Memorisation Testing & Output PII Scrubbing

Control objective

Memorisation Testing and Output PII Scrubbing verifies that a model has not memorised and cannot be coaxed into regurgitating personal data from its training or context, and that a scrubbing layer removes any PII that still appears in outputs — addressing privacy-exposure risk under IBM Privacy Exposure, NIST Data Privacy, India's DPDP Act and OWASP ASI03. Large models can inadvertently reproduce verbatim personal records seen during training or fine-tuning; in banking that could mean leaking a real customer's details to an unrelated user. The control checks two things: that a memorisation/extraction test is passed before release, and that output PII-scrub coverage is complete. Its targets are an explicit memorisation/extraction test pass pre-release and output PII-scrub coverage = 100%. To implement, run extraction attacks before each release — prompting the model to elicit training data and known canaries — and gate deployment on passing; in production, route every output through a PII-scrubbing filter that detects and redacts personal identifiers, recording per-output scrub coverage as evidence alongside the pre-release test reports. Operate the test as a release gate and the scrubber as an always-on guard. A failed memorisation test blocks release, and any output bypassing the scrubber (coverage below 100%) is a breach that triggers remediation of the filter before the path is reopened.