How to Build PII Redaction for LLM Applications

PII redaction for LLM applications means detecting personal data in every piece of text before it reaches a model, replacing it with placeholders, and restoring real values only where an authorized user needs them.

It must cover more than the user's message. Retrieved documents, tool results, agent memory, traces and logs all carry personal data. This guide gives a seven-stage pipeline, a worked example and a test plan you can use before launch.

What Counts as PII in an LLM Workflow

NIST SP 800-122 defines PII as information that can distinguish or trace an individual's identity, alone or combined with other information. In LLM systems, it shows up in five places:

• User input: names, emails, phone numbers and account numbers typed into chat

• Retrieved context: RAG chunks from tickets, contracts or HR files

• Tool results: CRM records or order histories returned to an agent

• Model output: values the model repeats or infers

• Telemetry: prompts and responses stored by tracing and logging tools

OWASP lists sensitive information disclosure as a top risk for LLM applications in its 2025 list. Redaction is one control; access control and data minimization are others.

The Seven-Stage Redaction Pipeline

Stage 1: Minimize. Send only the fields the task needs. Do not serialize a whole customer record and hope to redact it later.

Stage 2: Detect in layers. Combine field rules for known columns, patterns with checksums for structured identifiers, and a named-entity model for names and addresses in free text.

Stage 3: Apply a policy per entity type. Decide for each type whether to block, drop, mask or pseudonymize. A card number may be blocked; a customer name may be pseudonymized.

Stage 4: Replace with typed placeholders. Use tokens such as PERSON_1 and EMAIL_1, consistent within a session, so the model can still reason about who did what.

Stage 5: Call the model with sanitized text. The mapping table stays in your environment and never enters the prompt, cache or trace.

Stage 6: Inspect the output. Scan the response for new personal data, unknown placeholders or raw identifiers before it leaves the gateway.

Stage 7: Restore at the last trusted step. Rehydrate placeholders only for the authorized user and channel, never inside logs or downstream tool arguments.

Detection Options Compared

Most teams combine one managed or open-source detector with their own rules for internal identifiers such as policy or matter numbers.

Where to Enforce Redaction

Put the control at a point every request must pass. Three common choices:

• In the application: simple, but each team must remember to call it

• In an LLM gateway: one enforcement point for all apps; see our comparison of open-source LLM gateways

• At ingestion for RAG: redact or tag sensitive fields before chunks are indexed, as covered in data readiness for generative AI

Fail closed. If the redaction service is unavailable, the request should stop, not pass through raw.

Worked Example: Support Ticket Summaries

Illustrative example. A team wants an LLM to summarize support tickets for weekly reporting.

• Input: "Maria Lopez (maria@example.com) says card ending 4421 was charged twice."

• After Stage 2 to 4: "PERSON_1 (EMAIL_1) says card ending CARD_1 was charged twice."

• Model output: "PERSON_1 reported a duplicate charge on CARD_1."

• Stage 6 check: no new personal data found, only known placeholders

• Stage 7: the report for managers keeps placeholders; the agent view restores the name for the assigned agent only

The weekly report never needed the customer's identity, so Stage 1 could have dropped the name entirely. That is the cheapest control.

Test Plan Before Launch

Test 1: Recall. Label 300 to 500 real samples, with every PII span marked. Measure the share of spans the pipeline catches. A missed span is a leak.

Test 2: Precision. Measure how often normal text is wrongly redacted. Over-redaction breaks summaries and search.

Test 3: Edge cases. Include non-English names, nicknames, addresses split across lines and internal IDs that look like phone numbers.

Test 4: Multi-turn. Confirm placeholders stay consistent across a conversation and agent steps.

Test 5: Output and logs. Check that traces, caches and error logs contain only placeholders.

Test 6: Regression. Rerun the full set whenever you update the detector, model or prompt.

Sample sizes above are illustrative. Your privacy or security team should set the pass mark.

Launch Checklist

• Data inventory lists which fields each prompt actually needs

• Entity policy table approved by privacy and security owners

• Detector covers every input path: user, RAG, tools, memory

• Mapping table stored separately with its own access control

• Output scan blocks unknown personal data

• Tracing and logging tools receive sanitized text only

• Retention period set for prompts, responses and mappings

• Recall and precision results recorded with the detector version

Common Mistakes to Avoid

• Redacting only the chat box: tool results and retrieved chunks are often the bigger source

• Permanent [REDACTED] tokens everywhere: they break tasks that need to tell two people apart

• Logging before redacting: a trace store full of raw prompts undoes the work

• Trusting one detector: regex misses names; NER misses unusual ID formats

• No owner for the policy: entity rules drift as new data sources are added

Limitations

No detector catches every instance of personal data, so redaction lowers risk rather than removing it. Pseudonymized data may still be personal data under some privacy laws. This guide is technical, not legal advice; confirm obligations with your privacy counsel.

Next Step

If your LLM application touches CRM, ticketing or document data, LuMay's AI integration team can help map data flows, choose detectors and design the redaction and logging path.

• OWASP LLM02:2025 Sensitive Information Disclosure

• Microsoft Presidio

• Amazon Comprehend PII detection

• Google Sensitive Data Protection overview

• Amazon Bedrock Guardrails sensitive information filters