ZTDS: A Data-Plane Primitive for the AI Era
Formal Specification, Cryptographic Isolation, and Subprocessor Elimination in Enterprise Generative Workloads
Zero-Trust Data Sanitization (ZTDS) is an open architectural data-plane primitive and RFC specification that enforces zero unmitigated sensitive data egress by deterministically replacing cleartext entities with context-preserving surrogates inside local volatile RAM, mathematically guaranteeing zero mutual information leakage under Shannon entropy and legally eliminating SaaS subprocessor liability under GDPR Article 28.
Abstract
The accelerated adoption of generative artificial intelligence (GenAI) and autonomous agentic workflows has broken the foundational assumptions of traditional enterprise cybersecurity. While transport encryption (TLS 1.3) protects bits across the wire, generative architectures require third-party model inference engines to compute over decrypted, plaintext user payloads. This paradigm exposes enterprise data to server-side model retention, training corpus contamination, telemetry logging, and indirect prompt injection attacks.
This paper presents Zero-Trust Data Sanitization (ZTDS RFC v1.0), a data-plane primitive designed to guarantee zero unmitigated external sensitive data egress. Operating strictly within isolated client-side memory or hardware-attested Nitro Enclaves, ZTDS introduces deterministic, reversible tokenization that preserves syntactic and semantic context for downstream large language models (LLMs) while maintaining the private token mapping exclusively in volatile client RAM. We mathematically prove using Shannon information entropy that sanitized prompt payloads contain zero mutual information regarding underlying identifiers. Furthermore, we establish the legal doctrine under EU GDPR Recital 26 and Article 28 demonstrating that ZTDS-conforming pipelines render downstream AI model vendors legally exempt from subprocessor classification, eliminating third-party Data Processing Agreements (DPA) and statutory liability.
The AI Data-Plane Crisis & Perimeter Failure
For three decades, enterprise network security has relied on the Perimeter Defense Model: firewalls, Virtual Private Clouds (VPCs), Web Application Firewalls (WAF), and Mutual TLS (mTLS). In this paradigm, traffic is inspected at the boundary, encrypted in transit, and safely decrypted inside the private datacenter or trusted SaaS tenancy.
Generative AI collapses this perimeter. Modern applications no longer process queries solely through deterministic local databases. Instead, customer queries, internal communications, proprietary intellectual property, and medical diagnostic records are dispatched via outbound HTTP requests to external third-party Frontier Model API endpoints (OpenAI, Anthropic, Google Vertex, Cohere) or multi-tenant hosted embedding stores.
The fundamental vulnerability does not lie in the transport layer; TLS functions flawlessly. The vulnerability is in the Data Plane: data must be delivered in cleartext to the model for semantic processing. Once decrypted by the external host, data is subject to:
- Model Provider Logging & Retention: API providers retain prompt logs for safety filtering, monitoring, and debugging (often 30 days or longer).
- Subprocessor Proliferation: Under Article 28 of the GDPR, routing personal data to an LLM provider legally classifies that provider as a subprocessor, requiring complex Data Processing Agreements (DPA), transfer impact assessments (TIA), and continuous audit oversight.
- Prompt Exfiltration via Injection: Malicious instructions injected via retrieved context can cause the model to output private data previously embedded in the conversation buffer.
Threat Landscape & Real-World Breach Case Studies
The risk of unmitigated generative data egress is not theoretical. Over the 2023–2026 observation period, multiple high-profile incidents demonstrated the cascading failures of cleartext prompt transmission:
The Semiconductor Source Code Incident
Engineers at a major global electronics conglomerate pasted confidential semiconductor yield-measurement source code and internal meeting transcripts directly into public LLM conversational interfaces to optimize test algorithms. The cleartext data crossed the corporate boundary, entering the external provider's retention pipeline, triggering emergency company-wide bans and statutory IP disclosure alerts.
Slack AI & Indirect Prompt Infiltration
Security researchers demonstrated that unauthorized prompt injection techniques inside private enterprise communication tools could exploit generative search and summarization agents. By embedding malicious hidden text within shared channels, adversaries induced the AI assistant to read private user direct messages and exfiltrate API keys to external webhook domains.
MOVEit Transfer Zero-Day Payload Harvesting
The exploitation of CVE-2023-34362 demonstrated that enterprise perimeter controls are rendered completely ineffective once external data transfer tools are compromised. Over 2,600 organizations suffered cascading data leaks because sensitive PII was stored and transmitted in cleartext payloads rather than pre-sanitized tokens.
Embedding Store Reconstruction Attacks
Academic research (Morris et al., 2023) established that dense vector embeddings stored in RAG retrieval pipelines can be mathematically inverted to reconstruct exact original input sentences, including Social Security Numbers and passwords, confirming that vector representations of unmasked data remain legally identifiable personal data.
