(TR05) (INCYBER) Patrimoine informationnel : nouveaux défis face au Shadow AI

Value of the Information & Strength of the Argument

The value of the information lies in the diverse perspectives of the panelists, who bring practical experience from legal, cybersecurity, and IT leadership roles. They provide concrete examples and case studies, such as the Samsung data leak and a subcontractor breach, which illustrate the real-world consequences of Shadow AI. The argumentation is solid, as the experts build on each other’s points to present a balanced view: while Shadow AI is a risk, it is also a driver of innovation. They argue that the primary threat is not direct data leakage but the diffuse extraction of strategic information through model inference, and they emphasize the need for governance and visibility rather than outright prohibition. The discussion is well-structured, with each expert contributing unique insights, and the moderator effectively guides the conversation to cover legal, technical, and organizational aspects.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the discussion is based on professional experience and anecdotal evidence rather than peer-reviewed research. The sources cited are primarily the panelists’ own expertise and a few public incidents (e.g., Samsung, Microsoft Copilot). The description provides links to the INCYBER forum and LinkedIn, which are relevant but not directly cited in the discussion. The title accurately reflects the content, focusing on the challenges of Shadow AI to information patrimony. The discussion does not delve into technical details of AI models, but it does reference concepts like prompt injection and model fine-tuning, which are explained in an accessible manner. Overall, the content is informative but lacks rigorous citations, making it more of an expert opinion than a scientific review.

The title accurately reflects the content, which focuses on the challenges of Shadow AI to information assets, though the discussion also covers broader AI governance and cybersecurity issues.

7/10

The discussion features experienced professionals from legal, cybersecurity, and IT leadership backgrounds, providing practical insights and real-world examples. However, the content is largely opinion-based and lacks rigorous scientific citations or data, which limits its reliability as a purely factual source.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction of panelists and their backgrounds.
• 05:00Marine Brogli discusses the changing nature of the threat, citing the Microsoft Copilot incident.
• 08:00Grégory Margoline defines Shadow AI and its legal implications.
• 12:00Raphaël Marichz argues that Shadow AI is not the main risk, highlighting issues with legitimate AI use.
• 15:00Lionel Yonel Shane emphasizes the importance of AI adoption and the need for transparency.
• 20:00Discussion on the risk of information reconstruction and the shift in information patrimony.
• 25:00Raphaël explains the technical limitations of extracting specific data from AI models.
• 30:00Lionel discusses the need for visibility and governance, mentioning proxy LLMs and guardrails.
• 35:00Grégory shares a real case of a data breach involving a subcontractor and the legal consequences.
• 40:00Marine concludes that protecting data alone is insufficient; the entire information patrimony must be considered.

• Forum INCYBER Europe — Mentioned as the organizing event for this roundtable discussion.
• INCYBER Europe LinkedIn — Provided as a contact point for the forum.

• Samsung bans generative AI tools after ChatGPT leak — Referenced in the discussion as an example of a company restricting AI use due to data leakage concerns.
• Microsoft Copilot AI leak exposes sensitive data — Mentioned as an incident where a legitimate AI tool exposed sensitive information, illustrating risks beyond Shadow AI.

• AI models can memorize and leak training data — Contradicts the claim that specific data cannot be extracted from AI models, as research shows models can memorize and leak training data under certain conditions.