Watermark and Confidentiality Marking Extraction Prompt

This prompt is built for document security pipelines that must detect, extract, and classify text-based watermarks, confidentiality labels, and classification markings from document pages before those documents enter downstream processing, storage, or distribution systems. The primary job-to-be-done is auditable extraction that distinguishes between faint watermarks, overlaid text interference, and genuine classification markings. The ideal user is a document intelligence engineer or security pipeline operator who needs structured output—marking type, extracted text content, page coverage estimates, and confidence scores—that can be logged, reviewed, and acted upon programmatically. Required context includes the full page text, any available layout metadata (bounding boxes, font sizes, opacity hints), and the organization's classification taxonomy or marking dictionary.

Use this prompt when you need to prevent misclassification of documents, enforce downstream handling rules based on extracted markings, or build an audit trail of detected security labels. It is appropriate for pre-ingestion scanning of PDFs, office documents, and rasterized page images where text has already been extracted via OCR or native text extraction. The prompt expects [INPUT] containing page text and optional [LAYOUT_METADATA], plus a [CLASSIFICATION_TAXONOMY] defining the markings to detect (e.g., 'CONFIDENTIAL', 'DRAFT', 'INTERNAL USE ONLY', 'CUI', 'PROPRIETARY'). Do not use this prompt for image-only watermark detection without OCR preprocessing, for non-text visual watermarks (logos, patterns, steganography), or for documents where the classification is embedded in file metadata rather than visible on the page. It is also not a replacement for a full document classification system—it extracts markings, it does not independently classify document sensitivity.

Before deploying, validate that your OCR pipeline preserves text from faint or overlaid watermarks without dropping low-contrast content. Common failure modes include missing watermarks rendered in very light gray, conflating header/footer text with body content, and false positives from boilerplate text that resembles classification language. Wire the prompt into a harness that logs every extraction with page coordinates and confidence scores, routes low-confidence results to human review, and cross-references extracted markings against expected document handling rules. If your pipeline processes documents subject to regulatory controls (ITAR, HIPAA, CUI programs), require human confirmation for any document where the extracted marking conflicts with the expected classification or where confidence falls below your defined threshold.

This template is designed to be copied directly into your prompt management system, IDE, or orchestration layer. It uses square-bracket placeholders for all variable inputs, constraints, and output format requirements. Replace each placeholder with your specific values before use. The prompt instructs the model to extract watermark text, classify the marking type, estimate page coverage, and return a confidence score for each detected marking. It is structured to handle common failure modes such as faint watermarks, overlaid body text interference, and multiple markings on a single page.

textCopy
You are a document security classifier. Your task is to extract and classify watermarks and confidentiality markings from the provided document page text.

INPUT:
[PAGE_TEXT]

[PAGE_NUMBER]

CLASSIFICATION TAXONOMY:
[TAXONOMY]

OUTPUT_SCHEMA:
{
  "page_number": integer,
  "markings": [
    {
      "marking_text": string,
      "marking_type": string,
      "coverage": string,
      "confidence": float,
      "evidence": string
    }
  ]
}

CONSTRAINTS:
[CONSTRAINTS]

INSTRUCTIONS:
1. Identify all watermarks, confidentiality labels (e.g., CONFIDENTIAL, INTERNAL USE ONLY, DRAFT), classification banners, and security markings present in the text.
2. For each marking, extract the exact text as it appears.
3. Classify each marking into one of the types from the provided taxonomy.
4. Estimate the page coverage as one of: "full_page", "header_footer_only", "diagonal", "tiled", "corner", or "unknown".
5. Assign a confidence score between 0.0 and 1.0 based on text clarity and lack of interference from overlaid body text.
6. Provide a brief evidence string quoting the span or describing the visual pattern that led to the classification.
7. If no markings are detected, return an empty markings array.
8. Do not invent markings. If the text is ambiguous, lower the confidence score rather than omitting the finding.

EXAMPLES:
[EXAMPLES]

Adaptation guidance: Replace [PAGE_TEXT] with the extracted text content from a single document page. [PAGE_NUMBER] should be the integer page index. [TAXONOMY] must be a complete list of marking types you expect, such as CONFIDENTIAL, DRAFT, INTERNAL_ONLY, ATTORNEY_CLIENT_PRIVILEGE, WATERMARK_IMAGE, or CLASSIFICATION_BANNER. [CONSTRAINTS] can include additional rules like "ignore page numbers that resemble watermarks" or "treat text in parentheses after a company name as a potential marking." [EXAMPLES] should contain few-shot demonstrations of your specific document format, especially for edge cases like faint diagonal watermarks or markings that appear only in headers. If your pipeline processes scanned documents, include OCR artifact handling in the constraints.

Before deploying this prompt into production, validate its output against a golden dataset of documents with known markings. Pay special attention to false positives where body text is misclassified as a marking, and false negatives where faint watermarks are missed entirely. For high-risk document security workflows, route low-confidence results (below 0.7) to a human review queue. The evidence field is critical for auditability—ensure your evaluation suite checks that evidence strings actually quote or describe the detected marking rather than providing generic justifications.

This prompt is designed to operate as a dedicated stage in a document preprocessing pipeline, not as a standalone chat interaction. The extraction call should receive pre-processed page text and any available visual metadata (font size, color, opacity, z-index) from an upstream OCR or PDF parser. The model's output must conform to the defined JSON schema before any downstream security classification or redaction logic consumes it. Because confidentiality markings carry legal and compliance weight, the harness must treat every extraction as potentially incomplete and never silently drop a low-confidence result.

Wire the prompt inside a structured extraction function that accepts [PAGE_TEXT], [PAGE_NUMBER], and [VISUAL_METADATA] as inputs. After the model returns, validate the JSON against the expected schema: marking_type must be one of the defined enums (WATERMARK, CONFIDENTIALITY_LABEL, CLASSIFICATION_BANNER, NONE), text_content must be a non-empty string when marking_type is not NONE, and confidence must be a float between 0.0 and 1.0. If confidence falls below a configurable threshold (start at 0.85 for production), route the page to a human review queue with the extracted text and a rendered page image. For marking_type: NONE with confidence above 0.90, the page can bypass review. Log every extraction attempt with the model version, prompt hash, input page hash, raw output, and validation result for auditability.

Common failure modes require specific harness defenses. Faint watermarks (opacity below 15%) often produce marking_type: NONE with high confidence because the model misses the signal entirely; mitigate this by running a pre-check that boosts contrast on low-opacity text layers before extraction. Overlaid text interference—where body text sits on top of a watermark—can cause the model to extract partial or concatenated strings; implement a post-extraction deduplication check that compares text_content against known marking dictionaries and flags partial matches. Multi-page documents with inconsistent marking placement (e.g., watermark on odd pages only) require page-level extraction with a document-level reconciliation step that identifies the dominant marking and flags outlier pages for review. Always include a retry with temperature variation (0.1 to 0.3) on validation failures before escalating to human review, but cap retries at two attempts to avoid latency buildup in high-throughput pipelines.