Protecting PII in LLM Applications: Masking, Tokenization and Privacy Proxies

About this course

Every LLM application is a data flow. Card numbers and identifiers arrive in chat messages, retrieval steps pull records into prompts, debug logs keep whole conversations, and a third-party model provider receives whatever the prompt contains. The OWASP Top 10 for LLM Applications 2025 names this LLM02:2025 Sensitive Information Disclosure, and NIST AI 600-1 lists Data Privacy among the risks of generative AI. This course teaches the controls that keep personal data out of places it should not go, and the tests that prove they work: minimisation first, then detection you have measured, then masking or reversible tokenization in a privacy proxy that sits in front of the model, then logging, monitoring and limits on what persists. You build a small proxy that swaps sensitive values for random tokens before a stub model sees them and restores them afterwards, and you measure how often detection misses on a synthetic test set. The material is grounded in OWASP, NIST, MITRE ATLAS, the joint guidance Deploying AI Systems Securely, RFC 9562, the GDPR text and EDPB guidance, and the open-source Presidio documentation. It names legal obligations from the source texts and does not give legal advice. Where a control already exists on ibl.ai, the course links the live documentation.

What you will be able to do

1. Map every point where personal data enters, moves through and leaves an LLM application, and tie each risk to OWASP LLM02:2025 Sensitive Information Disclosure, LLM08:2025 and MITRE ATLAS techniques, with the preconditions and evidence each leaves.
2. Apply data minimisation first, with field allowlists enforced in code outside the model and tested with synthetic records, and name the obligations in the primary texts (GDPR articles, NIST SP 800-122, PCI DSS) without giving legal advice.
3. Build a pattern-and-checksum PII detector, measure its missed detections, recall and precision on a labelled synthetic test set, and evaluate an adopted detector such as Presidio the same way.
4. Choose between redaction, masking, keyed hashing, reversible tokenization and format-preserving encryption for each data type, and justify the choice from NIST, EDPB and RFC 9562 guidance.
5. Build and test a pre-flight and post-flight privacy proxy with per-session token vaults, fail-closed restoration and output scanning, and prove each control with tests that fail when it is removed.
6. Keep personal data out of logs, training data, retrieval indexes and agent memory, explain where differential privacy fits, and write a PII protection design for one of your own LLM data flows.

Who this course is for

Roles: security engineers, AppSec and platform teams, ML engineers and security leaders who build or run LLM applications and agents, and the privacy staff who review their designs.

Organizations: any sector, wherever an LLM application handles customer, employee, patient, student or citizen data.

Before you start: familiarity with application security and reading Python. The labs need Python 3.11 or later on your own machine; one optional lab installs Presidio. All lab data is synthetic and supplied in the course, and every lab runs locally against code you write.

Format

Time: about 10 to 12 hours, self-paced. Level: intermediate. Hands-on: six local Python labs (a detector, its measurement, Presidio on the same test set, a privacy proxy, its control tests, and log redaction with alerting), with an AI tutor that coaches each step from the output you paste.

Structure: a Start here section, four content sections of readings, worked examples, templates and hands-on labs, each ending in an AI assessment, and a capstone in which you write a PII protection design for one of your own LLM data flows, followed by a reading list.

Grading: the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent.

Currency

Last verified 2026-11-03 against the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications for 2026, NIST AI 600-1, NIST AI 100-2e2025, NIST SP 800-122, NIST SP 800-226, NIST SP 800-38G and the second public draft of its Revision 1 (February 2025), MITRE ATLAS release 2026.10, RFC 9562, the GDPR text, the EDPB Guidelines 01/2025 on Pseudonymisation (version for public consultation) and Opinion 28/2024, Presidio 2.2.366 and the ibl.ai documentation.

This field changes quickly. OWASP, NIST, MITRE and European regulators revise their guidance often, detectors change between releases, and the format-preserving encryption standard is under revision. Check the current versions before relying on any page or template, and test only systems you own or are authorized to test. This course is training, not legal advice and not a security assessment of your systems.