Originally published on AI Tech Connect.
What you need to know PII enters a RAG system at three points — at ingest when documents are indexed, at retrieval when chunks land in the prompt, and at generation when the model emits an identifier. Redacting only the model's output covers one point and leaves the other two open. Redaction must happen before embedding, not after. An embedding computed from raw personal data can be partially reconstructed by embedding-inversion attacks, and a vector is far harder to "erase" than a row of text. Clean the text first, then embed. Two stages do the work. Stage 1 is pre-index detection and redaction with named-entity recognition plus rule-based recognisers. Stage 2 is a pre-response scan that catches anything the model still manages to surface. Recall beats precision for a redactor. A missed…
Top comments (0)