Aramco Uses Decoy Prompts to Block Public AI From Ingesting Data

The AI Paradox: Using Public AI Without Exposing Enterprise Data With Saudi Aramco — Ai4

Ai4

By splitting sensitive prompts into algorithmic puzzles across decoy agents, enterprises can harness frontier reasoning models while intentionally triggering provider quality filters to disqualify corporate data from training corpuses.

AI-assisted summary of The AI Paradox: Using Public AI Without Exposing Enterprise Data With Saudi Aramco — original source. Check the original for full context.

Source published: 2026-08-19

Detailed notes

## Background Published by the Ai4 channel on YouTube on August 19, 2026, this presentation features Amjad Almonzer, Knowledge Management Specialist at Saudi Aramco. According to the page description, the talk examines how organizations can leverage public frontier models like ChatGPT and Gemini without sacrificing data privacy, introducing a U.S. patent-pending operating model that combines prompt management, privacy guardrails, and controlled AI-agent execution.

## TL;DR Saudi Aramco addresses the enterprise dilemma where internal AI deployments lag behind public frontier models in reasoning power, yet directly submitting prompts exposes sensitive corporate metrics and personal data to cloud training buffers. Traditional encryption breaks model reasoning and provider opt-outs leave secondary telemetry exposed, prompting the development of a patent-pending on-premises Prompt Guard mediator. The framework anonymizes real-world identifiers, turns proprietary figures into algorithmic puzzles, and executes queries across multiple public agents using randomized decoy values. By generating contradictory duplicates and simulating machine-generated scripts, the system intentionally tricks cloud ingestion pipelines into disqualifying the prompts from future training sets while safely reassembling the authentic response on-premises.

## Atmosphere & style The presentation carries a pragmatic, highly technical, and solution-oriented tone tailored to enterprise security architects and knowledge managers. Amjad Almonzer speaks with methodical clarity, systematically dismantling the assumption that standard cloud opt-outs are sufficient for enterprise privacy. The session feels like an insider engineering briefing, shifting smoothly from the risks of prompt data exposure to an ingenious, adversarial strategy that turns public AI intake rules to the enterprise's advantage.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=DRPUyqbrraM&t=4s) Enterprise teams frequently seek access to public frontier models (e.g., ChatGPT, Gemini, Claude) because their rapid evolution, superior compute, and advanced multi-step reasoning capabilities outpace private on-premises deployments. - [00:04](https://www.youtube.com/watch?v=DRPUyqbrraM&t=4s) Directly stripping sensitive corporate data destroys semantic context, while traditional encryption methods render prompts unreadable to LLM reasoning engines. - [02:01](https://www.youtube.com/watch?v=DRPUyqbrraM&t=121s) Approximately 8.5% of business prompts contain sensitive corporate data across three tiers: PII, company identity markers, and high-stakes operational/financial metrics. - [02:01](https://www.youtube.com/watch?v=DRPUyqbrraM&t=121s) Standard provider training opt-out toggles fail to eliminate secondary leakage vectors, including system telemetry, activity logs, vendor support access, and cloud storage breaches. - [05:12](https://www.youtube.com/watch?v=DRPUyqbrraM&t=312s) Public AI providers utilize automated ingestion filters to evaluate data-sharing permissions, prompt attribution, internal consistency, and human authenticity before adding data to training corpuses. - [05:12](https://www.youtube.com/watch?v=DRPUyqbrraM&t=312s) The patent-pending Prompt Guard model deliberately exploits ingestion checkpoints by masking network origins, injecting contradictory duplicate variants, and generating machine-scripted puzzles to disqualify enterprise prompts from training buffers. - [07:48](https://www.youtube.com/watch?v=DRPUyqbrraM&t=468s) An on-premises Prompt Guard mediator uses a lightweight local LLM to swap real-world identifiers (names, facilities, tags) with realistic fictitious entities to preserve reasoning context while hiding actual identities. - [11:03](https://www.youtube.com/watch?v=DRPUyqbrraM&t=663s) Proprietary figures are converted into algorithmic puzzles paired with candidate evaluation keys that bundle genuine parameters alongside plausible decoy values. - [11:03](https://www.youtube.com/watch?v=DRPUyqbrraM&t=663s) Obfuscated puzzles are dispatched concurrently to multiple public AI agents, each executing pre-instructions to reconstruct and run the reasoning task using a specific value index. - [14:02](https://www.youtube.com/watch?v=DRPUyqbrraM&t=842s) Upon receiving completions, the Prompt Guard isolates the authentic branch, discards the decoy outputs, and re-substitutes the original identifiers before returning the result to the user. - [14:02](https://www.youtube.com/watch?v=DRPUyqbrraM&t=842s) Because public AI providers receive multiple contradictory, machine-generated requests from masked origins, the ingestion pipeline categorizes the data as unreliable noise and discards it. - [18:50](https://www.youtube.com/watch?v=DRPUyqbrraM&t=1130s) Testing demonstrates up to a 98% data protection rate for textual queries against frontier models, mitigating both direct memorization and indirect inference risks. - [18:50](https://www.youtube.com/watch?v=DRPUyqbrraM&t=1130s) The architecture implements pass-through routing for the ~91.5% of safe enterprise queries to eliminate latency, while enforcing strict stripping or on-premises confinement for high-risk multimodal inputs.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=DRPUyqbrraM&t=4s) The Enterprise AI Dilemma: Public Model Capabilities vs. Data Privacy

Saudi Aramco, Saudi Arabia's national energy enterprise and one of the largest oil and gas producers in the world with over 100,000 employees, contends with an acute enterprise AI dilemma. While many large organizations have deployed private, locally hosted AI models behind internal firewalls, enterprise teams still find themselves drawn back to public frontier models such as ChatGPT, Gemini, and Claude. Public models possess vastly superior compute resources, richer feature sets, and advanced multi-step reasoning capabilities, and they evolve far more rapidly than on-premises deployments.

```mermaid flowchart TD accTitle: Enterprise Prompt Guard Architecture

subgraph Enterprise["On-Premises Enterprise Network"] User["User Prompt"] --> PG["Prompt Guard Mediator"] PG --> Filter{"Contains PII or Sensitive Data?"} Filter -- No (~91.5%) --> Direct["Pass-Through directly"] Filter -- Yes (~8.5%) --> Anonymizer["Local AI Identifier Anonymizer"] Anonymizer --> Obfuscator["Decoy & Puzzle Generator"] Assembler["De-Anonymize & Filter"] --> Final["Return Authentic Response"] end

subgraph PublicCloud["Public Frontier AI Platform"] Obfuscator --> AgentA["Agent A (Decoy 1)"] Obfuscator --> AgentB["Agent B (Authentic Key)"] Obfuscator --> AgentC["Agent C (Decoy 2)"] AgentA --> Buffer[("Training Buffer Disqualified")] AgentB --> Buffer AgentC --> Buffer AgentA -.-> Assembler AgentB --> Assembler AgentC -.-> Assembler end ```

The core issue is that user prompts routinely contain proprietary, sensitive, or personally identifiable information (PII). Stripping this data manually destroys the semantic context required for meaningful analysis, while traditional encryption methods render the prompt unreadable to the LLM's reasoning engine, "completely blocking the reasoning." To resolve this tension, a U.S. patent-pending operating model introduces a mediator architecture designed to preserve context and leverage public reasoning power while disqualifying enterprise data from being ingested into public training sets.

[02:01](https://www.youtube.com/watch?v=DRPUyqbrraM&t=121s) Prompt Data Exposure and the Limits of Provider Opt-Outs

Industry data indicates that approximately 8.5% of all business prompts contain sensitive corporate data or direct identifiers, whereas roughly 35% of personal consumer prompts carry private data. In personal accounts, conversational history compounds this exposure over time, allowing AI providers to continuously enrich user profiles based on accumulated interactions.

In an enterprise setting, sensitive information spans three distinct tiers: 1. Personal identifiable information (PII), such as employee names, direct telephone extensions, and corporate email addresses. 2. Company identity details, including brand names, proprietary service titles, or flagship facility names. 3. High-stakes business-sensitive data, such as production metrics, unannounced technology implementations, financial models, and operational statistics.

Major public AI vendors provide privacy settings to opt out of data training, but enterprise security teams remain skeptical. Beyond direct model training on text bodies, secondary data leakage vectors persist: providers collect system telemetry, interaction analytics, and activity logs. Furthermore, vendor support engineers may gain administrative visibility during troubleshooting sessions, and any external breach of cloud storage buffers immediately exposes ingested organizational prompts to third parties.

[05:12](https://www.youtube.com/watch?v=DRPUyqbrraM&t=312s) Exploiting the AI Ingestion Pipeline: Disqualifying Data from Training Buffers

Public AI platforms evaluate prompt streams through automated qualification pipelines to determine which conversational exchanges are suitable for inclusion in future training corpuses. These systems verify data-sharing permissions, temporary session toggles, compliance with safety guardrails, prompt origin and IP attribution, the presence of duplicate or contradictory data, quality metrics, and whether the input represents an authentic human submission.

