Someone pastes a customer name and a card number into a prompt.
At AG Tech, that is the question clients actually ask. Not which model to buy. Who sits between the prompt and the model.
On 1 September 2026, Salesforce was granted the patent on the gate that is supposed to strip them out before the model ever sees them.
That gate is not a new language model. It is a checkpoint.
The grant
US Patent 12,724,922 B2, “Trust Layer for Large Language Models,” went to Salesforce, Inc. Shashank Harinath is the first-named inventor. The application was filed on 11 January 2024. It claims priority to a provisional filed on 11 September 2023, and it was published as US 2025/0086309 A1 on 13 March 2025. The grant has 19 claims and 9 drawing sheets.
What the patent actually describes
The abstract is narrower than the marketing phrase “trust layer.”
A cloud platform receives a prompt from a client that wants an answer from a large language model. That client has configuration settings. The platform changes the prompt according to those settings, sends the changed prompt to the model, and takes the answer back. A separate model estimates the probability that the answer falls into one or more content categories. The platform then sends the answer, a notice of those scores, or both.
On the way out
The platform may replace sensitive elements with masking tokens. The description names:
personally identifiable information payment-card data protected health information anything else the customer has flagged
If the model echoes those tokens, the platform restores the original values before the user sees the text. Two names become separate person placeholders. A card number becomes a credit-card placeholder. The map from placeholder to real value stays off the model.
The same description allows a blunter rewrite. The platform may insert characters before the prompt, after it, or both, including a random string or XML-style tags, and it may delete parts of the prompt. It presents that fencing as a prompt-injection defense: a caution to the model, user text placed where it is less able to override later instructions, and tags so the model treats the user text as data.
On the way back
The categories named in the specification are toxicity, hate, identity, violence, physical, sexual, and profanity. Probabilities can be logged with the prompt and the response. Dashboards, alerts, and a request that an outside model not retain the prompt are in the description.
Read plainly, the patent covers a configurable gateway. Mask or fence the prompt. Call the model. Score the answer. Withhold or flag it when a customer-set threshold is crossed.
Why a CTO should care
The risk starts in the prompt, where someone pastes a customer record into a tool that calls an outside model. It ends in an answer that can be fluent and still unfit to show. Masking is the proposed compromise. The outside model works on a redacted prompt. The customer’s own platform restores the details only on the way back.
Until 1 September this was only a published application. Google Patents still listed that application as pending on 4 October 2026, and its page for the granted number returned not found. The grant is real. It is on the USPTO cover sheet.
A competitor does not have to abandon gateways. It does have to read these claims before shipping a product that rewrites prompts from customer settings, masks designated fields, wraps the prompt, scores the reply, and gates delivery on a threshold.
This is also a marker of how LLM security is being patented. The claimed object is not a jailbreak detector with a public score. It is control of the pipe: what a tenant may send, what an outside model may see, and what a user may receive.
The skeptical note
A grant is not evidence that the method works.
Fencing a prompt with tags, random characters, or a warning sentence is a heuristic. The patent reports no test set and no jailbreak rate, including against indirect injection, where the instruction arrives in a retrieved document rather than in the user box. Delimiter tricks have been bypassed for years.
Masking fails in ordinary ways. If the model never echoes the placeholder, there is nothing to restore. If it rewrites the placeholder, restoring the original value can attach sensitive data to the wrong words. The description does not stop the outside model from logging what it saw.
The pattern is also broad plumbing. Alter a prompt under a configuration, score the answer, compare it with a threshold, and deliver or flag it. Parts of that pattern were already used in commercial gateways before the 2023 priority date. The patent is a right to try to exclude others from that combination. It is not a finding that the combination is the best defense, and it is not a finding that every product described as a trust layer infringes.
Sources
USPTO grant, US 12,724,922 B2, date of patent 1 September 2026:
https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/12724922
Published application, US 2025/0086309 A1, 13 March 2025:
https://patents.google.com/patent/US20250086309A1/en
Originally published on LinkedIn in the Your CTO Advisor newsletter: read and comment on LinkedIn →
