What Is Inference, And Why Should Boards Care?

In intelligence tradecraft, inference is the practice of deriving conclusions from fragments of information that, individually, seem harmless. A single puzzle piece tells you nothing. But assemble enough of them and the picture becomes clear. This principle has shaped espionage for centuries. It now applies, at industrial scale and machine speed, to every interaction your workforce has with AI platforms.

The threat is not the employee who pastes source code into ChatGPT—though that happens too, as Samsung discovered to its cost. The more subtle, more pervasive, and arguably more dangerous threat is the one hiding in plain sight: the cumulative portrait of your organisation assembled from thousands of ordinary queries from ordinary employees just trying to do their jobs better.

Boards that dismiss this as a theoretical risk should consider the following scenario before reading further.

This Is Not New. Your Supermarket Already Does It.

Before exploring the AI-specific threat, it is worth grounding it in something your board members understand instinctively: commercial data inference. Because the techniques are identical. Only the target has changed.

The Loyalty Card Revelation

When Tesco launched the Clubcard in 1995, it was not offering customers a discount scheme. It was acquiring a surveillance apparatus. The economist Clive Humby, who designed it, described what happened when Tesco first analysed the data: the supermarket’s CEO told him it was like a “bomb going off.” They had not known their customers at all.

A loyalty card captures what you buy. But what the algorithms infer from that is qualitatively different. A well-known example: retailers can identify pregnancy in customers who have not disclosed it, based on changes in purchasing patterns—switching from scented to unscented products, buying certain vitamins, adjusting food choices—weeks before any public announcement. The US retailer Target famously sent pregnancy-related coupons to a teenager before her father knew she was pregnant. The data was never wrong. It was just drawing conclusions the customer did not know she had shared.

Google and Facebook operate on an identical model, simply applied to digital behaviour. The product you search, the articles you linger on, the ads you ignore—none of these individually identify you as a prospect for anything. Collectively, they build a predictive model of your intentions with striking accuracy. A user does not have to click on a cancer charity advertisement for Google to infer health anxiety. Prolonged engagement with health articles, searches with specific symptom terms, and changed purchasing patterns are enough.

When The Obvious Leak Is Not The Real One: The Samsung Case

In March 2023, Samsung’s semiconductor division lifted an internal ban on ChatGPT. Within three weeks, three separate incidents had occurred. One engineer pasted proprietary source code into ChatGPT to debug it. Another submitted code for yield and defect measurement. A third recorded an internal meeting, transcribed it, and sent the transcription for summarisation.

Samsung banned generative AI tools company-wide within weeks and began developing an internal AI platform. JPMorgan, Apple, Amazon, Verizon, and Deutsche Bank followed with similar restrictions.

The Samsung incident is important. But the security community’s focus on it may have inadvertently miseducated boards. The lesson absorbed by most organisations was: do not paste sensitive files into AI tools. That lesson, while correct, addresses only the most visible manifestation of a much larger problem.

The Invisible Biography: How AI Platforms Build Organisational Profiles

AI platforms, by design, retain interaction data. The stated purposes are model improvement, personalisation, and service quality. The privacy implications are regularly disclosed in terms of service that almost nobody reads. But the deeper question is not what these platforms store—it is what can be inferred from what they store.

The Inference Layers

Queries to AI platforms reveal intelligence across multiple dimensions simultaneously:

The critical point is that none of this requires access to the answers the AI provides. The queries alone constitute the intelligence picture.

The Deepest Layer: You Are The Data

There is a further dimension that most security discussions never reach, because it feels too abstract until it is demonstrated concretely. It concerns not the content of what people ask AI tools, but the way they ask it.

Keystroke Dynamics: The Biometric You Did Not Know You Had

Keystroke dynamics is the science of identifying individuals by the rhythm of their typing. It is not your words. It is the intervals between keystrokes, the duration of each keypress, the speed transitions between different letter combinations, the characteristic errors you make and correct. These patterns are as unique to you as your fingerprint, and—crucially—they are largely unconscious. You cannot fake them under pressure the way you might fake a password.

NVIDIA’s security research team has publicly described a system that builds a deep learning model for every user account on a network. The system learns how you type, when you type, what services you use, and in what sequence. When the pattern deviates, an alert fires. Their head of cybersecurity engineering described it simply: “We need to look for when Bartley is not acting like Bartley.”

The same technology that makes this a security control also makes it an attack vector. If an adversary has access to your keystroke patterns from AI platform interactions, they can:

• Identify specific individuals within an organisation by their typing signature, even without knowing their name
• Track the same individual across different platforms and sessions
• Correlate query patterns with individual roles—inferring seniority, function, and access level
• Detect when a high-value target (a CFO, a CISO, a board member) is the one typing

Language As Identity: The Cognitive Fingerprint

Beyond keystroke dynamics, research into what has been called the “cognitive fingerprint” reveals that the way individuals structure their language, their characteristic sentence patterns, their vocabulary preferences, and their problem-framing styles are distinctive enough to identify them with high reliability. A DARPA-sponsored project demonstrated that unique problem-solving sequences—even in abstract cognitive tasks—could verify individual identity as reliably as conventional biometrics.

Applied to AI interactions: a lawyer who consistently frames queries in conditional structures, an engineer who always begins with the constraint before the goal, a strategist who anchors every question in competitive context—these patterns are identity markers. They persist across sessions. They are not affected by VPNs, incognito mode, or pseudonymous accounts.

Researchers have noted that these language patterns can also inadvertently disclose sensitive attributes the user never intended to share: ethnicity, region, mental state, cultural background. The AI system does not need to be told these things. It infers them from the texture of the interaction.

The Aggregation Attack: How Small Pieces Build The Picture

Intelligence professionals call this “mosaic theory.” No single tile in a mosaic is a picture. But arrange enough tiles and a coherent image emerges. Adversaries—whether state-sponsored intelligence services, organised criminal groups, or well-resourced competitors—are now applying mosaic theory to the AI query streams of target organisations.

The attack does not require compromising the AI platform itself. It requires access to the query stream. That access can come through multiple routes:

The OmniGPT breach in early 2025 is instructive here. Attackers exposed 30,000 user email addresses, phone numbers, and 34 million lines of chat messages—along with thousands of private API keys. The chat messages were not incidental. They were the target. Every query in that dataset was a window into the intentions, concerns, and capabilities of the organisations whose employees had used the platform.

The Asymmetry Your Employees Don’t Understand

The failure here is not one of malicious intent. It is one of mental model. Your employees have a framework for data security built around documents, files, and systems. They know not to email sensitive spreadsheets to personal accounts. They know not to leave printed board packs on trains. They have been trained, briefed, and certified on these behaviours.

Nobody told them that the context in which they ask a question is itself a disclosure. Nobody explained that the AI platform they are using for a productivity boost is, simultaneously, building an organisational intelligence profile with every query. Nobody made the connection to the loyalty card analogy—which, if you did it on the street rather than the supermarket, we would call surveillance.

What Boards Should Ask This Week

Three Actions This Week