``` ┌─────────────────────────────────────────────────────────────┐ │ Public AI Ingestion Checkpoints │ ├──────────────────────────────┬──────────────────────────────┤ │ Provider Ingestion Gate │ Prompt Guard Evasion Tactic │ ├──────────────────────────────┼──────────────────────────────┤ │ Prompt Source & Attribution │ Mask IP via VPN/distributed │ │ │ global proxy servers │ ├──────────────────────────────┼──────────────────────────────┤ │ Content Reliability & Logic │ Inject conflicting decoy │ │ │ values across variants │ ├──────────────────────────────┼──────────────────────────────┤ │ Human Submission Authenticity│ Force agents to resolve │ │ │ puzzles (machine-generated) │ └──────────────────────────────┴──────────────────────────────┘ ```

The patent-pending methodology turns these ingestion rules against the model. Rather than attempting to safely pass these quality gates, the framework intentionally forces prompts to fail the qualification filters: - **Disattributing Origin**: Misattributing the location and masking corporate IP addresses to obscure organizational provenance. - **Generating Contradictory Duplicates**: Injecting plausible but contradictory variants into the provider's ingestion buffer to ruin data reliability. - **Simulating Inauthentic Submissions**: Structuring prompt reconstruction so that the public model recognizes the final prompt as a machine-generated script rather than authentic human dialogue.

[07:48](https://www.youtube.com/watch?v=DRPUyqbrraM&t=468s) The Prompt Guard Architecture and Identifier Masking

In a traditional enterprise configuration, an employee sends a prompt directly to a cloud LLM, which processes the request, returns the completion, and retains the input in a buffer where it is evaluated over several days for training suitability. The Prompt Guard framework eliminates this direct client-to-cloud link by placing an on-premises mediation server between the user and the external API.

``` [Employee Prompt] ───► [Prompt Guard (On-Prem)] ───► [Mask Network & Anonymize Entities] ```

When an employee submits an inquiry—such as requesting a financial and technical analysis of steam optimization at the "Chevron Kern River oil field" based on recommendations by an engineer named "Jane Doe" with specific well tags—the Prompt Guard initiates a multi-stage masking workflow: - The corporate IP address and geolocation are masked using enterprise VPNs or multi-region proxy servers distributed across global locations. - A lightweight, local on-premises language model scans the text to isolate corporate and personal identifiers (e.g., engineer names, company titles, field names, and hardware tag numbers). - The local engine swaps these identifiers with fictitious entity names (e.g., changing "Jane Doe" to "John Smith"). Because the reasoning task relies on relational logic rather than real-world names, substituting realistic placeholders preserves the semantic context entirely.

[11:03](https://www.youtube.com/watch?v=DRPUyqbrraM&t=663s) Obfuscation, Decoy Generation, and Multi-Agent Execution

After anonymizing identifiers, the Prompt Guard isolates the underlying proprietary parameters—such as an extraction figure of 8,000 barrels per day, a proprietary steam injection optimization technique, and specific operational cost metrics. The application converts the prompt into an algorithmic puzzle, replacing sensitive figures with parameterized variables (`P1`, `P2`, `P3`).

Alongside the puzzle, the system constructs an evaluation key containing multiple candidate options for each variable. In a three-branch setup, the key provides three plausible numerical or technical values for each parameter, where only one is authentic and the other two are generated decoys:

- **Parameter 1 (Production Volume)**: Value A (Decoy), Value B (Decoy), Value C (Authentic: 8,000 bpd) - **Parameter 2 (Technology Type)**: Value A (Decoy), Value B (Authentic: Steam Injection), Value C (Decoy) - **Parameter 3 (Financial Impact)**: Value A (Authentic: Cost Metric), Value B (Decoy), Value C (Decoy)

The Prompt Guard dispatches the obfuscated puzzle simultaneously to a minimum of three distinct public AI agents. Each agent receives a pre-instruction script mandating that it programmatically resolve the puzzle, substitute a specific candidate index, reconstruct the full prompt text, and execute the analytical reasoning. The permutation index for the true values is randomized per query and known exclusively to the on-premises mediator.

[14:02](https://www.youtube.com/watch?v=DRPUyqbrraM&t=842s) Response Assembly and Poisoning the Training Buffer

Once all three external agents complete execution, they transmit their outputs back to the on-premises Prompt Guard. The mediator identifies the single branch that evaluated the authentic key (for example, Agent B), accepts its completion, and discards the completions from the decoy branches (Agents A and C). The local engine then de-anonymizes the synthetic placeholders, swapping the original well tags, personnel names, and facility identifiers back into the response before serving the final output to the user.

``` [Agent A: Decoy Response] ──┐ [Agent B: True Response] ──┼──► [Prompt Guard] ──► [Filter True Branch & De-Anonymize] ──► [User] [Agent C: Decoy Response] ──┘ ```

On the public AI provider's side, all three agents feed into the backend ingestion buffer simultaneously. The provider's automated intake filters observe three identical reasoning requests originating from unusual network locations, containing mismatched corporate names, and presenting irreconcilable numerical figures.

Because each agent had to execute an algorithmic pre-instruction routine to solve the puzzle before running the prompt, the platform identifies the prompt as machine-generated rather than an authentic human submission: > "It will say to itself that maybe the algorithm that I used... did not put the right thing. So, this will create another doubt for it. This is not an authentic user prompt. This is machine-generated. So, this is another reason just to discard this as a training material."

Faced with contradictory duplicate data and non-human origin markers, the automated ingestion system flags the batch as unreliable noise and disqualifies it from future training sets.

[18:50](https://www.youtube.com/watch?v=DRPUyqbrraM&t=1130s) Evaluation, Protection Rates, and Multimodal Guardrails

Extended validation and adversarial testing conducted directly against frontier models over several months demonstrate the resilience of the architecture. For standard textual queries, the system achieves an estimated data protection rate of up to 98%, neutralizing both direct memorization risks and indirect inference attacks.

