Security and Privacy of Large Language Models: Threat Taxonomy, Ethical Implications, and Governance

Abstract

Large Language Models (LLMs) are increasingly deployed across professional and societal domains, introducing security, privacy, and governance challenges beyond traditional software vulnerabilities. Despite extensive research on individual risk categories, a unified lifecycle-oriented perspective connecting architectural properties, adversarial threats, and governance implications remains limited. This review examines security and privacy risks associated with LLMs through a lifecycle framework covering data acquisition, model training, alignment procedures, deployment, and post-deployment interaction. The study synthesizes prior research to construct a taxonomy of threats including prompt injection, jailbreaking, adversarial manipulation, training-stage attacks, privacy leakage, and socio-technical misuse. Ethical issues such as hallucination, bias amplification, and malicious use are analyzed alongside governance and regulatory frameworks. Results indicate that vulnerabilities in LLM systems arise primarily from probabilistic generation mechanisms, large-scale data ingestion, and complex deployment ecosystems rather than isolated implementation defects. Classical software vulnerability models therefore provide only partial coverage of risks associated with generative AI systems. The review is grounded in the concept of the alignment gap to explain how discrepancies between training objectives and real-world interaction contribute to persistent vulnerabilities. The findings highlight the need for lifecycle-oriented defense-in-depth strategies combining technical safeguards, privacy-preserving training, runtime monitoring, and governance mechanisms to support responsible deployment of LLM-based systems.

1. Introduction

The growing integration of Large Language Models (LLMs) into professional and social interaction has intensified the need for security evaluation [1,2]. Although foundation models (i.e., large-scale pre-trained generative models) demonstrate substantial capability in natural language processing and automation, their deployment has progressed faster than the development of robust safety and governance frameworks, raising concerns regarding reliability, accountability, and trust [3,4,5,6]. The adoption of LLM-based generative systems in domains such as medicine, law, and cybersecurity further amplifies these concerns, as inaccurate or unintended outputs may introduce legal liability and reduce public confidence [7,8]. Consequently, understanding risks emerging from uncurated training data and from the architectural characteristics of Transformer-based models—particularly next-token prediction objectives, large-scale parameterization, and opaque latent representations—has become an important research objective. During training, model parameters are optimized using likelihood-based loss functions such as cross-entropy, while probabilistic generation during inference relies on next-token prediction. The underlying probabilistic mechanism is discussed in greater detail in Section 2 [9,10,11].

Traditional safety assessments are often insufficient against adversarial manipulation [12]. Even aligned LLMs remain susceptible to transferable attacks in which small variations in phrasing can steer outputs toward unintended behavior [13,14]. For example, prompt injection techniques have demonstrated that carefully crafted inputs can override system-level safety instructions and induce unintended tool execution [13,14]. In parallel, the availability of automated tools and malicious use of generative systems reshapes the digital threat landscape by lowering technical barriers for cyber exploitation [3,10]. Recent threat intelligence reports confirm a growing integration of AI-assisted attack automation within modern cybercrime ecosystems [15]. Empirical observations indicate that LLM capabilities may be leveraged to support phishing and social engineering activities, highlighting the need for defensive mechanisms tailored to generative systems [1,4].

Privacy represents a security concern, particularly regarding memorization and potential exposure of personally identifiable information (PII) [4,16]. Studies demonstrate that LLMs may reproduce portions of their training data, introducing risks to data sovereignty and intellectual property protection [16,17]. The memorization tendency increases with model capacity and dataset scale, while limited transparency of training data provenance complicates ownership attribution and regulatory compliance [1,4,16]. The existing research highlights unresolved questions regarding data leakage mechanisms and the limitations of current privacy-preserving techniques. Recent surveys of open and rapidly evolving models emphasize the need for standardized safety evaluation frameworks across LLM deployments [2].

Ethical challenges further arise from the reproduction of societal biases present in large-scale corpora [18,19]. Such biases may influence decision-support applications including hiring or educational assessment [19]. Additionally, hallucinations—plausible but factually unsupported outputs—remain a major obstacle to reliable deployment [7]. Because LLMs cannot reliably distinguish adversarial intent expressed through authoritative language, interdisciplinary auditing and accountability standards are required [1,2].

The motivation for this review lies in the pace of model development exceeding regulatory and governance capabilities [1]. While cybersecurity, privacy, and AI ethics are widely studied individually, a unified safety-by-design perspective across the model lifecycle remains underaddressed [1,2]. In this work, the lifecycle perspective refers to a stage-oriented analysis encompassing data acquisition, model training, alignment procedures, deployment, and post-deployment interaction. Together with the alignment gap framework, the threat taxonomy, socio-technical risk model, and defense-in-depth mapping introduced in this paper, these stages constitute what we term the unified lifecycle model—an integrating conceptual structure that connects architectural vulnerability origins, adversarial threat categories, ethical implications, and governance mechanisms within a single analytical view. Rather than treating security, privacy, and governance as isolated research domains, the unified lifecycle model positions them as interconnected properties of the LLM system operating across sequential deployment stages. Comprehensive reviews of open LLMs provide insight into rapid model evolution and reinforce the need for standardized security evaluation across deployments [2]. This paper presents a structured taxonomy of threats and a consolidated overview of mitigation strategies to support safer and more trustworthy applications [2,13,16]. The analysis links architectural characteristics with regulatory and governance considerations, connecting technical vulnerabilities to broader societal consequences [1,7]. This paper is structured as a narrative review; the methodology underpinning the literature selection is described in the Literature Selection Methodology paragraph below.

The historical evolution of major application security risks that contextualize modern system-level vulnerabilities is illustrated in Table 1 (see also Appendix A).

Table 1. Evolution of the Open Web Application Security Project (OWASP) Top-10 risk categories (2003–2025) [20,21,22,23,24,25,26,27,28]. The table illustrates how dominant application security threats have shifted over time from implementation-level vulnerabilities toward system-level and AI-related risks. In addition to ranked categories, the table includes historical candidate categories that were considered during the development of the OWASP Top 10 but did not appear in any final ranked list; these are indicated by ‘x’ across all years.

OWASP Top Ten	2003	2004	2007	2010	2013	2017	2021	2025
Broken Access Control	A2	A2 [1]	A10 [13]	A8	A7 [16]	A5	A1	A1
Security Misconfiguration	A10	A10 [3,5]	x	A6 [12]	A5	A6	A5	A2
Software and Supply Chain Failures	x	x	x	x	x	x	x	A3 [27]
Cryptographic Failures	A8	A8 [5,6]	A8 [15]	A7	A6 [17]	A3	A2 [21]	A4
Injection	A6	A6 [3]	A2	A1 [10]	A1	A1	A3	A5
Insecure Design	x	x	x	x	x	x	A4	A6
Auth & Identification Failures	A3	A3	A7	A3	A2	A2	A7 [22]	A7
Software and Data Integrity Failures	x	x	x	x	x	A8	A8 [23]	A8
Logging & Monitoring Failures	x	x	x	x	x	A10	A9 [24]	A9
Mishandling of Exceptional Conditions	x	x	x	x	x	x	x	A10 [28]
XML External Entity (XXE)	x	x	x	x	x	A4	A5	x
Vulnerable and Outdated Components	x	x	x	x	A9 [18,19]	A9	A6 [25]	x
Server-Side Request Forgery (SSRF)	x	x	x	x	x	x	A10	x
Code Quality Issues	x	x	x	x	x	x	A11 [26]	x
Denial of Service	x	A9 [2]	x	x	x	x	A11 [26]	x
Memory Management Errors	x	x	x	x	x	x	A11 [26]	x
Unvalidated Input	A1	A1 [9]	x	x	x	x	x	x
Buffer Overflows	A5	A5	x	x	x	x	x	x
Cross Site Scripting (XSS)	A4	A4	A1	A2	A3	A7	x	x
Insecure Direct Object Reference	x	A2	A4 [11]	A4	A4	A5 [20]	x	x
Cross Site Request Forgery (CSRF)	x	x	A5	A5	A8	x	x	x
Insufficient Attack Protection	x	x	x	x	x	x	x	x
Unvalidated Redirects and Forwards	x	x	x	A10	A10	x	x	x
Info Leakage & Error Handling	A7	A7 [4,14]	A6	A6 [8]	x	x	x	x
Malicious File Execution	x	x	A3	A6 [8]	x	x	x	x
Insecure Communications	x	A10	A9 [7]	A9	x	x	x	x
Remote Administration Flaws	A9	x	x	x	x	x	x	x
Unprotected APIs	x	x	x	x	x	x	x	x
[1] Renamed “Broken Access Control” from 2003	[14] Renamed “Improper Error Handling” from 2004				Color Legend
[2] Split “Broken Access Control” from 2003	[15] Renamed “Insecure Storage” from 2004				Ranked Category
[3] Renamed “Command Injection Flaws” from 2003	[16] Renamed “Failure to Restrict URL Access” from 2010				Split
[4] Renamed “Error Handling Problems” from 2003	[17] Renamed “Insecure Cryptographic Storage” from 2010				Unranked Category
[5] Renamed “Insecure Use of Cryptography” from 2003	[18] Split “Insecure Cryptographic Storage” from 2010
[6] Renamed “Web and Application Server” from 2003	[19] Split “Security Misconfiguration” from 2010
[7] Split “Insecure Configuration Management” from 2004	[20] Split “Broken Access Control” from 2013
[8] Reconsidered during T10 2010 Release Candidate (RC) but excluded from the final Top 10 list	[21] Renamed “Sensitive Data Exposure” from 2017
[9] Renamed “Unvalidated Parameters” from 2003	[22] Renamed “Broken Authentication and Session Management” from 2017
[10] Renamed “Injection Flaws” from 2007	[23] Renamed “Insecure Deserialization” from 2017
[11] Split “Broken Access Control” from 2004	[24] Renamed “Insufficient Logging & Monitoring” from 2017
[12] Renamed “Insecure Configuration Management” from 2004	[25] Renamed “Using Known Vulnerable Components” from 2017
[13] Split “Broken Access Control” from 2004	[26] Listed under ‘A11: Next Steps’ in OWASP 2021—candidate categories not included in the final Top 10 ranking
[27] Split “Software and Data Integrity Failures” from 2021	[28] Renamed “Improper Error Handling” from 2004

Table 1 illustrates how dominant application security risks have progressively shifted from implementation-level vulnerabilities toward system-level behavior, configuration governance, and software supply-chain dependencies. The OWASP categories are presented for historical comparison and are not mapped directly to LLM-specific threat classes. This historical progression contextualizes the need for lifecycle-oriented risk analysis in systems where behavior emerges from data-driven learning processes rather than deterministic program logic.

A central concept of this review is the alignment gap, defined as the discrepancy between intended safety objectives embedded during training and the probabilistic behavior exhibited during real-world interaction.

• Contributions

This review provides a unified analysis of security, privacy, and governance risks in LLMs from the lifecycle perspective defined above. Specifically, it makes the following contributions:

• Lifecycle-based taxonomy. A structured classification of attacks organized by attacker control points across interaction, probabilistic exploitation, and training stages.
• Alignment-gap framework. A conceptual model explaining how probabilistic behavior propagates into security vulnerabilities and societal risk. The term alignment gap appears in the recent literature [29,30] to describe related but narrower phenomena—prompt injection exploitation and multimodal safety mismatches, respectively. In this paper, the construct is operationalized at the lifecycle level, serving as the organizing analytical lens connecting architectural vulnerability origins, adversarial threat categories, and governance implications across all deployment stages.
• Socio-technical risk model. A four-layer framework integrating technical vulnerabilities (probabilistic generation, adversarial attacks, privacy leakage), human behavioral risks (verification drift, automation bias, overreliance), organizational factors (Shadow AI, governance maturity gaps, accountability diffusion), and regulatory mechanisms (EU AI Act compliance, liability allocation, adaptive oversight). The model explains how risks propagate across these layers and why single-layer technical mitigations are insufficient for systemic risk management.
• Defense-in-depth mapping. A consolidated overview linking mitigation strategies to attack classes and deployment stages.

Together, these four contributions constitute the unified lifecycle model introduced in this paper. The relationships among its elements—and how they map onto the LLM lifecycle stages defined above—are illustrated in Figure 1.

Figure 1. Alignment gap propagation across the LLM lifecycle. The diagram illustrates how discrepancies between pre-training objectives and post-training alignment constraints propagate across lifecycle stages. Arrows indicate causal relationships between architectural characteristics, alignment procedures, and downstream behavioral risks.

