A 311 resident assistant sometimes returns retrieval chunks that include nonpublic resident PII in answers. What AI-specific privacy threat should the auditor cite?

Citing privacy leakage from RAG retrieval that exposes nonpublic resident PII in civic GenAI answers emphasizes an AI-specific confidentiality failure in 311 assistants. The correct threat works because retrieval-augmented generation can pull chunks containing addresses, case notes, or other resident identifiers into the context window and then surface them in answers even when the base model was not trained on that PII. Weak chunk filters, overly broad indexes, and missing output redaction turn municipal knowledge bases into leakage paths.

Model hallucination producing inaccurate trash pickup schedules fails as the privacy threat because it is an accuracy or integrity failure, not a confidentiality breach that surfaces nonpublic resident PII through RAG chunks. Prompt injection through crafted resident service requests fails as the cited privacy threat because it manipulates assistant instructions rather than causing retrieval-time disclosure of resident identifiers. Training data memorization revealing historical resident service records fails because the scenario describes PII emerging from retrieved chunks at answer time, not from the model's parametric memory.

Exam caveat: masking only obvious SSN patterns is insufficient if free-text case notes still contain identifying combinations of name, address, and incident detail. Operational check: segregate nonpublic resident content from public RAG indexes, apply pre-answer PII detection/redaction, test with known sensitive documents, and retain evidence that 311 answers were cleared of nonpublic resident data before wide release.