Multimodal inputs—such as scanned technical diagrams, site photographs, or seismic imagery—introduce greater privacy risks because embedded visual details cannot be as easily split and permuted into programmatic text puzzles. To address this, the Prompt Guard provides tunable security policies: - Administrators can set strict boundary rules, masking or stripping complex image layers that cannot be reliably scrubbed locally. - High-risk queries can be blocked from leaving the corporate network entirely, ensuring complete on-premises confinement. - For the ~91.5% of regular enterprise prompts that do not contain sensitive proprietary information, the Prompt Guard applies a zero-latency pass-through policy, routing safe queries directly to public models while reserving puzzle obfuscation strictly for the ~8.5% that require protection.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=DRPUyqbrraM&t=4s) completely blocking the reasoning.

> [14:02](https://www.youtube.com/watch?v=DRPUyqbrraM&t=842s) It will say to itself that maybe the algorithm that I used... did not put the right thing. So, this will create another doubt for it. This is not an authentic user prompt. This is machine-generated. So, this is another reason just to discard this as a training material.

## Mentioned Amjad Almonzer, ChatGPT, Chevron Kern River oil field, Claude, Gemini, Jane Doe, John Smith, Prompt Guard, Saudi Aramco

## Video description Amjad Almonzer - Knowledge Management Specialist, Saudi Aramco

Public AI is powerful, but many enterprises hesitate to use it because of the risk of exposing private or sensitive data. This talk will explore how organizations can benefit from tools such as ChatGPT, Gemini, and other AI agents without sacrificing data privacy. It will introduce a U.S. patent-pending operating model that combines prompt management, privacy guardrails, and controlled AI-agent execution. Attendees will learn how this model can help reduce data leakage risk while enabling safer and more practical enterprise AI adoption. The talk will provide a clear view of how companies can unlock public AI capabilities while keeping enterprise data protected.

[Source](https://www.youtube.com/watch?v=DRPUyqbrraM)

中文简报

沙特阿美利用诱饵提示词防止公共AI摄取企业数据通过将敏感提示词拆解为算法谜题并分发给多个诱饵智能体，企业既能利用前沿模型的推理能力，又能刻意触发服务商的质量过滤机制，使企业数据失去进入训练语料库的资格。沙特阿美（Saudi Aramco）正在解决一个企业困境：内部AI部署在推理能力上落后于公共前沿模型，但直接提交提示词又会使敏感的企业指标和个人数据暴露在云端训练缓冲中。传统加密方式会破坏模型推理，而服务商的退出训练机制仍会使次级遥测数据面临暴露风险，这促使该公司开发了正在申请专利的本地 Prompt Guard 中介系统。该框架对现实世界的标识符进行匿名化处理，将专有数据转化为算法谜题，并通过多个公共智能体结合随机诱饵数值执行查询。通过生成相互矛盾的副本并模拟机器生成的脚本，该系统刻意误导云端摄取管道，使其将这些提示词从未来的训练集中剔除，同时在本地安全地重组真实的响应结果。企业团队经常寻求使用公共前沿模型（如 ChatGPT、Gemini、Claude），因为其快速迭代、卓越算力以及先进的多步推理能力超越了私有本地部署。 (0:04) 直接剥离企业敏感数据会破坏语义上下文，而传统的加密方法会使LLM推理引擎无法读取提示词。 (0:04) 大约8.5%的业务提示词包含敏感企业数据，涵盖三个层级：个人身份信息（PII）、公司身份标识以及关键的运营/财务指标。 (2:01) 服务商标准的退出训练开关无法消除次级泄露途径，包括系统遥测、活动日志、供应商支持访问以及云存储泄露风险。 (2:01) 公共AI服务商在将数据加入训练语料库之前，会利用自动化摄取过滤器来评估数据共享权限、提示词归属、内部一致性以及人类真实性。 (5:12)

Reading summary

To access the superior reasoning of public frontier AI models without exposing proprietary data, a patent-pending mediator architecture detailed by Ai4 and applied at Saudi Aramco disguises enterprise queries and intentionally disqualifies them from public training pipelines. By combining local identifier substitution with multi-agent decoy puzzles, the framework preserves complex analytical context while actively poisoning provider ingestion buffers. Limits of Local Models and Privacy Opt-Outs (0:04) Large enterprises face an ongoing operational dilemma: locally hosted private models lack the compute resources, rapid evolution, and multi-step reasoning capabilities of public frontier models such as ChatGPT, Gemini, and Claude. However, approximately 8.5% of corporate prompts contain sensitive information spanning personally identifiable information (PII), corporate brand details, and proprietary operational metrics. While manual scrubbing strips away necessary context and standard encryption renders text indecipherable to an LLM's reasoning engine, enterprise security teams remain skeptical of public AI privacy toggles. Vendor opt-out settings fail to eliminate secondary exposure pathways. External providers routinely log telemetry, interaction analytics, and activity histories. Furthermore, vendor support personnel may view data during administrative troubleshooting, and third-party breaches of cloud ingestion buffers expose retained queries regardless of formal training opt-outs. Identifier Substitution and Decoy Puzzle Generation (7:48) To eliminate direct client-to-cloud exposure, the Prompt Guard architecture introduces an on-premises mediation server between internal staff and public APIs. The system first masks corporate IP addresses and geolocations via globally distributed proxy networks. A lightweight, on-premises language model then scans incoming queries to replace genuine corporate and personal identifiers—such as engineer names, facility locations, and hardware tag numbers—with realistic synthetic placeholders, preserving relational logic without exposing authentic entities. To safeguard underlying operational parameters like production volumes or proprietary extraction techniques, the mediator translates the prompt into an algorithmic puzzle parameterized by abstract variables. Alongside the puzzle, the system constructs an evaluation key containing both authentic metrics and plausible decoy values across multiple candidates. It dispatches this puzzle simultaneously to at least three distinct public AI agents, instructing each to resolve the puzzle with a different candidate index before performing the requested analysis. Reassembly and Training Buffer Disqualification (14:02) Once the public AI agents finish execution, the on-premises mediator gathers their outputs, accepts the single response evaluated with the authentic key, and discards the decoy branches. The local engine then de-anonymizes the synthetic placeholders, reinserting the original equipment tags, facility titles, and personnel names before delivering the completed analysis to the user. Simultaneously, the process exploits the automated qualification filters that frontier model providers use to curate training datasets. Because the provider's intake buffer receives multiple simultaneous requests from obscured IPs displaying conflicting operational figures and machine-scripted pre-instruction routines, the platform flags the batch as non-human, unreliable noise. This deliberate contradiction causes the provider's ingestion pipeline to disqualify the inputs from inclusion in future model training sets. Validation Metrics and Multimodal Constraints (18:50) Adversarial testing over several months indicates that this mediation method achieves an estimated data protection rate of up to 98% against both direct memorization and indirect inference attacks on textual queries. To minimize latency, the Prompt Guard uses a zero-latency pass-through policy for the approximately 91.5% of regular enterprise prompts containing no sensitive data, applying puzzle obfuscation exclusively to the sensitive 8.5%. Multimodal inputs present severe privacy hurdles because visual assets—such as site photographs, scanned engineering schematics, and seismic imagery—cannot be easily decomposed into programmatic text puzzles. To address this gap, the architecture applies tunable boundaries that either mask and strip visual layers locally or block sensitive multimodal queries from exiting the internal enterprise network entirely. While Prompt Guard offers a viable method for leveraging public frontier reasoning on sensitive text queries, its security strategy depends on provider ingestion filters predictably rejecting conflicting, machine-generated inputs. Furthermore, unresolved complexities surrounding complex visual and seismic data mean that multimodal workflows remain restricted to local network boundaries.

