PII Detection
PII detection and redaction in LLM applications: entity recognition, masking strategies, and compliance automation.
Last updated
After this section you can
- Build a detect → redact → output-scan → re-inflate PII gateway in stdlib Python, and name the production swap for each stage (Presidio, Cloud DLP, AWS Comprehend)
- Choose among masking, pseudonymization, tokenization, and format-preserving encryption from the downstream requirement — not from habit
- Quote real detection-quality numbers (0.72–0.81 recall on English names/addresses, 0.31 on non-English) and the memorization research that justifies the output scan
- Defend the latency/cost trade-offs of regex vs. NER vs. managed DLP API vs. LLM-based detection on a live request path
SD-14
PII Detection & Redaction — In Depth
The #1 security topic in FDE interviews. Know the pipeline cold.
PII — personally identifiable information: names, emails, phone numbers, government IDs, anything that singles out a person — is the data class that turns an LLM side-project into an incident report. Under GDPR, mishandling it can cost up to 4% of global annual turnover; under HIPAA, one leaked record in a health context is a reportable breach. The control is a detection-and-redaction gateway on the input path plus a second scan on the output path — and this section builds it, with runnable code for every stage.