NeedToKnow

Organizations fine-tune language models on internal documents and restrict what each user may see. These restrictions are defined over documents. A fine-tuned model holds facts rather than documents, and it can combine facts that come from different documents. A user may then obtain a restricted fact that no document they may read states. In database security, such a path is called an inference channel.

NeedToKnow measures this on synthetic organizations, where every label is known. For each world it lists every fact the documents imply, with the facts and offices each one depends on, and it scores answers by exact matching, without a human or model judge.

For teams that deploy fine-tuned models. A method implements one interface: build a deployment from documents labeled by office, then answer a reader with a given clearance. NeedToKnow reports stated, derived and open-request leakage, retained utility and adapter counts, next to four reference controls.

It runs where the model runs. The worlds are synthetic and the scoring is code, so the benchmark runs offline on the hardware the model will be deployed on, including air-gapped systems. Rerunning on the same private worlds after a change of model or recipe gives a regression test.