精炼阅读摘要

沙特阿美（Saudi Aramco）等大型企业面临公有尖端AI模型推理能力与企业核心数据隐私之间的固有矛盾；一项正在申请美国专利的Prompt Guard架构提出通过本地中介服务器、实体匿名化、诱饵谜题混淆及逆向利用模型训练摄取过滤规则，在不向第三方泄露真实数据的前提下安全使用公有AI。公有模型推理优势与数据泄露隐患 (0:04) 拥有超过10万名员工的沙特阿美指出，尽管大型组织部署了位于内部防火墙后的私有AI，但业务团队依然倾向于使用ChatGPT、Gemini和Claude等公有尖端模型。公有模型在计算资源、功能完备度、多步推理能力和更新迭代速度上明显优于本地私有部署。然而，行业数据显示约8.5%的企业业务提示词包含敏感数据或直接标识符，涉及员工个人可识别信息（PII）、企业身份标识以及核心业务数据（如生产统计、专有技术和财务模型）。直接从提示词中手动剥离敏感数据会破坏语义上下文，而传统加密方法则会使大模型的推理引擎完全无法读取内容，导致推理中断。企业安全团队强调，公有AI服务商提供的“退出训练”选项并不能消除次级泄露隐患：平台的系统遥测、交互日志、技术支持人员在排障时的管理权限，以及潜在的云存储漏洞，都可能导致企业提示词暴露于外部机构。逆向触发公有AI训练数据淘汰机制 (5:12) 公有AI平台通常通过自动化摄取流水线来评估用户对话，以决定是否将其纳入未来的训练语料库。该流水线会检验数据共享许可、临时会话设置、合规性、IP归属与请求来源、内容是否存在矛盾或重复、质量指标以及输入是否为真实人类对话。该专利方案并未试图安全通过这些质量检测，而是采取逆向反制策略，主动促使提示词触发淘汰机制。系统通过企业VPN或分布式多区域代理掩盖真实IP归属，向服务商的摄取缓冲区同时注入看似合理但相互矛盾的变体数值以破坏数据可靠性，并设计需要程序化解析的谜题结构，促使AI服务商的摄取算法将该请求标记为机器生成的脚本而非真实人类对话，从而使其自动丧失进入训练集的资格。本地中介代理、实体匿名与诱饵谜题分发 (7:48) Prompt Guard架构在企业内部部署中介服务器，切断了员工与公有云模型之间的直接通信链路。当员工提交包含专有设施名称、工程师姓名和设备编号的复杂查询时，本地中介首先屏蔽真实IP与地理位置，并调用本地轻量级模型扫描文本，将真实的人员、公司与设施实体替换为虚构名称。由于大模型的推理任务依赖实体间的关联逻辑而非真实名称，替换为逼真的占位符能够完整保留提示词的语义上下文。随后，系统将提取量、注入技术或运营成本等核心数值参数转化为参数化变量（如P1、P2、P3），构建算法谜题，并生成包含候选选项的评估密钥。在典型的三分支配置中，系统为每个参数提供三个选项（其中仅包含一个真实值和两个诱饵值），并分发给至少三个独立的公有AI Agent。各Agent根据预设指令执行算法脚本解开谜题、代入指定的参数组合并运行复杂推理，而真实参数分支的排列组合仅对本地中介服务器可见。真实结果重组与训练缓冲区干扰 (14:02) 在公有云端，三个Agent同时向服务商的后台摄取缓冲区提交推理请求。由于这些请求来自异常网络节点、包含冲突的实体名称以及无法调和的数值参数，且带有机器解题脚本痕迹，服务商的自动化摄取过滤器会将该批次数据判定为不可靠的机器噪声，进而将其全数剔除出训练语料库。在客户端，三个外部Agent将运算结果回传至本地Prompt Guard服务器。中介系统根据本地记录的分支索引，仅提取包含真实密钥的Agent输出，直接丢弃诱饵分支的计算结果。随后，本地模型执行反匿名化流程，将最初替换的虚构名称精准还原为真实员工姓名、油田标签和设施信息，最终向用户返回完整且真实的分析报告。持续数月的对抗性测试表明，该架构对标准文本查询的数据保护率估算可达98%，并允许对约91.5%不含敏感信息的日常提示词采用零延迟直接透传策略，仅将混淆算法应用于约8.5%的高风险查询。然而，针对包含地质构造图或现场照片等无法轻易拆解为文本谜题的多模态图像输入，系统目前仍依赖遮盖剥离或本地网络阻断等防御策略。

