PII Redaction — AI Glossary

Reference details

Related terms

• PII Detection
• Data Privacy (AI)
• AI Gateway

How it works

1. Detection runs first, combining pattern matching for structured identifiers — card numbers, national identifiers, email addresses — with a model for the unstructured cases that patterns cannot express, such as names in running prose.
2. Detected spans are replaced by placeholders or by synthetic substitutes. The choice matters: a placeholder is unambiguous and strips information the model may need, while a consistent synthetic substitute preserves coreference so that the same person remains the same person across the text.
3. A mapping from substitute back to original is retained outside the model boundary, so the response can be rehydrated before it reaches the user.
4. The architecture is usually a proxy, with redaction applied in a gateway between the application and the provider — which is what makes it enforceable rather than dependent on every caller remembering.
5. Objectives pull against each other. Over-redaction removes the context the model needs, under-redaction defeats the purpose, and the balance is set per field class rather than globally.
6. Recall is the metric that matters, because the cost of a miss is a disclosure and the cost of a false positive is a slightly worse answer — an asymmetry that should set the threshold.

Example: Why recall has to be stated to three nines

Take 10,000 documents averaging 5 pieces of personal information each: 10,000 x 5 = 50,000 items passing through the redactor. At 99% recall — a figure that sounds strong in most classification contexts — the misses are 50,000 x 0.01 = 500 items disclosed to a third-party API. At 99.9% recall it is 50,000 x 0.001 = 50, and at 99.99% it is 5. The compliance question is rarely whether the rate is high but whether the absolute count is acceptable, and 500 disclosures is not a rounding error in any regime that cares about this. Which means the useful reporting unit is nines of recall against document volume, not a percentage: the same 99% that passes without comment on a sentiment classifier is a 500-item breach here. The counterweight is real and should also be priced. If tightening the threshold to reach three nines raises false positives such that 2% of documents lose a detail the model needed, then at 10,000 documents 200 answers are degraded — which is a cost worth paying for 450 fewer disclosures, and is a trade that should be made explicitly rather than discovered.

Commonly confused with

Redaction and anonymisation are not the same guarantee, and the gap is where compliance arguments fail. Redaction removes the identifiers it detected from this text. Anonymisation is a claim that an individual cannot be re-identified from the result, which quasi-identifiers in combination routinely defeat — a date, a postcode and an occupation can single out a person with no name present. So a redacted document is not an anonymous one, and treating a redaction pipeline as satisfying an anonymisation requirement is a category error with legal consequences rather than technical ones.

When to use it

Reach for it when:

• Sending user or customer content to a third-party API where the data must not leave a jurisdiction or must not be retained.
• At a gateway rather than per caller, so the control is enforceable and cannot be forgotten.
• With synthetic substitutes where coreference matters, since placeholders destroy the relationships the model reasons over.
• With recall reported in nines against document volume, so the absolute disclosure count is visible.

Reach for something else when:

• As an anonymisation guarantee, which it does not provide — quasi-identifiers survive redaction.
• With recall targets borrowed from ordinary classification, where 99% is good and here it is 500 disclosures.
• Where over-redaction removes what the task needs, in which case the architecture rather than the threshold is wrong.
• As a substitute for a contractual or deployment control when the requirement is that data not be processed externally at all.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to PII Redaction — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path