← All courses

EDGE FDE

Intermediate

On-Device AI Guardrails (Injection + PII)

Keep private data private and block prompt-injection before it reaches the model or leaves the device.

Guardrails middleware with injection checks and PII redaction around LanguageModelSession.

Your checks run first. Guardrails.default is Apple's filter, not a complete product policy. iOS 27 and macOS 27 only.

Lessons

  1. How attacks and leaks show up on device
  2. Put middleware in front of the session
  3. Check for injection first
  4. Redact PII on the device
  5. Test the pipeline on device

Key concepts

Takeaways

Agent briefs

FAQ

Does Guardrails.default stop injection and PII leaks?

No. Guardrails.default does not document injection detection or PII redaction. It stays on the session. Your PromptGate checks and redacts text before respond.

What counts as prompt injection on device?

Untrusted text that tries to change the job. Sources include mail, web, OCR, chat paste, and tool results. It shows up when that text sits next to instructions in respond.

Where does guardrail middleware run?

One PromptGate prepares text before session.respond and uses the same path on tool arguments and tool results. Keep guardrails: .default on the session.

How do I redact PII on device?

Replace emails, phones, links, and card-shaped numbers with tokens before the model or Private Cloud Compute sees the text. The token-to-original map stays outside the session transcript. Restore values in the UI only, not inside respond.

How do I test the guardrail checks?

Local tests feed attack paste, PII strings, and clean prompts through the gate. A blocked injection fixture is expected. Redacted output must contain tokens and not the raw address. Every check runs on device with no network.

Related courses

Run tools in a safe box · Talk to tools with MCP · Make several agents agree first · Route work to the right Apple model