Detailed notes — zh

## Background 本内容由 Ai4 频道于 2026 年 8 月 19 日发布在 YouTube 平台。视频记录了沙特阿美（Saudi Aramco）知识管理专家 Amjad Almonzer 的主题演讲，主要探讨企业如何在不牺牲数据隐私的前提下安全使用 ChatGPT 和 Gemini 等公有大模型，并介绍了一套结合提示词管理、隐私防护与受控 Agent 执行的专利模型。 ## TL;DR 沙特阿美针对大型企业渴望公有大模型的强大推理能力、却担忧商业机密与身份标识泄露被用于模型训练的“AI 悖论”，提出了一套名为 Prompt Guard 的专利代理中介架构。该方案通过网络来源伪装和本地轻量模型无损替换敏感实体，并针对核心机密参数设计了“参数混淆与诱饵谜题”机制，调度公网多个 Agent 协同执行后在内网进行结果收敛与还原。这套机制反向利用了大模型厂商的训练数据质检规则，通过制造矛盾副本和非真实用户生成特征，主动使提交的数据失去被训练的资格（Disqualify）。实测表明，该方案在纯文本场景下实现了高达 98% 的数据防泄露成功率，以极低的计算开销化解了企业拥抱公有 AI 的核心顾虑。 ## Atmosphere & style 整场演讲呈现出严谨、前瞻且极具工业落地导向的专业技术氛围。演讲者立足于全球能源巨头的真实合规痛点，剥离了传统要么生硬脱敏、要么完全禁用的非黑即白思路，层层拆解公有 AI 底层的语料抓取逻辑。整个分享充满着攻防对抗的技术巧思与逆向思维的从容感，让观众在严密的架构推演中感受到一种破局企业 AI 隐私困境的创新工程力量。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=DRPUyqbrraM&t=4s) 企业 AI 悖论：公有大模型在算力规模、深度逻辑推理及迭代速度上显著超越本地私有模型，成为大型企业不可替代的核心生产力工具。 - [02:01](https://www.youtube.com/watch?v=DRPUyqbrraM&t=121s) 公有 AI 的致命痛点在于提示词可能泄露 PII、企业标识与商业机密，且企业安全团队普遍无法完全信任厂商的“关闭训练”隐私开关。 - [02:01](https://www.youtube.com/watch?v=DRPUyqbrraM&t=121s) 传统的彻底剔除（Redaction）会破坏上下文语义，而强加密（Encryption）会阻断推理，企业需要兼顾语义完整性与底层防训练机制的新方案。 - [05:12](https://www.youtube.com/watch?v=DRPUyqbrraM&t=312s) 沙特阿美专利核心思路是“逆向取消训练资格”，反向利用公有 AI 的语料质量质检门槛，主动诱导系统将企业提示词作为不可信语料淘汰。 - [07:49](https://www.youtube.com/watch?v=DRPUyqbrraM&t=469s) 通过引入内网 Prompt Guard 代理中介，系统首先利用多节点网络伪装抹去企业来源指纹，并由本地轻量级 AI 实现敏感实体的语义无损替换。 - [11:22](https://www.youtube.com/watch?v=DRPUyqbrraM&t=682s) 针对产量、专有技术等高危数值，Prompt Guard 采用“占位符+解谜结构（Puzzle & Decoy）”机制，将真实参数与虚假诱饵混淆打包。 - [14:10](https://www.youtube.com/watch?v=DRPUyqbrraM&t=850s) 公网部署至少 3 个独立 Agent 接收解谜指令并并行推理，仅企业内网掌握真实索引，并在接收返回后过滤诱饵、逆向还原真实实体。 - [14:10](https://www.youtube.com/watch?v=DRPUyqbrraM&t=850s) 多 Agent 协同机制在公有 AI 训练端制造数据矛盾，并因机器重组特征触发“非真实人类用户提交”判定，从源头确保语料被训练管道丢弃。 - [18:50](https://www.youtube.com/watch?v=DRPUyqbrraM&t=1130s) 在纯文本场景下该架构防数据泄露成功率达 98%，结合多模态输入阻断与局部遮盖策略可实现逼近 100% 的绝对安全。 - [18:50](https://www.youtube.com/watch?v=DRPUyqbrraM&t=1130s) 针对企业内超过 91% 的非敏感通用提示词开启直通模式（Safe Pass-through），以极小的系统开销与计算延迟保障核心业务运转。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=DRPUyqbrraM&t=4s) 企业 AI 悖论：公共大模型的诱惑与数据泄露隐患沙特阿美（Saudi Aramco）作为全球规模最大的石油与天然气巨头之一，拥有超过 10 万名员工。在企业级 AI 的推进过程中，知识管理专家面临着一个普遍而棘手的困境：尽管多数大型企业已经部署了本地私有 AI 模型，但员工和业务依然迫切需要使用 ChatGPT、Gemini、Claude 等公有云大模型。公有大模型拥有更强大的算力、更出色的逻辑推理能力、更丰富的功能与资源，最关键的是其技术迭代演进速度远超私有模型，在众多关键业务场景中不可替代。然而，公有模型的致命痛点在于提示词（Prompt）中的敏感信息泄露。如果直接将包含业务机密或身份信息的提示词发送至公网，这些数据极有可能被大模型厂商摄取并作为后续训练素材。为了打破这种“既想用公有 AI 的强大能力，又不敢暴露数据隐私”的两难僵局，沙特阿美研发并申请了一套专利方法，旨在不牺牲企业数据安全的前提下安全调用公有 AI 工具。 - **私有与公有 AI 的核心差距**：公有大模型在算力规模、深度推理逻辑、生态功能集成以及版本迭代速率上均显著领先于本地私有部署模型。 - **数据泄露风险**：公有 AI 在吸收提示词数据后，会将其作为模型迭代训练集，可能导致核心机密对竞争对手或公众泄露。 --- ### [02:01](https://www.youtube.com/watch?v=DRPUyqbrraM&t=121s) 提示词隐私风险与传统脱敏方案的缺陷调研数据显示，企业用户提交的提示词中约有 8.5% 包含身份标识符或敏感商业信息；而在个人用户中，这一比例高达近 35%。值得警惕的是，个人用户无需每次主动输入个人信息，AI 模型通过漫长的聊天上下文历史记录，已经拼凑并积累了大量用户个人画像。在企业端，员工提交的信息更为致命，涵盖了三类核心数据： 1. **个人身份信息（PII）**：姓名、电话号码、电子邮箱等； 2. **公司身份标识（CII）**：企业名称、核心主导产品或关键服务名称； 3. **高危商业机密**：前沿技术方案、油气生产指标、财务影响评估、运营统计报表等。尽管主流公有 AI 厂商提供了“关闭数据用于模型训练”的隐私开关，但企业安全团队普遍“对其心存疑虑，尚未真正信任这一设置”。不仅如此，数据安全威胁还存在诸多衍生途径：云端的活动审计日志（Activity Logs）、企业使用行为分析数据、技术支持人员的越权查看权限，以及潜在的云端第三方数据泄露事件。企业若采用传统的彻底剔除（Redaction）或置换脱敏，会严重破坏提示词的上下文语境完整性；而若采用强加密算法（Encryption），则会彻底阻断大模型的自然语言推理能力。因此，核心技术挑战变成了：“如何在向 AI 提供必要数据的同时，从底层机制上阻止其将这些数据作为训练语料？” --- ### [05:12](https://www.youtube.com/watch?v=DRPUyqbrraM&t=312s) 逆向训练资格算法：从合规准入到主动“取消资格” 公有 AI 厂商在后台会对用户提交的提示词执行一系列算法校验，以评估其是否具备作为模型微调（Fine-tuning）或持续预训练的高质量语料资格。判定门槛包括：用户授权许可、临时会话状态、安全合规规则、提示词地理与网络来源（IP 地址）、内容是否存在重复与矛盾、是否为真实人类用户提交（而非机器生成），以及格式是否规范高质量。 ```mermaid flowchart TD accTitle: AI Training Eligibility Disqualification Flow subgraph Client ["企业内网环境"] UserPrompt["用户原始提示词"] --> PG["Prompt Guard 代理中介"] end subgraph Defense ["反训练三大诱导策略"] PG --> D1["1. 来源去归属化 (VPN/多地IP伪装)"] PG --> D2["2. 身份泛化与替换 (虚拟命名/无损语境)"] PG --> D3["3. 混淆解谜与诱饵 (生成相互矛盾的副本)"] end subgraph PublicAI ["公有 AI 云端执行"] D1 & D2 & D3 --> AgentA["AI Agent A (解析诱饵 1)"] D1 & D2 & D3 --> AgentB["AI Agent B (解析真实数据)"] D1 & D2 & D3 --> AgentC["AI Agent C (解析诱饵 2)"] end subgraph Pipeline ["云端训练数据管道"] AgentA & AgentB & AgentC --> Buffer["训练数据缓冲区"] Buffer --> Check{"数据质量与真实性检测"} Check -->|矛盾数据 / 来源异常 / 机器生成| Discard["彻底淘汰 (Disqualified) 不可作为训练语料"] end ``` 沙特阿美的思路并非迎合这些规则，而是反向利用这些过滤门槛，主动让企业数据**失去被训练的资格（Disqualify）**。具体通过三大关键切入点对训练过滤机制进行诱导与干扰： - **来源去归属化（Disattribute Location）**：通过网络混淆掩盖企业真实 IP 与物理地理位置； - **构造冲突副本（Contradicting Duplicates）**：生成包含相互矛盾数据的提示词变体，使其在可靠性检测中被直接判定为不可信语料； - **伪装为非真实用户输入（Inauthentic User Prompts）**：使公有 AI 认定该输入为机器自动生成或程序异常产物，从而在源头被训练管道丢弃。 --- ### [07:49](https://www.youtube.com/watch?v=DRPUyqbrraM&t=469s) Prompt Guard 架构：网络伪装与身份信息无损替换在传统交互模式下，用户终端与公有 AI 模型直连，执行完毕后数据直接流入厂商的云端暂存缓冲区（Buffer）进行为期数天的训练资格审查。