AI Security Atlas › All entries › RAG & Knowledge Retrieval Security
Output Filtering & PII Anonymization
Post-generation filters redact PII, secrets, and out-of-policy content before the response is delivered.
Open in the interactive atlas →Impact
Provides a last line of defense when retrieval or generation still surfaces sensitive spans.
Why this severity
Guardrails take the highest severity of the risks they mitigate: Unauthorized Document Exfiltration (High), Indirect Prompt Injection via Documents (Critical).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- Unauthorized Document Exfiltration Threat · High severity
- Indirect Prompt Injection via Documents Threat · Critical severity
Remediation
- Run deterministic PII/secret detectors on every completion.
- Replace matches with typed placeholders and log redaction counts.
- Block responses that fail policy classifiers above threshold.
How to verify
- Canary SSNs and API keys never leave the filter unmasked.
- Redaction metrics alert on sudden spikes.
Pattern
return redact(completion, { pii: true, secrets: true });Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM02:2025 Sensitive Information Disclosure
- LLM05:2025 Improper Output Handling
MITRE ATLAS
- AML.M0020 Generative AI Guardrails
NIST AI RMF 1.0
- MEASURE 2.10 Privacy risk of the AI system is examined and documented