,GenAIandAgenticAIapplicationsandworkloads.

Page6

WhatisDataSecurityintheGenAIContext?

InGenAI,datasecurityisthesetofsafeguardsthatprotectsconfidentiality,integrityavailabilityand

authenticityofdataasitisstored,movesthroughandistransformedbyLLM/GenAI/agenticsystems—

acrosstraining/fine-tuning,retrieval(RAG),tooluse,agentmemory,telemetry/observability,inference-timeprocessing,anddownstreamoutputs.ThismattersbecauseGenAIintroducesnewdatasurfaces

(prompts,contextwindows,embeddings/vectorstores,agenttraces,toolpayloads)andnewfailuremodes(prompt-drivenextraction,cross-sessionbleed,inferenceattacks,plugin/tooldrains).

Thisdocument’sintentistoprovideafocusedlensondatasecurityrisksandmitigationsspecifictoLLMs,GenAI,andAgenticAI(nota“Top10”replacement),alignedtoOWASP’sbroaderwork,andpairedwitha

companionimplementationguide.

Practically,“datasecurity”inGenAImeansprotecting:

•Sourcedata:rawcorpora(structured+unstructured),useruploads,tickets,knowledgebases,analyticsexports.

•Deriveddata:embeddings,indexes,retrievedpassages,summaries,syntheticdatasets,featurestores.

•Modelartifacts:checkpoints,adapters/LoRA,traininglogs,evaluationsets,modelregistries.

•Runtimedata:prompts,contextwindows,toolcalls(LLM-to-SQL/Graph/API),agent-to-agentmessages,transientcaches(e.g.,KVcache),sessionmemory.

•Operationalexhaust:logs,traces,“debugmode”captures,monitoringpipelines.

•Agentstateanddelegationartifacts:agentmemory(short-termandlong-term),inter-agentmessages,toolcallpayloadsandresults,delegationchains,andcachedcredentials.

AcoreGenAIrealityisthatsensitivecontentcanleakverbatimornear-verbatimviamodelinteraction,RAGretrieval,orobservability/logging,especiallywheningestion/redactionandaccesscontrolsareweak.

OnearchitecturalpropertymakesGenAIdatasecurityfundamentallydifferentfromeverypriorcomputing

model:thecontextwindowaggregatesdatafrommultipletrustdomains(systemprompt,userinput,RAG

results,tooloutputs,conversationhistory)intoasingleflatnamespacewithnointernalaccesscontrol.A

RAGchunkretrievedfromaconfidentialHRdatabasesitsalongsideuserinputwithequaltrustweight.Thereisnomechanismtodaytomarkacontextsegmentas"availableforreasoningbutnotfordirectoutput"or

"usablefordecision-makingbutnotforwardabletootheragents."Multiplerisksinthisdocument(DSGAI01,

Page7

DSGAI19,DSGAI21,DSGAI25)tracebacktotheseidentifiedrootcauses.Themitigationsinthoseentrieswork

aroundthislimitationratherthansolveit.

Thisarchitecturalfusionofcontrolanddataplanesnecessitatesaproactive,minimalisticsecurityposture.GenAIsystemsmustassumezeroinherenttrustinthemodel(itcanleak,regurgitate,orreconstructdataviamemorization,inversion,oroutput)

Accordingly,GenAIdatasecurityemphasizes:

•Minimizationandcontrolledcontext(onlysendwhat’sneeded;avoidover-broadcontextwindows).

AcriticalfirstprincipleofGenAIsecurityisthatthecontextwindowaggregatesdistincttrust

domains—suchassystemprompts,RAGdata,anduserinputs—intoasingle,flatnamespacewithoutinternalaccesscontrol.Becauseallinputsshareequaltrustweight,themodelcannotinherently

distinguishbetweentrustedinstructionsanduntrusteddata.Thisarchitecturalfusionofcontrolanddataplanesrepresentsafundamentalshiftfromtraditionalcomputing,necessitatingauniquesecurityposture.

/docs/1_general_controls/#data-minimize

•Isolationandleastprivilege(per-tenant/per-user/per-agentboundaries;scopedtoolpermissions,human-in-the-loopapprovalforhigh-riskorirreversibleactions).UseSEGREGATEDDATAto

enforcestrictisolation(e.g.,multi-tenantRAGrespectsuser/departmentaccesscontrolsto

preventcross-leakageviaretrievedpassages).LimitprivilegesviaLEASTPRIVILEGEMODELandruntimeenforcement.