The conceptual model in Figure 1 illustrates how misalignments originating at different lifecycle stages propagate across deployment contexts into both technical vulnerabilities and socio-technical risk. This model also defines the structure of this paper: Section 2 characterizes architectural foundations and the alignment gap; Section 3 maps the threat taxonomy by lifecycle stage; Section 4 analyzes privacy risks across data acquisition and deployment; Section 5 addresses ethical and societal implications; Section 6 presents defense-in-depth mitigations; Section 7 examines domain-specific deployment risks; and Section 8 covers governance and regulatory frameworks. Taken together, these sections operationalize the unified lifecycle model introduced above.

• Literature Selection Methodology

This paper is structured as a narrative review rather than a systematic literature survey. The objective is to synthesize and conceptually organize a rapidly evolving body of research through a unifying lifecycle framework rather than to enumerate a statistically representative corpus. Given the pace of development in LLM security—where fundamental threat classes, nomenclature, and mitigation strategies are still being consolidated—a narrative synthesis is methodologically appropriate and consistent with structurally comparable reviews in this domain [1,2,31].

The 251 references cited were identified through the following principled selection rationale: (i) foundational papers establishing key threat categories (prompt injection, jailbreaking, adversarial robustness, privacy leakage, alignment); (ii) representative empirical studies demonstrating specific attack or mitigation mechanisms across the LLM lifecycle; (iii) governance and regulatory analyses with direct applicability to LLM deployment; and (iv) recent reviews and benchmarking studies providing comparative positioning. Sources were drawn primarily from Google Scholar, Semantic Scholar, arXiv, and the ACL Anthology, with emphasis on peer-reviewed publications and high-citation preprints published between 2017 and 2025, with emphasis on work published after 2022 to reflect the post-GPT-3 deployment landscape.

• Positioning with Respect to Prior Surveys

Prior surveys address individual dimensions of LLM risk, including ethical and societal harm [16,31], adversarial robustness and security vulnerabilities [32,33], privacy leakage and memorization [34,35,36], as well as multi-dimensional benchmarking efforts [37,38]. However, these works typically examine specific risk categories in isolation. A unified lifecycle-oriented perspective that systematically connects probabilistic model behavior, security exploitation pathways, and governance implications across training, deployment, and societal use remains comparatively under investigated. While related terminology—including shallow alignment, safety generalization gaps, and safety basins—appears across recent empirical work [39,40,41], the alignment gap is introduced here not as a novel coinage but as a precise analytical label for a well-documented structural discrepancy that has lacked a unified conceptual framework connecting it to privacy, governance, and socio-technical risk. Table 2 summarizes the focus of prior studies.

Table 2. Positioning of this review relative to prior literature. The table compares representative survey papers across dimensions such as threat coverage, lifecycle perspective, governance considerations, and methodological scope.

Work Type	Representative Work	Primary Focus	Missing Perspective
AI safety surveys	[16,31]	Ethics, bias, societal impact	Security attacks and lifecycle view
Security surveys	[32,33]	Adversarial attacks	Governance and socio-technical risk
Privacy surveys	[34,35,36]	Data leakage and memorization	Interaction and deployment lifecycle
Holistic trust surveys	[37,38]	Multi-dimensional benchmarking	Lifecycle governance integration
This paper	—	Unified lifecycle model: integrated analysis of security, privacy, ethics, and governance across all LLM deployment stages	—

The evaluation of model security and reliability relies on comprehensive benchmarks that track the evolution of risks. The Holistic Evaluation of Language Models (HELM) [38] dataset represents a foundational effort to standardize benchmarking across diverse domains, enabling a broader risk assessment beyond single-task performance metrics. Additionally, benchmarks such as DecodingTrust [37] provide a multi-dimensional framework for assessing trust and robustness within a unified experimental structure.

2. Large Language Model Architecture and Vulnerabilities

LLMs inherit their security and reliability characteristics from the architectural and training paradigms on which they are built [42]. Unlike conventional software systems, where vulnerabilities typically arise from implementation errors, LLM weaknesses primarily emerge from large-scale data ingestion, optimization-based training procedures, and post-training behavioral control mechanisms. During training, model parameters are optimized using gradient-based methods that minimize prediction loss over large text corpora. Analyzing architectural properties is therefore essential for understanding how memorization, adversarial manipulation, and alignment limitations emerge across the model lifecycle.

2.1. Data Scale, Memorization, and Latent Vulnerabilities

LLMs are built upon the Transformer architecture [8]. The Transformer architecture is a deep neural network composed of stacked transformer blocks, each integrating a multi-head self-attention mechanism and a position-wise feedforward layer connected through residual connections and layer normalization [8]. The self-attention mechanism enables the model to dynamically weight contextual relationships between tokens when processing an input sequence.

Unlike symbolic systems, models built on the Transformer architecture learn parameterized representations of language through large-scale optimization of next-token prediction objectives rather than explicit logical rules [1,2,7]. During training, model parameters are updated using gradient-based optimization to minimize a likelihood-based loss function, typically cross-entropy, computed between predicted and observed tokens in the training corpus. Probabilistic behavior emerges primarily during inference, when the model converts internal activation scores (logits) into a probability distribution over candidate tokens using the softmax function. Text generation then proceeds by selecting or sampling tokens from this distribution, which explains why model outputs appear probabilistic despite the deterministic nature of the underlying optimization process. This paradigm enables broad linguistic generalization but lacks grounded reasoning, contributing to hallucinations—fluent yet factually unsupported outputs generated through statistically plausible continuation [7,43]. Because training optimizes next-token prediction rather than factual correctness, reliability and safety emerge as indirect properties rather than guaranteed behaviors [1,2]. Consequently, vulnerabilities in LLMs are widely characterized as structural effects of the training objective and large-scale optimization process rather than isolated implementation flaws [1,3].

In the context of large language models, alignment refers to post-training procedures that adapt a pre-trained probabilistic model so that its outputs conform to human intention, safety constraints, and deployment policies rather than solely maximizing next-token likelihood [3,44].

The alignment gap refers to the discrepancy between behavioral constraints defined during alignment procedures and the output generated by the model during real-world interaction. During training, the model parameters are optimized to minimize prediction error on large datasets, rather than to explicitly encode human norms or safety policies. Consequently, although alignment techniques such as Reinforcement Learning from Human Feedback (RLHF) adjust model behavior, the underlying parameter structure learned during pre-training remains largely unchanged. During inference, the model produces outputs by sampling from token probability distributions derived from the softmax transformation of internal logits, which may still reflect statistical associations learned during pre-training. This concept synthesizes empirical findings demonstrating that post-training alignment methods such as RLHF or Direct Preference Optimization (DPO), constrain surface-level outputs but do not fully modify latent representational structures acquired during pre-training [1,3,44].

During alignment procedures, the LLM is optimized to prefer policy-consistent outputs; however, this process does not eliminate the probabilistic associations acquired during large-scale pre-training. This structural discrepancy persists across pre-training, alignment, and deployment stages [3,37], as illustrated in Figure 2.

Figure 2. Conceptual model of the origin of the alignment gap across the LLM lifecycle. The diagram illustrates how discrepancies between pre-training objectives, post-training alignment procedures, and deployment environments generate behavioral inconsistencies that propagate across lifecycle stages.

LLMs are trained on web-scale corpora containing heterogeneous and uncurated information, including sensitive data, copyrighted material, and social biases [4,19]. Documentation of large datasets such as Colossal Clean Crawled Corpus (C4) demonstrates the scale and heterogeneity shaping model behavior [45], while cognitive effects such as anchoring and controllable hallucination reveal architectural limitations [46,47,48]. Empirical findings demonstrate that increasing scale, measured in the size of model parameters, correlates with stronger memorization capability, including reproduction of training samples [4,16]. Such memorization may expose personally identifiable information or proprietary content through carefully designed prompts [1,16]. Model parameters therefore function as compressed representations of the training corpus, complicating ownership attribution and regulatory compliance [4,8]. Dataset duplication and large parameter capacity further reinforce retention of rare sequences, increasing confidentiality and intellectual-property risks [16].

Instruction tuning is a supervised fine-tuning procedure in which a pre-trained language model is further trained on datasets consisting of explicit task instructions paired with desired outputs, enabling the model to follow natural language instructions more reliably and perform instruction-specific tasks [18]. Instruction tuning and related alignment methods attempt to adapt behavior toward human expectations, yet they do not fully overwrite statistics learned during pre-training [2,10]. This limitation contributes to the alignment gap, in which LLMs may follow adversarial instructions despite alignment constraints [3,10].

Modern LLM deployments operate within complex application ecosystems including Application Programming Interfaces (APIs), retrieval pipelines, and external tools [1,3]. Retrieval-Augmented Generation (RAG) may improve factual accuracy but introduces indirect prompt injection through manipulated external documents [3]. Model extraction, also referred to as model stealing, is an attack in which an adversary attempts to approximate a proprietary model by systematically querying it and analyzing its outputs, without direct access to its training data or parameters [49]. Public interfaces and API-based deployments facilitate such attacks, as repeated querying allows for the construction of surrogate models that mimic the behavior of proprietary LLMs [1,50].

Scaling laws show that improved reasoning ability and instruction-following capability simultaneously expand the attack surface [2,16]. LLMs with improved instruction-following and reasoning performance more faithfully execute both benign and malicious instructions, linking capability scaling with exploitability [1,10]. These observations indicate a trade-off between capability scaling and increased attack surface, particularly in adversarial or out-of-distribution contexts [1,7].

In summary, across pre-training, alignment, and deployment stages, vulnerabilities arise from probabilistic language modeling, opaque internal representations, and large-scale data ingestion [1,4,10]. Memorization, prompt manipulation, model extraction, and reliability degradation can be interpreted as structurally related effects emerging from shared architectural and training characteristics [2,3,16].

2.2. Threat Model

To systematically analyze security risks across the lifecycle of LLMs, we define an operational threat model describing attacker capabilities and objectives. This model provides a structured foundation linking the alignment gap to concrete adversarial behavior across interaction, inference, and training stages [1,2]. The classification parallels adversary behavior modeling approaches such as the MITRE ATT&CK framework [51], a standardized knowledge base describing attacker tactics and techniques in cybersecurity. This layered protection approach aligns with Zero Trust security architectures applied to modern distributed systems [52].

• Attacker Capabilities

  1.

  Prompt-level attacks:

  The attacker interacts with the LLM as a regular user and manipulates natural language prompts using techniques such as prompt injection or jailbreak attacks to override system instructions or safety constraints [53,54,55].

  2.

  API-level exploitation:

  The attacker performs systematic querying through programmatic access, enabling adversarial probing of model behavior. This category includes attacks such as adversarial inputs, model extraction, and privacy leakage through repeated interaction with the model interface [1,3,56].

  3.

  Training-stage attacks:

  The attacker compromises the training or fine-tuning process by inserting poisoned samples or backdoor triggers into the dataset. These manipulations may remain dormant during evaluation but activate under specific conditions during deployment [57,58,59].

• Attacker Objectives

  1.

  Extract information.

  Disclosure of memorized data or sensitive information from training corpora [56,60,61].

  2.

  Manipulate output.

  Inducing hallucinations, misinformation, or harmful content that undermines integrity and trust [62,63,64].

  3.

  Bypass alignment.

  Exploiting the alignment gap to override behavioral constraints and perform restricted actions [32,37,65].

This threat model establishes a structured analytical baseline for the taxonomy developed in Section 3, where each attack class is mapped to a specific attacker capability and objective. The three capability tiers—prompt-level, API-level, and training-stage—correspond directly to the lifecycle stages at which defense-in-depth controls must be applied. Understanding attacker intent alongside access level is therefore essential for designing mitigations that address the underlying exploit pathway rather than individual surface manifestations.

Assessing architectural vulnerabilities, particularly the memorization of training data which may lead to information leakage, relies on datasets designed for Membership Inference attacks [35]. These datasets are used to test the detection of membership within a training set, while the risk of unintended memorization of exact sequences is analyzed through extraction attacks targeting model parameters [38,61].

3. Taxonomy of Security Attacks

Modern LLMs are exposed to adversarial threats across multiple stages of the model lifecycle [66]. Rather than isolated vulnerabilities, these attacks form an interconnected ecosystem in which weaknesses in interaction, alignment, and training layers reinforce one another [13,53,54]. Accordingly, contemporary research organizes threats according to attacker control point and objective. Within the unified lifecycle model, security attacks represent the most precisely characterizable threat category—each can be mapped to a specific attacker capability tier, lifecycle stage, and exploit mechanism—and therefore serve as the structural backbone of the taxonomy; privacy risks, ethical implications, and governance failures, which involve different actors and more diffuse causal pathways, are analyzed in their respective lifecycle positions in Sections 4 through 8. The taxonomy presented here is scoped to text-based LLM interaction; agentic architectures capable of autonomous tool use and multimodal systems processing non-text inputs introduce qualitatively distinct attack surfaces—including tool-chain hijacking and cross-modal adversarial perturbation—that extend beyond the present scope and are identified as a priority research direction in Section 10.

