Large language model security is often framed as a question of direct disclosure: did the model reveal a secret, leak a prompt, or expose restricted data? In this talk, I argue that this framing is no longer sufficient.

As LLMs are embedded into retrieval systems, copilots, agents, memory layers, and tool-connected workflows, the more important question is no longer just “who can open which file?” It is “what conclusions can this system derive once it can search, combine, summarize, and infer across many sources at once?”

That shift creates two security problems that current practice still struggles to handle cleanly: semantic leakage, where protected meaning is exposed without verbatim disclosure, and cross-domain inference, where individually permitted fragments are combined into a result that policy would treat as prohibited.

In this session, I will present the core ideas behind my Cognitive Security Verification Framework (CSVF), a practical approach for making inference boundaries visible, testable, and auditable in LLM-enabled systems. This framework was the topic of my Harvard Kennedy School thesis. I will walk through how organizations can model domains and permitted joins, define classes of statements that must remain unreachable, and test whether those prohibited conclusions become reachable in practice. I will also show where this work fits alongside existing efforts such as the OWASP Top 10 for LLM Applications, OWASP GenAI data security guidance, NIST AI RMF, and MITRE ATLAS.

This is a talk about the gap that appears when traditional access control meets systems that can synthesize meaning at scale. My goal is to give practitioners a vocabulary, a threat model, and a practical set of control ideas for thinking about LLM security as an inference problem, not just a disclosure problem.

What I’ll cover

• Why traditional access control and DLP break down in LLM-enabled workflows
• The difference between direct exfiltration and unauthorized domain reach
• Why “semantic leakage” matters even when no exact secret string is disclosed
• How to think about reachability as a security property
• A practical framework for defining boundaries: domains, joins, and unreachable outcomes
• How to test and measure these risks with draft concepts like Domain Inference Risk
• Where these ideas plug into OWASP, NIST, and MITRE rather than competing with them

Audience takeaways

• A clearer mental model for LLM risk beyond prompt injection and direct data leakage
• A practical way to reason about retrieval, memory, tool use, and inference as one security surface
• Concrete ideas for what to document, test, and measure in LLM-enabled applications
• A vocabulary for discussing semantic leakage and prohibited conclusions with security, legal, and engineering teams