•Lifecyclerigor(retention/erasureacrossraw+derivedassetslikeembeddingsandbackups).ImplementSHORTRETAINtodeleteoranonymizedata(prompts,contexts,KVcaches,sessionmemory,logs/traces)assoonasnotneeded,minimizingexposurewindowsandaligningwithprivacylaws(wherenecessary).

Traditionaldatasecurityfundamentalsthatneedtobeobserved:

•Integrityandprovenance(detectpoisoning/tampering;knowwhatwasingestedandwhochangedit).

•Continuousmonitoring(DLPonprompts/outputs/logs;anomalydetectionfor

scraping/enumeration),includingSENSITIVEOUTPUTHANDLING(runtimefiltering/redactiontoblockleakedPII,secrets,orreconstructedsensitivedata).

•Governance+compliance(traceability,lawfulbasis,DSRsupport,auditreadiness,datalineage),supportedbyMODELINPUTCONFIDENTIALITY/RUNTIMEMODELCONFIDENTIALITY

(encrypt/augmentintransit/atrest)andprovenancetracking.

Thisisreflectedintherisktaxonomyenumeratedinthedocument(DSGAI01–DSGAI25),spanningleakage,poisoning,unauthorizedaccess,inference/inversion,vector-storeweaknesses,supplychain,lifecycle,

Page8

governance,observabilityleakage,shadowAI,cross-contextbleed,plugin/tooldrains,endpointoverreach,

andmultimodalleakage.

Page9

DSPMforGenAI(AI-DSPM)

AI-DSPM(DataSecurityPostureManagement)forGenAIisthecontinuouspracticeofdiscovering,

classifying,governing,andmonitoringdataacrossGenAIpipelinesandruntimes—soyoucanseewheresensitivedataexists,understandhowitflows/derives(e.g.,intoembeddingsorlogs),andenforcecontrolsthatpreventexposure,tampering,andnon-compliance.

BelowarepracticalDSPMcapabilitycategoriestailoredtoGenAI/agenticsystems(andhowtheymaptothedocument’sriskthemes).

EXTENDINGTRADITIONALDSPM(ExtendyourexistingDSPMtocoverGenAIdatastore).

1)GenAIdataassetdiscovery&inventory

•InventoryallGenAI-adjacentassets,including:

•Training/fine-tunedatasets,evalsets,labelqueues

•Prompttemplates,systemprompts,agentmemorystores

•RAGsources(documentstores),vectorDBcollections,embeddingpipelines

•Toolintegrations(plugins/MCPtools),LLMgateways,caches

•Logs/traces/observabilitystoresthatmaycapturefullprompts/tooloutputs

Goal:eliminateunknowndatastoresand“hidden”AIdatapaths(amajordriverofshadowAIandleakage).

2)Dataclassification,labeling&policybinding

Extendclassicclassification(Public/Internal/Confidential/Restricted;PII/PHI/PCI/secrets/IP)to:

•Promptsandcontextwindows

•Embeddingsandretrievedsnippets

•Toolpayloads/results(e.g.,SQLqueryresults,CRMrecords)

•Observabilityevents(agenttraces,debuglogs)

Keyrequirement:labelsmustpropagatetoderivatives(embeddings,caches,backups),notjustrawfiles.

3)Dataflowmapping,lineage&“GenAIbillofmaterials”

Maintainend-to-endlineage:

•Source→preprocessing→embedding→indexing→retrieval→promptassembly→generation→logging/monitoring

•Datasetversions↔modelversions↔deploymentversions

Page10

AddDBOMconcepts(DataBillofMaterials)soyoucanproveprovenance,ownership,andchangehistory—especiallyusefulforpoisoningandsupply-chainrisks.Catalogtheprovenance,lineage,andcompositionofdataassetsacrossGenAIpipelinesusingCycloneDXML-BOM(ECMA-424,v1.7)asthebaseformat.Each

entryrecordssourceorigin,ingestiontimestamp,preprocessingsteps,classificationtags,andapplicablelicenses.ForGenAIsystems,extendthestandardBOMwithRAGcorpusversionsnapshots,embedding

modelversionlinkspervectorstore,andclassificationtagpropagationtoderivatives.SeeDSGAI02forpoisoningandtamperingrisksthatdependonDBOMtraceability.

