PolicyGuard: Prompt-Configurable Semantic DLP for LLM Coding Agents

2026-08-03

AI Summary

This work addresses the risk of data leakage in AI programming agents caused by inadvertent inclusion of credentials, personally identifiable information, or proprietary secrets in natural language prompts—a vulnerability inadequately mitigated by existing inflexible safeguards. To tackle this, the authors propose PolicyGuard, a pre-model interception framework grounded in the “policy-as-prompt” paradigm. PolicyGuard leverages natural language policy files to semantically classify user prompts via large language models, enabling configurable data loss prevention without code modification or model retraining. The approach empowers non-engineers to define custom policies and incorporates a sealed evaluation protocol to ensure rigorous generalization assessment. Experiments demonstrate that PolicyGuard achieves a 96.5% interception rate (with a 3.0% false positive rate) on 927 held-out test prompts, 100% accuracy on 217 hidden prompts, and consistently robust performance across four diverse large language models, with effectiveness ranging from 86.4% to 96.5%.

Abstract

AI coding agents accept free-form natural language prompts that may inadvertently contain credentials, personally identifiable information (PII), or proprietary business data. Existing data loss prevention (DLP) solutions rely on rigid regex patterns, model fine-tuning, or vendor-managed classifiers with limited customizability. We present PolicyGuard, a pre-model interception framework that classifies user prompts using an LLM guided by a natural language policy file. Our key contributions are: (1) the policy-as-prompt paradigm, where DLP classification criteria are defined entirely in a plaintext policy document editable by non-engineers without code changes or model retraining; (2) a sealed evaluation protocol with template-family-level data splits, hidden holdouts, and frozen test sets to rigorously assess generalization; and (3) a comprehensive empirical evaluation across 2,000 multilingual prompts demonstrating 96.5% effective block rate (EBR) with only 3.0% false positive rate (FPR) on a frozen test set of 927 prompts, and perfect 100% accuracy on a 217-prompt hidden holdout. Information-matched baseline experiments show that PolicyGuard's natural language format significantly outperforms equivalent content in JSON format (McNemar chi-squared = 31.58, p < 0.001) and dramatically outperforms zero-shot classification (Cohen's h = 0.915). Cross-model portability experiments demonstrate that the same policy achieves 86.4-96.5% EBR across four different LLMs without modification.

Problem

• Data Loss Prevention
• LLM Coding Agents
• Prompt Security
• Personally Identifiable Information
• Sensitive Data Leakage

Innovation

• Policy-as-Prompt
• Semantic DLP
• Natural Language Policy
• Pre-model Interception
• Cross-model Portability