Lesson 97 — Intermediate

Data Privacy, PII & Secrets

LLM app mein data har jagah ghoomta hai — prompts, logs, traces, memory, vector store, eval datasets. Har jagah copy sensitive ho sakta hai. Is lesson mein tum seekhoge sensitive data identify karna, redact/minimize karna, logs se bahar rakhna, retention/residency ke controls, aur secrets ko model se door rakhne ka pattern.

AI privacy ka funda

Funda: data jo kabhi store hi nahi hua, woh leak bhi nahi hoga. Isliye pehla control minimization hai (bhejo hi mat), redaction doosra. Log "debug ke liye rakh lunga" — yeh 2GB PII dump ban jaata hai jo breach report mein sabse pehle dikhta hai.

Identify aur redact

import re

PATTERNS = {
    "email":   re.compile(r"[\w.+-]+@[\w-]+\.[\w.]+"),
    "phone":   re.compile(r"(?<!\d)(?:\+91[- ]?)?[6-9]\d{9}(?!\d)"),
    "aadhaar": re.compile(r"(?<!\d)\d{4}[ -]?\d{4}[ -]?\d{4}(?!\d)"),
    "card":    re.compile(r"(?<!\d)\d{4}[ -]\d{4}[ -]\d{4}[ -]\d{4}(?!\d)"),
}

def redact(text: str) -> str:
    for kind, pat in PATTERNS.items():
        text = pat.sub(f"[{kind.upper()}]", text)
    return text

# LLM call se pehle: redact(user_text). Regex basic hai — production
# mein NER-based PII detector (jaise Microsoft Presidio) bhi chalao.
# Dono miss hote hain, isliye minimization (zaroori field hi bhejo)
# first-class control hai, redaction uska backup.

• Sensitive ki list: PII (naam, phone, email, ID numbers), credentials, financial (card, account), health, confidential business data, private conversations.
• Minimization: poora document bhejne ki zaroorat nahi — sirf woh field jo model ko chahiye (L8.7 ki desi example mein wahi).
• Masked identifiers: kaam ke liye IDs chahiye toh surrogate ID banao — original mapping ek alag secure store mein.

Logs, traces aur memory se PII bahar

import logging

REDACT_FIELDS = {"user_email", "phone", "customer_name", "query_text"}

def scrub(d: dict) -> dict:
    return {k: ("[REDACTED]" if k in REDACT_FIELDS else v)
            for k, v in d.items()}

class PrivacyFilter(logging.Filter):
    def filter(self, record):
        if isinstance(record.msg, dict):
            record.msg = scrub(record.msg)
        return True

# Tracing frameworks, eval datasets aur memory stores par bhi wahi rule:
# default scrub ON, raw text OFF. Retention chhoti rakho (days, months nahi).

• Prompts/answers: debugging ke liye store karo toh bhi scrub kar ke — aur retention window chhoti (din mein), on-call ke liye kaafi.
• Traces: tool args aur results bhi PII le jaate hain — sirf prompt dekhna kaafi nahi, har span par nazar.
• Eval datasets: real user conversations se banate waqt redact — woh repo mein permanent copy ban jaati hai.
• Memory/vector store: user ke delete karne par wahan se bhi delete — retention policy sirf database par nahi, har store par.

Retention, residency aur provider terms

• Retention: har store ka TTL — logs, traces, raw prompts. "Rakh lenge, kaam aayega" wala default nahi; explicit days decide karo.
• Deletion: user delete maange toh original + backups + eval copies — workflow likho, sirf promise nahi.
• Residency: data kis region mein process/store hota hai — regulated clients poochte hain; endpoint region choose karo.
• Private connectivity: model endpoint tak private network path (private endpoint/VNet), public internet se direct nahi — regulated deployments ka common requirement.
• Zero retention / no training: provider ke saath contractual terms — data retain na ho, training mein na jaaye. Woh terms tumhare paper par hongi, tumhare prompt ke nahi.

Sawaal jo har vendor par poochho: kya store hota hai, kitne din, kaun dekh sakta hai, kaise delete hota hai, aur kya training mein use hota hai. Jawab documentation mein likha ho, werna assume mat karo.

Secrets ko model se door rakho

# Secrets tumhare service layer mein rehte hain — model ko sirf reference.
BROKER = {
    "charge_refund": lambda args: stripe.refund(
        key=os.environ["STRIPE_KEY"],      # key kabhi prompt mein nahi
        charge_id=args["charge_id"],
        amount=args["amount"]),
}

def tool_router(name, args):
    if name not in BROKER:
        raise PermissionError("unknown tool")
    return BROKER[name](args)

# Model ko tool schema dikhao, key nahi. System prompt, conversation
# history ya tool results — kahin bhi key nahi. Compromised model ya
# prompt leak ho jaaye toh bhi key safe — wahi broker pattern ka point hai.

• Keys env vars ya secret manager mein — repo, config files, prompts, tool outputs mein kabhi nahi.
• Model ko chahiye toh scoped, short-lived token do — full key nahi.
• Pre-commit secret scanning aur log scan: accidental commit aur accidental log dono ka net.

Exercise

Common mistakes

• Traces aur logs mein poora prompt: Debugging ke bahane permanent PII store. Scrub filter lagao, retention chhoti rakho, raw text default OFF — har span par, sirf chat messages par nahi.
• Secrets ko model ke through pass karna: System prompt, history, tool results — key kahin bhi dikhi toh leak ho sakti hai. Broker pattern: model tool sirf naam se call kare, key tumhare layer mein rahe.
• Redaction ko perfect samajhna: Regex aur NER dono miss karte hain. Redaction ek layer hai — sabse pehla control minimization hai: jo field model ko chahiye wahi bhejo, baaki ghar par rakho.

bhejne se pehle:
  poora doc  ->  redact(user_text)  ->  model call
  [phone] [email] placeholders ban jaate hain, kaam chalta hai
# Jo cheez bhejni hi nahi, woh leak bhi nahi ho sakti — minimization