The whole point is that it's learning from inputs. So either you say it's not allowed to learn new things aside from the training set or it will leak.