Inside Arbitex's 3-Tier DLP Pipeline: How It Works

Most AI gateways log traffic. They record which model was called, how many tokens were consumed, and what the latency looked like. Some go further and track costs per team or per project. That is observability, and it is useful.

But it does not answer the question a CISO asks when AI traffic scales across an enterprise: what data left our network in those requests?

The standard approach to data loss prevention in the AI layer is a single regex pass. Scan the prompt for patterns that look like credit card numbers or Social Security Numbers, flag or block, move on. The problem is that regex alone produces two failure modes that erode trust in the system: false positives that block legitimate work, and false negatives that let actual sensitive data through.

This post walks through a 3-layer DLP inspection architecture designed to address both. Each layer catches what the others miss. The pipeline is additive, not redundant.

Layer 1: Regex Patterns with Checksum Validation

The foundation is pattern matching. 80+ regex detectors cover structured sensitive data: credit card numbers, government identification numbers, bank account numbers, tax IDs, and similar formats with predictable structure.

The key to making regex viable at scale is checksum validation. A raw regex for credit card numbers will match any 16-digit sequence. That means invoice numbers, order IDs, and timestamps all trigger false positives. Luhn algorithm validation on the matched sequence reduces false positive rates by an order of magnitude because it confirms the number is a structurally valid card number, not an arbitrary digit string.

The same principle applies across data types:

• Luhn validates credit card numbers (PCI-DSS scope)
• Modulus checksum validates IBANs and other financial identifiers (GLBA/BSA scope)
• Advanced checksum validation handles government IDs and tax numbers with check digits

Without checksum validation, regex is a liability. With it, regex becomes a high-precision first pass that handles 60-70% of DLP detections with a low false positive rate. The detections that remain ambiguous are escalated to subsequent layers.

Layer 2: Multi-Engine NER

Layer 1 handles structured data with predictable formats. Layer 2 handles unstructured data where patterns alone fail.

Named Entity Recognition (NER) identifies entities in free text: person names, addresses, phone numbers, medical record numbers, dates of birth, and other entities that do not have checksum-verifiable formats. A person’s name is just words. An address is just a sequence of tokens that looks like an address. No regex can reliably distinguish “Jordan” as a person’s name from “Jordan” as a country without context.

The NER engine uses a multi-engine NER stack backed by 40 recognizers running GPU-accelerated inference.

Layer 3: Contextual Validation

The contextual validation step is what separates a production DLP pipeline from a basic NER pass. When the NER model identifies a candidate entity, a contextual validation model evaluates the surrounding text to confirm or reject the detection.

For example, a raw NER pass might flag “Jordan Smith” in a request asking about a fictional character. The contextual validator examines the surrounding tokens, determines the context is literary analysis, and downgrades the confidence score below the detection threshold. The same name appearing in a request that includes an address and phone number gets a high confidence score because the context signals a real person’s record.

This is the layer that catches the ambiguous cases where sensitive data is embedded in natural language without a verifiable structure — and simultaneously prevents security fatigue by suppressing false positives.

Compliance Bundles

The three detection layers identify what is sensitive. Compliance bundles translate detections into regulatory enforcement.

Four regulatory frameworks are currently mapped:

Each compliance bundle defines which detectors from layers 1-3 are relevant, what confidence threshold triggers enforcement, and what action is taken (block, redact, or log). A HIPAA bundle activates PHI-related NER recognizers, medical record number regex patterns, and SSN detection, then enforces a block action at a lower confidence threshold than a general-purpose DLP policy would use.

Bundles are composable. An organization subject to both HIPAA and PCI-DSS activates both bundles, and the pipeline evaluates every request against both frameworks in a single pass. There is no performance penalty for activating multiple bundles because the underlying detection work is shared across all active bundles.

Compliance bundles are what turn a detection engine into a governance control. Without them, DLP is “we found something that looked like a credit card number.” With them, DLP is “this request violates PCI-DSS policy, action: blocked, logged to audit trail with policy reference.”

Why Layers Matter

The temptation in DLP design is to build one sophisticated detection model and run everything through it. The problem is that no single approach covers the full surface.

Regex with checksums is fast and precise for structured data but blind to unstructured content. NER handles unstructured content but is computationally expensive and unnecessary for data types with checksum-verifiable formats. Contextual validation reduces false positives but requires the NER candidate to exist first — it cannot operate alone. Compliance bundles require all three detection layers and add the policy context that turns a detection into an auditable enforcement action.

Each layer catches what the others miss. The pipeline is sequential: a request that passes Layer 1 with no detections still goes through Layers 2 and 3. A detection at any layer can trigger enforcement. The layers are additive.

The result in the Arbitex Gateway is a DLP pipeline where false positive rates stay low enough that teams do not disable the controls, and false negative rates stay low enough that the audit trail is trustworthy. That is the bar for DLP in production AI traffic: the system must be accurate enough that people leave it on.

Book a demo to see the full 3-tier DLP pipeline inspect your AI traffic.