Data Loss Prevention (DLP)

Real-time scanning of user prompts before they reach the retrieval engine. This layer uses named entity recognition (NER) and regular expression patterns to detect and block queries containing credentials, API keys, or PII.

• Detects accidental paste of secrets into chat interfaces
• Classifies intent to extract sensitive data (e.g., 'show me all salary information')
• Integrates with SIEM systems for alerting on policy violations

Post-retrieval inspection of all document chunks before they are injected into the LLM's context window. This capability applies field-level redaction and data masking to strip sensitive spans from authorized documents.

• Masks credit card numbers, SSNs, and health records with placeholder tokens
• Applies format-preserving encryption for structured data fields
• Logs all redaction events for audit trail compliance

A guardrail layer that inspects the LLM's generated response before it reaches the user. This catches sensitive data that survived retrieval filtering or was hallucinated by the model.

• Uses semantic similarity to detect paraphrased confidential content
• Blocks outputs containing competitor mentions or internal project codes
• Implements canary token detection to identify training data leakage

DLP for RAG extends beyond text to monitor all output channels. This includes browser extensions, API responses, and downloaded files that could carry extracted context data.

• Inspects JSON payloads in streaming responses for structured data leaks
• Monitors clipboard events in web-based chat interfaces
• Applies watermarking to generated text for downstream traceability

Integration with the Policy Decision Point (PDP) to enforce DLP rules at the retrieval stage. Queries that match high-risk patterns are blocked before any document access occurs.

• Regex-based classifiers for detecting queries targeting financial or HR data
• ML-based intent models that score query risk in real time
• Geofencing rules that block retrieval based on user location

Every DLP decision—allow, block, redact, mask—is recorded in a tamper-proof audit log. This provides forensic evidence for compliance with GDPR, HIPAA, and SOC 2 requirements.

• Captures original prompt, retrieved chunks, and final output
• Records policy ID that triggered each action
• Supports SIEM forwarding via syslog or Kafka for centralized monitoring

The permanent removal or blacking out of sensitive text spans from a document chunk during post-retrieval processing to prevent any exposure to the generation model.

• Irreversible operation — redacted content cannot be recovered downstream
• Applied using span annotations from NER models that mark character offsets for removal
• Can degrade RAG quality if redaction removes contextual cues the LLM needs for accurate generation
• Often combined with confidence thresholds to balance security and utility (redact only high-confidence PII spans)

A set of input sanitization and guardrail techniques designed to prevent malicious instructions embedded in retrieved documents from hijacking LLM behavior.

• Indirect prompt injection occurs when an attacker poisons a document that later gets retrieved into the context window
• Defenses include instruction hierarchy (system messages override retrieved content) and delimiter-based isolation
• Input validation scans retrieved chunks for known injection patterns before concatenation into the prompt
• Emerging research explores LLM-as-judge approaches where a separate model screens retrieved content for adversarial instructions

The systematic recording of every retrieval event — including user identity, query, documents accessed, and any DLP actions taken — to create an immutable record for forensic analysis and compliance.

• Captures pre-filtering and post-filtering decisions to demonstrate policy enforcement
• Must log PII detection events with timestamps, confidence scores, and actions taken (mask/block/allow)
• Immutable storage (append-only logs) prevents tampering and satisfies regulatory requirements
• Feeds into SIEM systems for real-time alerting on anomalous retrieval patterns that may indicate exfiltration attempts