You can sandbox applications, but LLM training data is sent over the same communication channels as application specific data. The common way here is to force an always-on connection behind an access gate for as many features as possible, so you‘ll think twice about disconnecting <llm-enabled-app> entirely from phoning home.