1. A computer implemented method comprising: generating, by a client computer system, a first determination on whether an information content item on the client computer system violates a data loss prevention (DLP) policy, the first determination being generated based on a support vector machine (SVM) classifier associated with the DLP policy; transmitting the information content item and the first determination on whether the information content item violates the DLP policy to a remote system; receiving an updated SVM classifier from the remote system if the first determination differs from a second determination based on document fingerprint matching by the remote system, wherein the updated SVM classifier reflects the second determination with respect to the information content item; and determining, by the client computer system, whether other information content items on the client computer system violate the DLP policy using the updated SVM classifier.