4)Accessgovernance&entitlementposture(includingagents)

Implementandcontinuouslyvalidate:

•Fine-grainedRBAC/ABACfordatasourcesfeedingRAGandtraining

•Short-livedcredentials,secrethygiene,privatenetworking

•Per-agentidentityandscopedtool/datapermissionsforagenticsystems(preventlateraldatapulls)

•Just-in-Time(JIT)DataAccess:InsteadofgivinganAIAgentpermanentcredentialstoyour

database(standingprivileges),theAgentrequestsaccessonlywhenauserasksarelevantquestion.Thesystemgrantsatemporarytokenonlyforthedurationofaspecifictask,andrevokeson

completion.Theagent'stoolcredentialshouldbemintedper-taskwithscopeandTTLbakedin.

Why:mis-scopedaccesstovectorstores,buckets,registries,ortoolsisaprimarypathtounauthorizedaccessandbroaddataexposure.

GenAIspecificDSPM

5)Prompt,RAG,andoutput-layerDLPcontrols

DSPMforGenAImustincludein-linecontrolssuchas:

•Input/outputscanningforPII/secrets(prompt+response)

•Retrieval-timeredactionandper-documentACLenforcement

•Guardsagainstenumeration/scrapingpatterns(behavioranalytics)

•“No-train/no-retain”policyenforcementforspecificdatatypes

Thisdirectlyaddressesthe“modelorRAGreturnssensitivestrings”failuremodedescribedinDSGAI01.

6)Vectorstore&embeddingsecurityposture

Becauseembeddingscreateadurable,searchablerepresentationofsensitivecorpora,DSPMshouldcover:

•Encryptionatrest/intransit;keymanagementalignment

•Stricttenantscopingenforcedserver-side

•Controlsontop-k,similarityquerypatterns,snapshot/importsecurity

•Monitoringforunusualnearest-neighbor/extractionbehaviors

7)Dataintegrity,poisoning&tamperdetection

Page11

GenAIDSPMmusttreatintegrityasfirst-class:

•Ingestionvalidation(schemaenforcement,contentsanitation)

•Drift/outlierdetectionand“goldensets”

•Signeddatasets/artifacts;immutableregistries

•Humanreviewgatesforhigh-impactRAGcorpora

(Thesealigntothepoisoningandartifact-tamperingpatternsinDSGAI02andDSGAI07.)

8)Observability,telemetry&log-retentionposture

BecauseGenAIdebuggingoftencaptureseverything,DSPMshouldenforce:

•Least-loggingdefaults(nofullbodiesbydefault)

•Tokenization/redactionofprompts,tooloutputs,andsecretsinlogs

•ShortTTLfordebugtraces+approvalworkflows

•Accesscontrolsandmonitoringonobservabilityplatforms

9)Third-party,plugin/tool,andconnectorgovernance

Inventory+risk-rateeveryintegration:

•Whatdataisshared,withwhom,whereit’sstored,howlongit’sretained

•Whetherthetoolreceivesfulltranscriptvsminimalpayload

•Subprocessors,cross-borderflows,incidentnotificationterms

10)Lifecyclemanagement,erasure&compliancereadiness

Ensurerawandderivedassetsadheretostrictretentionanderasurerules:

•Delete/expireembeddings,indexes,caches,andbackupstiedtodeletedsources

•Supportdata-subjectrights(access/erasure)withtraceability

•Tracklawfulbasis,purposelimitation,andapprovalsfortraininguse

•Zerodataretentionunlessneeded

11)Traininggovernance&privacy-enhancingfine-tuning

Governthedatalifecycleformodel"fine-tuning"and"refining":

•AutomatedPII/PHIredaction,anonymization,and"HardDe-identification"

•SyntheticdatagenerationandDifferentialPrivacy(DP-SGD)injectiontopreventinferencebasedonmissingindividuals.

•Consentmapping(RTBF)andcopyright/IPscrubbing

Goal:Ensurecompromisedmodelsdonotleakoriginalsensitivetrainingdataandensureregulatorycompliance.

