A large language model can sometimes repeat text from its training data. If that data contains a private message or a credit card number, the repetition becomes a privacy risk. Privacy-enhancing technologies (PETs) are methods used to reduce such risks when data is prepared or a model is trained. They help, but they do not make sensitive data safe to use without further care. section 3.4 section 10.18
PETs take different approaches:
- Anonymization and pseudonymization reduce the direct link between data and a person. They may still leave clues from which someone can infer an identity or other personal information. section 3.17
- Obfuscation, sanitization, and data masking hide or alter sensitive content. A blocklist, for example, can filter known sensitive patterns from a training dataset, but it cannot catch every unseen or rare item. section 3.4
- Differential privacy introduces statistical noise during training to limit how much any one data point affects a model. Applying it effectively to large language models is difficult: privacy and model performance must be balanced, and it does not eliminate every memorization risk. section 3.4
The strongest first step is to avoid training on data known to contain substantial amounts of personally identifiable information (PII). That is hard to guarantee at scale: public datasets can contain hidden or mislabeled sensitive content. Masking is also imperfect because sensitive items are difficult to find reliably, while replacing them can disrupt the language patterns a model learns. PETs therefore complement careful data selection rather than replace it. section 3.4 section 10.18
When identifiers slip through
Researchers studying a model trained on the Enron Email Dataset, a collection of internal emails, extracted credit card and Social Security numbers. The case illustrates why removing obvious identifiers or filtering known patterns cannot be assumed to prevent disclosure. section 3.4
PETs belong within a broader privacy approach. Organizations also use policies governing AI tools, privacy risk assessments, and reviews of how models are trained and deployed. Even when direct identifiers have been removed, seemingly innocuous details may reveal personal information. The practical question is not whether a system has a PET, but which risk that method reduces—and which risks remain. section 3.17 section 3.17
