Third-Party Confidential Information in Training Data: NDA and Trade-Secret Screening

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Why a buyer can inherit someone else's trade secret

A buyer's exposure comes from the definition of misappropriation, which reaches recipients and not only the original leaker. Under 18 U.S.C. 1839(5), misappropriation includes acquiring a trade secret by a person who knows or has reason to know it was acquired by improper means, and using or disclosing it when the person knew or had reason to know it was derived through someone who owed a duty to keep it secret [1]. "Improper means" in 1839(6) includes breach of a duty to maintain secrecy, while reverse engineering and independent derivation are excluded [1].

The qualifying bar for a trade secret is low enough to sweep in ordinary business files. Section 1839(3) covers financial, business, scientific, technical and engineering information of any form, provided the owner took reasonable measures to keep it secret and it derives independent economic value from not being generally known [1]. Pricing models, bill-of-materials files, test procedures, source code and customer lists can all qualify.

The practical consequence is a notice problem. A corpus whose documents say "Confidential: Property of [another company]" on every page gives a recipient reason to know, and continuing to train on it after that notice is the fact pattern counsel should want to avoid. Treat confidentiality legends as notice, not noise.

Where other parties' confidential information hides in operational data

Third-party secrets cluster in predictable places in the support, sales, engineering, legal and finance records AI teams license. The supplier owns its own records, but many of those records exist only because another company shared information under an NDA, a master services agreement or a professional duty. Our hub on provenance, rights and permitted use covers the supplier's own ownership; this page is about the content inside that it does not own.

Common high-risk locations:

• Customer-supplied specifications and drawings in engineering ticket systems (Jira attachments, PLM exports, CAD files with the customer's title block).
• Deal-room exports from M&A, financing or vendor diligence, often as Datasite or Intralinks folder dumps with index numbers and watermarks.
• Email and chat with partners and customers containing forwarded pricing, roadmaps, incident reports or source snippets; see third-party content inside licensed corpora for attachments and quoted text more broadly.
• Professional-services files where the supplier is a service provider: accounting workpapers, legal matter files, consulting deliverables. Duties like the AICPA Confidential Client Information Rule bar members in public practice from disclosing client information without specific consent [7]. Our guide on client data held by service providers covers the authorization chain.
• Screen recordings and agent trajectories that capture a customer's portal, a partner's dashboard or a competitor's tool; see screen recordings and third-party content.
• Code repositories with vendored proprietary libraries, licensed SDKs or customer forks, plus embedded credentials; pair this screen with secrets removal in code datasets.

Screening signals and how to detect them

The most reliable screen combines document metadata, text patterns and supplier-declared exclusions, because no single signal catches everything. Pattern matching finds legends and watermarks; metadata finds the folders and senders that hold NDA material; only the supplier knows which counterparties it signed NDAs with.

Illustrative example: invented to show structure; it does not describe an available dataset.

Expect false positives from the supplier's own boilerplate (many companies stamp everything "Confidential") and false negatives from documents stripped of legends during forwarding. Measure both on a labeled sample of a few hundred documents before you trust the rules at corpus scale.

What to ask the supplier before data moves

The supplier is the only party that can see its own NDA obligations, so the screen starts with structured disclosures, not with your classifier. Ask for these in the due diligence questionnaire; our data provider DDQ has the surrounding questions.

Illustrative example: invented to show structure; it does not describe an available dataset.

Supplier confidentiality disclosure request (template)

1. NDA register extract. List every NDA, MSA confidentiality clause, joint development agreement and data room access agreement in force during the record period whose counterparty information could appear in the offered systems. Fields: counterparty, agreement type, effective and expiry dates, survival period, whether it restricts use beyond the stated purpose.
2. Location map. For each listed agreement, the systems, folders, matter codes, channels or repositories where covered material is stored.
3. Exclusion method. How covered material will be excluded at export (path filter, sender filter, tag filter) and who ran it.
4. Professional-duty carve-outs. Whether any records were created while providing professional services under a confidentiality duty, and the client consents relied on, if any [7].
5. Customer contract terms. Whether customer contracts or DPAs restrict use of customer-provided content, including for training; see customer contracts and DPAs.
6. Residual-risk statement. The supplier's statement that, to its knowledge after the described screen, the delivered records do not include information it received under a duty of confidentiality to a third party.
7. Notice and removal path. A named contact and process for handling a later claim that a record contains a third party's confidential information.

Make the answers feed the data rights attestation and the chain of title file, so the screen is documented where auditors and litigators will look.

Why memorization raises the stakes for confidential text

Memorization turns an ingestion problem into a disclosure problem, because a model can reproduce training text to users. Carlini et al. extracted verbatim training sequences from a production-scale language model by querying it [3], and later work extracted memorized data from deployed chat models [4]. Lee et al. found that duplicated text is memorized more, and deduplication reduces how often models emit training text [5].

A secret that appears once in a corpus is a weaker memorization target than a pricing sheet attached to hundreds of email threads, so run deduplication alongside the confidentiality screen rather than relying on either alone. NIST AI 600-1 lists intellectual property and data privacy among the risks generative AI exacerbates and suggests actions on training-data review [6]. If your models are offered as a service, also keep in mind that FTC staff warned model-as-a-service companies in January 2024 against breaking confidentiality commitments about customer data [2].

Use case matters. RAG over third-party secrets surfaces the text directly in answers; supervised fine-tuning on a few thousand examples concentrates exposure; pre-training dilutes but does not eliminate it. Set stricter exclusion thresholds for SFT and retrieval indexes than for large pre-training mixes.

Exclusion rules and documentation that hold up later

A defensible program has written exclusion rules, a record of what was removed, and a way to remove more after delivery. Courts and counterparties will ask what you knew and when, so the log matters as much as the filter [1].

• Exclude by default any document with a confidentiality legend naming an entity other than the supplier, any deal-room export, and any location on the supplier's NDA map.
• Escalate to human review customer pricing, third-party technical drawings and partner correspondence that lack legends but match a counterparty domain.
• Record each exclusion with rule ID, document hash, counterparty (if known) and reviewer in your training data use register, using record-level provenance fields so later removals target exact records.
• Plan for takedown. Keep shard-level manifests so a flagged document can be removed from future training runs and retrieval indexes, and decide in advance how you will handle checkpoints already trained on it.
• Re-screen on notice. A later letter from a third party is new notice; rerun the screen for that counterparty across all delivered batches.

On the supply side, every SourceX dataset is rights-reviewed for ownership and consents and delivered under a license that defines records, uses, term and delivery, and every release is approved by the supplying company. Diligence materials covering source, rights, preparation and allowed use are prepared per dataset. Buyers can describe the business records they need and the screening they expect.

Sourcing business records with documented rights review

SourceX sources operational datasets from US companies on request and manages the licensing process; nothing is contracted until a supplier agrees, and a request does not guarantee a match. Personal details are removed or replaced before delivery, and delivery runs through private, access-controlled workflows only after an executed agreement. Describe your data needs on the buyer page.