PII Detection and Masking

What it is

Locating spans of text that identify a person and replacing them with something that does not, while keeping the text usable for whatever was going to read it next. The product of this capability is a transformed document rather than a verdict, which puts the hard questions on the transformation: whether it can be undone, whether the same person receives the same placeholder wherever they appear, and who is permitted to resolve it back.

Why it matters

Personal data in a language-model system is never in one place. The same name sits in the prompt, in the generated answer, in the retrieved passages, in the trace, in the evaluation set, in the prompt cache, and in whatever was sent to an inference provider under a contract somebody signed two years ago. Masking is the only control that changes the data itself rather than restricting who may look at it, which is what separates a log that is a liability from a log that is useful. It is also the control that most often breaks the product, because the identifier it removed is frequently the thing the user was asking about.

Key decisions

• Where the transformation is applied: before the model, before persistence, before display, or at several points with different rules at each. Removing identifiers before the model protects the provider relationship and destroys the system's ability to answer anything about a person.
• Reversible tokenisation against irreversible redaction, and if reversible, where the mapping lives and who may resolve it. That mapping immediately becomes the most sensitive store you own.
• Whether a placeholder is stable within a document, within a session, or globally. Stability buys coherent text and leaks linkage across everything that shares the namespace.
• Which classes count, in which jurisdictions, including the quasi-identifiers that identify in combination while matching no pattern individually.
• How recall is measured, given that the labelled corpus needed to measure it is made of exactly the data you are not supposed to retain.
• What happens to a span the detector is unsure about. Defaulting to replacement is safe for privacy and corrosive to the text.
• Whether free prose is the whole surface, or structured fields, attachments, images, and audio transcripts are also in scope, since each needs a different detector.

Failure modes

• The prompt is masked and the model reconstructs the identity from the surrounding details, so the answer contains the name the transformation removed.
• Every occurrence receives a fresh placeholder, coreference collapses, and a summary of a three-party conversation becomes unreadable.
• The detector was validated against one locale's name and identifier formats and deployed to a global user base, where its recall on other scripts was never measured and is far lower.
• Replacement is applied to the message body while the same values persist in request metadata, span attributes, error payloads, and the cached embedding.
• A reversible token is written into a document that is then exported, outliving the mapping, and leaving a record that is neither usable nor safely deletable.
• Masking happens at display time, so the raw values were already written to the store that the retention policy governs.
• Role, employer, and city together identify one person precisely, and every span was correctly judged non-identifying on its own.
• Embeddings are computed before the transformation, so the vector index still carries what the text no longer does.
• The detector is itself a hosted service, so protecting the data from one third party requires sending all of it to another.

Related capabilities

• Data Leakage Prevention — the recipient-dependent judgement this intrinsic one cannot make
• Output Guardrails — the egress checkpoint where a transformation is most often applied
• Content Moderation — the other classifier whose recall varies sharply by language
• Fail-closed Behavior — what is stored when the detector does not answer in time
• Memory Access Control — the complementary control that restricts readers instead of altering content

Applies: Production readiness · Design questions