Figure 3 provides an overview of the proposed attack taxonomy, illustrating how threats can be organized across three layers: interaction-level manipulation, probabilistic exploitation, and training-stage attacks.

Figure 3. Taxonomy of security attacks against large language models. The diagram organizes attack vectors across three layers of the LLM lifecycle: interaction-level manipulation, probabilistic exploitation, and training-stage attacks. Arrows represent escalation pathways through which prompt-level manipulation may propagate toward deeper model-level vulnerabilities.

3.1. Prompt Hacking (Injection and Leakage)

Prompt hacking exploits the shared contextual space in which system instructions and user inputs are processed [9,53,54,67]. Attackers manipulate this structure to override intended behavior, subverting the model’s intended functionality through goal hijacking or safety filter bypassing [54,68,69,70]. Large language models are typically fine-tuned to improve instruction following, a post-training adaptation process in which models are trained on instruction–response pairs to comply with explicit natural language directives [3,18]. Because this optimization emphasizes faithful execution of user-provided instructions, stronger instruction-following performance may paradoxically increase susceptibility to adversarial manipulation [9,69,71]. A typical example involves prompts such as “ignore previous instructions and follow the user request”, which override system directives and redirect behavior [9,69,71].

Indirect prompt injection extends this threat to retrieval-augmented pipelines, where malicious instructions are embedded in external data processed by the model [54,55]. Prompt leakage attacks attempt to extract hidden system prompts defining operational constraints, often through multi-turn dialogue strategies [53,54,67,68]. Early public deployments further illustrated prompt injection risks, including documented cases in which conversational systems revealed internal behavioral guidelines through crafted user prompts, demonstrating the feasibility of policy leakage in deployed LLMs interfaces. Automated goal-directed prompt generation techniques further increase attack success rates in real-world applications [72,73,74].

Prompt hacking highlights how interaction-layer design choices introduce exploitable vulnerabilities in LLM deployments [53,54]. The vulnerability arises from the shared semantic processing channel through which system instructions and user inputs are interpreted, preventing strict authority separation between trusted and untrusted tokens. In real-world deployments, this represents one of the most practical attacks, since it requires no model access, training knowledge, or technical expertise beyond natural language interaction. Typical mitigations rely on input isolation, contextual segmentation, and external policy enforcement rather than internal robustness.

3.2. Jailbreaking Attacks

Jailbreaking aims to bypass alignment safeguards instead of merely redirecting tasks [65,75]. These attacks exploit the conflict between helpfulness objectives and alignment constraints [65,76].

Common strategies include persona adoption, fictional framing, nested instructions, or role-playing contexts [75,76,77,78,79,80]. A well-known illustration is the “Do Anything Now (DAN)” persona, which frames the model as an unrestricted entity to induce prohibited responses [65,75].

Step-by-step reasoning prompts may amplify vulnerability by encouraging unsafe reasoning chains [32,81], while retrieval pipelines can propagate jailbreak behavior through manipulated external content [82,83].

Successful jailbreaks frequently enable disclosure of restricted information, demonstrating that alignment failures arise from behavioral conflicts rather than simple parsing errors [76,84].

Jailbreaking exploits the optimization tension embedded in the alignment gap, where conversational coherence can override policy constraints. Recent automated jailbreak generation methods demonstrate scalable alignment bypass without manual prompt engineering [85,86,87]. The Prompt Automatic Iterative Refinement (PAIR) method further demonstrates that fully automated black-box jailbreak generation can achieve high success rates within fewer than twenty queries on advanced models, confirming the practical feasibility of alignment bypass in real-world deployments [88].

Feasibility is high in conversational LLM interfaces where iterative dialogue allows attackers to gradually reshape behavior. Mitigation typically focuses on alignment reinforcement and behavioral monitoring rather than purely lexical filtering.

3.3. Adversarial Attacks

Adversarial attacks manipulate statistical decision boundaries through carefully crafted perturbations [13,32,33,89]. Unlike jailbreaks, which attempt to bypass alignment policies, adversarial attacks target the statistical sensitivity of model outputs to input variations.

Consequently, small perturbations in the input can shift the softmax-derived probability distribution (see Section 2.1) and lead to different generated outputs. Perturbations may occur at multiple linguistic levels including character modifications, word substitutions, paraphrasing, and structural phrasing variation [13,33,90,91]. Because the model generates outputs through probabilistic decoding of softmax-derived token distributions, even small input changes can induce disproportionate output deviations [13,33]. Universal perturbation strategies further demonstrate the sensitivity of Transformer architectures to structured input noise [92,93,94].

Optimization-based techniques such as Greedy Coordinate Gradient (GCG) generate universal adversarial suffixes that consistently induce harmful responses across models [95]. These attacks often transfer between architectures, enabling black-box exploitation of proprietary LLMs [13,89].

Adversarial robustness is therefore treated as a systemic property of the model architecture rather than a discrete implementation defect [13,33], as perturbations exploit the sensitivity of token probability distributions where small input modifications can produce disproportionate output shifts. Automated optimization techniques further enable scalable black-box exploitation and cross-model transfer. Mitigation strategies therefore focus on robustness training and anomaly detection mechanisms rather than rule-based filtering.

3.4. Training-Stage Attacks (Poisoning & Backdoor)

Training-stage attacks compromise LLMs before deployment by manipulating training data or parameters [57,96,97]. A backdoor trigger is a specific input pattern or token sequence intentionally embedded into a model during training through data poisoning, such that the model behaves normally on benign inputs but produces unintended or adversary-specified outputs when the trigger is activated [58]. Such triggers may remain dormant during standard evaluation yet activate unintended behavior under specific prompt conditions [1,10]. Because alignment procedures primarily modify surface-level behavior rather than internal parameter distributions, backdoor triggers may persist through post-training alignment [1,7]. Data poisoning inserts malicious samples that bias future outputs, and even small fractions of corrupted data may significantly alter behavior due to dataset redundancy [59,96,98].

Backdoor attacks embed hidden triggers that activate harmful behavior only under specific conditions [57,58,59,97,99]. An illustrative case is the TrojanPuzzle attack on code assistants, where malicious functionality is injected yet remains undetected during normal evaluation [57,99]. Red-teaming research shows that fine-tuning may inadvertently introduce vulnerabilities while dataset filtering aims to preserve integrity [39,100,101]. Because these triggers persist through fine-tuning and alignment, compromised LLMs may appear safe while behaving maliciously in targeted scenarios [96,99].

Training-stage attacks are particularly dangerous because they compromise the model prior to deployment and cannot be reliably detected through normal interaction testing. Their real-world feasibility depends on data supply-chain control, making them especially relevant for open-source datasets and collaborative training pipelines.

Mitigation strategies focus on dataset auditing, provenance verification, and post-training integrity validation.

From a lifecycle perspective, LLM attacks differ primarily by attacker control point. Prompt-level attacks manipulate the interaction context through crafted prompts, API-level exploitation targets model behavior through systematic querying and probabilistic probing, while training-stage attacks compromise the model through poisoned data or embedded backdoor triggers [13,53,57]. This layered taxonomy supports defense-in-depth mitigation strategies across the model lifecycle.

The evaluation of vulnerabilities to surface manipulation and jailbreaking relies on specialized benchmarking resources. Methods such as AutoDAN [65] enable automated generation of stealthy prompts capable of bypassing alignment safeguards. However, AutoDAN attack success rates are highly model-version-dependent and degrade rapidly as alignment is updated; generated adversarial prompts are also often detectable by perplexity-based filters, limiting real-world transferability. Additionally, robustness to universal adversarial queries is assessed using datasets designed to systematically break alignment through structured statistical perturbations [95]. These evaluation frameworks provide empirical evidence of the attack mechanisms summarized in the taxonomy presented in Section 3.1, Section 3.2, Section 3.3 and Section 3.4.

4. Privacy Risks and Data Governance

Privacy represents one of the central challenges in the lifecycle of LLMs because they are trained on large-scale uncurated datasets that may contain sensitive data or Personally Identifiable Information (PII) [1,7,9,16,18,19]. The opacity of the Transformer architecture makes it difficult to determine which information is encoded in model parameters, raising concerns for deployment in high-stakes domains such as healthcare, finance, and legal decision-making [1,2,50]. This creates a structural tension between high-capacity data-driven learning and data-protection requirements under contemporary regulatory frameworks [1,16]. At the same time, accountability is difficult to assign because deployment ecosystems involve multiple actors including developers, service providers, and users [3,4]. Regulatory expectations therefore increasingly demand transparency and governance mechanisms, yet adversarial extraction techniques demonstrate that alignment alone cannot guarantee privacy protection [8,10,13,14].

This section reviews privacy and governance risks across three complementary dimensions: memorization leakage, inference attacks, and intellectual-property implications. The relationship between data ingestion, memorization behavior, inference attacks, and legal accountability is illustrated in Figure 4.

Figure 4. Conceptual model of privacy risks across the LLM lifecycle. The diagram illustrates how privacy vulnerabilities emerge across data collection, model training, deployment, and inference stages, and how memorization, inference attacks, and data leakage pathways interact across these stages.

4.1. Privacy Leakage and Memorization

Privacy leakage occurs when LLMs reproduce fragments of their training corpus during generation [38,60,102]. Since training objectives prioritize next-token prediction rather than semantic abstraction, rare or duplicated sequences may be retained, and memorization is therefore widely characterized as a structural consequence of large-scale optimization rather than a discrete implementation error [60,102]. Larger models, according to the size of model parameters, demonstrate stronger persistence of stored information, as shown by canary-sequence experiments revealing recall of unique samples [34,60,102]. This behavior correlates with model scale, where increased parameter capacity increases the depth of memorization, which in turn raises the probability of verbatim reproduction during inference. It is important to distinguish memorization from verbatim reproduction. Memorization refers to the internal retention of training information within model parameters, whereas verbatim reproduction represents a specific manifestation in which the model outputs exact or near-exact fragments of the original training data [1,4,16].

The issue becomes critical when memorized content contains identifiers such as names, phone numbers, or email addresses [38,103]. Dataset duplication and sensitive public records increase reproduction probability [56,102]. Attackers can exploit this behavior using probing prompts or prefix completion strategies to induce disclosure, effectively turning the model into a searchable representation of its training data [60,61,104]. Clinical-domain studies demonstrate extraction of sensitive data from pre-trained models, calling for rigorous de-identification procedures [49,105,106]. Although models generalize well to new contexts, they may still retain exact sequences—often referred to as memorization without overfitting [38].

Mitigation techniques operate at different levels: deduplication reduces memorization by lowering the frequency of repeated sequences in the training corpus, while de-identification targets verbatim reproduction directly by removing sensitive identifiers before training. Neither approach fully eliminates risk given the scale of parameters and limited data provenance transparency [56,102]. However, comprehensive empirical evaluation of memorization mitigation in frontier-scale LLMs remains limited, reflecting broader methodological gaps in LLM trustworthiness assessment [107].

This represents a passive leakage mechanism because sensitive information may emerge without a targeted attacker, purely through normal interaction. Consequently, memorization risk increases primarily with model scale and dataset diversity rather than attacker capability.

4.2. Inference Attacks (Membership Inference & Model Inversion)

Inference attacks attempt to extract information about training data by analyzing model behavior [35,108,109]. Membership inference determines whether a specific record was used during training by distinguishing probabilistic differences between training and unseen samples [109,110]. Techniques including shadow models and threshold-based classifiers exploit subtle probability variations even in well-generalized systems [109]. Confidence leakage represents a primary signal because models assign higher likelihood to familiar inputs, and instruction tuning may amplify this effect [36,109].

Model inversion attacks extend this approach by reconstructing approximate inputs or sensitive attributes through iterative querying [35,109]. Attribute inference may reveal demographic or personal characteristics even without explicit identifiers [35,111]. Empirical studies show that LLMs can infer sensitive attributes such as age, income level, or education with accuracy exceeding 80%, demonstrating privacy risks beyond direct memorization leakage [112]. Attack feasibility depends on access level: black-box attacks rely on query interaction, whereas white-box attacks use gradients and parameters, though transferability allows surrogate-model attacks against proprietary LLMs [35,109]. Gradient inversion and preference-data membership inference further expose risks introduced by alignment training [113,114,115,116]. These risks are particularly severe in systems processing personal or financial records [35].

