arXiv: Unveiling Privacy Risks in Multi-modal Large Language Models: Task-specific Vulnerabilities and Mitigation Challenges

This publication is a pre-print research paper from arXiv, not a regulatory change. It analyzes privacy vulnerabilities in multi-modal large language models (MLLMs) that process text, images, and audio. The paper identifies task-specific risks, such as models inadvertently leaking sensitive personal data from visual inputs or generating private information in responses, and highlights current technical limitations in mitigating these risks.

Organizations deploying or developing MLLMs in high-risk sectors—including healthcare, finance, legal services, and customer-facing AI products—are directly affected. Any firm subject to GDPR, the EU AI Act, or similar data protection frameworks should take note, as these vulnerabilities could lead to non-compliance with data minimization and privacy-by-design obligations.

Compliance teams should immediately review their organization’s use of MLLMs to assess whether sensitive data is processed. They should engage technical teams to evaluate current mitigation strategies, such as input sanitization and output filtering, and document any residual risks. Proactive monitoring of this research area is advised, as regulatory guidance on MLLM-specific privacy risks is expected to evolve.