A fire-hydrant-use-permit team is told that context manipulation targets confidential training data, for example by overloading the context window until stray training snippets appear. What is the correct tester stance?

Fire-hydrant-use permits must not become a channel for leaking confidential training material. Context manipulation that overloads or abuses the context window can surface stray training snippets that were never part of the permit pack. The correct tester stance is to recognize the training-data leakage risk, refuse to treat unexpected “remembered” secrets as normal testware, stop, and escalate to security. Civic testing does not harvest mystery secrets for coverage.

Copying unexpected secrets into the shared regression pack fails by concept: that redistributes potentially confidential material and converts a security symptom into a fixture. Raising temperature to “flush” training data fails because temperature does not safely purge models and can increase uncontrolled disclosure. Ignoring the symptom because context windows “cannot” relate to security fails the syllabus link between context manipulation and leakage risk.

Exam caveat: unexpected confidential-looking content is a stop-and-escalate event, not an invitation to reproduce the leak for a better defect ticket. Do not lengthen prompts to coax more training snippets.

Operational check: publish a hydrant-permit GenAI incident rule—halt generation, isolate the output, notify security/privacy, do not paste fragments into chat or tickets, and resume only after clearance. Keep the civic test basis separate from any unsolicited model “memories.” Record the model, time, and prompt class without copying the secret payload.