Handling Confidential Data in LLM Prompts

Sammanfattning

Increase in popularity of Large Language Models (LLMs) throughout different applications led to important privacy challenges, especially when it comes to handling Personally Identifiable Information (PII) that is embedded in prompts of users. PII being exposed to LLMs, or to third party providers that are managing them can lead to privacy breaches and regulatory non-compliance. This work investigates several methods for protecting confidential data inside LLM prompts by anonymizing PII before model input and de-anonymyzing the output. To address this, the custom Named Entity Recognition (NER) model trained on ai4privacy/pii-masking-200k dataset was developed in order to identify PII spans. These spans are replaced by placeholder tokens and a mapping to original value is stored. Two approaches are compared for de-anonymization: (1) fine-tuned seq2seq “Seek” models (T5, mBART, BART) that predict original text from anonymized text and evaluated using BLEU and ROUGE metrics; and (2) a mapping-based approach that simply replaces placeholders with the stored originals. While fine tuned “seek models” can generate understandable de-anonymized text, they mostly hallucinate incorrect details. Mapping approach achieves 100% accuracy and semantic consistency. Besides its accuracy, the mapping strategy is preferred for reliability and performance (does not have to generate new words). This work demonstrates an effective end-to-end pipeline for PII protection which contributes clear guidelines for safer LLM utilization.