新的架构在用户与公有 AI 之间引入了一个中介服务——**Prompt Guard**。 Prompt Guard 首先执行基础设施层的网络掩蔽，通过企业级 VPN 或跨国多节点服务器分发请求，抹去沙特阿美的网络来源指纹。随后，Prompt Guard 内部部署的轻量级本地 AI 模型会精准识别提示词中的 PII 与企业专有标识（如油田名称、工程师姓名、井号 Tag 等）。在执行替换时，本地 AI 会利用虚构的实体替换真实实体（例如将特定项目工程师替换为虚拟名字，将具体油田名称置换为通用代称）。由于替换逻辑严格遵循语义等价原则，大模型在理解“业务逻辑与技术影响分析”时完全不受影响，从而实现了“在隐藏真实来源与主体的前提下，完好保留上下文推理能力”。 - **直连与代理对比**：从传统的客户端直连云端，转变为由企业内网的 Prompt Guard 统一接管、脱敏、混淆与路由。 - **本地轻量级模型分工**：仅负责敏感实体识别（NER）与上下文无损替换，对算力要求极低，确保核心数据不出内网。 --- ### [11:22](https://www.youtube.com/watch?v=DRPUyqbrraM&t=682s) 诱饵生成与谜题混淆机制对于产量数据（如 8,000 桶/日）、核心专有技术（如蒸汽注入优化技术）以及敏感财务金额等高度机密的业务参数，Prompt Guard 采用了独特的“参数混淆与解谜（Puzzle & Decoy）”机制。系统会将敏感数值与专有技术术语替换为占位符（如 `P1`, `P2`, `P3`），并在提示词中附带一个解谜结构（Key）。 ```mermaid flowchart LR accTitle: Decoy Obfuscation and Agent Execution subgraph OnPrem ["企业内部 (On-Prem)"] Raw["原始参数 (8,000 bpd / 核心技术)"] --> PG["Prompt Guard"] PG --> Enc["生成占位符 P1, P2, P3 注入动态解谜 Key"] end subgraph CloudAgents ["公有 AI 代理集群 (Public Agents)"] Enc --> Ag1["Agent A: 解出参数组合 1 (诱饵)"] Enc --> Ag2["Agent B: 解出参数组合 2 (真实数据)"] Enc --> Ag3["Agent C: 解出参数组合 3 (诱饵)"] end subgraph Resolution ["结果收敛与还原"] Ag1 & Ag2 & Ag3 --> Filter["Prompt Guard 结果过滤 (抛弃 A 与 C，保留 B)"] Filter --> Final["逆向还原真实实体 返回给终端员工"] end ``` 在解谜结构中，Prompt Guard 会为每个占位符注入多个候选值（例如包含 1 个真实值和 2 个具有迷惑性的虚假诱饵值）。公网端则配置至少 3 个独立的公有 AI Agent，每个 Agent 接收到预设指令，必须先运行特定解谜逻辑重构提示词，然后再进行业务推理。关键点在于：**只有内网的 Prompt Guard 掌握哪个 Agent 对应着真实算法与正确索引**。对于公网上的大模型而言，它只看到来自不同 Agent 的动态重组过程，完全无法判断哪个候选值才是真实的企业生产数据。 --- ### [14:10](https://www.youtube.com/watch?v=DRPUyqbrraM&t=850s) 多 Agent 协同执行、结果还原与训练端数据污染防御在实际调用流程中，Prompt Guard 将混淆后的谜题同时分发给公网环境下的 Agent A、Agent B 和 Agent C。每个 Agent 分别解出不同的提示词版本并执行计算。Agent A 和 Agent C 执行的是包含错误诱饵参数的任务，而 Agent B 执行真实参数任务。当三个 Agent 将计算结果返回给 Prompt Guard 时，系统依据本地维护的动态映射表，果断丢弃 Agent A 与 Agent C 的响应，仅提取 Agent B 的结果，随后进行反向实体还原（De-anonymize），最终呈现给企业员工无缝、精准的分析答案。而在公有 AI 厂商后台的训练数据缓冲区内，这一机制引发了多重防范效应： 1. **数据矛盾与可信度崩塌**：大模型的质检管道在同一时段收到了三份结构高度相似、但关键业务数据与技术指标完全冲突的记录，且网络 IP 来源异常，直接触发低可靠性警报； 2. **非真实用户判定**：由于提示词是由公网 Agent 执行了解谜算法后重新生成的，“大模型能够识别出提示词是由自身 Agent 机器拼装生成的，而非人类真实输入的 Prompt”，从而因“非真实用户提交（Inauthentic Prompt）”规则被训练数据采集系统彻底剔除。 --- ### [18:50](https://www.youtube.com/watch?v=DRPUyqbrraM&t=1130s) 防护效能评估与多模态安全边界在历经数月与 ChatGPT 进行深度推演与对抗性验证后，该方案在文本场景下展现出了极高的防护有效性。针对纯文本类提示词，该专利架构的企业敏感数据防泄露成功率可高达 **98%**。对于多模态输入（如包含敏感图纸、仪表图像等），由于图像语义解析与动态混淆重构的复杂度更高，风险相对增加。但 Prompt Guard 本身具备高度可配置的安全策略等级：安全团队可以根据业务部门的合规要求灵活调整拦截规则。对于高风险的多模态内容，系统既可以选择彻底阻断（Bypass/Block），也可以对未识别图像区域进行遮盖或局部过滤，从而无限逼近 **100% 的绝对数据安全**。更为重要的是，在企业日常运营中，仅有约 8.5% 的提示词涉及核心机密与标识符，其余超过 91% 的通用性、无害提示词可以通过 Prompt Guard 的直通模式（Safe Pass-through）直接流向公有大模型并快速返回。该方案以极小的系统开销与极高的针对性，在保障 100% 业务推理精度的同时，彻底化解了企业拥抱公有 AI 时的隐私泄露梦魇。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=DRPUyqbrraM&t=4s) 公有大模型在算力规模、深度推理逻辑、生态功能集成以及版本迭代速率上均显著领先于本地私有部署模型。 — Amjad Almonzer > [00:04](https://www.youtube.com/watch?v=DRPUyqbrraM&t=4s) 公有 AI 在吸收提示词数据后，会将其作为模型迭代训练集，可能导致核心机密对竞争对手或公众泄露。 — Amjad Almonzer > [02:01](https://www.youtube.com/watch?v=DRPUyqbrraM&t=121s) 对其心存疑虑，尚未真正信任这一设置 — Amjad Almonzer > [02:01](https://www.youtube.com/watch?v=DRPUyqbrraM&t=121s) 如何在向 AI 提供必要数据的同时，从底层机制上阻止其将这些数据作为训练语料？ — Amjad Almonzer > [05:12](https://www.youtube.com/watch?v=DRPUyqbrraM&t=312s) 失去被训练的资格（Disqualify） — Amjad Almonzer > [07:49](https://www.youtube.com/watch?v=DRPUyqbrraM&t=469s) 在隐藏真实来源与主体的前提下，完好保留上下文推理能力 — Amjad Almonzer > [11:22](https://www.youtube.com/watch?v=DRPUyqbrraM&t=682s) 只有内网的 Prompt Guard 掌握哪个 Agent 对应着真实算法与正确索引 — Amjad Almonzer > [14:10](https://www.youtube.com/watch?v=DRPUyqbrraM&t=850s) 大模型能够识别出提示词是由自身 Agent 机器拼装生成的，而非人类真实输入的 Prompt — Amjad Almonzer > [18:50](https://www.youtube.com/watch?v=DRPUyqbrraM&t=1130s) 针对纯文本类提示词，该专利架构的企业敏感数据防泄露成功率可高达 98% — Amjad Almonzer ## Mentioned Amjad Almonzer, Saudi Aramco, ChatGPT, Gemini, Claude, Prompt Guard ## Video description Amjad Almonzer - Knowledge Management Specialist, Saudi Aramco Public AI is powerful, but many enterprises hesitate to use it because of the risk of exposing private or sensitive data. This talk will explore how organizations can benefit from tools such as ChatGPT, Gemini, and other AI agents without sacrificing data privacy. It will introduce a U.S. patent-pending operating model that combines prompt management, privacy guardrails, and controlled AI-agent execution. Attendees will learn how this model can help reduce data leakage risk while enabling safer and more practical enterprise AI adoption. The talk will provide a clear view of how companies can unlock public AI capabilities while keeping enterprise data protected. [Source](https://www.youtube.com/watch?v=DRPUyqbrraM)