Unlike memorization, inference attacks constitute active extraction where attackers intentionally probe probabilistic behavior. In practice, these attacks are most relevant in API-based black-box deployments where direct parameter access is unavailable but repeated querying is inexpensive. LLMs may additionally leak information through side-channels such as response latency and memory access patterns, enabling timing-based membership inference. Countermeasures include constant-time implementations and hardware-isolated execution environments [15,117].

Defenses aim to suppress exploitable signals while maintaining utility. Differential Privacy (DP) bounds individual influence [108,118], confidence masking reduces probability exposure [109], and regularization or Federated Learning (FL) reduces overfitting. However, federated learning is not immune to security risks, as attacks such as gradient inversion and Byzantine client manipulation may allow adversaries to reconstruct private training data or disrupt model updates during distributed training [36,118,119]. Nevertheless, achieving comprehensive protection remains challenging at the current model scale [36]. In addition, standardized benchmarks for privacy risk quantification in large language models remain underdeveloped, complicating cross-model comparison and regulatory validation [107,120].

4.3. Copyright and Intellectual Property

Training on internet-scale data introduces legal uncertainty because datasets frequently contain copyrighted or proprietary material collected without explicit consent [121,122,123,124]. Model parameters effectively compress the corpus, making provenance difficult to trace and distributing responsibility across developers, providers, and users [123,125,126]. The authorship of generated outputs is similarly ambiguous. Since LLMs generate text probabilistically, detecting the originality of generated content remains an unresolved problem [121,124,127]. Legal interpretations generally attribute responsibility to human operators rather than the model itself [123,125,126].

Models may also reproduce copyrighted fragments or imitate writing styles without attribution [121,122,123,124,125]. Deduplication reduces the memorization of protected content by minimizing repetition during training, while RAG reduces verbatim reproduction at inference by grounding outputs in retrieved documents rather than recalled training sequences [128,129,130]. The distinction between transformation and memorization remains unclear because models lack citation mechanisms [125,131]. Regulatory initiatives such as General Data Protection Regulation (GDPR)-related governance and the European Union Artificial Intelligence Act (EU AI Act) promote documentation and risk management, but global consensus remains unsettled [121,123,124,126,127,131].

Intellectual-property exposure differs from privacy leakage in that the risk emerges primarily during output publication rather than model interrogation, shifting the focus from confidentiality toward accountability and provenance.

4.4. Governance and Mitigation Measures

Mitigation requires coordinated technical and organizational safeguards [53,132]. Differential Privacy (DP) introduces controlled noise during optimization to limit the influence of individual records on model parameters, thereby reducing memorization; the downstream effect is a reduced probability of verbatim reproduction during inference [53,133]. Machine unlearning techniques further allow selective removal of specific data influence from trained models to satisfy regulatory deletion requirements; this approach primarily addresses memorization at the parameter level, with reduced verbatim reproduction as the intended downstream outcome [134]. Watermarking techniques embed identifiable patterns into generated text to support provenance verification, although robustness may degrade after paraphrasing [121,123,132]. Watermarking does not reduce memorization or verbatim reproduction of training data but rather enables attribution and detection of AI-generated text more broadly. Regulatory compliance frameworks further require documentation of data provenance and privacy-impact assessment across the model lifecycle [125,126,127].

In summary, privacy risks in LLMs arise from memorization behavior, probabilistic inference vulnerabilities, and unresolved legal ownership of generated content. Addressing these issues requires coordinated technical safeguards and governance mechanisms to ensure responsible deployment consistent with regulatory expectations. These protections illustrate that technical privacy defenses alone are insufficient, since real-world risk depends on deployment policies, logging practices, and access control around the model interface. Standardized security control baselines such as National Institute of Standards and Technology (NIST) guidance further formalize access protection and handling of sensitive data in AI systems [117]. A unified integration of technical privacy safeguards with lifecycle governance controls remains an open area of research.

Privacy risks in LLMs span multiple mechanisms, including passive memorization leakage, active prompt-based extraction, and probabilistic inference about training data. In practical deployment settings, black-box API access represents the most realistic threat model, as attackers can repeatedly probe models without internal access while providers struggle to reliably distinguish malicious from benign queries. Although the existing governance frameworks primarily regulate data collection and processing, comparatively less attention is given to post-deployment interaction auditing and provenance accountability, indicating gaps in operational oversight.

Quantifying privacy risks and attacks on personal attributes (such as addresses or identity—address/attribute attacks) utilizes domain-specific datasets to test de-identification and information flow. Clinical datasets [49,105] are critical for analyzing the leakage of sensitive identifiers like addresses or patient IDs. Additionally, the model’s capacity to protect private values within confidential prompts is tested through prompt leakage attacks [69].

5. Ethical Dilemmas and Social Impacts

The socio-technical risk model presented in Figure 5 organizes these risks across four interconnected layers—technical, human behavioral, organizational, and governance—illustrating how risks propagate upward from architectural properties through human interaction to institutional and regulatory consequences.

Figure 5. Socio-technical risk model of LLM-related risks across four layers: technical, human behavioral, organizational, and governance. Arrows indicate upward risk propagation and downward governance feedback.

LLMs introduce substantial ethical risks alongside their practical utility across professional and social domains [2,4,8,9,10,14,16,18,19,135,136]. Because these models generate text through the softmax-based probabilistic generation mechanism described in Section 2.1, rather than through explicit symbolic reasoning or grounded knowledge representations, they may produce plausible but factually unsupported information, commonly described as hallucination [64,137,138]. Their integration into decision-making contexts therefore requires evaluation of accountability, transparency, and societal compatibility [54,139,140]. This section operationalizes the socio-technical risk model introduced in the Introduction, examining how risks propagate from technical characteristics through human behavioral responses to organizational and governance consequences. Figure 6 illustrates the societal risk propagation pathway, covering the hallucination, bias amplification, and misconduct dimensions analyzed in this section.

Figure 6. Conceptual model of societal risk propagation in large language models. The diagram illustrates how technical characteristics such as probabilistic generation and training data biases propagate through deployment contexts to produce societal risks including hallucination, bias amplification, and misinformation.

A second major concern involves amplification of biases present in training corpora [141,142]. Empirical studies document toxic language, demographic disparities, and cultural stereotypes in generated outputs [143,144,145]. The opacity of the Transformer architecture complicates mitigation because the origin of biased responses remains difficult to detect or interpret [1,146]. In addition, the concentration of model development among a small number of organizations raises governance and power-distribution concerns [135,138].

Ethical risks further extend to malicious misuse. LLMs enable automated persuasion, phishing, and disinformation campaigns capable of undermining trust in digital communication environments [140,147,148,149]. Addressing these challenges requires alignment techniques, auditing procedures, and deployment oversight [150,151]. Comprehensive harm surveys additionally propose actionable mitigation procedures and standardized harm evaluation metrics for real-world deployment [152].

5.1. Truthfulness and Hallucination

Hallucination refers to the generation of content not grounded in verifiable facts [1,64]. Outputs may include fabricated details, incorrect claims, or fictitious narratives presented with high linguistic plausibility [1,137]. Because the training objective optimizes next-token prediction loss rather than factual correctness, LLMs often prioritize linguistic coherence over epistemic accuracy, which may result in plausible but incorrect outputs during probabilistic decoding [1,67,151,153]. Ensuring truthfulness is therefore a prerequisite for deployment in information-sensitive domains [1,77,154]. Prompt-based few-shot adaptation can further guide models toward safer responses without parameter updates [154]. Hallucination therefore reflects not only a knowledge gap, but also a misalignment between the model’s optimization objective—next-token prediction—and the requirement for factual grounding in real-world applications [1,64].

Hallucinations arise from multiple sources including noisy training data, probabilistic decoding, and architectural uncertainty [64]. Next-token prediction may produce incorrect distributions in ambiguous contexts, and cross-entropy optimization does not enforce factual validity [1,64,155]. Training on web-scale corpora introduces outdated information, while opaque internal representations hinder the identification of failure mechanisms [1,64,151].

Factual hallucinations produce incorrect statements, fabricated citations frequently occur in academic contexts, and reasoning hallucinations generate coherent but unsupported conclusions [1,63,64,137]. Intrinsic hallucinations contradict prompt context, whereas extrinsic hallucinations lack external verification [64,156].

These risks span multiple domains [137]. Healthcare systems risk unsafe recommendations [137,146]. Fabricated scientific and medical content represents a significant integrity risk for knowledge ecosystems [157]. Legal contexts may incorporate fabricated precedents [1]. Publicly reported judicial incidents further illustrate these risks in legal practice. In the United States, an attorney submitted a federal court filing containing entirely fabricated legal precedents generated by ChatGPT, resulting in judicial sanctions [158]. A similar case occurred in Australia, where a Melbourne-based lawyer was referred to disciplinary authorities after relying on AI-generated fictitious case citations [159]. Educational environments experience verification drift, where authoritative responses are accepted without validation [64,140]. These risks necessitate human oversight and domain-specific safeguards [77,153].

Mitigation focuses on grounding and verification, including RAG, Chain-of-Knowledge, Chain-of-Verification, and self-reflection methods [1,64,140,155]. Formal verification approaches using solver-guided prompting have also been proposed to iteratively eliminate incorrect outputs and enforce factual consistency [160]. Decoding strategies such as Decoding by Contrasting Layers (DoLa) further attempt to prioritize factual associations [1].

Despite progress, alignment methods including RLHF cannot fully eliminate hallucinations, particularly in out-of-distribution scenarios [64,155]. Sycophantic behavior additionally reduces reliability [140]. Ongoing research therefore emphasizes grounding, explainability, and structured knowledge integration [1,151,161].

From a technical perspective, hallucination originates in probabilistic generation mechanisms; in practice, however, its impact depends on institutional oversight and verification procedures, positioning it as both a model reliability issue and a procedural governance challenge rather than a purely algorithmic failure.

5.2. Fairness and Bias

Systemic bias in LLMs refers to unequal representation arising from uncurated training data [162,163]. Because the model learns linguistic correlations, it reproduces historical social asymmetries or prejudices from the training dataset [31,163,164]. The same mechanism enabling fluent generation thus propagates stereotypes [164,165].

Bias appears across multiple dimensions. Gender bias associates competence with male identities and domestic roles with female identities [166,167]. Racial and dialect bias affects minority language varieties [168]. Cultural and political bias reflects region-specific information norms [145,162]. Linguistic bias arises from English-dominant datasets underrepresenting low-resource languages [31,163].

Primary causes include dataset imbalance, representation gaps, and feedback loops in web-scale data collection [31]. Limited transparency allows small toxic subsets to disproportionately influence outputs [142]. Generated content may later become training data, reinforcing inequalities [31,162]. Alignment to user preferences may privilege majority viewpoints [148]. Formal fairness frameworks such as equality-of-opportunity remain central to bias mitigation research [169,170].

Consequences affect multiple domains. Recruitment evaluation may become discriminatory [167]. Educational systems risk stereotype reinforcement [148]. Healthcare decision support may exhibit disparities [163]. Public discourse may be influenced by persuasive biased narratives [142,146]. Even benchmark evaluation can inherit hidden bias [144].

StereoSet is a benchmark that quantifies stereotypical bias by evaluating whether language models prefer stereotypical over anti-stereotypical associations across domains such as gender, race, religion, and profession [150]. Bias in Open-Ended Language Generation Dataset (BOLD) evaluates social bias in open-ended generation across multiple identity dimensions using automated toxicity and sentiment metrics [135].

Although these benchmarks provide structured bias evaluation, they carry specific limitations: StereoSet’s forced-choice format may not reflect how bias manifests in open-ended generation, and its stereotype categories are fixed at dataset creation time; BOLD’s sentiment and toxicity scoring inherits the biases of automated classifiers, and its bias dimensions are drawn from US-centric demographic categories with limited cross-cultural applicability. Both benchmarks remain limited in capturing multi-turn conversational dynamics and context-dependent bias amplification [135,150,163]. Mitigation approaches include dataset filtering, debiasing objectives, RLHF alignment, and principle-driven self-alignment [31,138,140,144,149,171]. Pre-trained models can also identify toxicity in their own outputs and enable self-debiasing through self-diagnosis mechanisms [172]. However, adversarial prompting can reveal latent bias [171]. Trade-offs between fairness and accuracy, as well as cultural variation in fairness definitions, remain unresolved [31,139,163]. Continuous auditing and interdisciplinary governance are therefore required [31,162].

Bias mitigation is not purely technical because definitions of fairness vary across legal and cultural contexts. Consequently, alignment can reduce harmful outputs but cannot determine normative acceptability without external policy frameworks.

