drop similarity search query log · detect data exfiltration via similarity queries · runs locally
query log · local only
heuristic screener · vendor schema varies · not definitive proof