Source quotes

[0:04] Amjad Almonzer: 公有大模型在算力规模、深度推理逻辑、生态功能集成以及版本迭代速率上均显著领先于本地私有部署模型。 [0:04] Amjad Almonzer: 公有 AI 在吸收提示词数据后，会将其作为模型迭代训练集，可能导致核心机密对竞争对手或公众泄露。 [2:01] Amjad Almonzer: 对其心存疑虑，尚未真正信任这一设置 [2:01] Amjad Almonzer: 如何在向 AI 提供必要数据的同时，从底层机制上阻止其将这些数据作为训练语料？ [5:12] Amjad Almonzer: 失去被训练的资格（Disqualify） [7:49] Amjad Almonzer: 在隐藏真实来源与主体的前提下，完好保留上下文推理能力 [11:22] Amjad Almonzer: 只有内网的 Prompt Guard 掌握哪个 Agent 对应着真实算法与正确索引 [14:10] Amjad Almonzer: 大模型能够识别出提示词是由自身 Agent 机器拼装生成的，而非人类真实输入的 Prompt [18:50] Amjad Almonzer: 针对纯文本类提示词，该专利架构的企业敏感数据防泄露成功率可高达 98%

Source quotes

[0:04] completely blocking the reasoning. [14:02] It will say to itself that maybe the algorithm that I used... did not put the right thing. So, this will create another doubt for it. This is not an authentic user prompt. This is machine-generated. So, this is another reason just to discard this as a training material.