5.3. Misconduct (Cybercrime & Disinformation)

LLMs significantly alter the landscape of malicious activity by automating persuasive communication and lowering technical barriers for attackers [56,62]. Misuse primarily spans cybercrime facilitation and large-scale disinformation [147,173]. Because generated text mimics trusted communication, distinguishing legitimate from adversarial interaction becomes difficult [62,173].

In cybercrime, LLMs enhance phishing and spear-phishing through personalized messaging [173,174]. A documented experimental study demonstrated this scalability by using Generative Pre-trained Transformer (GPT)-based models to automatically gather publicly available information and generate tailored phishing emails targeting more than 600 members of the UK Parliament, illustrating the feasibility of large-scale spear-phishing with minimal technical overhead [174]. Automation enables large-scale deception campaigns at reduced cost, while multilingual capabilities further expand malicious attempts reach [56,174].

LLMs can also assist malware generation and vulnerability reconnaissance [56,173]. Conversely, LLMs can also support defensive security workflows, including zero-shot vulnerability repair in source code, highlighting their dual-use nature as both offensive and defensive cybersecurity tools [175]. Removal of alignment significantly increases offensive capability [173]. Consequently, attackers with limited expertise may perform sophisticated attacks [56,173].

Disinformation constitutes the second major threat [62,147]. Because models optimize plausibility rather than factuality, they generate credible but false narratives [143,147]. Public-health communication is particularly vulnerable [147,176]. Synthetic personas and propaganda campaigns can degrade institutional trust [62,143,177]. Real-world deployments have exposed concrete risks to information integrity and editorial accountability. The technology news outlet CNET published multiple AI-generated financial advice articles without transparent disclosure, later retracting content due to factual inaccuracies, highlighting challenges of accountability and reliability in automated journalism [178].

These risks originate from training on unverified corpora and feedback loops where generated content becomes future training data [62,147,176]. Lack of symbolic truth verification additionally complicates detection [62,147].

RealToxicityPrompts is a benchmark that evaluates the propensity of language models to generate toxic or offensive continuations when prompted with real-world text snippets, thereby revealing sensitivity to specific trigger phrases [179,180]. Its toxicity labels are sourced from the Perspective API, which carries documented biases against certain dialects and identity groups; additionally, the prompt-continuation format does not reflect the instruction-following contexts in which modern LLMs are typically deployed. The frequency of generating inaccurate information is measured by benchmarks such as TruthfulQA [146], HaluEval [156], and FActScore [140], which deconstruct generated text into atomic factual claims. These benchmarks share notable limitations: TruthfulQA covers only single-turn question answering and is vulnerable to contamination as questions become known to developers; HaluEval relies on ChatGPT-derived annotations, introducing circularity when evaluating similar models; and FActScore requires a structured reference knowledge base, limiting its applicability beyond well-documented domains such as biographies. To address the ethical risks of fabricated content in professional fields, specialized datasets like MedQA [181], PubMedQA [182] and LegalBench are used to evaluate the reliability of model-generated medical and legal advice. Additionally, social bias and toxicity are analyzed through StereoSet [150], BOLD [135], and RealToxicityPrompts [179,180], which quantify stereotypical associations and the propensity for offensive outputs in generated content.

However, adversarial prompting techniques and cross-jurisdiction deployment contexts limit the effectiveness of purely technical safeguards [56,147]. Consequently, mitigation must extend beyond model-level controls and be complemented by governance frameworks and regulatory oversight mechanisms [143,173,176].

Misuse risk therefore depends less on model capability alone and more on enforcement capacity, jurisdictional regulation, and platform governance. Technical safeguards can reduce abuse probability but cannot eliminate malicious intent in open deployment environments.

Mitigation strategies include detection tools, alignment techniques, deployment-time guardrails, grounding mechanisms, and transparent data-provenance practices [56,62,143,177].

Overall, LLMs amplify existing societal patterns because their outputs reflect both training data distributions and interaction context. Alignment improves observable behavior but does not guarantee elimination of hallucination, bias, or misuse in real-world deployment. Ethical risk therefore remains deployment-context dependent and requires coordinated governance and technical mitigation.

6. Defense and Mitigation Strategies

The deployment of LLMs has progressed faster than the development of standardized safety frameworks [53,183,184]. Because these systems rely on probabilistic generation and large-scale web training data, they expose attack surfaces affecting confidentiality, integrity, and availability, including harmful content reproduction, privacy leakage, adversarial manipulation, and tokenization-based evasion techniques [53,62,63,68,84,90,185,186,187,188,189,190,191]. The emergence of automated exploitation and social-engineering attacks therefore necessitates comprehensive mitigation strategies spanning training, inference, and governance stages [123,132,192].

Defense-in-depth integrates dataset curation, alignment mechanisms, runtime monitoring, and governance accountability across the LLM lifecycle [3,53,84,132,193,194]. Because vulnerabilities propagate across stages, mitigation is treated as a socio-technical process combining technical safeguards with institutional oversight [190,193,195,196]. This section organizes defenses into five complementary categories, as depicted in Figure 7, which illustrates the defense-in-depth architecture for mitigating LLM security risks.

Figure 7. Defense-in-depth architecture for mitigating LLM security and privacy risks. The diagram illustrates five layered safeguards across the model lifecycle: training-layer controls, model alignment, inference safeguards, deployment controls, and governance layer. Arrows represent the interaction between technical safeguards and organizational oversight in reducing residual risk by mapping each safeguard layer to specific threat categories.

6.1. Guardrails & Frameworks

Guardrails are deployment-time safety layers positioned between users and LLMs [185]. Guardrails primarily address observable behavioral deviations at the interface layer but cannot fully resolve latent alignment discrepancies embedded in model parameters. They monitor prompts and outputs and enforce organizational policies without modifying internal parameters, allowing rapid policy updates as risks evolve [185]. In practice, guardrails are implemented through programmable moderation frameworks integrated into production pipelines, screening both user inputs and model completions [185,190,191].

Implementations combine rule-based filtering and classifier-based moderation. Rule-based methods, usually relying upon keyword filtering, statically detect restricted patterns, while semantic classifiers evaluate intent across categories such as toxicity or illegal activity [185,191]. Multi-stage pipelines analyze prompts before generation and validate responses afterward, including groundedness checks to reduce hallucinations [63,185]. Because guardrails operate as a supervisory layer, they can be iterated independently of retraining [185].

However, adversarial prompts can bypass filtering through obfuscation, formatting, or role-playing contexts [185]. Strict filtering reduces usability, whereas permissive configurations increase exposure [190,191]. Guardrails therefore function as supportive controls rather than standalone security [63,185,190,191]. In safety-critical contexts, guardrail design increasingly follows high-assurance software practices [91].

6.2. Technical Internal Defenses

Technical internal defenses modify the parameters and optimization objectives of LLMs during training and adaptation in order to reduce unsafe behavior at its source [3,44]. Because harmful outputs originate from probabilistic associations learned during pre-training, internal alignment reduces reliance on external filtering mechanisms that can be bypassed through adversarial phrasing [3,90,196,197]. Rather than blocking responses at the interface, these approaches reshape the model’s weight space, so unsafe behaviors become less reachable.

Adversarial training represents a primary robustness mechanism. During optimization, LLMs are exposed to adversarial prompts through structured red-teaming procedures, improving resistance to prompt injection and jailbreaking attempts [90,196,197]. Automated red-teaming frameworks iteratively generate challenging inputs and incorporate them into fine-tuning datasets, enabling targeted correction of discovered failure modes [196]. This process reduces discrepancies between pre-training behavior and deployment requirements.

Complementing robustness-oriented defenses, RLHF is a post-training alignment procedure in which human preference annotations are used to train a reward model that approximates human evaluative judgments [1,3,50]. The base LLM is subsequently optimized using reinforcement learning to maximize the learned reward signal, thereby encouraging policy-consistent and value-aligned outputs while reducing unsafe behaviors inherited from pre-training [3,44,149,198]. RLHF transforms a general pre-trained model into an instruction-following assistant aligned with human preferences.

Pairwise Proximal Policy Optimization (P3O) is a reinforcement learning algorithm designed for LLM alignment that optimizes policies using pairwise human preference comparisons rather than absolute reward scores [199]. By directly modeling relative feedback between response candidates, P3O improves alignment precision within preference-based optimization settings. However, stronger alignment constraints may reduce behavioral flexibility, particularly in open-ended or creative tasks, illustrating a robustness–utility trade-off [3,149,200].

Architectural methods such as pruning and regularization constrain parameter regions associated with unstable behavior [90,201]. Targeted pruning strategies that remove selected parameter subsets can increase resistance to jailbreak attacks without full retraining [202]. These techniques reduce susceptibility to adversarial steering and assist backdoor mitigation by suppressing malicious activation patterns embedded during training [196,201]. Internal objectives may also incorporate factuality and bias-mitigation constraints to stabilize probabilistic associations [151].

Knowledge distillation can further reduce exposure of sensitive training data by transferring behavior into smaller surrogate models that are less prone to memorization [203]. However, distillation also introduces model extraction risks. Recent industry reports document so-called distillation attacks, in which adversaries systematically query frontier models to approximate their behavior and replicate alignment properties through model extraction techniques. Anthropic has described detection and prevention strategies for such attacks, including behavioral monitoring and usage-pattern analysis to detect suspicious querying patterns [204].

Overall, internal defenses provide durable protection because alignment constraints are embedded directly into parameter updates rather than applied after generation [3,90,149,151]. Despite these advantages, internal defenses require retraining and cannot eliminate the alignment gap entirely.

6.3. Technical Inference Defenses

Technical inference defenses operate during runtime and aim to detect unsafe behavior before output delivery [68,84]. They address residual vulnerabilities that persist after alignment, particularly in multi-turn interactions where attackers iteratively refine prompts based on model feedback [84,183,205].

Input preprocessing neutralizes malicious structure prior to generation [68,84]. Retokenization and paraphrasing disrupt optimized adversarial patterns while preserving semantic intent. Text detoxification approaches, often implemented through paraphrasing models, replace toxic expressions while preserving semantic meaning [206]. Encoding normalization further prevents bypass through special characters or alternative linguistic encodings, ensuring standardized processing [84,188]. These transformations reduce exploitability without modifying model parameters.

Detection mechanisms analyze abnormal probability distributions associated with adversarial prompts [84,194,207]. Perplexity-based detection methods—techniques that use a perplexity score to determine how likely a piece of text was generated by a particular LLM—analyze the likelihood assigned by a language model to an input sequence; adversarial prompts often exhibit atypical token probability patterns or unusually low perplexity relative to natural human text, enabling statistical identification of machine-optimized inputs [207,208]. Because attackers may embed malicious intent within semantically valid text, runtime monitoring complements alignment rather than replacing it.

Output validation evaluates responses before exposure to the user [84,183,192,194,209]. Refusal policies, toxicity detection, and multi-model verification reduce unsafe completions and hallucinations [192,208,209].

Continuous monitoring across conversations enables rate-limiting and anomaly detection during probing attempts [84,183,205]. Randomized smoothing and response variability further reduce sensitivity to optimized adversarial strings [84]. Randomized smoothing additionally enables provable robustness guarantees under bounded adversarial perturbation assumptions by providing mathematically certified stability bounds [210].

Although inference defenses introduce latency and may block legitimate queries, they provide essential protection in real-world deployment and complement training-time mitigation within a defense-in-depth architecture [68,84,183,192,194,207].

6.4. Privacy Protections (Differential Privacy & Federated Learning)

Because LLMs may encode sensitive data, privacy preservation is essential for trustworthy deployment [53,187,189,211]. Differential Privacy (DP) limits leakage by bounding individual influence [133]. Implemented via Differentially Private Stochastic Gradient Descent (DP-SGD), it applies gradient clipping and noise injection to reduce memorization during training, with the downstream effect of reducing verbatim reproduction risk at inference [53,133]. The privacy budget illustrates the privacy–utility trade-off [144,212].

DP reduces membership inference and extraction attacks by suppressing exploitable confidence signals [53,133,144]. Private decoding further mitigates inference leakage [125].

Federated Learning (FL) is a decentralized machine learning framework in which model training is performed locally across distributed clients, while only model updates are propagated to a central server for aggregation, without directly sharing raw (local) training data [193]. By limiting data centralization, FL primarily reduces memorization of any individual’s data rather than directly targeting verbatim reproduction. Secure aggregation mechanisms protect individual client updates, although communication overhead and potential gradient leakage remain practical challenges [193,213]. Hybrid DP-FL approaches protect both training and inference phases [125,133,193,213]. Advanced deployments further employ Trusted Execution Environments to prevent data exposure even to infrastructure providers during inference [52,117]. Secure multiparty computation additionally protects confidential inputs during distributed inference [214,215]. Computational cost and adaptive prompting remain open challenges [53,144,211].