12)ResiliencepostureforGenAIdatadependencies

CoverdataavailabilityforRAG/training/inference:

Page12

•Backups(encrypted+tested),replication,restoredrills(RTO/RPO)

•Ratelimitsandabusecontrolsforvectorendpoints

•Integritychecksonrestore

13)Humanand“ShadowAI”controls

Includegovernanceanddetectivecontrolsfor:

•HITLlabelingpipelines(minimizeexposure;vendorcontrols)

•UnapprovedGenAISaaSusageandunsanctioneddataflows

Page13

GenAIDataRisks

GenerativeAIsystemsintroduceadatasecuritythreatlandscapethatexistingframeworkswerenot

designedtoaddress.Whendataisencodedintomodelweights,derivedintoembeddings,retrieved

dynamicallyatinference,andacteduponbyautonomousagentsoperatingacrosstrustboundaries,the

traditionaldatasecurityperimeternolongercleanlymapstowhatneedsprotection.Thisdocument

identifiesandstructuresthedatasecurityrisksspecifictoGenAIsystems—notAIbehavingunexpectedly,buttheconcretewaysAIpipelinescreatenewexposureacrossthefulldatalifecycle.

Thetwenty-oneentriesareorganizedtofollowdataasitmovesthroughaGenAIsystem.Theopening

entriesaddressdirectexposure:sensitivedataleakingfrommodelsandretrievalsystems(DSGAI01),

credentialandidentityfailuresthatopenthedataplanetounauthorizedaccess(DSGAI02),andungoverneddataflowsfromunsanctionedAIadoption(DSGAI03).Thenextgroupcoverspipelineintegrity—poisoning,supplychaincompromise,andartifacttampering(DSGAI04),validationfailures(DSGAI05),andtherisks

introducedwhereplugins,tools,andagentsexchangecontext(DSGAI06).Governancefundamentals—

lifecyclemanagement,classification,traceability,andregulatorycompliance—areconsolidatedinDSGAI07andDSGAI08,treatedhereasenablingconditionsforeveryothercontrolratherthanstandalonerisks.

ThemiddleentriesaddressattacksurfacesuniquetoGenAI:multimodalleakage(DSGAI09),falseprivacy

guaranteesinsyntheticandde-identifieddata(DSGAI10),conversationbleedacrossusersessions(DSGAI11),naturallanguageinterfacesgeneratingunsafedatabasequeries(DSGAI12),andvectorstoreplatformrisks(DSGAI13).ThefinalentriescovertheoperationalinfrastructuresurroundingAIsystems—telemetryand

monitoringleakage(DSGAI14),over-broadcontextwindows(DSGAI15),browserandendpointassistant

overreach(DSGAI16),andRAG-specificavailabilityandresiliencefailures(DSGAI17)—beforeclosingwith

threatstothemodelasadataartifact:inferenceandreconstructionattacks(DSGAI18),labeleroverexposure(DSGAI19),modelexfiltration(DSGAI20),andadversarialdisinformationintroducedthroughtrustedretrievalpipelines(DSGAI21).

Eachentryfollowsaconsistentstructure:howtheattackunfoldsinGenAI-specificterms,anillustrative

scenariogroundedindocumentedincidentsorcurrentresearch,attackercapabilities,impact,andatieredmitigationsetprogressingfromFoundationalthroughHardeningtoAdvanced—designedtosupport

organizationsatdifferentstagesofsecuritymaturityratherthanpresentinganundifferentiatedcontrol

checklist.Scopeannotations(Buy/Build/Both)indicatewhethereachcontrolisaddressedthroughvendorcapability,internalengineering,orboth.

Eachentrycontainsthreetiersofmitigationsfollowingacrawl,walk,runapproachtoimplementation.

Page14

Tier1mitigationsrepresentthosecontrolsateamcanlikelyshipinonesprintwithexistingtooling.These

mitigationsreducethemostexposurewiththeleastfriction.

Tier2mitigationsrepresentcontrolsthatlikelyrequirearchitecturechanges,newtooling,orcross-teamcoordination.Thesemitigationslikelycarryhighimpactandrequiremoderateeffort.

Tier3mitigationsrepresentcontrolsthatassumeamatureprogram:redteaming,differentialprivacy,formalverification,customdetectionmodels.

Whereearlierdraftentrieswereconsolidatedbasedonoverlappingattacksurfacesorduplicatedcontrols,editorialnotesdocumenttherationaleandpreservecross-references.

