How do you handle PII in an LLM pipeline?
mediumAnswer
- (1) Detect PII at input: regex + NER models (Presidio, spaCy) for emails / phones / SSN / names.
- (2) Redact or tokenize before sending to a third-party LLM.
- (3) Rehydrate the mapping if needed for the final output.
- (4) Log responses with PII scrubbed.
- (5) For self-hosted models on sensitive data, isolate compute + no logging + no cache.
- (6) Audit fine-tuning data for PII leakage — models can memorize and regurgitate.
- Legal drivers: GDPR, HIPAA, PCI-DSS, SOC 2.
- PII in LLM logs is a common audit finding.
Check yourself — multiple choice
- Ignore PII
- Detect via NER/regex → redact/tokenize → rehydrate if needed → scrubbed logs → self-host for sensitive data + audit fine-tune data
- Only encryption
- Impossible
PII: detect / redact / rehydrate / scrub logs / self-host for sensitive data.
#safety#guardrails#production
Practise LLMs & GenAI
214 interview questions in this topic.