6.5. Machine Content Identification

Generated text requires attribution and provenance verification to preserve information integrity [62,132]. Two primary approaches are watermarking and post hoc detection [62,132].

Watermarking embeds statistical signatures during decoding, by inserting a subtle, hard-to-notice pattern into the text generation process [121,132]. Watermarked signals degrade under paraphrasing of the generated text [123,195]. Research therefore explores semantic watermarking and distortion-free schemes [123,131,186,195].

Detection methods analyze probability distributions and stylometric patterns [62,216]. Probability curvature analysis methods such as DetectGPT enable detection of machine-generated text without training dedicated classifiers [217]. Adversarial rewriting weakens detection performance, producing an arms race [62,195]. Cryptographic provenance metadata supports auditing [62,131]. Emerging cross-platform provenance standards aim to embed persistent metadata across distribution channels, though enforcement and interoperability remain unresolved challenges [62,131]. Because false positives are common in detection methods, human oversight remains necessary [62,216].

Table 3 illustrates that LLM security cannot be addressed by isolated safeguards but requires defense-in-depth mechanisms distributed across the entire lifecycle.

Table 3. Mapping of threats and defense-in-depth controls across the LLM lifecycle. The table illustrates how specific threat categories correspond to mitigation mechanisms deployed at different stages of the model lifecycle, highlighting the layered structure of defense-in-depth security strategies.

Lifecycle Stage	Primary Threat	Security Objective	Defense-in-Depth Controls	Residual Risk	Representative References
Training	Data poisoning, backdoor triggers	Preserve model integrity	Dataset filtering, deduplication, data provenance verification, secure fine-tuning	Latent backdoor persistence and incomplete dataset visibility due to opaque or proprietary training corpora	[57,58,59,96,97,98,99,218]
Inference	Prompt injection, jailbreak, adversarial prompting	Maintain aligned behavior	Guardrails, alignment reinforcement, input normalization, adversarial training	Adaptive adversarial prompting and iterative black-box optimization across multi-turn interactions	[53,55,63,68,71,84,185,190,191]
Deployment	Model extraction, privacy leakage	Protect confidentiality	Monitoring, rate limiting, anomaly detection, auditing	Scalable black-box probing and statistical inference despite rate limiting and monitoring controls	[3,7,38,60,61,102,109,219]
Societal Use	Disinformation, bias, misuse	Ensure safe operation	Governance policies, transparency, regulatory compliance (EU AI Act)	Enforcement variability across jurisdictions and platform-level governance gaps beyond technical control	[3,7,16,31,62,139,140,173,220]

No individual mitigation category provides complete protection because vulnerabilities originate from probabilistic modeling and architectural characteristics rather than isolated defects. Guardrails remain bypassable, internal alignment introduces robustness–utility trade-offs, inference monitoring increases latency, privacy protection constrains performance, and attribution mechanisms operate within an adversarial arms race.

Consequently, effective protection requires layered defense-in-depth combining parameter-level robustness, runtime safeguards, privacy-preserving optimization, provenance mechanisms, and governance oversight. Residual behavioral risk cannot be fully eliminated, but it can be systematically constrained through lifecycle-integrated security architectures.

7. Application-Specific Risks

While the structural vulnerabilities of large language models generalize across domains, deployment-specific contexts shape the magnitude, accountability requirements, and societal consequences of model behavior [221]. The alignment gap, probabilistic generation mechanisms, and governance constraints manifest differently depending on whether LLMs are integrated into epistemic, financial, medical, or regulatory environments. The following subsections illustrate how domain-specific deployment conditions modulate risk exposure and reshape governance requirements, with particular focus on education and financial services. This comparative perspective highlights how identical technical mechanisms can produce fundamentally different societal and institutional consequences depending on the deployment context.

Risks in specific sectors require domain-specific benchmarks to ensure operational safety: MedQA [181] and PubMedQA [182] assess factual correctness in biomedical tasks, while LegalBench [222] evaluates legal reasoning and citation reliability. These domain benchmarks carry scope limitations: MedQA and PubMedQA evaluate closed-domain question answering on structured medical knowledge but do not assess clinical reasoning under uncertainty or real-world deployment safety; and LegalBench coverage is predominantly US common law and does not transfer to civil law systems or non-English jurisdictions, nor does it capture the open-ended argumentation central to legal practice. In the programming domain, vulnerabilities and the integrity of generated logic are tested using specialized datasets for code generation [223].

7.1. Education

The integration of LLMs into educational systems creates a socio-technical environment distinct from conventional decision-support applications. Domain-specific deployments in other regulated domains require additional safeguards and transparency mechanisms [224,225,226,227,228]. However, education differs structurally because learning outcomes depend on reasoning construction rather than answer generation [229,230]. Within this context, LLMs function as cognitive mediators that shape perceptions of authority, correctness, and epistemic reliability [231,232]. Because fluency and coherence emerge from probabilistic modeling rather than verified knowledge grounding, learners may conflate linguistic plausibility with factual validity [229,230,231,232]. Figure 8 shows the conceptual model of educational and cognitive risks associated with LLM use.

Figure 8. Conceptual model of educational and cognitive risks associated with LLM use. The diagram illustrates how model characteristics such as hallucination, automation bias, and epistemic overreliance may influence learning processes, cognitive workload, and academic integrity in educational contexts.

The following analysis addressestwo dimensions of the education domain: (A) pedagogical impact and (B) academic integrity implications [103,229,233].

7.1.1. Pedagogical Impact

LLMs alter the relationship between effort and learning by providing immediate, well-structured responses that may substitute inquiry-driven reasoning [229,230]. As educational tasks increasingly permit automated support—such as question answering, summarization, explanation drafting, or feedback construction—students may shift from problem solving toward answer retrieval [229]. This transformation modifies cognitive engagement patterns and risks reducing the productive effort required for durable understanding.

Excessive reliance on LLM-generated intermediate reasoning can diminish metacognitive engagement and weaken long-term knowledge consolidation [229,234]. From a cognitive-load perspective, overreliance reduces germane load—the effort devoted to schema construction—because learners may bypass critical reasoning steps when structured outputs are immediately available [229,234]. Over time, such dependency may contribute to skill atrophy in domains requiring structured analytical reasoning, including law, engineering, and mathematics [231,232]. When tasks exceed learner capability or outputs contain subtle inaccuracies, insufficient procedural understanding may hinder independent problem resolution [232].

A related phenomenon is verification drift—the tendency to equate linguistic fluency with epistemic validity—where authoritative phrasing reduces critical scrutiny even when hallucination risks are recognized [229,230,231,232]. Anchoring effects may further narrow reasoning exploration, as learners overweight the first generated answer and adjust subsequent thinking around it [230,234]. These dynamics reflect a broader robustness–utility tension: assistance enhances efficiency but may attenuate independent analytical capacity if not institutionally moderated.

Nevertheless, when deployed as scaffolding tools rather than answer substitutes, LLMs can increase accessibility and support iterative conceptual clarification [223,229,235]. Research therefore emphasizes AI literacy training and pedagogical frameworks that preserve learner responsibility for verification and reasoning [229,235].

7.1.2. Academic Integrity and Ethical Concerns

LLM-generated text challenges traditional plagiarism detection mechanisms because outputs are novel and typically evade similarity-based detection systems [233]. This enables AI-assisted ghostwriting, where assignments appear original while substantial cognitive work is delegated to automated systems [233,236]. Authorship attribution becomes increasingly ambiguous as LLMs replicate academic style and perform structured writing or coding tasks at advanced levels of fluency [236,237].

Assessment of validity of generated content is consequently affected. Evaluations may inadvertently measure prompting proficiency rather than conceptual mastery, thereby altering the construct validity of assessment instruments [236,237]. In response, institutions increasingly adopt process-oriented assessment strategies emphasizing draft submission, reasoning transparency, oral defense, and supervised evaluation environments [236].

Automated detection tools offer partial mitigation but introduce fairness risks, including false positives and potential bias against non-native speakers [233,236]. Erroneous accusations undermine procedural justice and institutional trust, indicating that detection technologies alone cannot guarantee academic integrity [233,236]. Ethical governance therefore requires the balanced integration of technical safeguards and transparent procedural norms.

LLMs also introduce equity concerns. Differential access to advanced tools and disparities in AI literacy may generate performance asymmetries across student populations [233,236]. Furthermore, integration of student-generated content into proprietary model training pipelines raises privacy and consent concerns if institutional safeguards are insufficient [103,229]. Educational governance is therefore shifting from prohibition toward regulated integration through disclosure policies, revised authorship standards, and institutional oversight frameworks [103,233,236].

Distinguishing between legitimate pedagogical augmentation and harmful cognitive displacement remains an open governance and research challenge [103,233,236].

While educational contexts primarily expose epistemic and cognitive risks, in the next subsection, we analyze the financial application domain, highlighting financial decision-making and market stability challenges associated with generative AI systems.

7.2. Finance

Financial systems represent a particularly sensitive deployment environment for large language models and generative AI systems due to the systemic importance of financial decision-making, regulatory oversight, and market stability. Recent survey studies increasingly document the rapid adoption of generative AI technologies across financial services, while simultaneously emphasizing emerging risks related to model reliability, regulatory compliance, and systemic market stability [238,239,240]. These developments position finance as a critical domain for examining how LLMs interact with institutional decision-making environments.

Financial institutions process vast quantities of heterogeneous data, including financial reports, regulatory filings, news sources, and market signals. Generative AI technologies have demonstrated significant potential to enhance financial analytics by extracting patterns from complex datasets, supporting decision-making, and generating synthetic financial data for modeling and simulation purposes [238,240].

LLMs enable more sophisticated analysis of financial text compared to earlier text-mining approaches that relied on bag-of-words representations. By capturing contextual relationships within financial language, large language models can improve sentiment analysis, financial document interpretation, forecasting, and automated report generation. These capabilities allow generative AI models to support tasks such as financial forecasting, algorithmic trading, risk analysis, and investment decision support [238].

Recent research also highlights the integration of LLMs with traditional quantitative finance pipelines. Hybrid architectures combine LLM capabilities with statistical risk models to extract linguistic risk signals, generate financial scenarios, and support feature engineering within financial analytics systems. Such approaches demonstrate measurable improvements in efficiency and analytical capability but also introduce new challenges related to interpretability, data quality, and regulatory compliance [240].

Within this context, generative AI is increasingly deployed in areas such as credit scoring, macroeconomic simulation, financial risk modeling, and automated data processing. At the same time, the probabilistic nature of these systems introduces technical and governance challenges that are particularly critical in financial environments. These include reliability risks, regulatory accountability, and the potential systemic impact of automated financial decision-making [239,240].

Accordingly, the financial deployment context illustrates three primary and interrelated dimensions of risk: (A) financial decision-making reliability and model risk; (B) regulatory, governance, and systemic stability implications; and (C) market manipulation and algorithmic trading risks, as shown in Figure 9.

Figure 9. Conceptual model illustrating domain-specific risk pathways in LLM deployment across educational and financial systems. The diagram compares how similar technical mechanisms produce different institutional and societal consequences depending on the deployment context.

7.2.1. Financial Decision-Making and Model Risk

LLMs are used to support financial decision-making processes, including investment analysis, credit risk assessment, and financial forecasting. By analyzing large volumes of textual and numerical financial data, these systems can extract risk indicators, identify emerging trends, and generate predictive insights that support risk management workflows [239].

One of the most significant advantages of generative AI in finance lies in its ability to process unstructured financial information. Financial news, regulatory documents, and investor communications contain valuable signals that traditional quantitative models often fail to capture. LLMs enable automated extraction of such information, improving sentiment analysis and the predictive modeling of financial markets [238].

However, the use of LLMs in financial analysis also introduces substantial model risk. Because these systems generate outputs probabilistically rather than through deterministic computation, they may produce inaccurate or fabricated information, a phenomenon commonly described as hallucination. In financial contexts, such inaccuracies may lead to flawed investment recommendations, incorrect risk assessments, or misleading interpretations of regulatory documents [238,240].

Empirical research indicates that while generative AI models can enhance risk identification and monitoring processes, they still exhibit limitations in quantitative reasoning and mathematical financial modeling. As a result, AI-generated financial insights often require validation through traditional econometric methods and domain-specific risk models. Hybrid analytical pipelines that combine generative AI with conventional financial modeling techniques therefore represent a common architecture for practical financial AI deployment [239].

Another important challenge concerns the interpretability of generative AI systems. Financial institutions must be able to explain the reasoning behind risk predictions and investment recommendations, particularly in regulated environments. Researchers have therefore emphasized the development of interpretability methods and feature attribution techniques that allow analysts to understand how LLMs derive financial insights from textual and numerical data [239].

