Enterprise AI Must Enforce Participant-Aware Access Control (2509.14608v1)

Abstract: LLMs are increasingly deployed in enterprise settings where they interact with multiple users and are trained or fine-tuned on sensitive internal data. While fine-tuning enhances performance by internalizing domain knowledge, it also introduces a critical security risk: leakage of confidential training data to unauthorized users. These risks are exacerbated when LLMs are combined with Retrieval-Augmented Generation (RAG) pipelines that dynamically fetch contextual documents at inference time. We demonstrate data exfiltration attacks on AI assistants where adversaries can exploit current fine-tuning and RAG architectures to leak sensitive information by leveraging the lack of access control enforcement. We show that existing defenses, including prompt sanitization, output filtering, system isolation, and training-level privacy mechanisms, are fundamentally probabilistic and fail to offer robust protection against such attacks. We take the position that only a deterministic and rigorous enforcement of fine-grained access control during both fine-tuning and RAG-based inference can reliably prevent the leakage of sensitive data to unauthorized recipients. We introduce a framework centered on the principle that any content used in training, retrieval, or generation by an LLM is explicitly authorized for \emph{all users involved in the interaction}. Our approach offers a simple yet powerful paradigm shift for building secure multi-user LLM systems that are grounded in classical access control but adapted to the unique challenges of modern AI workflows. Our solution has been deployed in Microsoft Copilot Tuning, a product offering that enables organizations to fine-tune models using their own enterprise-specific data.

• The paper presents a security framework ensuring only authorized users access fine-tuned LLMs through deterministic, participant-aware controls.
• It introduces a biclique-based model construction method that aligns document ACLs with user privileges to secure enterprise data.
• The study outlines practical strategies for enforcing deterministic access control in RAG pipelines, mitigating risks like cross-prompt injection attacks.

Deterministic Participant-Aware Access Control for Enterprise AI

Introduction

The deployment of LLMs in enterprise environments introduces significant risks of data leakage, particularly when models are fine-tuned on sensitive internal data or integrated with Retrieval-Augmented Generation (RAG) pipelines. The paper "Enterprise AI Must Enforce Participant-Aware Access Control" (2509.14608) presents a formal security framework for multi-user LLM systems, arguing that only deterministic, fine-grained access control—enforced at every stage of the AI pipeline—can provide robust guarantees against unauthorized data exposure. The authors demonstrate the inadequacy of existing probabilistic defenses and propose a participant-aware access control paradigm, with practical deployment in Microsoft Copilot Tuning.

Data Leakage Risks in Fine-Tuned and RAG-Integrated LLMs

Fine-tuning LLMs on enterprise data enables domain adaptation but also creates a direct vector for data exfiltration. When a model is fine-tuned on documents with heterogeneous access controls, any user with access to the model may extract information—either verbatim or paraphrased—that they are not authorized to see. This risk is exacerbated by the scaling properties of LLMs, which increase memorization and leakage as model and dataset sizes grow.

RAG pipelines further amplify these risks. In RAG, user prompts are augmented with retrieved documents at inference time. If the retrieval mechanism does not strictly enforce access control lists (ACLs) for all participants in the interaction, restricted content may be introduced into the model’s context, leading to unauthorized disclosures. The paper provides a concrete attack scenario—cross-prompt injection—where an adversary can exfiltrate confidential data by embedding hidden prompts in seemingly benign emails.

Figure 1: A demonstration of a cross-prompt-injection attack on a RAG-based intelligent email assistant, illustrating how an attacker can induce data leakage via prompt injection and insufficient access control.

Inadequacy of Probabilistic Defenses

The authors systematically analyze existing defense mechanisms, categorizing them as data-centric (e.g., deduplication, data scrubbing), output-level (e.g., output filtering, DLP), and training-level (e.g., regularization, differential privacy). All these approaches are fundamentally probabilistic and lack end-to-end guarantees:

• Data-centric methods reduce memorization but cannot guarantee the absence of leakage, especially for structured or correlated enterprise data.
• Output filtering and DLP tools are unable to track fine-grained information flow from training data to outputs and cannot enforce recipient-specific policies.
• Differential privacy provides only bounded leakage guarantees and is impractical for group-level or correlated data, as required in enterprise settings.

The paper asserts that these probabilistic defenses are insufficient for enterprise adoption, as they cannot provide deterministic guarantees of confidentiality.

Formal Security Principle and Biclique-Based Model Construction

The core contribution is a formal security principle: a user $U$ may access a fine-tuned model $M$ only if $U$ is authorized to access all documents $D$ used in $M$'s fine-tuning. This requirement is operationalized by representing the relationship between documents and entities (users or groups) as a bipartite graph, where edges encode ACLs. Secure model construction then reduces to finding bicliques in this graph: a model can be fine-tuned on a set of documents $D$ and made available to a set of users $E$ if and only if $(D, E)$ forms a biclique (i.e., every user in $E$ is authorized for every document in $D$).

The paper discusses practical strategies for biclique selection:

• Maximum biclique: Maximizes both document and entity coverage but is NP-complete to compute.
• Maximal biclique heuristic: Efficiently finds large bicliques by leveraging the structure of enterprise ACLs, where a small number of entity sets govern large document corpora.

This approach is implemented in Microsoft Copilot Tuning, enabling secure, participant-aware fine-tuning for enterprise customers.

Deterministic Access Control in RAG Pipelines

The paper extends the access control principle to RAG-based inference. In any multi-user interaction (e.g., email drafting, collaborative editing), the system must ensure that all content—whether retrieved or generated—is accessible to all active participants. This requires:

• At inference time, retrieved documents must be filtered so that only those accessible to all recipients are included in the LLM context.
• If no fine-tuned model exists that is accessible to all participants, the system must fall back to a general-purpose model.

The authors demonstrate that this approach eliminates covert channels for data exfiltration, such as cross-prompt injection attacks, by making unauthorized information flow provably impossible.

Limitations of Existing Prompt Injection Defenses

The paper provides a detailed critique of current prompt injection defenses, including input sanitization, output filtering, and system-level isolation. All are shown to be probabilistic, with no deterministic guarantee of blocking sophisticated or steganographically encoded attacks. The cross-prompt injection attack illustrated in Figure 1 bypasses these defenses by exploiting the indistinguishability between benign and malicious prompts and the lack of recipient-aware access control.

Practical Implications and Future Directions

The participant-aware access control framework has immediate implications for the design and deployment of enterprise AI systems:

• Auditability and Compliance: Deterministic enforcement of ACLs enables provable compliance with internal and regulatory data governance requirements.
• Scalability: The biclique-based approach allows for efficient construction of shared models with maximal utility, balancing document and entity coverage.
• Dynamic Environments: The framework can be extended to handle dynamic ACLs, weighted importance of users/documents, and misconfiguration detection.

Future research directions include efficient algorithms for biclique discovery at scale, integration with dynamic access control systems, and formal verification of end-to-end information flow in complex AI pipelines.

Conclusion

This work establishes that deterministic, participant-aware access control is necessary for the secure deployment of LLMs in multi-user enterprise environments. By formalizing the security requirement and providing practical algorithms for model construction and inference-time enforcement, the paper addresses a critical gap in current AI security practices. The proposed framework offers strong, auditable guarantees against data leakage, setting a new standard for enterprise AI confidentiality and compliance.