AI DLP vs. classic DLP: why your DLP can't see prompts to local models

In short

• Classic DLP was built for files, email and uploads. It recognizes patterns in attachments and file transfers.
• Sensitive data leaves companies through other channels today: prompts in chat tools, context windows of coding assistants, tool calls of agents, and local models that produce no network traffic at all.
• AI DLP inspects exactly those channels, on the device, before the data is encrypted or leaves the machine.
• The two do not replace each other. Classic DLP keeps covering files, AI DLP takes over the AI interactions.

What is AI DLP?

AI DLP is data loss prevention for AI interactions. It inspects prompts, model responses and agent actions for personal data, secrets and confidential content and enforces rules before the data reaches an AI system: redact, block, or pass with an audit entry.

The difference to classic DLP lies less in detection than in location and format. Classic DLP sits at the network edge or in the email gateway and understands files. AI DLP sits on the endpoint and understands conversations.

Where classic DLP is blind

The typical discovery looks like this: a security team has DLP rules for customer data, tests ChatGPT in the browser, pastes a customer list into the prompt, and nothing happens. No alert, no block, no log. Three reasons:

Prompts are not files. DLP engines parse file formats: PDF, DOCX, XLSX, images via OCR. A prompt is a JSON field in an API call, often split across several messages, sometimes streamed. The model's answer comes back in fragments as server-sent events or over WebSockets. Classic engines have no parser for that.

Encryption hides the content. AI API calls are TLS-encrypted. Network DLP without TLS inspection sees bytes and a destination, say api.openai.com. With TLS inspection it sees the content, but only for apps without certificate pinning, and only for traffic that actually passes through the proxy.

Local models produce no traffic. Anyone using Ollama, LM Studio or a model built into the IDE sends the prompt to a process on the same machine. There is no network traffic a gateway could inspect. The same applies to agents that read files locally and only send the result out afterwards.

What AI DLP does differently

The most important row is the reaction. Classic DLP can hold back an email but cannot repair a prompt. AI DLP replaces the customer number with a placeholder and lets the rest of the prompt through. The employee gets her answer, the customer number stays in-house.

How detection works on the device

Patronus Protect runs as a small piece of software on the company machine and sits in the network path before data is encrypted. AI traffic detection is behavior-based and independent of the provider: a new chat tool or an unknown API is recognized by its pattern, not by a domain list. The technical details are in the post on detection across WebSockets, SSE and gRPC.

Content inspection uses local models from our model zoo: Orca Sonar classifies the document type (contract, HR file, source code, financial report), GLiNER-based models extract personal entities, deterministic rules catch secrets such as API keys and tokens. The result is available in milliseconds, without the prompt leaving the device.

The policy decides per data type and application. Examples from practice:

• Customer data in ChatGPT: redact, pass the rest
• API keys in any prompt: block
• Source code to an unapproved provider: block, allow to the approved one
• Internal documents to a local model: allow, but log

How to recognize AI DLP that deserves the name

Five questions help when comparing solutions:

1. Does it see local models? If the answer is "through the proxy", the answer is no.
2. Can it redact instead of only block? Blocking alone pushes people to private devices.
3. Does it understand streams? Responses arrive as SSE or WebSocket frames. Inspecting only at the end means the data already passed.
4. Does it inspect agent actions? A coding agent that reads a .env file and packs the content into an API call is the most common leak path in development environments.
5. Where do prompts go for inspection? If they are sent to a cloud for analysis, the privacy problem has only moved.

What this means for the architecture

Classic DLP stays. Files, email attachments and uploads still need the existing rules. AI DLP adds the channel that appeared in the last two years, and the only place where both worlds meet is the device. That is where the prompt is written, where the agent runs, where the local model lives.

How Patronus implements this is on the AI DLP solution page. In the live demo you can see, on one example, what reaches the provider and what gets redacted.

Sources and context

• The description of classic DLP follows the usual product categories (network DLP, email DLP, endpoint DLP for file transfers). Vendor-specific features were deliberately not assessed.
• On agent tool calls and MCP: The MCP attack surface nobody is securing.
• As of September 7, 2026.