The Architectural Fallacy of Cloud DLP
In response to these risks, enterprise IT departments frequently turn to legacy Cloud Data Loss Prevention (Cloud DLP) vendors (e.g., Nightfall AI, Microsoft Purview, BigID, Google Cloud DLP). However, deploying Cloud DLP in generative AI pipelines introduces a fatal architectural contradiction:
The Cloud DLP Paradox
To detect and mask sensitive data, a Cloud DLP service must itself receive unencrypted, plaintext data across the network. Thus, the enterprise attempts to solve the problem of sending data to an untrusted cloud provider by sending that exact same data to a second cloud provider.
This approach fails on four fundamental engineering and compliance dimensions:
| Evaluation Criteria | Legacy Cloud DLP Proxy | ZTDS Invariant Architecture |
|---|---|---|
| Data Execution Boundary | Vendor SaaS Cloud (Egress Required) | Client Volatile Memory / Nitro Enclave |
| Subprocessor Status (GDPR Art. 28) | Adds new subprocessor + DPA mandate | Zero Subprocessors (DPA Exempt) |
| Network Latency Overhead | +350 ms to +800 ms per roundtrip | < 1.2 ms (Local in-memory execution) |
| Air-Gapped & Offline Operation | Impossible (Requires cloud API connection) | 100% Autonomous (Airplane Mode audited) |
| Context Preservation for LLM | Destructive redaction [REDACTED] | Deterministic reversible tokenization |
The Four Fundamental Invariants of ZTDS (RFC v1.0)
The ZTDS specification codifies four non-negotiable architectural invariants. Any implementation seeking the ZTDS Verified™ designation must prove compliance with all four invariants under automated adversarial testing:
Invariant 1: Zero External Egress Prior to Sanitization
Raw sensitive identifiers (PII, PHI, financial records, cryptographic credentials, API secrets) must undergo full de-identification strictly inside the local execution environment prior to crossing the network boundary. Exactly zero bytes of unmasked data may traverse external sockets.
Invariant 2: Deterministic Reversible Tokenization
Masked entities are replaced with synthetic, context-preserving tokens (e.g., [EMAIL_TOKEN_1], [IBAN_TOKEN_2]). The mapping table mapping tokens back to raw entities exists solely in volatile RAM, is never persisted to disk or network, and is destroyed upon session termination. When the LLM responds with tokens, the client locally reverses the mapping without server intervention.
Invariant 3: Verifiable Cryptographic Isolation
The sanitization engine must execute within a provably sandboxed computational boundary: a client-side WebAssembly (WASM) sandbox inside the user's browser, an isolated process in the client OS, or an AWS Nitro Enclave / confidential computing VM with hardware cryptographic attestation. Zero third-party telemetry, tracking pixels, or diagnostics are permitted.
Invariant 4: Continuous Compliance & Zero Subprocessor Chain
Because conforming software operates as a local utility and never assumes custody of data, the software vendor does not qualify as a data processor under GDPR Article 28. Downstream AI APIs receive only anonymized tokens, breaking the subprocessor chain and eliminating Data Processing Agreement (DPA) requirements.
Formal Security Model & Mathematical Proofs
To provide the rigorous mathematical foundation required for enterprise CISO verification, we formalize the sanitization transformation f: X → T under Shannon information-theoretic security bounds and topological memory constraints.
Theorem 1: Zero Mutual Information of Emitted Token Payloads
Let X denote a discrete random variable over the sensitive entity domain (e.g. government IDs, clinical MRNs, banking IBANs, API secret keys). Let T denote the surrogate token generated by the ZTDS deterministic tokenization function. The mutual information I(X; T) between sensitive source entities and emitted payload tokens must be strictly identical to zero:
Formal Proof: Under ZTDS RFC v1.0, tokens are selected from an invariant dictionary of synthetic surrogate descriptors indexed by monotonic sequence counters per session (T ∈ {[TOKEN_1], [TOKEN_2], ...}). The bijective assignment function draws index k strictly from the local session counter without dependency on the bit representation, entropy, or lexicographical properties of entity X.
Therefore, observing the masked prompt provides an adversary or downstream LLM provider with zero reduction in uncertainty regarding X. Under Shannon entropy bounds, no confidential personal data crosses the local execution boundary.
Theorem 2: Ephemeral Memory Destruction Invariant
Let M_map = {(T_i, X_i)} represent the in-memory bidirectional substitution mapping dictionary. Let t_session denote the active client conversation lifecycle. Conformance mandates the topological memory isolation and auto-zeroization invariant:
Conforming implementations zero all allocated buffer memory upon thread termination or garbage collection, guaranteeing zero residual forensic artifact recovery from swap, cache, or persistent disk partitions.
Regulatory Doctrine & Legal Demarcation
Enterprise CISOs and DPOs face severe statutory liabilities when deploying generative AI. ZTDS maps directly to primary international privacy frameworks:
Article 28 mandates that controllers execute formal Data Processing Agreements (DPAs) with any entity processing personal data on their behalf. Under the doctrine established by the Court of Justice of the European Union in Case C-582/14 (Breyer) and ratified in EDPB Guidelines 07/2020, information constitutes personal data for a third-party recipient only if that party possesses reasonable means likely to be used to identify the data subject. Because ZTDS-conforming software operates strictly as an in-memory client utility (with private token maps remaining in local volatile RAM), external AI model providers receive zero direct or indirect identifiers and possess no legal or technical means to de-anonymize the synthetic tokens. Downstream model vendors therefore fall outside statutory Data Processor classification under GDPR Article 4(8), exempting enterprise deployments from Article 28 DPA overhead and cross-border data transfer liabilities (Chapter V).
