AI
It's worth starting with what data masking for third-party fine-tuning is not solving anymore. As of 2023, OpenAI's default policy stopped using API data — including fine-tuning data — to train its own models unless a customer explicitly opts in, and Anthropic's commercial API terms make a similar default-no-training commitment. If your only concern was "will the vendor train on my data," that's now mostly an opt-in checkbox, not an engineering problem.
The real reason to mask data before it leaves your infrastructure is regulatory, not contractual: HIPAA, GDPR, and similar frameworks restrict transmitting personal or health data to a third-party processor at all, regardless of what that processor promises to do with it afterward. A vendor's "we won't train on this" policy doesn't make sending unmasked patient records or customer PII to their API compliant — the transmission itself is the exposure a regulator or an incident review would look at.
How Masking Actually Works
1. Detect entities before the API call. Microsoft's open-source Presidio framework runs a text detection pipeline (Named Entity Recognition plus pattern/checksum rules) to find PII like names, phone numbers, and financial identifiers before anything is transmitted.
2. Replace, don't just flag. Presidio's Anonymizer module actually swaps each detected entity for a placeholder or a redaction — the fine-tuning dataset that reaches the third-party API contains no real values, not values with a warning label attached.
3. Know the limit. Presidio's own documentation is explicit that automated detection is not guaranteed to catch every instance of sensitive data, so masking should be one layer in a review process, not the only one, for genuinely regulated data.
# pip install presidio-analyzer presidio-anonymizer
from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine
analyzer = AnalyzerEngine()
anonymizer = AnonymizerEngine()
def mask_training_row(text):
# 1. Detect PII entities (names, phone numbers, etc.)
results = analyzer.analyze(text=text, language="en")
# 2. Replace each detected entity with a placeholder before this
# row is ever written to the fine-tuning dataset file
masked = anonymizer.anonymize(text=text, analyzer_results=results)
return masked.text
# Example: "Contact John Smith at 555-0142" becomes
# "Contact <PERSON> at <PHONE_NUMBER>" - this masked version is
# what gets uploaded to the third-party fine-tuning API| Concern | Solved By Vendor's Default Policy? | Solved By Masking Before Upload? |
|---|---|---|
| Vendor training a future model on your data | Yes, by default at OpenAI/Anthropic as of their current commercial terms — unless you opt in | Not the point — masking doesn't change vendor training policy |
| Regulated PII/PHI leaving your infrastructure at all | No — a no-training promise doesn't cover a transmission restriction like HIPAA's | Yes — the real value/names never leave in the first place |
Treat these as two separate checkboxes on a compliance review, not one. Confirm the vendor's current training/retention policy in writing for the contractual side, and mask before transmission for the regulatory side — they don't substitute for each other.
Practical Challenge
Install presidio-analyzer and presidio-anonymizer, run a few sample rows of fake customer support transcripts through the pipeline above, and inspect which entity types (names, emails, phone numbers) get caught — and try one deliberately awkward example (like a name embedded in an unusual sentence) to see where automated detection struggles.
Concept Check
Sources & Further Reading
- Microsoft Presidio (GitHub) — the open-source PII detection/anonymization framework and code pattern used in this lesson, including its own documented limitation that automated detection isn't guaranteed to catch everything.
- OpenAI Enterprise Privacy — source for OpenAI's current default policy of not training on API/fine-tuning data unless a customer opts in.