Data diodes exist and are common in high-security environments https://en.wikipedia.org/wiki/Unidirectional_network

The hardware literally only goes one way. Nothing can "escape" without rewiring cables.