Skip to content

Synthetic demo · No customer connectors attached · Fixture snapshot 24 Sep 2026, 06:15 UTC

Finding

Contract content used as a training input under a deny decision

Run run-clause-lora-3 consumed ds-contracts v2026.08.2. The data-use policy dup-2026.09 records an explicit deny for fine-tuning on counterparty content, and deny takes precedence. Two further inputs to the same run are unresolved, so the full input set cannot be asserted.

Observed at 24 Sep 2026, 06:15 UTCfnd-2277R09 — unauthorized training purposedetected 9 Sep 2026, 08:15 UTClast observed 23 Sep 2026, 21:45 UTC

Summary

Severity
critical
Status
open
Evidence freshness
Partial
Remediation
rem-8790

Potential access

Paths that could reach the data. These are capability, not proof of disclosure.

  • 126,300 restricted contract documents
  • Adapter clause-lora-r3 and any copies of it

Observed disclosure

Only what collection actually recorded leaving the boundary.

  • Privacy leakage suite reproduced 7 counterparty names verbatim from adapter r3 on 2026-09-16

Affected records

Datasets

Actors

  • svc-training-orchestrator
  • Legal Operations

Continue the investigation

The sample code-to-cloud path is a separate synthetic scenario; a link here does not establish that it caused this finding.

Inspect bounded code-to-cloud evidence →Review collection gaps →Inspect evidence register →

Mitigations in place

A mitigation reduces exposure; it does not close the finding until verification passes.

Scroll table sideways for more columns →

MitigationStatusNote
Promotion of release 2026.09.8 refused server-sidePassGate G-PRIV failing; refusal enforced at the release service, not in the UI.
Adapter r3 quarantined in artifact storagePartialPrimary registry copy locked; a second regional copy is still readable.
Rollback candidate confirmedPassAdapter r2 remains approved and deployed.
Unresolved input reconciliationUnknown2 inputs still unidentified.

Evidence

  • Training run manifest r3 (incomplete)

    ev-trn-14 · manifest · producer training-orchestrator · collected 8 Sep 2026, 12:00 UTC (16 d ago)

    Unsigned producerNo expiry set

  • Privacy leakage suite result restricted preview

    ev-eval-44 · test · producer eval-runner-02 · collected 16 Sep 2026, 15:10 UTC (8 d ago)

    SignedNo expiry set