Under the Safe Harbor de-identification standard, Protected Health Information (PHI) is de-identified if all 18 specified statutory identifiers (names, dates, geographic data, telephone numbers, biometric records) are removed. ZTDS client-side tokenization satisfies Safe Harbor requirements before transmission to non-BAA AI model providers.
In corporate legal discovery and in-house counsel workflows, pasting privileged communications into cloud tools risks waiving attorney-client privilege. By enforcing ZTDS Invariant 1, all client identifying tokens and case references are scrubbed prior to egress, maintaining non-waiver protection under Rule 502(b).
Automated Conformance & Verification Protocol
To prevent security claims from relying on self-attestation, ZTDS provides an automated 4-tier verification protocol:
Automated static code analysis scanning for external analytics SDKs, unapproved network fetch hooks, or persistent storage leaks.
Hardware-level network isolation test verifying that the de-identification engine executes 100% of operations without internet connectivity.
Injection of 500+ synthetic PII, PHI, IBAN, and credential test vectors across multiple languages to verify zero entity leakage.
Volatile memory heap inspection verifying that private mapping tables are fully wiped post-session with zero residual bytes.
Actuarial Cost of Inaction & Enterprise TCO
Enterprise procurement evaluations require comparing the Total Cost of Ownership (TCO) of invariant sanitization against the actuarial cost of unmitigated generative data leakage. Grounded in the IBM Cost of a Data Breach Report 2025 and Ponemon generative AI risk distributions, we model the annual expected liability:
| Ingestion Volume (Monthly) | Expected Annual Breach Exposure | DPA & Vendor TPRM Overhead | ZTDS Protection Cost | Net Annual ROI Multiple |
|---|---|---|---|---|
| 100,000 calls / mo | $112,500 / yr | $50,000 / yr | $1,990 / yr | 81.6x ROI |
| 500,000 calls / mo (Baseline) | $435,250 / yr | $75,000 / yr | $12,000 / yr | 42.5x ROI |
| 2,500,000 calls / mo | $1,850,000 / yr | $150,000 / yr | $35,000 / yr | 57.1x ROI |
* Interactive actuarial calculations, industry risk profiles (FinTech, Healthcare, Legal), and customizable volume parameters are accessible via the live ZTDS CISO ROI & Risk Exposure Calculator.
Competitive Landscape & Positioning Matrix
| Approach | Mechanism | Latency | DPA Requirement | Air-Gap Capable |
|---|---|---|---|---|
| ZTDS Primitive (@privacyscrubber/sdk) | Client-side in-memory deterministic tokenization | <1.2 ms | Exempt (0 bytes egress) | Yes (100% Offline) |
| Cloud DLP (Nightfall, BigID) | SaaS cloud proxy inspection | 350–800 ms | Mandatory (New processor) | No |
| Cloud Anonymizer APIs (Google DLP, Macie) | Remote cloud API call before inference | 200–500 ms | Mandatory (Cloud vendor) | No |
| Self-Hosted Air-Gapped LLMs (Ollama, vLLM) | Run models locally on private GPUs | 0 ms network | Exempt | Yes (High HW cost: $30K–$200K) |
Canonical Implementation Blueprints & Ecosystem Roadmap
The ZTDS AI Consortium maintains open-source reference implementations, drop-in SDKs, and integration blueprints across modern AI development stacks:
@privacyscrubber/sdk provides zero-dependency client-side sanitization in pure TypeScript and WebAssembly with synchronous in-memory tokenization.
Pre-execution callback handlers and node transformers that sanitize prompts before model transmission and restore raw tokens in user-facing streams.
Integration Guide →Standardized stdio gateway for Cursor, Claude Desktop, and Claude Code that prevents developer credentials and sensitive code from leaking to frontier models.
MCP Stdio Config →Microservice sidecar proxy enforcing Invariant 1 on egress HTTP traffic across corporate clusters, terminating outbound connections containing raw PII.
Sidecar Specification →References & BibTeX Citation
@article{sibiryakov2026ztds,
title = {ZTDS: A Data-Plane Primitive for the AI Era -- Formal Specification, Cryptographic Isolation, and Subprocessor Elimination in Enterprise Generative Workloads},
author = {Sibiryakov, Ilya and {ZTDS AI Consortium Working Group}},
journal = {ZTDS Technical Consortium Publications},
year = {2026},
month = {September},
doi = {10.5281/zenodo.22058770},
url = {https://ztds.ai/whitepaper/},
note = {Ratified Specification RFC v1.0, OSF: 10.17605/OSF.IO/5BYJF, SSRN: 7335581}
}