Core ML

PII Detection and Redaction

Before processing sensitive data or sending it to an LLM, a system must automatically identify and mask personally identifiable information to prevent privacy leaks.

Raw text containing a name and phone number passes through a redaction pipeline, which replaces the sensitive data with placeholder tokens before it reaches the external model.

Why Does This Exist?

In the era of Generative AI, companies are increasingly sending user data—support tickets, medical records, financial transcripts—to third-party LLMs for summarization or analysis. If you send a transcript that says, "My name is John Doe and my credit card is 1234-5678," that data is now stored on someone else's servers. It might even be used to train future models, leading to catastrophic privacy leaks.

To comply with regulations like GDPR or HIPAA, and to protect user trust, organizations use PII (Personally Identifiable Information) Detection and Redaction. This is an automated pipeline that scans raw data, finds sensitive entities (names, phone numbers, SSNs, addresses), and replaces them with safe placeholders before the data ever leaves the organization's secure environment.

Think of It Like This

A government censor reading classified documents

Imagine a government censor whose job is to prepare classified documents for public release.

They read through the document with a thick black marker. Whenever they see the name of an undercover agent or the coordinates of a secret base, they black it out. The public still gets to read the overall document and understand the context, but the specific, sensitive details are gone forever.

An automated PII redaction system does exactly this, but at the speed of millions of words per second, using algorithms instead of a black marker.

How It Actually Works

The Hybrid Approach

PII detection is rarely solved by a single tool. Because the cost of a false negative (missing a credit card number) is a massive fine, but the cost of a false positive (redacting a non-sensitive word) is just an annoying user experience, systems use a layered approach:

Regular Expressions (Regex) and Rules: Fast, deterministic pattern matching is used for highly structured data. Credit card numbers, Social Security Numbers, phone numbers, and email addresses follow predictable formats. Regex catches these perfectly with almost zero latency.
Named Entity Recognition (NER): Unstructured data (like names, company names, or addresses) cannot be caught by regex. "John Smith" looks just like any other two words. Here, organizations use fine-tuned NLP models (like spaCy or small transformers like RoBERTa) trained on NER tasks to identify the context and label the text as a PERSON or LOCATION.
Lookup Tables (Dictionaries): Comparing words against a known database of sensitive terms, such as a list of rare medical conditions or specific internal project code names.

Masking Strategies

Once a sensitive entity is detected, the system must handle it.

Redaction / Masking: Replacing the text with a generic token, e.g., "Hello [PERSON], your balance is [MONEY].". This is the safest approach.
Pseudonymization (Faker): Replacing the sensitive data with realistic but fake data, e.g., "Hello Alice, your balance is $100.". This is useful when the downstream model needs the text to flow naturally to perform well.
Tokenization / Reversibility: Replacing the entity with a unique identifier (e.g., PERSON_89A2). The downstream model processes the text and returns an answer. The local system then swaps the original name back in before showing the result to the user. The external LLM never sees the real name, but the end-user gets a personalized experience.

Show Me the Code

1import re2import spacy3
4# Load a pre-trained Named Entity Recognition model5nlp = spacy.load("en_core_web_sm")6
7def redact_pii(text: str) -> str:8    # 1. Regex for structured PII (e.g., Email addresses)9    text = re.sub(r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b', '[EMAIL]', text)10    11    # 2. NER for unstructured PII (e.g., Names)12    doc = nlp(text)13    redacted_text = text14    15    # Process entities in reverse so string indices don't shift16    for ent in reversed(doc.ents):17        if ent.label_ == "PERSON":18            redacted_text = redacted_text[:ent.start_char] + "[PERSON]" + redacted_text[ent.end_char:]19            20    return redacted_text21
22# Example usage23raw = "Please contact Jane Doe at jane@example.com."24print(redact_pii(raw))25# Output: "Please contact [PERSON] at [EMAIL]."

Watch Out For

Contextual leakage

Redacting explicit identifiers isn't always enough. If a document says, "The 44th President of the United States," the person is uniquely identified without their name being stated. This is called quasi-identifier leakage, and standard NER models will not catch it.

OCR and Multimodal PII

If you build a flawless text redaction system, but users upload screenshots of their passports, you still have a massive data leak. PII redaction must often sit behind an Optical Character Recognition (OCR) pipeline to strip text from images, or use specialized computer vision models to blur faces and license plates in raw images.

The Quick Version

PII Detection and Redaction automatically masks sensitive data before it is exposed to external APIs or stored in databases.
It relies on a hybrid approach: Regular Expressions for structured data (emails, credit cards) and Named Entity Recognition (NER) for unstructured data (names, addresses).
Redacted data can be replaced with generic tokens, fake data, or reversible identifiers depending on the downstream application's needs.
Missing a single PII entity can result in regulatory fines, making high recall the priority over high precision.