Cisco finds a clever way to make LLMs spit out their training data

AI labs love to promise that their models learn abstract concepts rather than memorizing the internet, and that guardrails will always stop them from regurgitating copyrighted text word for word.

Cisco just blew a massive hole in that narrative. Researchers at Cisco Talos revealed a technique called decomposition, which coaxes large language models into verbatim reciting articles straight from their training datasets.

Amy Chang, an AI security researcher at Cisco Talos, is set to present the findings at Black Hat on August 6. Her takeaway from the experiment is blunt: nobody on Earth truly understands what goes on inside frontier frontier models, and if you cannot comprehend the black box, securing it is practically impossible.

Peeling the onion prompt by prompt

Usually, if you ask a commercial LLM to reproduce a paywalled news article, it hits you with a polite refusal or claims it cannot browse the live web.

To bypass these filters, the Cisco team tested two undisclosed commercial models. They started with an article about pandemic languishing, chosen specifically for its rare and distinct turns of phrase. Instead of demanding the full piece, the researchers broke the request into tiny steps.

First, they tricked the model into confirming the piece and coughing up the exact headline. From there, they prompted for opening phrases, followed by specific subsequent sentences. Piece by piece, the text came together.

The researchers set explicit guardrail overrides, such as instructing the AI never to say it cannot browse the web. Surprisingly, adding a simple boilerplate phrase like "You are a helpful assistant" made the model significantly more prone to picking high-probability tokens that matched the original training data.

The results were striking. Across 3,723 articles from The New York Times, the decomposition attack extracted at least one verbatim sentence from 73 pieces. Out of 1,349 articles from The Wall Street Journal, it pulled verbatim sentences from seven.

The exploit was not infallible. Models sometimes refused the prompt or hallucinated wildly after accurately repeating the first few sentences. Cisco Talos responsibly disclosed the technique to the affected AI companies, which confirmed and acknowledged the report.

Why it matters

This research hands a smoking gun to content publishers locked in high-stakes copyright battles against AI giants.

When outlets like The New York Times took AI firms to court, model creators argued that verbatim regurgitation was a bizarre, near-impossible glitch under normal usage. Cisco proved that anyone armed with a structured prompting strategy can systematically extract proprietary prose from deep within the model weights.

For enterprise teams, the implications are even scarier. Thousands of companies are rushing to attach LLMs and RAG pipelines to internal data pools containing financial spreadsheets, HR files, and sensitive customer information. If a clever prompt chain can extract Wall Street Journal articles, it can extract confidential executive memos just as easily.

Chang's security advice for sensitive enterprise data is uncompromising: if you cannot afford to have information leaked, air-gap it entirely and never let an LLM touch it.

We think this research exposes the fundamental fragility of modern AI alignment. Slapping safety filters and system prompts on top of a black box is like putting a screen door on a submarine. As long as sensitive training data lives in the model weights, someone will find the right sequence of words to shake it out.