Articles

Detect and Redact PII in LLM Applications (2026)

April 16, 2026 7 min read

The most surprising truth about PII detection in LLM applications is that it’s not a binary "found/not found" problem, but a spectrum of confidence, and the LLM itself is often the best tool to disambiguate its own output.

Let’s see this in action. Imagine an LLM generating a customer service response.

{
  "user_query": "I need to update my billing address. It's currently 123 Main St, Anytown, CA 90210. My new address is 456 Oak Ave, Somewhere, NY 10001.",
  "llm_response": "Thank you for letting us know! I've updated your billing address from 123 Main St, Anytown, CA 90210 to 456 Oak Ave, Somewhere, NY 10001. Is there anything else I can help you with today?"
}

Here, the LLM directly repeated the PII. This is a common scenario. The system needs to identify and redact these instances before they’re logged, displayed, or sent externally.

The Core Problem: Generative Models Don’t "Know" PII

LLMs are trained on vast datasets. They learn patterns, language, and how to generate coherent text. They don’t have an inherent understanding of what constitutes Personally Identifiable Information (PII) in a legal or privacy sense. When they output something that looks like an address, phone number, or credit card, it’s simply because that pattern appeared in their training data and fits the context of the generation task.

How Detection and Redaction Works (The Usual Suspects)

  1. Regex-Based Pattern Matching: This is the most straightforward approach. You define regular expressions for common PII types.

    • Diagnosis:
      echo "My new address is 456 Oak Ave, Somewhere, NY 10001." | grep -E '\d{1,5} [A-Za-z ]+, [A-Za-z ]+, [A-Z]{2} \d{5}(-\d{4})?'
    • Fix: If a match is found, replace it with a placeholder like [REDACTED_ADDRESS].
      import re
text = "My new address is 456 Oak Ave, Somewhere, NY 10001."
pattern = r'\d{1,5} [A-Za-z ]+, [A-Za-z ]+, [A-Z]{2} \d{5}(-\d{4})?'
redacted_text = re.sub(pattern, '[REDACTED_ADDRESS]', text)
print(redacted_text)
# Output: My new address is [REDACTED_ADDRESS].
    • Why it Works: Regex is excellent at matching specific, well-defined character sequences. It’s fast and efficient for common formats.

  2. Named Entity Recognition (NER) Models: More sophisticated than regex, NER models are trained to identify and classify entities in text (e.g., PERSON, ORG, LOCATION, DATE). Some specialized NER models are trained specifically for PII detection.

    • Diagnosis: Use a library like spaCy or Hugging Face Transformers.
      import spacy
nlp = spacy.load("en_core_web_sm") # Or a specialized PII model
doc = nlp("My new address is 456 Oak Ave, Somewhere, NY 10001.")
for ent in doc.ents:
    if ent.label_ in ["GPE", "LOC", "FAC"]: # General location entities
         print(f"Potential PII: {ent.text} ({ent.label_})")
# Output: Potential PII: 456 Oak Ave, Somewhere, NY 10001. (LOC)
    • Fix: Similar to regex, replace identified entities.
      import spacy
nlp = spacy.load("en_core_web_sm")
text = "My new address is 456 Oak Ave, Somewhere, NY 10001."
doc = nlp(text)
redacted_text = text
for ent in doc.ents:
    if ent.label_ in ["GPE", "LOC", "FAC"]:
        redacted_text = redacted_text.replace(ent.text, '[REDACTED_ADDRESS]')
print(redacted_text)
# Output: My new address is [REDACTED_ADDRESS].
    • Why it Works: NER models leverage contextual information to identify entities, making them more robust than simple pattern matching for variations in formatting or less common PII types.

  3. Keyword and Contextual Analysis: Looking for terms that often precede or follow PII, like "address:", "phone:", "email:", "SSN:", etc.

    • Diagnosis: A simple script checking for keywords.
      text = "Please confirm your new address: 456 Oak Ave, Somewhere, NY 10001."
keywords = ["address:", "phone:", "email:"]
found_pii = False
for keyword in keywords:
    if keyword in text.lower():
        # Further processing to extract/redact the value after the keyword
        found_pii = True
        break
print(f"Potential PII indicated by keyword: {found_pii}")
# Output: Potential PII indicated by keyword: True
    • Fix: Once a keyword is found, apply regex or NER to the text following the keyword.
    • Why it Works: This adds a layer of confidence by checking for linguistic cues that signal PII is imminent, reducing false positives from generic patterns.

