CADLP | Context-Aware Data Loss Prevention for LLMs

How it works

The Contextual Sensitivity Classifier (CSC) runs four stages in cascade. Each stage emits a SensitivityMap that drives the Policy Engine, which issues an ALLOW, REDACT, BLOCK, or QUARANTINE decision before the prompt reaches the LLM API.

1 Regex + Entropy (fast path)

High-confidence structured secrets: API keys, private keys, JWT tokens, SSNs, credit cards, email addresses, and high-entropy opaque strings. Handles ~75% of sensitive prompts with sub-millisecond latency.

2 NER + Disambiguation

Named entity recognition with operational vs. exemplary disambiguation. Entities in hypothetical examples are suppressed; entities in action-verb contexts are escalated. Catches person names, org codes, and ticket IDs.

3 AST Code IP Fingerprinting

Parses embedded code blocks, analyzes import graphs and identifier patterns against an internal symbol corpus. Flags proprietary code fragments that neither regex nor NER can detect.

4 Semantic / KB Similarity

TF-IDF cosine similarity against an internal terminology knowledge base identifies domain-specific jargon and project codenames that appear innocuous to general NER models but carry confidential meaning.

Why CADLP

Shadow AI is the defining enterprise data risk of this decade: employees using consumer LLM tools inadvertently expose credentials, PII, and proprietary code with no organizational visibility once it leaves the network boundary.

Closes the Shadow AI exposure gap. A transparent proxy requires no change to employee workflow while intercepting every outbound prompt for sensitivity analysis.
Detects what regex alone misses. The four-stage cascade catches internal terminology and proprietary logic that pattern-matching cannot identify.
Preserves LLM utility after redaction. Typed, indexed placeholders ([EMAIL_1], [API_KEY_1]) maintain referential consistency across multi-turn sessions so redacted prompts still produce useful outputs.
Zero-retention audit logging. Only metadata is logged; raw prompt content is never persisted, satisfying compliance requirements without sacrificing traceability.
Open and independently verifiable. Apache 2.0, 90 tests, and a SEPAD-10K benchmark sample so detection claims can be reproduced.

Detection coverage

Evaluated on the SEPAD-10K synthetic enterprise prompt benchmark.

Entity type	Stage	Method	Confidence
API Keys (OpenAI, AWS, etc.)	1	Regex	0.95 – 0.99
Private Keys / JWTs	1	Regex	0.95 – 1.00
SSN / Credit Cards / Email	1	Regex	0.85 – 0.95
High-entropy Secrets	1	Shannon Entropy	variable
Person Names / Org Codes / Ticket IDs	2	NER + Disambiguation	0.60 – 0.95
Proprietary Code Fragments	3	AST + Import Analysis	variable
Internal Terminology / Codenames	4	TF-IDF Similarity	variable

Quick start

Python 3.9+ required. No external dependencies for the base install.

pip install cadlp

from cadlp import ContextualSensitivityClassifier, UtilityPreservingRedactor
from cadlp.policy.engine import PolicyEngine, Action

csc    = ContextualSensitivityClassifier()
upr    = UtilityPreservingRedactor()
policy = PolicyEngine()

prompt   = "Please reset the password for alice@company.com. Her SSN is 234-56-7890."
smap     = csc.classify(prompt)
decision = policy.evaluate(smap)

if decision.action == Action.REDACT:
    result = upr.redact(smap)
    print(result.redacted_prompt)
    # "Please reset the password for [EMAIL_1]. Her SSN is [SSN_1]."

Stop sensitive data from reaching LLM APIs