AI / ML Security — Detection, Trust Boundary, Governance

Audit Log IntegritygovernanceAn audit log is only as good as the guarantees you can make about it under adversarial review. Confidential Computing for On-Prem InferenceencryptionWhen privileged matters are pinned to an on-prem model, the trust boundary shrinks to the physical server… Data Residency & Sovereignty RoutinggovernanceSensitivity-tier routing decides which model handles a request (cloud vs. Differential Privacy for AggregatesprivacyA firm running document intelligence across hundreds of matters will eventually want cross-matter analytics:… Format-Preserving Encryption (FPE)encryptionAES ciphertext of an SSN looks like a 256-bit blob; a downstream system expecting cannot validate it, index… Homomorphic Embedding SearchencryptionIn a conventional RAG pipeline, the user's query is embedded on the application server and then sent in… k-Anonymity & l-DiversityprivacyReleasing a dataset — a discovery set, a training corpus, a research extract — is different from running a… Output Filtering & Canary Tokensllm defenseIngest-time redaction ( see the redaction page ) removes PII and privileged content from prompts before… Personally Identifiable Information (PII) & Privileged-Content Redaction on IngestprivacyIn a legal document-intelligence platform, the single riskiest moment in the data lifecycle is ingest . Prompt-Injection Defense for RAGllm defenseIn a retrieval-augmented generation (RAG) pipeline, the documents retrieved from the vector store are spliced… Right-to-Erasure (GDPR Art. 17) in a Vector StoreprivacyGDPR Article 17 — the right to erasure, colloquially "right to be forgotten" — requires that, when a data… Secrets & Key RotationencryptionA legal-tech platform accumulates secrets quickly: per-tenant encryption keys, vault data-encryption keys,… Structured-PII Detection with Microsoft PresidioprivacyThe regex + spaCy pipeline on the PII redaction page is fast and transparent, but extending it to new entity… Supply-Chain Security for Model ArtifactsgovernanceOn-prem inference reduces the exposure of prompt and response data — but only if the model you are running is… Tokenization vs. Pseudonymization vs. AnonymizationprivacyThree terms are used almost interchangeably in marketing copy and mean meaningfully different things under… Encryption & KeysSectionEncryption for AI workloads: confidential computing, format-preserving and homomorphic encryption, and key… GovernanceSectionAudit-log integrity, data residency and sovereignty routing, and supply-chain security for model artifacts. LLM DefenseSectionDefending LLM applications: prompt-injection defense for RAG, and output filtering with canary tokens. PrivacySectionProtecting personal data in AI pipelines: PII detection and redaction, pseudonymization, k-anonymity,…

This section captures the security architecture used to run an AI document-intelligence platform for legal and healthcare workflows, where every uploaded file may contain attorney–client privileged material, protected health information, or other regulated content. Security here is not a feature bolted on after launch — it is the design constraint that determines how documents are ingested, where inference runs, who can see results, and what the system remembers.

The core principle is defense in depth with policy-driven routing: every document is classified by sensitivity on ingest, redacted before any model ever sees it, encrypted everywhere it lives, and routed to the model tier that its classification permits — never left to user discretion. Every query and retrieval is recorded with enough context to reconstruct "who saw what, when, and why" during a compliance review.

Design Pillars

Ingest-time redaction — PII and privileged content are detected and masked before any text is persisted, embedded, or sent to an external model provider.
Encryption at rest and in transit — AES-256 for storage, TLS 1.3 for every network hop, envelope encryption with customer-managed keys.
Role-based access control aligned to matter management — RBAC mirrors the legal team's matter-centric org model with per-matter ACLs and ethical-wall enforcement.
Full audit logging — every query, retrieval, and model call recorded in append-only, hash-chained logs signed for compliance review.
Provider routing by sensitivity tier — a policy layer classifies each request and pins privileged matters to the on-prem model by policy rather than user discretion.

Subsections

Detection & Transformation

PII & Privileged-Content Redaction — regex + spaCy NER + domain lexicons; reversible tokenization; quarantine path.
Differential Privacy for Aggregates — Laplace/Gaussian noise on counts and averages under an ε/δ budget.
k-Anonymity & l-Diversity — generalization and suppression on quasi-identifiers before dataset release.
Format-Preserving Encryption (FPE) — FF1/FF3-1 for realistic non-prod data and legacy format constraints.
Tokenization vs. Pseudonymization vs. Anonymization — taxonomy and GDPR treatment.
Structured-PII Detection with Microsoft Presidio — pluggable recognizers for legal identifiers.

Trust Boundary & Inference-Time Protection

Prompt-Injection Defense for RAG — content sanitization, tool-use allowlists, the two-prompt pattern.
Output Filtering & Canary Tokens — leak scanning, re-emergence detection, exfil canaries.
Confidential Computing for On-Prem Inference — Intel TDX, AMD SEV-SNP, attestation, confidential GPUs.
Homomorphic Embedding Search — SEAL / OpenFHE / TenSEAL for encrypted query vectors.

Governance & Lifecycle