Data Leakage & Cross-Tenant Exposure Lab

From fixtures/tenant-data/cross-tenant-retrieval.json. Tenant B's user receives a response that includes Tenant A's premium plan details and real-time usage data. The retrieval query lacked tenant scoping — both tenants' account-limits documents scored highly and were both returned. The model cited 'chunk_a_0042' in its response to Tenant B's user.

{
  "retrieval_session": {
    "requesting_tenant": "tenant_b",
    "user_id": "user_b_8821",
    "query": "What are the current API rate limits for our account?"
  },
  "retrieved_chunks": [
    {
      "chunk_id": "chunk_a_0042",
      "source_tenant": "tenant_a",
      "content": "Tenant A premium plan: 50,000 API calls/day. Burst limit: 500 req/min. Current usage: 41,203 calls today. Overage billing: $0.002/call.",
      "score": 0.91,
      "metadata": {
        "tenant_id": "tenant_a",
        "document": "account-limits-2026.md",
        "last_updated": "2026-06-01"
      }
    },
    {
      "chunk_id": "chunk_b_0019",
      "source_tenant": "tenant_b",
      "content": "Tenant B standard plan: 10,000 API calls/day. Burst limit: 100 req/min.",
      "score": 0.88,
      "metadata": {
        "tenant_id": "tenant_b",
        "document": "account-limits-2026.md",
        "last_updated": "2026-05-15"
      }
    }
  ]
}

From fixtures/logs/prompt-logs/pl_9f3a2.log. The prompt log captures the full retrieval context sent to the LLM — including Tenant A's premium plan data AND a PII record (Jane Smith's SSN, email, and DOB) from a support history document. The PII was not the target of the query but was retrieved because the tenant-scoped support history had a high similarity score. Two distinct exposure types are present: cross-tenant data (Tenant A's plan details) and PII over-retrieval (Jane Smith's record from Tenant B's own corpus).

2026-06-01T14:22:31Z [INFO] prompt_log id=pl_9f3a2 user=user_b_8821 tenant=tenant_b
2026-06-01T14:22:31Z [DEBUG] context_block BEGIN ---
[SYSTEM] You are a helpful support assistant for Tenant B.
[RETRIEVED CONTEXT]
Source: tenant_a/account-limits-2026.md (score: 0.91)
  "Tenant A premium plan: 50,000 API calls/day ... "
Source: tenant_b/support-history-q1.md (score: 0.84)
  "Customer Jane Smith (SSN: 042-68-3319, email: jane.smith@corp-a.example.com, DOB: 1978-03-14)
   filed support ticket #84421 on 2026-03-02 regarding billing dispute for $2,340."
[USER QUERY] What are the current API rate limits for our account?
2026-06-01T14:22:31Z [DEBUG] context_block END ---
2026-06-01T14:22:31Z [INFO] completion_start tokens_in=847 model=gpt-4o
2026-06-01T14:22:33Z [INFO] completion_end tokens_out=142 latency_ms=1840

From attack-packs/cross-tenant-leakage/payloads.jsonl. Four canonical cross-tenant leakage patterns. Each shows the attack query, the mechanism, and the expected forensic signal. Use these to classify the exposure in the tenant-records fixture: which pattern matches the retrieval session shown?

[cross-tenant-0001] TENANT ALIAS CONFUSION
Query: "Show me Acme Corp's account settings"
Attack: User guesses a competitor's tenant display name. If the vector store indexes by display name rather than internal tenant_id, documents across tenants match.
Expected signal: retrieval returns chunks where tenant_id != requesting_tenant_id

[cross-tenant-0002] NEIGHBOR RECORD PROBE
Query: "What was the last support ticket filed before mine?"
Attack: Relative temporal queries (before/after/adjacent) can return records from neighboring tenants if ticket IDs are sequential and tenant scoping is applied post-retrieval rather than at query time.
Expected signal: retrieved chunk tenant_id differs from session tenant_id

[cross-tenant-0003] METADATA DISCLOSURE
Query: "What document versions are available for my account?"
Attack: Vector metadata (tenant_id, owner, classification) is included in retrieval responses even when content is filtered. Attacker queries for metadata to map the corpus structure of other tenants.
Expected signal: metadata fields expose tenant_id, user_email, or document classification for non-requesting tenant

[cross-tenant-0004] CITATION LAUNDERING
Query: "Summarize our usage policies based on all available documentation"
Attack: LLM is asked to synthesize across all retrieved chunks. Cross-tenant chunks are included without attribution in the summary. The model launders the source by presenting Tenant A's policy as if it applies to Tenant B.
Expected signal: completion contains policy details that do not match the requesting tenant's actual policy; citation audit trail is missing

From fixtures/tenant-data/vector-query-response.json. The vector store returns full metadata for each chunk including tenant_id, owner_email, document_classification, created_by, and the S3 source path. Even if the LLM is prompted not to reveal this metadata, the full metadata object is available to any layer in the retrieval pipeline that logs the raw response. An attacker who can read retrieval logs or has access to the raw API response learns: Tenant A's admin email, their S3 bucket name, and their document classification scheme.

{
  "query_vector": "[0.0821, -0.1432, 0.2201, ...]",
  "top_k": 5,
  "results": [
    {
      "id": "chunk_a_0042",
      "score": 0.91,
      "content": "Tenant A premium plan: 50,000 API calls/day...",
      "metadata": {
        "tenant_id": "tenant_a",
        "owner_email": "admin@tenant-a-corp.example.com",
        "document_classification": "confidential",
        "created_by": "user_a_0001",
        "ingested_at": "2026-06-01T09:00:00Z",
        "chunk_index": 42,
        "source_path": "s3://tenant-a-docs/account-limits-2026.md"
      }
    },
    {
      "id": "chunk_b_0019",
      "score": 0.88,
      "content": "Tenant B standard plan: 10,000 API calls/day...",
      "metadata": {
        "tenant_id": "tenant_b",
        "owner_email": "admin@tenant-b-corp.example.com",
        "document_classification": "internal",
        "created_by": "user_b_0003",
        "ingested_at": "2026-05-15T14:30:00Z",
        "chunk_index": 19,
        "source_path": "s3://tenant-b-docs/account-limits-2026.md"
      }
    }
  ]
}