PII in GenAI pipelines

Lesson 2 of 3 in Data Security and Privacy for GenAI.

PII gets caught at three stations, and the exam tests whether you know which is which. At rest: Macie runs automated sensitive-data discovery across S3 — the bucket-scale question "where is PII sitting in our lake?". In flight: Comprehend analyzes text you hand it — DetectPiiEntities returns each entity with character offsets (English and Spanish), ContainsPiiEntities gives a fast labels-only triage, and redaction runs as an asynchronous batch job, not in the real-time API. At the model boundary: the guardrail's sensitive-information filter blocks or masks entities in prompts and responses — the MLA board walks that one.

The professional pattern is privacy-preserving by construction: don't just filter PII at the boundary — remove it before the model is involved. A filter on the way out still means the identifier was sent, held in context, and written to whatever logs the call touched; strip it first and there is nothing there to leak, and the placeholders keep the output just as useful. Those Comprehend offsets are what make the removal surgical. Watch a support transcript make the round trip.

Where does each station belong in a GenAI pipeline? Before ingestion: point Macie at the buckets feeding your Knowledge Base — automated discovery samples objects continuously and raises findings (to EventBridge, and on to quarantine-and-notify automation) when sensitive data lands where it shouldn't. Before training: run a Comprehend redaction job (asynchronous, batch) over a fine-tuning corpus, because a customized model cannot un-memorize a Social Security number later — the time to redact is before the training job, a one-way door. At retrieval: S3 Object Lambda access points for PII can redact documents as they are read, so even a compromised reader sees clean text. At runtime: the guardrail filter remains the always-on net for whatever survived the pipeline.

The honest division of labor: Macie answers "where is PII in S3?" — it does not transform anything. Comprehend answers "where exactly in this text, and give me a redacted copy" — it does not patrol buckets. Guardrails answer "stop or mask it at the model boundary, both directions" — they see only the conversation. Exam options love to hand one service another's job.

Interactive sorting exercise: Route each requirement to the service built for it.

Key terms: Data masking, Anonymization, Amazon Comprehend, Amazon Macie

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.