Trap facts

Invisible false facts woven into your documents. If your content ever shows up inside someone else's AI, such as a competitor's chatbot or a leaked knowledge base, the trap fact surfaces and proves the ingestion.

THE PROBLEM

You can't watermark knowledge. Or can you?

Text can be paraphrased, reformatted, and re-embedded, and traditional watermarks don't survive a RAG pipeline. When your documentation, research, or internal wikis end up in someone else's model, you have no way to prove it happened.

A trap fact is a plausible, harmless, entirely fictional detail that exists only in your document: a budget figure, a project codename, a date. Humans skim past it. But a model that ingested your content will reproduce it, even paraphrased. When it appears in a completion, that is proof of ingestion.

Paste the document

CanaryRAG reads the content and writes trap facts that blend into the surrounding text.

Weave the traps

Three trap facts unique to that document are woven into the text. Protect the same source twice and each run gets its own set, so a leak points at the copy it came from.

Monitor completions

Point the monitoring API at any assistant you can query. When a trap fact surfaces, the hit is scored, attributed to its document, and recorded with a content hash you can recompute.

WHAT YOU GET

Everything reports into the same console.

import os
import httpx

r = httpx.post(
  "https://api.canaryvaults.com/canaryrag/inject",
  headers={"X-API-Key": os.environ["CV_KEY"]},
  json={"user_id": "<your-uuid>", "document_name": "finance-q3.docx", "document_text": text},
  timeout=120)
r.raise_for_status()
protected = r.json()["injected_document"]

The answer carries injected_document, the protected text, and canary_facts, the three planted facts. Store the protected text in your RAG corpus, not the original. The document is sent as text, so read the file yourself. The console ends with this call and the others written out with your user ID in them.

Will readers notice the trap facts?

They are written from your document's own context (a plausible figure in a table, a minor date), so they read as ordinary detail. Each one is added to a sentence the document already has, and every character the document had stays as it was. Protection returns the rewritten document alongside the original and the three planted facts, so you can diff the two and check every change before you distribute it.

Does it survive paraphrase?

Yes. Trap facts are semantic, not textual: a model that learned the figure will reproduce it even in completely different wording. Detection matches the fact, not the phrasing.