Keep each customer's data in its own fine-tuned model

How to do it

A model can repeat its training data word for word, and no filter on the prompt reliably stops that. Train shared models only on data every customer may see, such as your own help pages or examples you wrote. Record the owner account of each fine-tuned model in the gateway, and route calls to it only for that account. Put a unique canary string, such as CANARY-7f3a91, into each customer's training set. After every training run, ask the other customers' models and the shared models to complete it. The legal basis for training is in train only on data people agreed to share.

Examples

TypeScript example

export function checkModelAccess(accountId: string, modelId: string): void {
  const owner = fineTunedModelOwners.get(modelId);
  if (owner && owner !== accountId) throw new Error('model_not_owned');
}

Python example

def check_model_access(account_id: str, model_id: str) -> None:
    owner = fine_tuned_model_owners.get(model_id)
    if owner and owner != account_id:
        raise PermissionError("model_not_owned")

How to check

A test calls the gateway as customer B with customer A's model ID and gets an error with no model call. After each training run, 20 prompts with the canary's first half sent to every other model never return its second half.

Sources

• OWASP LLM02:2025 Sensitive Information Disclosure

Related rules

• Train only on data people agreed to share in AI features