Output Sanitization

The foundational layer of sanitization uses deterministic regex and string matching to enforce structural and compliance rules. Unlike probabilistic model outputs, these rules are guaranteed to execute with 100% consistency.

• PII Redaction: Scans for and masks patterns like Social Security Numbers (\d{3}-\d{2}-\d{4}), email addresses, and credit card numbers.
• Structural Validation: Ensures generated JSON, XML, or code blocks are syntactically valid before transmission.
• Blocklist Filtering: Removes or replaces profanity, toxic terms, and organization-specific forbidden phrases.
• Citation Format Enforcement: In legal contexts, rewrites malformed case citations (e.g., 347 U.S. 483) into a canonical format.

A secondary layer employs lightweight classifier models to detect nuanced semantic violations that regex cannot catch. These models score the raw output for specific risk categories and trigger blocking or rewriting actions.

• Toxicity Scoring: Uses models like Perspective API to detect hate speech, harassment, or threatening language.
• Topic Boundary Enforcement: Classifies if a legal assistant's output has drifted into medical or financial advice, triggering a refusal response.
• Entailment Gate: A small Natural Language Inference (NLI) model verifies that a generated summary is entailed by the source document before release.
• Prompt Injection Detection: Identifies and neutralizes residual attempts to override system instructions that may have survived the input guardrails.

A proactive sanitization technique that forces the language model to generate tokens conforming to a predefined formal grammar. This prevents structural hallucinations at the generation level rather than fixing them post-hoc.

• JSON Schema Enforcement: Guarantees the model outputs valid, parseable JSON matching a specified schema, critical for API responses.
• Legal Citation Grammar: Constrains generation to only produce citations matching a formal Backus-Naur Form (BNF) grammar of valid legal references.
• Controlled Vocabulary: Limits token selection to an approved set of terms for specific fields, preventing the invention of non-existent statutes or case names.
• Regular Expression Guidance: Applies a regex state machine during beam search to prune any token sequence that would violate a structural pattern.

A specialized sanitization pipeline that transforms identifying information to protect privacy while preserving analytical utility. This is a legal requirement under regulations like GDPR and HIPAA.

• Entity Recognition: Uses a named entity recognition (NER) model to identify persons, organizations, locations, and dates in the output.
• Deterministic Substitution: Replaces identified entities with consistent pseudonyms (e.g., 'John Doe' → 'PARTY_A') to maintain narrative coherence across multiple documents.
• k-Anonymity Enforcement: Ensures that any released data cannot be used to distinguish an individual from at least k-1 other individuals.
• Format-Preserving Encryption: Encrypts sensitive fields while maintaining the original data format, allowing downstream systems to process the output without modification.

A critical safety mechanism that instructs the system to refuse to respond rather than risk a hallucinated or harmful output. This is a core principle in high-stakes legal AI where a non-answer is preferable to a fabricated one.

• Uncertainty Threshold: If the model's internal confidence score or a conformal prediction set falls below a calibrated threshold, the output is suppressed.
• Out-of-Distribution Detection: Identifies queries that fall outside the model's defined competency boundary and triggers a canned disclaimer.
• Contradiction Flag: If the generated output contradicts a known fact in a trusted knowledge graph, the response is blocked and flagged for human review.
• Jailbreak Response: When a classifier detects that a user has successfully bypassed input guardrails, the output sanitizer replaces the entire response with a refusal message.

Every sanitization action is immutably logged to provide a complete audit trail for compliance officers and risk managers. This transforms the sanitizer from a black box into a transparent, governable system.

• Decision Logging: Records every instance where a filter was triggered, including the raw output, the rule that fired, and the final sanitized version.
• Drift Monitoring: Tracks the rate of sanitization triggers over time to detect model degradation or new attack patterns.
• Redaction Provenance: Maintains a cryptographic hash of the original output alongside the sanitized version to prove what was altered.
• Compliance Reporting: Generates structured reports demonstrating adherence to internal AI governance policies and external regulations like the EU AI Act.

A generation technique that forces a language model to output tokens conforming to a predefined formal grammar or JSON schema. Unlike post-hoc sanitization, this prevents structural hallucinations at the token level by masking invalid next-token probabilities during inference. For legal applications, this ensures extracted clauses or metadata fields are always syntactically valid before reaching any downstream sanitization filter.

The automated process of verifying that every factual claim in a generated text is explicitly supported by the provided source document. This serves as a semantic complement to output sanitization's syntactic and pattern-based filters. While sanitization blocks PII and toxic content, groundedness detection ensures legal assertions are tethered to evidence, flagging unsupported fabrications for human review.

A secondary, often smaller, language model trained to act as a critic that checks the primary model's output for factual errors, logical inconsistencies, and hallucinations before presentation to the user. This architecture creates a two-stage pipeline where sanitization handles rule-based filtering and the verifier model performs semantic fact-checking, providing defense-in-depth for high-stakes legal outputs.

A training methodology developed by Anthropic where a model is aligned to a predefined set of principles, enabling it to self-critique and revise outputs to reduce harmful or hallucinated content. Unlike output sanitization's external rule-based approach, CAI internalizes the filtering criteria during training, creating a model that inherently avoids generating content that would otherwise be caught and rewritten by post-processing layers.

A metric that quantifies the degree to which a generated statement can be directly linked to a specific segment of a source document. This provides a verifiable provenance trail for every legal conclusion. When combined with output sanitization, attribution scoring ensures that even after sanitization rewrites or redacts portions of text, the remaining content maintains a clear chain of custody back to authoritative sources.

A structured adversarial testing process where a dedicated team systematically probes an AI system to elicit harmful, biased, or hallucinated outputs. Red-teaming identifies failure modes that output sanitization rules must address, such as novel prompt injection attacks or edge cases where PII leaks through formatting tricks. The findings directly inform the regex patterns and content classifiers deployed in the sanitization layer.