PII Detection — AI Glossary

Reference details

Related terms

• PII Redaction
• Differential Privacy
• Data Privacy (AI)

How it works

1. Recognisers run over the text and emit spans, each carrying an entity type and a confidence rather than a boolean, so the output is a ranked set of candidates and not a verdict.
2. Pattern recognisers match structure and are precise about format while blind to variation, which is why a differently punctuated identifier is missed by one and caught by a model-based recogniser.
3. Model-based recognisers generalise across formatting but produce type confusions, flagging product and place names as people, so their confidence distribution is wider in both directions.
4. Checksum validation is what separates a real identifier from a coincidental digit string: a card-number candidate failing its check digit is discarded regardless of how well it matched.
5. Context words near a span adjust its score, so the same digits score higher beside the word invoice than in a bare list — which is how precision is recovered without tightening the pattern.
6. A threshold then converts scores to decisions, and because it is one number governing both error directions, where it sits is a policy choice about which failure is more acceptable rather than a tuning detail.

Example: Two places to scan, not one

A regex for a social security number matches “123-45-6789” and misses “123 45 6789” written with spaces. A named-entity model catches the spaced form and also catches names, but flags the product name in “our Bean integration failed” as a person. Neither is sufficient alone, and both should run twice: once on the inbound prompt, once on the model's output. The output scan is the one teams skip and the one that matters — a retrieval step can pull a customer record into context that the user never typed, and the model will quote it back.

Commonly confused with

Detection is not redaction and not anonymisation. Detection locates spans; redaction removes or masks them; anonymisation additionally aims to prevent re-identification from the remainder. A transcript with names masked but a rare job title, city and date left intact is redacted, not anonymised.

When to use it

Reach for it when:

• Any pipeline where user text is logged, retained for evaluation, or sent to a third-party model
• Both inbound prompts and outbound completions, especially with retrieval in the loop
• Before data leaves a regulated boundary, where the legal test is on transfer, not on display

Reach for something else when:

• As the only control — treat it as defence in depth beside access control and retention limits
• Where false negatives are catastrophic and volume is low; human review is more reliable
• On structured data you already control: mask at the query, do not detect after the fact

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to PII Detection — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path