Egress Content Guard

Scans generated text for patterns matching Personally Identifiable Information (PII) , Protected Health Information (PHI) , and secrets before release.

• Uses regex patterns and Named Entity Recognition (NER) to detect credit card numbers, social security numbers, and API keys.
• Replaces detected entities with placeholder tokens like [REDACTED] or type-preserving synthetic data.
• Prevents accidental leakage of training data memorized by the model, addressing a key model inversion risk.

Inspects output for hyperlinks and domains, blocking those associated with malware, phishing, or adult content.

• Cross-references extracted URLs against real-time threat intelligence feeds and blocklists.
• Strips or defangs malicious links (e.g., hxxps://malicious[.]com) rather than passing them to the user.
• Mitigates indirect prompt injection payloads that instruct the model to generate links to attacker-controlled infrastructure.

Detects and blocks outputs that contain fragments of the model's confidential system prompt or internal instructions.

• Compares output embeddings or n-gram overlaps against a secure hash of the system prompt.
• Prevents attackers from successfully executing a prompt leaking attack, which is often the reconnaissance phase of a more complex jailbreak.
• Ensures proprietary prompt engineering intellectual property remains confidential.

Applies a secondary classification layer to the raw model output to enforce content safety policies.

• Utilizes a specialized guard model or toxicity classifier to score output against categories like hate speech, violence, and self-harm.
• Can rewrite or block non-compliant responses, acting as a safety net for the primary model's internal refusal training.
• Provides an auditable, deterministic policy enforcement point independent of the generative model's stochastic behavior.

Validates that the model's output strictly conforms to an expected schema when structured output enforcement is required.

• Parses generated JSON, XML, or YAML and validates against a predefined schema definition.
• Blocks or rewrites malformed outputs that could cause parsing errors in downstream applications.
• Prevents injection attacks that attempt to break out of a structured format to inject free-form malicious content.

Analyzes generated code blocks for malicious patterns before they reach a code execution sandbox or the user.

• Detects shell injection attempts, unauthorized system calls, and obfuscated payloads within generated scripts.
• Strips dangerous functions or flags them for human review, providing a safety layer before any code is executed.
• Essential for agents with tool calling capabilities, preventing an injection from translating into a remote code execution exploit.

The practice of designing robust system-level instructions that resist override attempts. A hardened prompt explicitly defines the instructional hierarchy, clearly separating untrusted data from trusted directives.

• Uses delimiters to create unambiguous boundaries between user input and system commands
• Employs explicit refusal clauses for common injection patterns
• Defines a strict instructional hierarchy where system > user > tool
• Repeatedly reinforces critical safety instructions throughout the context window

A secondary, often smaller and faster model that screens both inputs and outputs independently of the primary model. It acts as a policy enforcement layer that detects policy violations, toxic content, or injection attempts.

• Operates as a binary classifier for safe vs. unsafe content
• Can be fine-tuned on organization-specific safety policies
• Provides an independent audit trail separate from the primary model
• Often deployed as a lightweight model for low-latency screening

A security checkpoint that validates every function call or API request a model attempts to make before execution. This prevents an injection attack from autonomously triggering destructive actions.

• Validates parameters against a strict allowlist of permitted operations
• Requires human-in-the-loop approval for sensitive actions like database writes or external API calls
• Logs all tool invocation attempts for forensic analysis
• Implements rate limiting to prevent automated exploitation

A Web Application Firewall-like layer deployed at the API gateway that inspects and blocks malicious prompts before they reach the language model. It uses signature-based detection and behavioral heuristics.

• Analyzes prompts for known injection patterns and adversarial prompt detection signatures
• Measures perplexity to identify crafted or anomalous inputs
• Can block requests based on semantic similarity to known attack vectors
• Integrates with existing SIEM and security monitoring infrastructure

Constrains the model to generate responses exclusively in a specific, machine-readable format like JSON or XML. This prevents free-form text that could contain injected instructions or leaked system prompts.

• Uses grammar-constrained decoding to enforce valid syntax
• Rejects any output that deviates from the expected schema
• Prevents the model from executing instructions embedded in its own output
• Essential for systems where model output feeds into downstream automated processes