Every prompt you send to an LLM is a potential data breach waiting to happen. Here's how seasoned security professionals stop it before it starts.
We're living in a time where AI is no longer something futuristic — it's part of our everyday workflow. Developers casually paste database schemas into ChatGPT. Customer support teams drop entire ticket conversations into tools like Claude. Healthcare analysts even query LLMs using patient summaries.
And in all of this, there's one risk that most organizations still haven't fully grasped:
" Sensitive data is being shared with third-party AI systems — often without any protection. "
I didn't write this blog from a theoretical standpoint. I'm working in this space more than 2 year, and as a AIML engineer I keep seeing the same pattern repeat itself. Not because people don't care about security — but because many don't fully understand what data leakage actually looks like in the context of generative AI and agentic systems.
If you're building AI-powered products, integrating LLMs into your backend, or even just using AI tools in your daily work, this is something you need to understand.
Not as a concept you've heard about — but as something you actively design for.
Introduction :
What Is PII — and Why Does AI Change Everything?
Personally Identifiable Information (PII) is any data that can be used on its own, or in combination with other data, to identify a specific individual. Classic examples include names, email addresses, phone numbers, social security numbers, and medical records. Under GDPR, HIPAA, CCPA, and India's DPDP Act, organisations are legally bound to protect this data.
Traditional data security was built for structured systems like databases and APIs, where access and behavior were predictable. Large Language Models break those assumptions. They're probabilistic, can learn from data, and even infer sensitive information from context — far beyond what rule-based systems can detect. Most importantly, once data is sent to an external LLM API, control over it is effectively lost.
Agentic AI systems take this risk even further. By autonomously accessing emails, databases, and APIs, they don't just process isolated pieces of data — they aggregate and connect them, potentially exposing an entire identity with every task they perform.
Types of PII :
Understanding What You Are Protecting.
Before you can mask PII, you need to know what it looks like. PII is not just a name and an email — it spans three distinct categories, and AI systems are particularly dangerous because they can re-identify individuals from data that appears safely anonymised.
The most dangerous category for AI systems is indirect PII — because an LLM is extraordinarily capable at making the inferences that traditional anonymisation was designed to prevent. What your rule-based system treats as safe, the model will connect.
Core Techniques
The 5 PII Masking Techniques Every AI System Needs
These are not theoretical — these are the techniques deployed in production AI systems, RAG pipelines, agentic workflows, and LLM gateways worldwide. Each solves a different part of the problem.
- Foundation Layer — Named Entity Recognition (NER) Redaction
Named Entity Recognition (NER) Redaction is the core of PII masking. It scans text before it reaches the LLM, replaces sensitive data (like names, emails, phone numbers) with placeholders such as [PERSON_1] or [EMAIL_2], and stores the originals securely for optional restoration later.
Flow: Detect → Replace with placeholders → Store mapping securely → Send masked text to LLM → Re-inject original data if required.
Tools : presidio , spacy , aws.comprehend and GLiNER
2. Reversible & Utility-Preserving — Tokenisation & Pseudonymisation
Tokenisation & Pseudonymisation replace real PII with synthetic, format-preserving values (e.g., a valid-looking email or name), allowing the LLM to retain context without seeing actual data. A secure vault maintains mappings for controlled restoration when needed.
Flow: Detect PII → Replace with synthetic tokens → Store mappings securely → De-tokenise only for authorised use.
Tools: Skyflow , protegrity , AWS Macie
3. Mathematically Rigorous — Differential Privacy with Data Perturbation
Differential Privacy with Data Perturbation protects sensitive data by adding calibrated noise, preventing identification of individuals while preserving overall patterns. Controlled by a privacy budget (ε), it's widely used in AI training systems.
Flow: Add noise to numeric data → Generalise sensitive attributes → Control privacy via ε → Use safely in model training.
Tools: OpenDP , TensorFlow Privacy
4. Context-Aware Detection — Semantic Embedding-Based PII Detection
Semantic Embedding-Based PII Detection uses embedding models to identify contextually sensitive information that rule-based methods miss. It can detect indirect identifiers through inference, making it essential for advanced AI systems.
Flow: Convert text to embeddings → Compare with sensitive patterns → Flag indirect PII → Mask or escalate for review.
Tools : LlamaGuard , Langchan Guardrails
5. Enterprise Production Standard — LLM Gateway Proxy with Real-Time PII Interception
LLM Gateway Proxy with Real-Time PII Interception acts as a security layer between your app and the LLM, monitoring and filtering all traffic in real time. It detects, masks, and governs sensitive data using rules and models, with full audit and policy control.
Flow: Route traffic through proxy → Inspect input (regex + ML) → Mask PII → Scan outputs → Enforce policies (block/redact/alert) with audit logging.
Tools: Portkey AI Gateway , Cloudflare AI Gateway , LangChain Guardrails
Internal Architecture
How PII Masking Works Internally
Understanding the mechanism behind PII masking is essential for implementing it correctly. At a high level, every production PII masking system operates across three layers: detection, transformation, and governance.
Fields of Application
Where PII Masking Is Applied in the Real World
Beyond Masking
Other Data Security Techniques That Complement PII Masking
PII masking is essential but not sufficient. A comprehensive AI data security strategy layers multiple complementary techniques.
Conclusion
From my experience in AI/IT, one thing became very clear: PII masking is not something you "add later." It has to be part of the system from day one — in prompts, pipelines, agents, and governance.
With agentic AI growing, the risk is only increasing. Models are now interacting with APIs, databases, and documents — so the exposure surface is much bigger.
What worked best in my experience:
- Start with an LLM gateway proxy
- Add NER-based redaction for inputs (my go-to method)
- Use tokenisation where structure matters
- Run regular PII audits on pipelines
And one rule I always follow: if I'm not comfortable seeing that data in a breach report, I don't send it to a model.
Personal Project for this concept
To wrap this up, I've also built a practical implementation of these concepts in my own project:
https://github.com/shreyasskrishna/PII_masking_with_fastAPI.
It's a FastAPI-based PII masking middleware that detects sensitive data in real time, replaces it with secure tokens, and ensures that only masked inputs are sent to the LLM.
The original data is encrypted and never exposed outside the system. This project reflects how I approach building privacy-first AI systems in real-world applications.
See you with interesting facts : )