AI Privacy and Data Protection

When you send a text prompt to an external provider (like OpenAI or Anthropic), you are sending that data outside your company's perimeter. If that prompt contains a social security number, a private trade secret, or a patient's medical history, you might be violating laws like GDPR, HIPAA, or CCPA.

As an LLM Engineer, you must build a "Privacy Perimeter" around your model interactions.

---

1. The Three Layers of Data Risk

A. Data in Flight (Encryption)

Standard SSL/TLS handles this. The risk here is minimal (standard web security).

B. Data at Rest (Model Providers)

Once your prompt arrives at the provider:

• Consumer Plans: Data is often used to train future models. (High Risk).
• Enterprise/API Plans: Data is usually not used for training and is deleted within 30 days. (Standard Risk).

C. Data in Output (Leaks)

The most common risk: The model accidentally reveals one user's data to another user because it was "baked" into the model's weights or retrieved via a shared RAG database.

---

2. Privacy Strategy 1: PII Masking

Before the prompt ever leaves your server, you should "Anonymize" it. You strip out identifying information and replace it with placeholders.

• Raw: "Send an email to John Doe at john@gmail.com about his $5,000 debt."
• Anonymized: "Send an email to [USER_NAME] at [USER_EMAIL] about his [DEBT_AMOUNT] debt."

You store the "Map" in a local database and swap the real data back in when the model returns its response.

---

3. Privacy Strategy 2: Private Endpoints

Instead of using the public API, enterprises use specialized "Private Tunnels" provided by cloud giants.

• AWS Bedrock: Your data stays inside your AWS VPC (Virtual Private Cloud). It never touches the public internet and is never used to improve the base models.
• Azure OpenAI: Similar to Bedrock, it offers a "Sovereign" environment for regulated industries.

---

4. Privacy Strategy 3: Local/Private Hosting

For extreme privacy (Defense, Healthcare), the LLM Engineer hosts the model on-premise.

• Ollama / vLLM: You run the model on your own hardware. Zero data ever leaves your building.
• Advantage: 100% Privacy.
• Disadvantage: You are responsible for the $20,000+ electricity and hardware costs.

graph LR
    A[User Laptop] --> B[Your Server]
    subgraph Privacy Perimeter
        B --> C[PII Masking Layer]
        C --> D[Model: Local or Private AWS]
    end

---

5. RAG Confidentiality: Document Permissions

If your RAG system contains the CEO's salary and a Junior Intern asks: "How much does everyone make?", the system should not retrieve that document.

The Fix: Metadata Filtering (Revisited) When you store a vector in your database, you must store a "Permission Level."

• Query: "Find salary docs where user_role = 'HR'".

---

Code Concept: A Privacy Redactor with presidio

Microsoft provides a library called Presidio that is the gold standard for AI privacy masking.

from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine

analyzer = AnalyzerEngine()
anonymizer = AnonymizerEngine()

text = "My name is Bob and my phone is 555-0199."

# 1. Analyze for PII
results = analyzer.analyze(text=text, entities=["PERSON", "PHONE_NUMBER"], language='en')

# 2. Anonymize
anonymized_result = anonymizer.anonymize(text=text, analyzer_results=results)

print(anonymized_result.text)
# Output: "My name is <PERSON> and my phone is <PHONE_NUMBER>."

---

Summary

• Never send PII to public models without an enterprise agreement.
• Masking is the cheapest and most effective way to protect privacy.
• Private Cloud (Bedrock/Azure) is the standard for corporate reliability.
• Metadata filters are the only way to ensure RAG data security.

In the final lesson of this module, we will step back and look at the Ethical Considerations of AI, exploring the "Should we?" instead of the "How can we?".

---

Exercise: The HIPAA Challenge

You are building an AI to summarize doctor-patient consultations.

1. Which privacy strategy (Masking, Private Cloud, or Local Hosting) would you recommend for a hospital group?
2. What happens if the AI accidentally "Remembers" a patient's name because it was used in a few-shot example during fine-tuning?

Answer Logic:

1. Private Cloud or Local. Hospitals need extremely high security, but masking might destroy the medical context needed for a good summary.
2. Data Leakage. This is a major violation. One should never use real PII in fine-tuning datasets!