Most data leakage in AI systems is not malicious. It is accidental: users paste sensitive information, tools return full records, and logs capture content that should never be stored. A redaction pipeline is the set of pre-processing controls that reduces those leaks systematically.
Start with classification and allowed fields
Redaction works best when the allowed data boundary is explicit. Define what is allowed, what must be redacted, and what must be blocked (see data classification).
Prefer structured redaction over regex
Pattern-based redaction is fragile. When you control the data shape, structured approaches are safer:
- Map input fields to allowed and forbidden sets.
- Replace forbidden values with typed placeholders (e.g., [REDACTED_EMAIL]).
- Keep stable identifiers when needed for joinability (e.g., hashed IDs).
Use regex as a safety net, not the primary control.
Redact before the data enters the system
Redact at capture time so sensitive content never enters:
- Provider requests.
- Telemetry and logs.
- Caches and evaluation exports.
This aligns with minimisation and safe logging practices (see data minimisation and telemetry schema).
Redact tool outputs too
Tool outputs are a common leakage path: they often return full records. Apply output shaping:
- Tools return only fields needed for the current intent.
- Tool outputs are validated and bounded (see structured outputs).
- High-risk tool outputs trigger step-up controls or human review (see approvals).
Scan outputs for accidental disclosures
Even with redaction, leakage can happen. Use output scanning as a layer that blocks common PII disclosure patterns (see DLP for LLM systems).
Test the pipeline
Redaction should be testable. Add:
- Unit tests for field mapping and masking rules.
- Adversarial tests for injection and exfiltration (see red teaming).
- Regression cases so redaction does not quietly weaken over time (see testing pyramid).
Redaction pipelines are not glamorous, but they are one of the most effective ways to reduce data risk while keeping AI systems useful.