7.2.2. Regulatory, Governance, and Systemic Risk Implications

The adoption of generative AI in financial systems also raises significant governance and regulatory concerns. Financial institutions operate within strict regulatory frameworks designed to ensure market stability, consumer protection, and systemic risk control. Consequently, the integration of LLMs into financial decision processes requires careful consideration of accountability, transparency, and compliance requirements [238,240].

Regulators and policy organizations have expressed concerns that large-scale LLM adoption could introduce new systemic risks to financial markets. Automated decision systems may amplify market volatility, propagate incorrect financial information, or generate correlated decision behaviors across institutions. These dynamics could potentially influence financial intermediation, asset management, insurance systems, and payment infrastructures [240].

Data governance also represents a major challenge. Financial datasets frequently contain proprietary or sensitive information, limiting their availability for model training and validation. As a result, researchers increasingly explore synthetic financial data generation using generative models such as generative adversarial networks, variational autoencoders, and diffusion models. Synthetic datasets allow institutions to train machine learning models and simulate financial scenarios while protecting confidential financial data [238].

Despite these advantages, synthetic data generation introduces additional ethical and governance considerations. Generated datasets must preserve statistical realism without introducing biases or distortions that could compromise financial models. Moreover, regulatory frameworks must ensure that AI-generated financial analyses remain transparent, auditable, and aligned with legal accountability requirements [238,240].

Overall, the financial sector illustrates both the transformative potential and the governance challenges associated with generative AI deployment. While these technologies enable new forms of financial analysis, forecasting, and risk management, their probabilistic behavior, limited interpretability, and regulatory implications require carefully designed oversight mechanisms and hybrid analytical architectures that combine AI capabilities with established financial modeling practices [238,239,240].

7.2.3. Market Manipulation and Algorithmic Trading Risks

The integration of generative AI into financial markets also raises concerns regarding market manipulation and automated trading dynamics. Financial markets increasingly rely on algorithmic decision systems that analyze news, reports, and market signals in real time. The ability of large language models to generate convincing financial narratives and automated analyses introduces the possibility that AI-generated content could influence investor behavior or market sentiment at scale [238,240].

LLMs are capable of producing realistic financial commentary, investment recommendations, or news-style content. If such outputs are disseminated without verification, they may contribute to misinformation within financial information ecosystems. Because financial markets are highly sensitive to sentiment signals and news events, automated generation of persuasive financial narratives could amplify volatility or distort market expectations [240].

Algorithmic trading environments further propel these risks. Many trading strategies rely on automated text analysis of financial news, social media signals, and analyst commentary. Generated content could therefore interact with other automated systems, creating feedback loops in which algorithmic traders respond to synthetic signals rather than verified information. Such dynamics may increase systemic fragility in high-frequency trading environments and complicate market surveillance mechanisms [238,240].

Regulatory discussions increasingly emphasize the need for safeguards addressing these emerging risks. Potential mitigation strategies include transparency requirements for generated financial communication, monitoring systems capable of detecting synthetic market signals, and stricter governance frameworks for AI-assisted financial advisory tools. These measures aim to ensure that generative AI technologies enhance financial analytics without undermining market integrity or investor protection [238,239].

Together, these financial deployment risks illustrate how LLMs can influence not only individual decision processes but also broader market dynamics, reinforcing the need for domain-specific governance frameworks and robust institutional oversight. Taken together, the existing research indicates that the benefits of generative AI in financial analytics are inseparable from new forms of model risk, governance complexity, and potential systemic effects, underscoring the importance of interdisciplinary oversight frameworks that combine financial regulation, AI safety mechanisms, and institutional risk management practices [238,239,240].

The domain-specific risks discussed above emerge from the interaction between generation and the institutional contexts in which LLMs are deployed. Figure 9 contrasts how these mechanisms manifest differently across educational and financial application environments.

8. Regulatory Frameworks and Compliance

The rapid diffusion of LLMs has created a structural regulatory lag between generative capability and established legal oversight mechanisms [3,220]. Unlike narrow AI systems designed for predefined tasks, LLMs function as general-purpose AI (GPAI) models and, more specifically, as General-Purpose AI Systems (GPAIS), capable of deployment across heterogeneous domains and value chains [7,220]. This adaptability complicates attribution of responsibility among developers, model providers, system integrators, and end users. Governance discourse therefore increasingly centers on accountability, transparency, liability allocation, and risk-proportionate regulatory design [3,241].

Enterprise governance structures have begun incorporating dedicated AI oversight committees, model approval workflows, and internal risk-classification protocols to manage deployment exposure [242]. At the supranational level, the EU AI Act represents the most comprehensive attempt to formalize obligations for foundation model and high-risk system deployment [3,220]. However, the probabilistic and context-sensitive behavior of LLM systems challenges traditional regulatory expectations grounded in determinism and predictable functionality [3,7]. Regulatory supervision must evaluate observable behavior, risk profiles, and deployment context rather than internal algorithmic determinism [3,220].

Modern AI regulation increasingly adopts risk-tiered classification models, distinguishing between prohibited practices, high-risk applications, limited-risk systems, and minimal-risk uses [3,220]. Applications in healthcare, finance, and legal decision-making are typically categorized as high-risk due to potential impacts on fundamental rights and safety [3,220]. Foundation models are subject to enhanced documentation requirements, including disclosure of training data characteristics, summaries of copyrighted material usage, and communication of operational capabilities and limitations [7,220]. High-risk deployments additionally require structured human oversight mechanisms to mitigate potential rights violations [3].

Nevertheless, definitions of GPAIS remain in flux, reflecting the difficulty of applying static legal categories to adaptive systems whose behavior evolves through prompting, fine-tuning, and downstream integration [220]. This regulatory tension illustrates a broader challenge identified throughout this review: governance frameworks must accommodate probabilistic generative behavior whose risk profile is interaction-dependent rather than fixed [3]. The complementary safeguards operating at training, inference, and governance levels are illustrated in Figure 10.

Figure 10. Defense-in-depth mitigation layers for reducing risks associated with the alignment gap in large language models. The diagram illustrates how complementary safeguards at the training, inference, and governance levels interact to constrain residual behavioral risks in the context of regulatory compliance and governance oversight.

8.1. EU AI Act and GPAIS Classification

Regulatory analysis identifies GPAI models as uniquely complex because they are not confined to a single application domain but are designed for reuse across multiple downstream contexts [3,220]. Under the EU AI Act’s risk-based framework, AI systems are classified according to specific use cases defined in Article 6 and Annex III, rather than entire sectors. High-risk categories include, inter alia, employment and worker management, access to essential public and private services (such as creditworthiness assessment), law enforcement, migration and border control management, and the administration of justice and democratic processes [243].

For foundation models and GPAI systems, compliance obligations extend beyond application-level evaluation. Providers must maintain detailed technical documentation, describe training data sources at an aggregated level, disclose summaries of copyrighted content usage, and communicate known limitations and risk mitigation measures [7,220]. GPAI models presenting systemic risk are subject to additional requirements, including model evaluation, adversarial testing, incident reporting, and cybersecurity safeguards [243]. These requirements aim to increase transparency across the LLM training-to-deployment lifecycle while preserving trade secrets and intellectual property.

However, static (pre)classification struggles to capture the dynamic behavior of LLMs when integrated into downstream systems. A model that is compliant at release may generate high-risk outcomes when deployed in high-risk use cases or under adversarial prompting conditions [3]. Consequently, regulatory interpretation must incorporate lifecycle monitoring and post-deployment oversight rather than relying exclusively on pre-deployment conformity assessment [220].

8.2. Liability and Accountability

Assigning legal responsibility for LLM-generated outputs remains a central governance challenge. Because outputs arise from probabilistic inference rather than deterministic programming, harmful results may emerge without explicit developer intent [3,7]. This complicates traditional liability doctrines that assume direct causal control over system behavior.

Responsibility is typically distributed across multiple actors, including model developers, API providers, integrators, and end users [3,7]. In cases involving hallucinated information, discriminatory outputs, or security incidents, identifying the locus of negligence becomes legally and practically complex. Alignment procedures and safety testing, while necessary, cannot guarantee absence of harmful outputs in all interaction contexts [3].

This dynamic creates an accountability gap in which technically compliant systems may still produce adverse outcomes. Regulatory discussions, therefore, emphasize the need for auditable deployment practices, traceability mechanisms, and clearly defined responsibility allocation across contractual and operational boundaries [3,7]. Legal compliance must therefore extend beyond model-level safeguards to encompass organizational governance structures and continuous oversight.

8.3. Organizational Practice: Multi-Tier Auditing

Operational compliance increasingly adopts a multi-tier auditing architecture aligned with the LLM lifecycle [3,7], encompassing three complementary levels. Governance audits evaluate organizational structures, data-collection policies, ethical review processes, and internal accountability mechanisms [3]. Building on this foundation, model audits assess robustness, factual reliability, bias exposure, and resistance to adversarial manipulation prior to deployment [3,7]. Finally, application audits examine real-world societal impact, contextual bias risks, and compliance with user rights within specific deployment environments [3]. End-to-end lifecycle documentation and responsibility mapping are particularly critical in cross-border deployments subject to multiple legal regimes [3,7]. Such layered oversight functions as a system of institutional checks and balances, complementing technical defense-in-depth mechanisms described earlier in this review [3]. This auditing structure reflects the recognition that regulatory compliance cannot be reduced to a one-time technical evaluation but rather requires ongoing monitoring proportional to deployment risk.

8.4. Shadow AI and Invisible Deployment

A growing compliance challenge arises from the emergence of Shadow AI, in which employees utilize publicly accessible LLM services to process organizational data without formal approval or oversight [229,236]. This phenomenon parallels the broader concept of Shadow IT, where unsanctioned technologies bypass institutional governance mechanisms [244]. A related and increasingly documented pattern is “Bring Your Own AI” (BYOAI), whereby employees independently integrate external generative AI tools into workplace workflows without formal authorization, data-protection assessment, or contractual safeguards. Such practices may expose sensitive organizational data to third-party providers, create compliance blind spots, and undermine internal governance controls, even when the model itself is technically compliant [245].

In this context, risk emerges not from adversarial exploitation but from uncontrolled adoption. Enterprise analyses indicate that AI usage frequently precedes governance maturity, exposing organizations to operational and regulatory vulnerabilities before risk management processes are established [246]. Unmonitored submission of proprietary or personal data to external LLM platforms increases the likelihood of unintended memorization and potential downstream disclosure [38,56]. Such exposure has been identified as a significant enterprise risk in generative AI deployment [16].

Shadow AI expands the socio-technical threat surface identified throughout this review [1,2]. Technical properties such as probabilistic memorization and extraction risk [16,61] interact with human trust in fluent outputs, amplifying verification drift and reducing critical evaluation [64,140]. Without auditing procedures, usage governance, and access controls, Shadow AI may undermine compliance with regulatory frameworks such as the EU AI Act [7,91,220]. Thus, compliance risk may arise from ordinary workflow practices rather than malicious activity, underscoring the importance of internal policy enforcement and employee training.

8.5. Continuous Compliance and Adaptive Governance

Regulatory frameworks are essential for responsible deployment of LLMs, yet static compliance models are insufficient in dynamic AI environments [220]. Transitioning from reactive enforcement toward safety-by-design architectures—incorporating auditable pipelines, transparent data provenance, and continuous monitoring—can improve systemic trustworthiness [3,7].

In practice, risk-tiered regulation is operationalized through continuous documentation, periodic audits, and ongoing monitoring obligations rather than one-time certification events. Organizations must maintain technical testing procedures, record data provenance decisions, and demonstrate oversight proportional to system risk. Industry analyses similarly emphasize governance maturity models as prerequisites for safe enterprise AI deployment [247].

A persistent structural difficulty lies in shared responsibility across multiple actors—developers, providers, integrators, and users—where harmful outcomes may emerge without a single, clearly negligent, party. This complexity is amplified by the training principles and multi-stage interaction chains across LLM training-to-deployment lifecycle, rendering static compliance verification inadequate.

Effective LLM governance therefore requires integration of legal oversight, technical evaluation, lifecycle monitoring, and organizational accountability mechanisms. Even technically compliant systems may exhibit emergent behavior under novel prompting conditions, indicating that regulatory compliance must be adaptive rather than static. Operational standards for continuous auditing of adaptive generative systems remain insufficiently defined and represent a critical area for future regulatory and interdisciplinary development [3,7,220].

