---
title: "How attacks and leaks show up on device"
lesson_id: "01"
---

# How attacks and leaks show up on device

- **Lesson ID:** 01
- **Goal:** Define prompt injection and PII leaks. State that Guardrails.default does not finish that work.
- **Human lesson:** [01-attacks-and-leaks.html](01-attacks-and-leaks.html)

## Prerequisites

LanguageModelSession on iOS 27 or macOS 27. Xcode 27.

## Inputs, outputs, and artifacts

- **Inputs:** Untrusted paste and private store data.
- **Outputs:** Two named failures and the need for extra middleware.
- **Artifacts:** Progressive .flow diagrams, environment setup, and a Swift session sketch.

## Agent build steps

1. Define injection as untrusted text that tries to change the job.
2. Define a leak as private data reaching the model, a tool, or PCC.
3. Say Guardrails.default is Apple's safety filter, not this course's full gate.
4. Show LanguageModelSession(guardrails: .default) with your checks around respond.
5. Link [Run tools in a safe box](../on-device-sandboxed-tools/), [Talk to tools with MCP](../on-device-mcp-server-client/), and [Make several agents agree first](../on-device-multi-agent-consensus/).

## Constraints

iOS 27 or later, or macOS 27 or later, and Xcode 27. Plain spoken English. No metaphor, quizzes, Mermaid, or em dashes. Apple's Guardrails.default is a safety filter, not PII redaction or injection detection. Do not invent a built-in injection API.

## Key concepts

- Untrusted sources include mail, web, OCR, chat paste, and tool results.
- Injection drops untrusted text next to instructions in `respond`.
- `Guardrails.default` does not document injection detection or PII redaction.
- `PrivateCloudComputeLanguageModel` sends packets off device. Redact first.

## Takeaways

- Treat pasted and fetched text as untrusted.
- Treat account data as leave-the-store only if redacted.
- Write middleware for injection and PII. Do not rely on Apple's default alone.

## Acceptance checks

- Both failures are named.
- Apple's default guardrails are not oversold.
- Sibling links, progressive .flow diagrams, and the Agent brief link are present.
- [ ] Proceed to [lesson brief](02-middleware-layer.llms.md).