Five egress signals, with the strongest attribution first

A remembered canary receives specific attribution because GuardLLM already knows its value. The other four signals do not.

You are here
SourceEgressSink

1. Remembered canary

BLOCKED
GuardLLM provisioned this token itself, so a match is identification rather than inference. Host-provisioned token: CANARY-0f0...fb03
Canary token detected in outbound content; canary_detected=True; session_escalated=True

2. Known credential format

BLOCKED
A complete synthetic credential matches a known pattern.
Secret pattern detected: OpenAI API key, High-entropy token (4.9 bits)

3. Opaque random-looking token

BLOCKED
A9x2Qm7Lp4Vz8Tr1Nk6Ws3Hy5Jd0Fc
Secret pattern detected: High-entropy token (4.9 bits)

4. Whitespace splitting

BLOCKED
A9x2 Qm7L p4Vz 8Tr1 Nk6W s3Hy 5Jd0 Fc
Secret pattern detected: High-entropy token (4.9 bits)

5. Hex decode then byte entropy

BLOCKED
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
Secret pattern detected: High-entropy token (hex-decoded 4.9 bits)
Evidence, scope, and reproduction

Scope and instrumentation

Each signal below runs on its own fresh, named pipeline. These are independent comparisons, not one five-step session.

Adversary A1/A2EgressT-IN9A-AS9Source: SecurityPipeline.check_outboundTest: tests/test_demo_scenarios.py

Exact fixture test: tests/test_demo_scenarios.py::test_dlp_canary_fixture

.venv/bin/python -m pytest tests/test_demo_scenarios.py::test_dlp_canary_fixture -q

Generated fixture