PII Removal › PII Removal

Training a language model on raw web text means training it on the personal details of real people. Email addresses scraped from public forums, phone numbers embedded in product reviews, medical complaints posted under pseudonyms, and home addresses listed in contact pages all flow into pre-training corpora without any filtering. Unless you actively remove this material, your model will memorize it. When a user later prompts the model in just the right way, it will reproduce a stranger's phone number or Social Security number verbatim. This is not a theoretical concern: researchers have demonstrated that large models trained on web crawls can be induced to emit exact training examples including real names, email addresses, and phone numbers from the original dataset.

The memorization behavior is not a bug introduced by a particular architecture choice. It is a natural consequence of how language models are trained. A model that sees the string "John Smith's SSN is 412-78-9021" enough times, or in a sufficiently prominent context, will associate the pattern of "John Smith" with "412-78-9021" in its weight space. With the right prefix, the model will complete the pattern by generating the memorized number. Research by Carlini et al. (2021) showed that large GPT-style models trained on internet text could reproduce verbatim training examples at rates that increased with model scale and with the number of times an example appeared in the training data. Removing PII before training is the direct countermeasure.

Personally Identifiable Information, or PII, refers to any data that can uniquely identify an individual or be combined with other information to identify them. The legal frameworks that govern PII are partly determined by jurisdiction: GDPR in Europe, CCPA in California, and a patchwork of sectoral laws elsewhere. But the core concern is universal. People did not consent to their personal information being absorbed into model weights where it can be retrieved indefinitely. Removing PII from training data is both an ethical obligation and increasingly a legal requirement for organizations deploying models commercially.

The challenge is that PII is not cleanly labeled in web text. It appears in unpredictable formats, in the middle of otherwise valuable prose, embedded in HTML markup, or disguised by partial redaction. You cannot simply scan for well-formatted strings. You need a detection system that is both precise enough to avoid false positives (removing legitimate content) and sensitive enough to catch personal information across its many forms. The tension between these two requirements drives almost every design decision in a PII pipeline.

Building on the deduplication and quality filtering techniques from earlier in this part, PII removal is the final scrubbing step before data enters the training pipeline. While deduplication removes redundant documents and quality filters exclude low-value text, PII removal specifically targets the privacy risk in the text that remains. The next chapter on data mixing then takes the cleaned, filtered, and deduplicated corpus and combines it in proportions calibrated for downstream task performance.