Trap facts
Invisible false facts woven into your documents. If your content ever shows up inside someone else's AI — a competitor's chatbot, a leaked knowledge base — the trap fact surfaces and proves the ingestion.
THE PROBLEM
You can't watermark knowledge. Or can you?
Text can be paraphrased, reformatted, and re-embedded — traditional watermarks don't survive a RAG pipeline. When your documentation, research, or internal wikis end up in someone else's model, you have no way to prove it happened.
A trap fact is a plausible, harmless, entirely fictional detail that exists only in your document — a budget figure, a project codename, a date. Humans skim past it. But a model that ingested your content will reproduce it, even paraphrased. When it appears in a completion, that's not coincidence — it's proof of ingestion.
HOW IT WORKS
Weave, monitor, confirm.
Paste the document
CanaryRAG reads the content and writes trap facts that blend into the surrounding text without changing its meaning.
Weave the traps
Three trap facts unique to that document are woven into the text. Protect the same source twice and each run gets its own set, so a leak points at the copy it came from.
Monitor completions
Point the monitoring API at any assistant you can query. When a trap fact surfaces, the hit is scored, attributed, and sealed.
WHAT YOU GET
Everything reports into the same console.
inject() returns the protected text plus the three planted facts — store the protected text in your RAG corpus, not the original. Documents are passed as strings, so read the file yourself. LangChain helpers ship in canaryrag.langchain.
Will readers notice the trap facts?
They are written from your document's own context — a plausible figure in a table, a minor date — so they read as ordinary detail. Protection returns the rewritten document alongside the original and the three planted facts, so you can diff the two and check every change before you distribute it.
Does it survive paraphrase?
Yes. Trap facts are semantic, not textual — a model that learned the figure will reproduce it even in completely different wording. Detection matches the fact, not the phrasing.
FIELD NOTES
Reading that goes with this surface.
CANARYRAG · 5 MIN READ
Proof beats suspicion when private documents leak through AI
CanaryRAG is designed around planted facts and reproducible signals so operators can distinguish real leakage from vague answer drift.
PLATFORM · 6 MIN READ
Why AI security alerts need evidence attached from the start
A useful security alert does more than say that something suspicious happened. It explains what fired, which surface was involved, and what proof is available before the incident review even begins.
Find out where your documents really go.
Free tier, no credit card. Five minutes to your first alert.
Protect a document