OIA LAB · RESEARCH NOTE
Cognitive leakage:
a definition
Most AI privacy work asks one question: which sensitive data is in the prompt? Names, account numbers, client identities. Remove them, and the request is considered safe to send.
That question misses a second kind of exposure. A request is not only data. It is a task, and a task says what you are trying to do.
What an external AI can infer about your intent (your strategy, your priorities, your next move) from the task you give it, even when every sensitive field has been redacted.
A simple example
Here is a request with the names removed:
“Review the liability cap in the [SUPPLIER] agreement for [CLIENT]. We could accept a higher cap if needed. Keeping this supplier matters more than price.”
No names, no numbers. A typical data-loss filter would pass it. Yet the request still tells the AI that you are renegotiating a supplier contract, that you are willing to concede on the cap, and that you depend on this supplier more than you would say at the table. That is your fallback position, disclosed before the negotiation starts.
Illustrative example with synthetic content.
How it differs from other kinds of leakage
| Term | What leaks | Typical control |
|---|---|---|
| Data leakage | Sensitive fields: names, numbers, identifiers | Redaction, data-loss prevention |
| System prompt leakage | A model's own hidden instructions | Prompt hardening, output filtering |
| Cognitive leakage | The user's intent: purpose, priorities, strategy | Intent isolation |
Where it comes from
- Purpose. A task states what you want done, and why. The “why” is often the confidential part.
- Combination. Individually harmless details (a sector, a clause, a deadline) can combine into something that is not harmless.
- Repetition. A series of requests to the same service can reveal more than any single one.
Redaction works on individual fields. None of these three channels is a field.
Intent isolation
Dividing a task so that no single external AI receives enough of it to reconstruct the intent behind it, while the full picture is reassembled only inside your own boundary.
APL, OIA Lab's AI Privacy Layer, is built around this idea. We also call it decentralizing intent. In workflows routed through APL, a task is rewritten into smaller pieces for different AI services. Each external AI receives approved, task-scoped inputs. Sensitive context, such as client identity and negotiation limits, stays on your premises, where the results are combined for professional review.
Can cognitive leakage be measured?
We think it has to be, or the term is only a slogan. A practical test asks: given only what one AI service received, can an evaluator reconstruct the key facts behind the task? Useful measurement separates what was directly assigned, what was observed in outputs, what could be reconstructed, and how task quality changed.
We will publish our measurement method and its limits in a separate note.
What intent isolation does not do
- It does not guarantee privacy. It reduces what any single service receives.
- Cross-request inference and collusion between providers require separate evaluation.
- Splitting a task can affect output quality. That has to be measured workflow by workflow.
Where to start
If you hold back a task from AI because of what it would reveal, that task is the right place to evaluate cognitive leakage. Discuss a design-partner pilot
Cite as: OIA Lab, “Cognitive leakage: a definition,” research note, October 2026. https://oia-lab.com/research/cognitive-leakage/