How to remove PII from training data before a model learns it

It is easy to assume the risk applies only to large language models. It applies to simpler models too, for different reasons.

Word-based models keep their vocabulary

A Classifier Model learns words and phrases, and the vocabulary it learned is kept inside the model. If customer surnames or the parts of email addresses appear in the training text, they can end up inside the model as part of that vocabulary.

Fine-tuned models can memorize

A Dedicated AI Model is an AI language model fine-tuned on your examples. A fine-tuned model can memorize training text. Research on language models has shown that they can repeat rare strings they saw during training, and a card number or a password is exactly that kind of rare string.

Deleting the upload later does not undo training

StayCharted's security page says it directly: deleting an original upload does not remove what an existing model learned. Uploads are deleted 90 days after upload unless you delete them sooner, but derived data and trained models remain. The clean-up has to happen before training.

Before training, AMT's data quality step scans the text for 8 types of personal and secret information. The check runs for every text model, on every plan, including Free.

The checks use patterns and, where applicable, validation such as card-number checksums. Review the matches: pattern-based checks can still miss sensitive values or flag non-sensitive ones.

For each type AMT finds, you choose what happens to it.

Removing rows is the bluntest choice. It takes the value out, but it also takes out everything else the row could have taught the model, and if the rows that contain card numbers are mostly refund requests, removing them leaves the model with fewer refund examples to learn from. Keeping values should be a deliberate decision, made after someone has looked at what was found, not a way to skip the step.

Why masking usually helps the model

Masking is often treated as a cost you pay for privacy. For a classifier it can reduce irrelevant variation. A thousand unique email addresses may offer little useful signal. One repeated token such as [MASKED-EMAIL] is a signal the model can use: "this message has an email address in it." The private value is gone and the useful fact stays.

If a model was trained on masked text, AMT masks the text sent to it later in the same way first, so the model sees the same kind of input it learned from. That applies everywhere text reaches the model: every fill, the Try box and the API. Text kept in a model's recent predictions is masked too, so the record of what people asked doesn't become a new place where personal information collects. For more on that record, see AI audit trail.

Pattern matching works for values with a fixed shape. Much personal information has no fixed shape, and AMT does not detect it:

• Names of people.
• Street addresses.
• Health details, such as a diagnosis or a medication mentioned in a note.
• Other free-text personal information, such as "my husband's surgery is on Friday."

Finding these needs entity recognition, which isn't built into AMT. The security page says the same: the checks do not detect every name, address or sensitive free-text detail.

Picture models are a separate case. This check is for text models. Photos are not scanned for personal information, so a photo showing a face, a license plate or a document is not caught by it, and if a picture model also reads a text column, check that text yourself before training rather than relying on this text-model check.

If your data may contain these kinds of information, you have three practical options:

1. Remove the columns. A customer name or address column is rarely needed to predict a category. Leave it out of the file before upload.
2. Use another tool first. Run the text through an entity-recognition or redaction tool before uploading it to AMT.
3. Leave the free text out. If a notes field is likely to hold health details and the category can be predicted from other columns, train without it.

1. Decide which columns the model needs. Drop the rest before upload, especially name, address and free-text contact fields.
2. Read what AMT found. The data quality step shows which of the 8 types appear in your text.
3. Mask by default. Choose remove or keep only for a reason you can explain.
4. Read a sample of rows yourself. Look for names and health details, which AMT does not detect.
5. Record what you chose. Your governance or privacy team will want to know what was masked, removed or kept, and why.

Personal information is one part of data quality. Wrong labels are another. For that side, see data cleansing for machine learning and our label error detection benchmark, where we planted wrong labels in a product dataset to measure how many a model could find.

Data you upload is kept in a database area that belongs to your organization, encrypted, hosted on AWS in the United States, and used only for your models. StayCharted does not hold SOC 2 or ISO 27001 certification, and AMT's checks do not make anyone compliant with a privacy law. They reduce what reaches a model; the decisions about what you may collect and train on stay with you.

1. Prepare a file with only the columns your model needs.
2. Upload it to StayCharted AI Model Trainer. The data quality step runs before training.
3. Review the types found and choose mask, remove or keep for each.
4. Train, then check the held-out test results before you publish.

Masking is on every plan. See the pricing page and the product page for the rest.