  4. Specialized PII Detection Services/Libraries: Off-the-shelf solutions like Google Cloud DLP, AWS Comprehend PII, or open-source libraries like presidio-analyzer are pre-trained for this.

    • Diagnosis: Using presidio-analyzer.
      from presidio_analyzer import AnalyzerEngine
analyzer = AnalyzerEngine()
text = "Contact me at john.doe@example.com or call 555-123-4567."
results = analyzer.analyze(text=text, language='en')
print(results)
# Output: [RecognizerResult(entity_type='EMAIL', score=0.95, start=15, end=36), RecognizerResult(entity_type='PHONE', score=0.95, start=44, end=58)]
    • Fix: Use presidio-rewriter or implement custom logic based on results.
      from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine
analyzer = AnalyzerEngine()
anonymizer = AnonymizerEngine()
text = "Contact me at john.doe@example.com or call 555-123-4567."
results = analyzer.analyze(text=text, language='en')
# Example redaction logic
anonymized_text = anonymizer.anonymize(text=text, analyze_results=results)
print(anonymized_text.text)
# Output: Contact me at <EMAIL> or call <PHONE>.
    • Why it Works: These services aggregate multiple detection techniques and are maintained by experts, offering a robust, "batteries-included" solution.

  5. LLM as a PII Detector (Self-Correction/Verification): This is where it gets meta. You can prompt the LLM to review its own output or the output of another LLM.

    • Diagnosis:
      # Assume 'generated_text' holds the LLM's output
generated_text = "Your order #12345 will be shipped to 789 Pine Ln, Villagetown, TX 75001. Please confirm."
prompt = f"""
Review the following text for any Personally Identifiable Information (PII) such as names, addresses, phone numbers, email addresses, or credit card numbers.
If PII is found, list each piece of PII and its type. If no PII is found, state "No PII detected".

Text to review:
"{generated_text}"

PII found:
"""
# Send 'prompt' to an LLM and get its response.
# Example LLM response:
# Address: 789 Pine Ln, Villagetown, TX 75001 (Type: Address)
    • Fix: Use the LLM’s output to guide programmatic redaction. You can even prompt the LLM to perform the redaction directly.
      # Example prompt for direct redaction
prompt_redact = f"""
Redact all Personally Identifiable Information (PII) in the following text. Replace PII with a placeholder like '[REDACTED_PII]'.
Do not change any other part of the text.

Text to redact:
"{generated_text}"

Redacted text:
"""
# Send 'prompt_redact' to an LLM.
# Example LLM response:
# Your order #12345 will be shipped to [REDACTED_PII]. Please confirm.
    • Why it Works: LLMs excel at understanding context and nuances that regex or even standard NER models might miss. They can distinguish between a generic "123 Main St" in a fictional story and a specific address provided by a user. This is particularly powerful for ambiguous cases.

  6. Hybrid Approaches: Combining multiple methods. For instance, use regex for high-confidence patterns (credit cards, emails) and NER/LLM for more complex or ambiguous PII like names and addresses.

    • Diagnosis: Observe the failure modes of individual techniques. If regex misses a slightly malformed address, and NER misclassifies a product name as a person, it’s time to combine.
    • Fix: Implement a pipeline:
      1. Run regex for obvious patterns.
      2. Run a general NER model.
      3. Run a specialized PII NER model.
      4. If confidence is low or for sensitive data, use an LLM for final verification or redaction.
    • Why it Works: A layered defense catches more PII and reduces false positives by cross-referencing multiple detection signals.

The LLM’s Role in Disambiguation

Sometimes, a string might look like PII but isn’t. For example, "123 Main Street" could be a fictional location in a story. Or "John Smith" could be a character’s name in a generated narrative, not a real person’s. Regex and standard NER might flag these incorrectly.

This is where prompting the LLM to judge its own output or a given text snippet for PII is invaluable. You can ask it: "Is '123 Main Street' in the context of this story a real-world address that needs redaction?" The LLM, understanding the narrative context, can often provide a more accurate "yes" or "no" than a pattern-matching system.

The Next Frontier: Contextual PII and Intent

Once you have robust PII detection and redaction, the next challenge is understanding why the PII is there. Was it user input that should be processed but not logged? Was it generated by the LLM erroneously? This leads into fine-grained access control and data lineage for sensitive information.

Want structured learning?

Take the full AI Security course →