Compliance with regulatory requirements, such as those defined in the EU AI Act [243], is tested through benchmarks that simulate high-risk scenarios. DecodingTrust [37] serves as a crucial tool in this context, as it measures compliance with dimensions such as fairness and transparency, which are necessary for documentation under new regulations [241].

9. Discussion: Research Gaps and Future Directions

Research on LLM security, privacy, and ethics has expanded rapidly, yet remains conceptually fragmented and methodologically inconsistent across domains [38,120]. Comprehensive surveys increasingly emphasize the absence of standardized methodologies for evaluating LLM trustworthiness in a unified and comparable manner [107]. While individual threat categories—such as prompt injection, privacy leakage, hallucination, or adversarial robustness—have received substantial attention, evaluation frameworks capable of measuring multiple safety dimensions simultaneously remain limited [38,120].

The existing benchmarks frequently assess isolated properties rather than interactions among reasoning capability, safety constraints, robustness, and utility. This fragmentation complicates cross-model comparison and obscures trade-offs between performance and security in LLMs [120]. The iterative pipeline for identifying and mitigating alignment gaps is illustrated in Figure 11. Advancing trustworthy deployment therefore requires a transition from reactive mitigation strategies toward safety-by-design methodologies that embed continuous validation across the entire LLM lifecycle [37,219]. Whereas prior surveys often isolate privacy, ethics, or adversarial robustness as separate research strands, this work integrates lifecycle modeling, alignment gap analysis, and governance structures into a unified conceptual framework for evaluating systemic risk.

Figure 11. Evaluation and governance pipeline for identifying and mitigating alignment gaps in large language models. The diagram outlines the iterative process of risk identification, evaluation, mitigation, and governance oversight used to manage alignment-related vulnerabilities.

9.1. Fragmented Evaluation and the Alignment Gap

A primary structural gap in the current research landscape is the absence of unified safety evaluation enabling direct comparison across LLM architectures and deployment contexts [38,120]. Many evaluation methodologies focus narrowly on toxicity, hallucination, or bias without capturing interactions between reasoning capability, reliability, adversarial robustness, and utility [120]. As a result, improvements along one dimension may inadvertently degrade another.

A persistent challenge concerns incomplete behavioral control following post-training alignment procedures [37]. Even models aligned using RLHF remain vulnerable to adversarial prompting and out-of-distribution inputs [37]. Latent jailbreak studies further demonstrate that harmful behaviors can be triggered through subtle semantic steering, indicating that alignment does not eliminate unsafe internal representations but instead constrains their surface expression [219]. This alignment gap (defined in Section 2) remains insufficiently quantified and methodologically underexplored.

9.2. Toward Holistic Benchmarking

Future research increasingly emphasizes comprehensive evaluation frameworks capable of measuring multiple trustworthiness dimensions simultaneously [37,38]. HELM represents a foundational effort to standardize cross-domain benchmarking and enable broader risk assessment beyond single-task performance metrics [38]. However, HELM does not evaluate adversarial robustness, jailbreak susceptibility, or privacy leakage—the central concerns of this paper—its snapshot design cannot capture model behavior drift over time, and benchmark contamination remains a concern as models may have been trained on HELM scenarios. Similarly, DecodingTrust proposes a multi-dimensional evaluation framework assessing robustness, privacy, fairness, toxicity, and factual reliability within a unified experimental structure [37].

Importantly, DecodingTrust demonstrates that gains in one trustworthiness dimension do not necessarily generalize across others. In some cases, increased reasoning capability may enhance exploitability by enabling more coherent adversarial strategies [37]. These findings suggest that trustworthiness must be evaluated as an interacting system of properties rather than as independent safety metrics.

However, DecodingTrust was evaluated predominantly on GPT-4 and GPT-3.5, limiting generalizability to open-source or smaller models; its dimensions are largely static and do not model multi-turn adversarial interactions or agentic deployment contexts; and its fairness metrics rely on predefined demographic categories that may not transfer across cultural or jurisdictional contexts. More broadly, current holistic benchmarks remain primarily diagnostic rather than preventive. They identify failure modes but rarely provide mechanisms for continuous validation in live deployment environments. Bridging evaluation and operational monitoring therefore represents a critical research direction.

9.3. Automated Vulnerability Discovery and Continuous Validation

Manual red-teaming remains resource-intensive and difficult to scale, motivating the development of automated vulnerability discovery mechanisms [37,248]. Fuzzing-based frameworks such as FuzzLLM automatically generate and mutate adversarial inputs to expose structural weaknesses and stress-test deployed safeguards [248]. These approaches shift security from periodic auditing toward continuous adversarial validation.

Integrating automated red-teaming directly into deployment pipelines is increasingly recognized as a practical requirement for operational security [37,248]. Exploitability analysis and curated high-quality instruction datasets further define future alignment research priorities by enabling systematic exposure of latent failure modes [249,250]. Such mechanisms complement defense-in-depth architectures by proactively identifying weaknesses rather than relying solely on reactive mitigation.

Nevertheless, automated discovery frameworks remain limited in modeling complex multi-turn interaction chains and long-horizon reasoning manipulation; FuzzLLM’s template-based mutation strategies may also miss semantically novel attack vectors outside predefined perturbation patterns, and evaluation coverage depends heavily on seed prompt quality. Extending fuzzing methodologies to conversational and AI-agent-based contexts constitutes an open research challenge.

9.4. Interpretability, Causal Tracing, and Internal Representations

Understanding persistent failure modes requires deeper insight into internal representations of Transformer-based architectures [37,120,219]. Current alignment techniques primarily operate at the behavioral level, constraining outputs without fully characterizing internal activation dynamics associated with unsafe responses.

Research on neural activation analysis increasingly investigates representation clusters correlated with protection bypass, hallucination, and adversarial steering [37,248]. Latent jailbreak phenomena demonstrate that harmful behaviors may remain embedded within the model and can be activated through subtle contextual modulation [37,219]. This indicates that surface-level filtering and reinforcement learning constraints may not fully eliminate unsafe generative pathways.

Advancing interpretable alignment therefore requires causal tracing methodologies capable of identifying and modifying internal representations associated with harmful behavior. Without such mechanisms, alignment remains probabilistic rather than verifiable.

9.5. Structured Research Priorities

Based on the reviewed literature, future research directions can be structured into four complementary categories:

• Unified evaluation frameworks—development of standardized, multi-dimensional benchmarks capable of jointly measuring safety, reasoning capability, robustness, and utility across heterogeneous deployment contexts [38,107,120].
• Automated red-teaming and fuzzing—scalable mechanisms that continuously discover vulnerabilities during deployment, integrating exploitability analysis directly into operational pipelines [37,248,249,250].
• Interpretability and causal alignment—techniques that identify internal representations responsible for unsafe behavior and enable targeted modification rather than relying solely on surface-level output constraints [37,120,219].
• Verifiable guarantees—formal approaches providing measurable privacy, robustness, and safety assurances instead of relying exclusively on probabilistic behavioral expectations [37,38,219].

Collectively, these four research categories—unified evaluation frameworks, automated red-teaming, interpretability and causal alignment, and verifiable guarantees—underscore that trustworthy LLM deployment requires their integration rather than treating them as isolated research domains.

As model capability increases, improvements in usefulness may simultaneously expand exploitability by enhancing coherence, contextual reasoning, and adaptive response generation. This duality reinforces the need for continuous validation mechanisms embedded throughout the lifecycle. At present, no unified methodology provides verifiable end-to-end safety guarantees for adaptive generative systems, highlighting the necessity of coordinated technical, institutional, and regulatory development [251].

Although watermarking and provenance attribution mechanisms represent promising approaches for identifying AI-generated content, their effectiveness remains limited under paraphrasing, adversarial rewriting, and cross-model generation pipelines. Consequently, these mechanisms are treated in this review as complementary mitigation techniques rather than as standalone future research priorities [121,123,132].

10. Limitations and Future Research Directions

Limitations of this review. This paper synthesizes a rapidly evolving body of research through a narrative review approach, which carries inherent methodological constraints. First, the scope is bounded by publications available through the primary sources consulted and does not constitute an exhaustive enumeration of all relevant work; highly specialized or non-English contributions may be underrepresented. Second, the LLM security landscape evolves faster than the academic publication cycle, meaning that the attack techniques, regulatory instruments, and mitigation approaches described here may already have been refined or superseded. Third, the lifecycle model introduced in this paper is primarily conceptual: while it organizes existing findings coherently, empirical validation of the framework as a whole—for instance, whether the five lifecycle stages are necessary and sufficient for characterizing systemic risk—remains an open research task. Fourth, the application-specific analysis in Section 7 focuses on education and financial services as illustrative domains; other high-stakes deployments such as healthcare, legal decision support, and critical infrastructure warrant dedicated investigation that falls outside the present scope.

Limitations of the reviewed literature. The analysis across all sections reveals a structural methodological gap in the field itself: most empirical studies evaluate isolated threat categories under controlled laboratory conditions, using small-scale models or white-box access that may not reflect the behavior of frontier-scale proprietary systems deployed in the wild. Membership inference and privacy leakage experiments, adversarial robustness evaluations, and alignment bypass studies are largely conducted on open models, raising questions about the generalizability of findings to closed deployments where training data, fine-tuning procedures, and safety layers remain undisclosed. Benchmark fragmentation—with separate evaluation suites for toxicity, hallucination, bias, robustness, and privacy—prevents direct cross-model comparison and obscures interaction effects between safety dimensions. Governance and regulatory research, meanwhile, remains predominantly prescriptive rather than empirical, with limited longitudinal evidence on whether existing frameworks reduce harm in deployment.

Future research directions. Several directions emerge directly from the gaps identified in this review. Lifecycle-integrated safety evaluation represents the most pressing need: future work should develop unified benchmarks capable of measuring security, privacy, fairness, and reliability as interacting properties across all deployment stages simultaneously, rather than as independent metrics. Formal verification of alignment properties—establishing mathematically bounded guarantees on behavioral constraints rather than relying on probabilistic expectation—remains an open foundational challenge that would transform alignment from a best-effort procedure into a verifiable engineering discipline. Agentic and multimodal architectures represent an expanding and underexplored attack surface: LLM systems capable of autonomous tool use, multi-step planning, and cross-modal input processing introduce indirect prompt injection, tool manipulation, and adversarial perturbation through non-text modalities for which current threat taxonomies and defenses provide only partial coverage. Longitudinal empirical studies of governance effectiveness—tracking whether regulatory interventions such as the EU AI Act produce measurable reductions in documented harms—would provide the evidence base currently absent from policy discourse. Finally, the socio-technical dimension of risk requires deeper interdisciplinary investigation: the cognitive, institutional, and behavioral mechanisms through which LLM outputs influence human decision-making in high-stakes domains such as healthcare, law, and education remain poorly characterized, yet they determine the real-world consequence of model failures far more than laboratory attack success rates alone.

11. Conclusions

The unified lifecycle framework developed in this review comprises four interconnected components—the alignment gap model (Figure 1 and Figure 2), the threat taxonomy (Figure 3), the risk propagation models (Figure 4, Figure 5, Figure 6, Figure 8 and Figure 9), and the defense-in-depth architecture (Figure 7, Figure 10 and Figure 11)—which together demonstrate that LLM risk emerges as a systemic property rather than a collection of isolated flaws.

This review synthesizes the rapidly expanding body of research on LLM security, privacy, ethics, and governance into a unified lifecycle-oriented framework. By integrating interaction-layer threats, adversarial optimization techniques, training-stage compromise, privacy leakage, and regulatory accountability within a defense-in-depth perspective, the analysis demonstrates that LLM risk is not reducible to isolated implementation flaws. Rather, it emerges as a systemic property of probabilistic generative architectures interacting with complex socio-technical environments.

The findings highlight a persistent alignment gap between intended behavioral constraints and latent generative capacity. While post-training alignment, runtime safeguards, privacy-preserving optimization, and regulatory oversight reduce observable risk, none fully eliminate vulnerabilities inherent to adaptive probabilistic modeling. Security and trustworthiness therefore cannot be achieved through single-layer mitigation strategies but require coordinated protections distributed across the entire model lifecycle.

Advancing reliable deployment demands continuous automated red-teaming, unified multi-dimensional evaluation methodologies, interpretability-driven alignment techniques, and progress toward formally verifiable privacy and robustness guarantees. Equally important is the maturation of governance mechanisms capable of adapting to evolving threat models and deployment contexts.

Ultimately, trustworthy LLM integration depends on the convergence of technical robustness, privacy-aware learning, institutional accountability, and continuous lifecycle auditing. As model capability continues to expand, sustainable deployment will require not only stronger safeguards, but also adaptive governance architectures capable of managing emergent behavior in generative systems.