Preventing PII in LLM outputs: curation, fine-tuning, or guardrails

WHAT THIS TESTS Whether you can compare mitigation layers by guarantee strength, coverage, and cost, and argue for defense-in-depth rather than a single silver bullet.

A GOOD ANSWER COVERS DATA CURATION. Scrubbing PII from training data reduces what the model can memorize and later regurgitate, addressing the root cause. But it is probabilistic, never achieves perfect recall at web scale, and critically does nothing about PII that enters at inference through the prompt or retrieved context, which the model may then echo. FINE-TUNING. You can fine-tune or use RLHF to discourage emitting PII, which generalizes better than rules to novel phrasings, but it changes the distribution without offering a hard guarantee; the model can still leak under adversarial prompts and you cannot prove it will not. POST-PROCESSING GUARDRAILS. A detector that scans every output and redacts or blocks PII before it reaches the user is deterministic, auditable, and updatable without retraining, making it the enforceable last line of defense; this is why I would make it primary. Its costs are added latency, false positives that may redact legitimate content, and dependence on detector recall. CONCLUSION. No single layer is complete, so use defense-in-depth: curate data to limit memorization, optionally fine-tune to reduce propensity, and rely on output guardrails for the hard, auditable guarantee, plus input scanning to catch PII entering via prompts.

COMMON WRONG ANSWERS Picking one layer and declaring the problem solved. Relying solely on data curation, ignoring inference-time PII. Trusting fine-tuning to give a hard guarantee. Forgetting input-side scanning. Ignoring guardrail latency and false-positive tradeoffs.

LIKELY FOLLOW-UPS Why can't data curation stop PII supplied at inference? What guarantee does a guardrail give that fine-tuning cannot? How do you tune the detector's precision-recall tradeoff? How do you handle PII that arrives in retrieved context?

ONE CONCRETE EXAMPLE A user pastes someone's SSN and asks the model to repeat it. Data curation and fine-tuning are irrelevant because the PII did not come from training, yet the model might echo it. An output guardrail running a validated PII detector intercepts the SSN and redacts it before display, giving a deterministic, auditable stop, while curation and fine-tuning still help reduce memorized leakage from training data.