PII & Data Leakage

PII

Part of: Guardrails & Safety

A developer pasted a customer database export into a prompt to "clean it up." The provider logged the request. The model later, in a different session, produced a phone number that matched a real customer. Whether that was coincidence or training contamination almost doesn't matter, the data left the building the moment it was sent. That is the quiet, ordinary way AI systems leak personal data. What it is PII : personally identifiable information, is any data that can identify a specific person: names, emails, phone numbers, addresses, government IDs, credit cards, health records. Data leakage is PII (or other sensitive data) escaping where it shouldn't: into provider logs, into a model's output, into another user's session, or into training data. The danger with AI is that leakage happens through normal use . You don't have to be breached. You only have to send sensitive text to a system you don't control, or let the model emit something it absorbed. How it works PII leaks at three points in an AI pipeline: - On the way in. Sensitive data placed in a prompt is transmitted to the provider and may be logged or retained. Anything you would not paste into a public form, you should thi

Challenge: Multi-Type PII Scrubber