Stop compromised credentials before they reach any model.
In-process lookup checks every prompt against a compromised credential dataset — sub-millisecond, no external service, no raw credential storage.
Three layers of credential detection
Dataset lookup, format validation, and entropy analysis work together — each catching what the others miss.
Real-Time Credential Lookup
An in-process lookup engine checks every credential pattern against a compromised credential dataset instantly — no network round-trip, no external service dependency. Sub-millisecond lookup latency means detection adds no perceptible overhead to the request path.
Format Validation
Credential patterns matched by format — API key structures, token prefixes, secret formats — are validated against known credential schemas before triggering enforcement. This eliminates false positives on strings that look like credentials but fail structural validation, keeping alert volume meaningful and actionable.
Entropy Analysis
High-entropy strings that pass format validation undergo entropy scoring to catch novel or obfuscated credentials that don't match known patterns. Entropy analysis provides a final catch layer for secrets that weren't in the dataset or don't conform to structured formats — covering the long tail of credential exposure.
- Lookup latency
- Sub-ms
- External dependencies
- Zero
- Raw credentials stored
- None
Compromised Credential Dataset
Leaked credentials sourced from breach databases are held in a compromised credential dataset. The dataset is versioned and updated continuously — when new breaches are published, it refreshes without redeployment.
Parallel Async Inspection
Credential checks run in parallel with the DLP pipeline — they don't block the main request path. A circuit breaker automatically disables the check if the dataset service is unavailable, defaulting to pass-through rather than blocking all traffic.
Audit Trail Integration
Every credential intelligence check is recorded in the audit log. Fields include whether the dataset was consulted, whether a hit was found, and the risk level of the matched credential — without storing the raw credential itself.
Enforcement Actions
When a compromised credential is detected, the configured enforcement action fires: block the request before it reaches any model, redact the credential and allow the prompt through, or log the detection for review. Enforcement is policy-controlled — different orgs and request types can apply different responses.
Risk Classification
Matched credentials are categorized by exposure frequency — how many times the credential appeared across known data breaches. High-frequency matches warrant different enforcement than low-frequency single-breach entries. Risk classification flows into the audit log and policy engine.
Privacy-Preserving Design
Raw credentials are never sent to an external service and never stored in the audit log. The lookup mechanism is designed so detection never creates a secondary exposure risk.
Online Breach Verification
For higher-confidence breach verification, an optional second layer queries an external breach API without transmitting the raw credential. Matches are evaluated locally. Raw credentials are never transmitted. The in-process dataset remains the default fast path; online verification provides an optional second layer for additional confidence.
How it works
Prompt arrives, credential patterns extracted
As each prompt enters Arbitex Gateway, credential detection runs in parallel with the DLP pipeline. Format validators scan for API key structures, token patterns, and high-entropy strings. Candidate credentials are extracted for dataset lookup.
Real-time check against a compromised credential dataset
Each candidate is checked against the in-process lookup engine — sub-millisecond with no network dependency. Hits are scored by risk level.
Enforcement fires, detection recorded
Confirmed matches trigger the configured enforcement action immediately. The detection — including hit status, risk level, and context type — is written to the tamper-evident audit log. No raw credential is stored at any stage.