Skip to content

Work

Anonymise before inference

An internal build: real identities replaced with stable aliases before any content reaches a model, an independent check that fails the run if a real value leaks, and rehydration done only locally.

What it proves
Using sensitive data with a third-party model while keeping real identities out of what the model receives.
Method stages
Built from
  • Stable alias substitution before any model call
  • Independent verification gate: fails the run if any real value is detected
  • Local-only rehydration at the end of the pipeline
Sectors

The problem

Advice on using sensitive data with a third-party model is usually procedural: a data processing agreement, a rule about what not to paste into a chat window, a training session. People forget a policy. An architectural constraint holds regardless.

What we built

Before any document, transcript or structured record reaches a model, every name, address and identifier in it is replaced with a stable alias. Stable means the same real value maps to the same alias throughout a run. The model can still reason about relationships, such as one person appearing three times in a document, without learning who the person is.

The model works entirely on aliased content. At the end, the aliases are reversed locally, on infrastructure that never sent anything to the model.

A separate check sits between the pipeline and the model. It inspects everything about to leave the boundary and fails the whole run if it finds a real value that should have been aliased. It is independent of the substitution logic, so it does not share that logic’s blind spots.

What it proves for a client

Personal, commercial and FADP-regulated data can be put to work with a model while the raw values stay inside your boundary. The check runs on every run, and the reversal happens under your own control.

Method stages

It belongs to Stage 03 · Engineer the system, where security and data-protection work is built before any user meets live data. The regulatory applicability note in Stage 01 · Ground the case flags where you need it. See the KARPINITY Method.