Derived signals are non-raw indicators produced from data, such as classifier outputs, confidence scores, risk labels, aggregates, or metadata. Instead of storing full conversation text or payloads, a system can keep these smaller byproducts to support monitoring, moderation, or anomaly detection.
In cyber security, derived signals matter because they can preserve useful defense capabilities while reducing exposure to sensitive content. A platform may use them to spot repeated abuse, prompt injection attempts, policy evasion, or coordinated misuse across sessions. Defenders also use derived signals in SIEM and detection pipelines, where scores and event metadata help correlate activity without retaining every original message. The limitation is that derived signals are still security-relevant data: if they are too detailed, they can reveal user behavior or become a new retention risk. Good designs therefore minimize what is stored, document what each signal means, and tie retention to a clear policy.