Handling PII in Training Data

What is PII?

Personally Identifiable Information (PII) is any data that can be used to distinguish or trace an individual's identity:

• Direct Identifiers: Social Security Numbers, Credit Card Numbers, Real Names, Email Addresses, Phone Numbers.
• Indirect Identifiers: IP Addresses, GPS Coordinates, Unique Device Fingerprints.

Raw User Text: "Hi my name is Alice Smith, SSN 123-45-6789, email alice@mail.com"
                                      │
                                      ▼
                      [ AUTOMATED PII SANITIZATION ]
                                      │
                                      ▼
Sanitized Text: "Hi my name is [NAME], SSN [REDACTED_SSN], email [EMAIL]"

Why PII Sanitization is Mandatory

1. Model Memorization Risk: Large Language Models (LLMs) memorize exact training text sequences. Unsanitized PII in training sets can be extracted by prompt injection attacks.
2. Regulatory Penalties: Regulations like GDPR (EU) and CCPA (California) mandate strict data privacy protection and grant users the Right to be Forgotten.
3. Data Leakage in Logs: Storing raw PII in un-encrypted feature stores exposes organizations to security breaches.

PII Sanitization Pipeline Techniques

┌──────────────────────────┬──────────────────────────┬──────────────────────────┐
│ 1. REGEX REDACTION       │ 2. NER REDACTION         │ 3. PSEUDONYMIZATION      │
├──────────────────────────┼──────────────────────────┼──────────────────────────┤
│ Fast pattern matching    │ Machine learning model   │ Replaces real IDs with   │
│ for deterministic numbers│ (Presidio / spaCy) to    │ cryptographic hashes     │
│ (SSNs, Phone Numbers,    │ identify names, locations│ (HMAC + Salt) to preserve│
│ Credit Cards).           │ and context PII.         │ join capabilities!       │
└──────────────────────────┴──────────────────────────┴──────────────────────────┘

1. Deterministic Pattern Matching (Regex)

Use regular expressions to catch structured numerical PII:

• Social Security Numbers: \d{3}-\d{2}-\d{4}
• Credit Card Numbers: \d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}
• Email Addresses: [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}

2. Machine Learning Named Entity Recognition (Microsoft Presidio)

Regex fails on unstructured text names ("John Smith" or "Living at 742 Evergreen Terrace"). Use fine-tuned NER models to detect and mask named entities ([PERSON], [LOCATION]).

3. Cryptonymization / Hashing with Salt

When feature engineering requires tracking user activity across sessions without knowing real identities, replace real user_id values with salted cryptographic hashes:

$$\text{Hashed ID} = \text{SHA256}(\text{Real ID} + \text{Secret Salt})$$

This preserves entity join capabilities while preventing reverse lookup.

Say this out loud

Handling PII in training data sanitizes sensitive personal information before model training. Unsanitized PII can be memorized by neural networks and leaked during inference, violating GDPR regulations. Sanitization pipelines use regex pattern matching, Named Entity Recognition redactors like Microsoft Presidio, and salted cryptographic hashing to anonymize datasets.

Followups to expect

1. What is Machine Unlearning? Algorithmic techniques designed to remove the influence of specific deleted user samples from a trained model without retraining the entire model from scratch.
2. What is Differential Privacy in PII handling? Adding calibrated noise to model gradients or data queries to ensure an attacker cannot verify whether a specific individual's record was included in the training set.