Original transcript

[0:04] Thank you very much. Hello and good afternoon and thank you for stopping by attending this session. [0:10] Uh my name is Abdulmonem. I am working as a knowledge management specialist in Saudi Aramco. [0:17] Actually, I'm leading the knowledge management program across the company. [0:21] Uh Saudi Aramco is the national oil company in Saudi Arabia and it's one of the largest [0:26] oil and gas company across the world with uh more than 100,000 employees. [0:34] Uh today we are going to tackle one of the common challenges that we are facing right now. [0:40] Uh most of the company now they have a private local AI models. However, we still need to use the [0:49] publicly available AI uh models such as ChatGPT, Gemini, Claude, or other for very obvious reason. [0:59] The public AI models they have more computing power, they have more reasoning capabilities, [1:05] they have more functionality, and also they have more resources, [1:09] and most importantly, they evolve much faster than the private AI models. This is why we still need [1:19] uh to use it for many business use cases. But the challenge now that most of our prompt has either [1:29] um identifiable information or sensitive information. So, how can we still use this [1:37] great tools without exposing this data to be a training material for this AI models? [1:45] Uh today I'm going to share with you uh it's a patent-pending uh method [1:51] to enable us to use this great tools without releasing or sacrificing our data privacy. [2:01] A study shows that almost 8.5% of business prompts contain some identifiers or sensitive information. [2:12] On the other hand, the personal user user almost 35% of their prompt contain uh [2:20] some private or sensitive data related to their uh personal life. [2:28] Don't think that when it comes to your personal prompt that every time you have to put some of [2:35] your personal information because, as you know, AI already knows from your [2:40] chat history a lot about you. So, it just add up more information about what it already uh knows. [2:51] Uh so, the dilemma here is we have an employee who is submitting a prompt that has some personal [2:58] information like names, uh telephone number, email addresses, and so on. Or it has some company uh [3:06] identity information like the company name or the main product they are using [3:11] uh or producing or the main service they are providing. But most importantly and critically [3:19] is the business sensitive information such as if you are prompt contained the new technology [3:25] that you are using, uh production data, financial impact, operational statistic, or other business [3:33] sensitive information. And we send all of this to the cloud. Uh most of the public AI provider, they [3:44] have a setting where you can select to switch off using your data as a training material. However, [3:51] many of the company, including my company, they really don't trust this setting yet. [3:58] But in addition to this, it's not only about learning directly from your data. There are other [4:05] derivative from your data that this AI model can learn from, such as your activity logs, [4:12] some analytics they can get some additional information about your company from this [4:18] analytics. Also, in case if you need some sort of support, the support people, [4:25] they could have access to this information. In addition, of course, if a breach happen, [4:31] that this might expose all the information available to a third party. [4:37] Now, the challenge is if we go and completely eliminated the sensitive data or identifier, [4:47] we are going to destroy the context of our prompt. Or if we try to encrypt this data, we are going to [4:55] completely block the reasoning. So, again, the challenge, how to use it while not exposing the [5:03] data. How to give the data, but preventing them from taking this data as a training material. [5:12] In order to do this, let's now look at the algorithm they are using to [5:18] qualify your data as training material or not. Uh when a user start by submitting a prompt, they [5:25] check if the user permit them to to use it or not. Of course, if not, it will not be eligible. Then, [5:32] if you are turning on the temporary chat or not. If you are meeting the safety and security rules, [5:39] uh it and also they will check the prompt source because the response always rely on where you are [5:48] prompting from. The location, maybe the IP address of your company, or any other [5:54] location. This might affect the response you are getting. Also, whether or not [6:02] the data embedded in this prompt contains some duplicate or contradicting information, [6:07] which will makes it unreliable for being a training material. [6:13] And whether or not this is an authentic user submission, not a machine submitted prompt. [6:21] And finally, if it's of high quality and misformed. And if it passes all these gates, [6:30] then it will be qualified for training material. But our goal is not to make it qualify. We [6:37] are trying to disqualify our data from being a training material. So, there are certain area [6:45] that we can mislead the training model with, not every gate. And these are the three area. [6:53] We can disattribute the location, or mask the IP of the source of the prompt. And also, [7:04] we can create some contradicting duplicate of this prompt, as we are going to see very soon now. [7:14] Also, we will try to make these prompts looks as inauthentic user prompt. While in reality, it is [7:26] submitted by the user, but we'll make it look for the AI model as if it is machine generated prompt. [7:38] Uh let's uh deep dive a little bit about how we can achieve this. The traditional way of [7:49] uh prompting an AI model, we submit a prompt to any of the available AI models, it will execute [7:56] it and it send it back directly. It's a direct connection between the user and the provider. [8:02] And then what happened, they take this data and they put it in a buffer [8:08] and they run this several days to find out whether it qualifies for training or not. [8:15] The new methodology will not have this direct connection. There will be a mediator [8:21] uh server running an application. We call it prompt guard application. And it will try to [8:30] do what we agreed on to create some doubts and try to mislead this uh AI model by masking [8:40] source and identity, creating contradicting duplicate, and uh inauthentic user prompt. [8:51] Okay, to achieve the first goal, to mask source identity, simply to to mask [8:58] IP address or location, we can use some sort of a VPN. Or if the company can afford to have [9:04] multiple server in several location across the world, it will do the job. This is an easy step. [9:12] Then we will do anonymization. The prompt guard is going to detect the [9:20] personal identifiable information or the company identifiable information. [9:24] It will use a local AI model. It's a simple one that can easily identify this uh [9:34] uh information. And for example, if uh employee has um and prompt similar like this one, [9:43] like analyze the technical and financial impact, and then he put some information, Chevron current [9:49] river oil field, and and he start to uh give some news. Now, the prompt guard is going to identify [10:00] the identifiers, like the company name, the field name, the name of the engineer, [10:06] Jane Doe, who did this recommendation, and uh well tag numbers. All of this are identifier. [10:16] If anyone got to know anything about this, they might be able to identify the source of this [10:23] prompt. So, simply, this identifiers are going to be replaced by fictitious one, which will not [10:31] affect the context at all. It doesn't matter for the prompt. If what If who recommended this [10:41] is John Smith or Jane Doe, it doesn't matter a lot. And the AI the local AI within the prompt [10:47] is smart enough to know which replacement that will not change the context of the prompt. [10:57] So, now we mask the source and the identity without changing the context. [11:03] Now, it will come to to the more advanced part, which is trying to uh create some decoys in order [11:12] for uh to create the contradicting duplicates and to make the prompt look inauthentic. [11:22] Now, the prompt guard is going to uh do something similar like this. [11:30] This is the same prompt. Now it identified the sensitive information. In this case, [11:38] the sensitive information is 8,000 barrel per day. And the technology that is being used, [11:46] which is steam injection optimization technology here. And dollar value, which most of the time [11:53] is sensitive information. And this is how it will look like. Now, this is how the prompt will look [12:00] like. It will become like a puzzle. The prompt is the the prompt guard is going to replace all the [12:11] all the sensitive information with a with a placeholder like P1, P2, P3. [12:17] And it will do this is a I just a simple example to to just to elaborate the idea. [12:25] It is going to add a key here for the AI agent, which is available in public, [12:33] to resolve this puzzle and regenerate this prompt. Because when this one is being sent [12:41] to the public AI, there will be several agents. Minimum three agents. Each agent is pre-instructed [12:50] to execute some algorithm before it execute the prompt. So, it has to rebuild the prompt [12:56] first first and then execute it. Okay? So, this is how this several agents are going to receive [13:05] this prompt. It will be like a puzzle that they have to resolve. For example here, [13:11] the key to solve this, it has for each of this parameter, it has three values. Uh in our example, [13:21] only the third value is the right one. So, it has two wrong value and one right value. [13:29] And in our example, it's the third value. But who knows that the third value is the right one? [13:40] The one who created in the first place, which is the prompt guard. So, the prompt guard, [13:45] which on brim, is the only thing that knows that it put the right answer in in the third value. [14:02] Now, we'll dig more to see how does it work exactly to make it uh more clear for you. [14:10] Now, a user is going to submit a prompt. It will go first to the prompt guard. As we mentioned, [14:18] the locally I is going to detect the identifier and the sensitive information. [14:24] Then, it will go to the identifiable data and anonymize it. [14:30] Then, it will go to generate these decoys by converting this prompt into a puzzle that need to [14:38] be resolved first before it is being executed. And each time it does this, it change the algorithm. [14:47] In the example I showed to you, the third value was the right value, while the first value and [14:52] the second value was wrong. The second prompt that it will receive, it will change the order. [14:58] And this will happen randomly, but the prompt guard, he knows for each prompt which algorithm [15:05] he used in order to be able to restore the original prompt back when it receives. [15:17] Then, this uh confiscated prompt is going to be sent to at least three different agent. [15:27] This is in the public domain. Each agent is going to first [15:33] restore the prompt, then execute. Uh, in this example, for example, it could be agent B. [15:42] And prompt guard knows that agent B will be the only one who will give back the right response. [15:50] Now, it is going to get back all the responses from the three different agent. And the prompt [15:57] guard is going to discard agent A and agent C response because it knows that only agent B is [16:04] have the right response. And then it will de-anonymize it and send it back to the user. [16:12] Behind the scene, again, these three agent who belong to the same AI model, which, [16:19] for example, will chat GPT or Gemini or what have you, they went to the same buffer. [16:24] But now the algorithm, when it looks at this, it will find three plausible but contradicting story. [16:34] They look the same but with different figures and they're coming even [16:40] uh, from a weird location, unexpected location, because it has been misattributed. And even the [16:48] names of the companies, it doesn't match. So, here it will start [clears throat] to have [16:55] a big doubt about the reliability of this data. Furthermore, there's a very important point here. [17:04] Now, since each of these agent first resolved the puzzle before executing it, now the prompt became [17:14] a machine-generated prompt, not a user authentic user prompt. But it knows that I am the one who [17:24] built this prompt, not not a user. So, it will say to itself that [17:31] maybe the algorithm that I used, whoever put this instruction for me, did not put the right thing. [17:39] So, this will create another doubt for for it. This is not a authentic user prompt. This is [17:44] machine generated. So, this is another reason just to discard this as a training material. [17:50] We will notice here that while all this data looks alike, uh but they are completely different. [18:03] And this is an example that we can quickly can show you how how it work. A user will submit a [18:11] prompt. It will be identified by the prompt guard for the identifier and sensitive information. [18:19] Then it will be anonymized and then obfuscated by the application, then sent to three different [18:30] agents as we mentioned. And the three agents now is going to give three different responses. Only [18:37] one of them will be selected and then will be the anonymized and sent back to the user. [18:50] Now, in order to to see how effective is this method, I because I was I have been chatting [18:57] with ChatGPT for too many months about this patent and idea and we go back and forth and [19:05] and after all I asked ChatGPT to make a fair and unbiased assessment [19:11] to this and to this method in protecting uh company data that exists in user prompt. [19:21] And it gave me the strength and the vulnerable area. And we have many strength area [19:30] uh in this method. Uh and there are mitigation in order to increase the level of uh protection [19:40] at each type of the uh prompt, but in general if we are talking about a pure textual prompt, [19:53] the protection rate will be very high and up to 98%. If it has uh multimodal uh input, [20:04] this will be a little bit more risky. However, we have always to remember that this prompt guard [20:12] you can make it as strict as you want. You can make it just bypass the whole prompt and not [20:19] allowing it to go outside the company. If you want, you can make it hide some of the [20:26] for example images uh that it is not able to read it carefully and uh regenerated again. But you can [20:36] go as strict as you want in order to achieve almost 100% protection of your company data. [20:44] And we are here only talking about uh 8.5% of the uh of the prompt user and business [20:53] and all the remaining prompt percentage, this uh method is going just to bypass the whole process [21:00] and just send it. It will say this is just safe prompt. It can send it to the public AI [21:06] uh model and receive the response back without any problem. [21:12] Uh by this I conclude my presentation. [21:16] And the message here is that we can still use the public AI models [21:22] without sacrificing our our data privacy. And I'll be happy to to answer any question.