Design an ML workflow that masks PII from scientists

WHAT THIS TESTS: The interviewer wants to see if you can design a secure data lifecycle for machine learning that prevents direct human exposure to sensitive records. They care about separation of duties, automated governance, and the practical mechanics of transforming raw PII into research-safe datasets without breaking compliance or model utility.

A GOOD ANSWER COVERS: A strong answer walks through four layers. First, ingestion and classification: raw data lands in a locked-down storage tier where PII fields are automatically classified. Second, de-identification: before any scientist can query the data, an automated pipeline applies masking or tokenization using Sensitive Data Protection so that names, emails, and IDs become non-reversible tokens or synthetic equivalents in the experimentation zone. Third, key management and re-identification: the cryptographic keys or mapping tables needed to reverse the masking are stored in a separate vault with strictly narrower access; re-identification is reserved only for approved production inference or regulated reporting pipelines, never for ad-hoc notebooks. Fourth, access controls and audit: scientists receive role-based access only to the masked datasets, with query audit logs and automated scans ensuring no raw PII leaks through exports or joins.

COMMON WRONG ANSWERS: Red flags include suggesting scientists can request temporary unmasking for debugging, storing de-identification keys in the same project as the experimentation data, relying on manual spreadsheet masking, or proposing simple hash functions without salting that are vulnerable to rainbow tables. Another weak pattern is ignoring the inference phase and only masking training data, which leaves production pipelines exposed.

LIKELY FOLLOW-UPS: The interviewer may ask how you would preserve model utility if masking removes important features, how you would handle a data subject deletion request across masked copies, or how you would prove to an auditor that no scientist accessed raw PII during a specific experiment.

ONE CONCRETE EXAMPLE: Imagine a healthcare ML team building a readmission predictor. Patient records arrive in a raw bucket. An automated pipeline scans each record with Sensitive Data Protection to identify PII, then writes a de-identified copy to an analyst-facing dataset where medical history is retained but patient names are replaced with stable tokens. The token vault lives in a separate environment accessible only to a break-glass automation role used by the production inference pipeline. Data scientists query the dataset through a workbench that has no network path to the raw bucket or the vault. Every query is logged, and the system is rescanned monthly to catch schema drift that might expose new PII fields.