Page15

DSGAI01—SensitiveDataLeakage

Howtheattackunfolds

Anattacker(oracurioususer)interactswiththemodeloraRAGsystemthatwastrainedontoretrieve

sensitivecorporatedata.Throughcarefullycraftedinstructions,enumeration,orhigh-recallprompts,thesystemreturnsverbatimornear-verbatimsensitivestrings(PII/PHI/secrets/IP).Largemodelscan

unintentionallyrestatesecretsfromtrainingdataevenwithoutspecificuserprompting.Fine-tunedmodelsandLoRAadaptersareparticularlyvulnerable:evensmalladaptersmemorizeraretrainingexamples

verbatim,creatingatargetedextractionsurfacedistinctfromthebasemodel'smemorizationrisk.

Leakagecanalsooccurviaerrormessages,logs,telemetry,orbyretrievingsemanticallysimilarpassagesfromavectorstore,particularlywhenretrieval,logging,oroutputconstraintsareinsufficientlyenforced.

Furthermore,thetechnicalchallengeofmachineunlearningmeansthatsensitivedatacanremain

persistentlyembeddedinmodelweightsorderivedartifacts(likeembeddings)evenafterrawsourcedataisdeleted,creatingalong-termleakageandcomplianceexposurepoint.

It’sworthnotingthatafrequentprecursortotheseattacksisexcessiveexposureofsensitivedatainthesystemsfeedingRAG(e.g.,shareddrives,publicinstantmessagingchannels,legacypermissions).Insuchcases,themodelisbehavingasdesigned,butthedatasurfaceisalreadyoverlybroad/overshared.

AttackerCapabilities

Adversariestargetingsensitivedataleakagerangesfromopportunisticusersprobingadeployedmodeltosophisticatedexternalattackersexecutingsystematicextractioncampaigns.Atthemostaccessibleend,acuriousormalicioususersubmitshigh-recallprompts,enumerationsequences,orcarefullycrafted

instructionsdesignedtocoaxverbatimornear-verbatimreproductionofPII,PHI,credentials,orproprietaryinformationembeddedintrainingdataorretrievedfromaconnectedRAGpipeline.

Moretargetedattackersfocusonfine-tunedmodelsandLoRAadapters,whichpresentadistinctandoftenunderappreciatedextractionsurface—becauseadaptersaretrainedonnarrower,task-specificcorpora,rareorsensitivetrainingexamplesarememorizedwithdisproportionatefidelity,makingsystematic

extractionofspecificrecordsmoretractablethanattackingageneral-purposebasemodel.

Attackersalsoexploitindirectleakagechannels:errormessages,telemetry,andlogsthatsurfaceinternaldatastructures,APIresponses,orretrievedpassageswhenoutputfilteringisinconsistentlyenforced.Inmultimodalsystems,leakagemayalsooccurthroughgeneratedortransformedmedia—includingimages,videos,PDFs,audiotranscripts,embeddedmetadata,orOCR-renderedcontent—wheresensitive

informationisreconstructedorencodedoutsidetraditionaltext-basedfilteringcontrols.InRAG-based

Page16

systems,adversariesexploitoverlypermissiveretrievalconfigurationstorecoversemanticallysimilar

passagesthatwereneverintendedtobesurfaced.

Compoundingallofthisisthepersistenceproblem—evenwheresourcedatahasbeendeleted,attackerswhounderstandthelimitationsofmachineunlearningcantargetmodelweightsorderivedembeddings

knowingthatsensitiveinformationmayremainextractablelongaftertheupstreamdataisnominallygone.

Aparticularlylow-effortattackpathexistswherethepreconditionhasalreadybeenmetbytheorganizationitself:whensensitivedatahasbeenoversharedintosystemsfeedingtheRAGpipeline—through

misconfiguredshareddrives,legacypermissions,orpublicmessagingchannels—anattackerneednot

manipulatethemodelatall,butsimplyqueryitasintendedtoretrievedatathatshouldneverhavebeeninscope.

Illustrativescenario

Asupportchatbotfine-tunedonhistoricalticketsreturnsasnippetcontainingacustomer’sSSNbecausethoseticketswereingestedwithoutredaction.Alternatively,auserrequestsdeletion.Youremovetherawrecordsbutnotthederivedembeddings,whic