Proof beats suspicion when private documents leak through AI

CanaryRAG is designed around planted facts and reproducible signals so operators can distinguish real leakage from vague answer drift.

Companies are feeding private documents into RAG systems so AI can answer questions from internal data. The problem is that nobody can tell whether the AI is leaking private information or just generating plausible-sounding answers from its training data.

CanaryRAG solves this by injecting fake but realistic facts into your documents before they enter the RAG pipeline. These planted facts (fake names, fake numbers, fake dates) are unique to your documents and tracked by CanaryRAG.

If any AI system ever outputs one of these planted facts, you have proof that your document was accessed and its contents leaked. Not suspicion. Not correlation. Proof. The fake fact could only have come from your specific document.

Each planted fact gets a unique identifier (like CNRY-7F3A91C2) and is monitored continuously. When a match is detected, CanaryRAG fires an alert with the exact fact that surfaced, the document it came from, and a trigger record holding the matched output and the detection timestamp. Two corrections to earlier versions of this post. That record does carry a re-verifiable content hash of its own, computed over the fields that identify the hit and stored on the row, so you do not need to write one yourself. What it is still not is part of the hash-sealed evidence log CanaryAudit maintains, which is why the public verifier resolves nothing for a RAG hit.

This approach works because it converts a hard problem (did the AI leak my data?) into an easy problem (did a specific fake fact appear in an output?). The signal is binary and unambiguous.

This article is about a shipped surface: CanaryRAG, trap facts for your documents. Integration details live in the docs.