Public works suspects a model reveals details from underground infrastructure maps used in training. Which threat class should drive treatment?

If a public-works model reveals details from underground infrastructure maps used in training, vulnerability management should treat sensitive disclosure and training-data leakage via model outputs as AI threats requiring containment and remediation. Leakage of subsurface asset layouts can aid physical attacks or criminal targeting of critical infrastructure. Treatment—access restriction, output filtering, training-data minimization or unlearning where feasible, incident handling, and possibly model withdrawal—works because the threat is information disclosure through the model channel, not a conventional file-share breach alone.

Treating suspected disclosures as model hallucination requiring factuality scoring, evaluation and targeted model retraining fails because the model is reproducing specific sensitive training data rather than generating inaccurate content, so factuality scoring and retraining won't contain the leakage. Treating the behavior as external prompt injection requiring input sanitization, prompt filtering and continuous monitoring controls fails because the disclosure emerges from the model's trained knowledge of the maps, not from malicious user inputs trying to override system behavior. Treating the incident as training-data poisoning requiring provenance validation, filtering and secure retraining pipeline controls fails because the exposure stems from memorized infrastructure data in model outputs, not from maliciously poisoned training data intended to corrupt model behavior.

Exam caveat: RAG systems can also leak if sensitive maps enter the corpus; leakage treatments must cover training and retrieval paths. Operational check: immediately restrict model access, test for reproducible disclosure prompts, remove or gate sensitive map content from training/RAG sources, add output filters for infrastructure detail patterns, notify appropriate critical-infrastructure stakeholders, and document residual disclosure risk before any return to broader use.