Module 8 Lesson 4: Sanitizing AI-generated content

Sanitization is the process of making AI output "Safe for Consumption." It is your last line of defense before a potential exploit hits a user or a system.

1. Types of Sanitization

1. Semantic Sanitization: Removing "Bad Ideas" (e.g., hate speech, bomb-making instructions). This is usually done by a second, small AI model (like a Guardrail).
2. Syntactic Sanitization: Removing "Bad Code" (e.g., <script> tags, terminal commands, SQL keywords). This is done using traditional software tools.
3. PII Scrubbing: Removing sensitive data (e.g., Credit Cards, SSNs) that the AI might have hallucinated or leaked from its memory.

---

2. Tools of the Trade

• DOMPurify: For HTML/Markdown output. It strips away all dangerous JavaScript attributes while keeping the <b> and <i> tags.
• Pydantic / JSON Schema: If your AI is outputting data for an API, NEVER just parse it. Validate it. If the AI was supposed to return an "Age" (integer) but returned a "System Command" (string), the schema validator will block the attack.
• Presidio: Microsoft's open-source tool for finding and masking PII in text strings.

---

3. The "Guardrail" Pattern

Modern AI engineering uses Guardrails. A Guardrail is a "wrapper" around the AI.

1. AI #1 (the generator) creates a response.
2. Guardrail checks if the response contains forbidden keywords or patterns.
3. If the check fails, the Guardrail blocks the response and returns a safe alternative like: "I'm sorry, I cannot provide that information."

---

4. Why "Regex" is Not Enough

Attackers are creative. If you use a Simple Regex to block the word password, an attacker will get the AI to output p.a.s.s.w.o.r.d or p@ssword. Sanitization must be Semantic (understanding the intent) as well as Syntactic (looking at the characters).

---

Exercise: The Sanitizer Setup

1. You are building an AI that writes "SQL Queries" based on natural language. Should you sanitize the Input (the user's English) or the Output (the generated SQL)?
2. Why is "Blocklisting" (banning specific words) less effective than "Allowlisting" (only allowing specific formats)?
3. Draft a simple Python function that uses a list of forbidden keywords to "Flag" a suspicious AI response.
4. Research: What is "NVIDIA NeMo Guardrails" and how does it implement programmable security for AI?

---

Summary

Sanitization turns a "Fragile" AI into a "Robust" system. By assuming the AI will occasionally output something dangerous, you can build a safety net that protects your users and your servers.

Next Lesson: The Human Shield: Human-in-the-loop patterns.