Embedding cryptographic canary tokens and structural delimiters in system prompts to instantly detect prompt exfiltration.
INTERACTIVE EXHIBIT 14
Semantic Firewalls & Cryptographic Canaries
LEAKAGE DETECTOR STATUS
NOMINAL
Canaries are unique per-session random hashes that should never appear in valid responses.
💡 Zero False Positives: Because canary keys are high-entropy random hashes, legitimate generations will never match by chance.
ARCHITECTURAL OVERVIEW
Semantic Firewalls & Canary Tokens
System prompts often contain proprietary intellectual property, private database schemas, and confidential business logic. Semantic firewalls enforce strict XML/JSON structural boundaries, while cryptographic canary tokens detect prompt exfiltration attacks in real time.
Cryptographic Canary Injection
A high-entropy random string (e.g. `CANARY_7X9Q2L4`) is injected into the system prompt with an absolute rule never to repeat it. If an attacker tricks the model into repeating the system prompt, an egress regex trap catches the canary.
Syntactic Delimiter Enforcement
System instructions, developer context, and user inputs are strictly encapsulated in distinct XML tags (e.g. `<system_rules>`, `<user_input>`). The parser rejects prompts where user inputs contain matching closing tags.
Automated Session Termination
Upon canary detection or delimiter breakout detection, the semantic firewall immediately drops the TCP socket, logs the attacker IP, and revokes active session credentials.
MATHEMATICAL FORMULATION · CANARY EXFILTRATION DETECTION PROBABILITY
Because the canary token possesses 64+ bits of cryptographic entropy, the probability of false-positive random generation by the LLM is < 1e-19, guaranteeing 100% precision on true exfiltration events.
REAL-WORLD PRODUCTION ENGINEERING
Rotate canary tokens per user session or per API request to prevent attackers from memorizing static canary strings.
Escape user input: replace `<` and `>` with safe HTML entities before interpolating into prompt templates.
Set up instant PagerDuty/Slack security alerts whenever a canary exfiltration trigger is tripped in production.