Securing Enterprise Language Model Applications Against Data Leakage and Response Manipulation

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Enterprise language-model applications combine internal documents, retrieval, conversation history, and executable tools. This critical narrative and thematic review examines data leakage and response manipulation through targeted discovery completed on September 29, 2026, with a bounded supplementary discovery and source-status audit on October 1, 2026. Primary studies are distinguished from institutional guidance and contextual reviews. The evidence identifies indirect prompt injection, corpus poisoning, retrieval-stage exploitation, log contamination, embedding inversion, and cumulative knowledge-base extraction under different conditions (Chang et al., 2026; Greshake et al., 2023; Morris et al., 2023; Yao et al., 2026). Defensive studies address provenance signaling, structured training, preference optimization, capability enforcement, and action attribution, with configuration-dependent findings (Chen, Piet, et al., 2025; Chen, Zharmagambetov, et al., 2025; Debenedetti et al., 2026; He et al., 2026). The synthesis proposes six assurance boundaries: identity and scope, source authorization, content provenance, model interaction, executable actions, and output release. Provider and inference-data handling, monitoring, and incident response span all six. Authoritative confidentiality and authorization decisions require application or infrastructure controls independent of unconstrained model interpretation. The framework is an author-developed, unvalidated decision aid, not a certification or a NIST/OWASP-endorsed standard. A hypothetical assistant and prospective protocol illustrate permission-preserving processing, cumulative-disclosure budgets, revocation propagation, legitimate-task utility, and verification effort. No original experiment, complete database census, or universal estimate of compromise is claimed.