A common failure mode we are seeing is systems leaking PII, and the root cause is almost always the same… People treat masking as a text-replacement problem, not a data-classification problem.
The common pattern: a support bot or RAG pipeline gets connected to real customer data. Someone runs a regex over the prompt to strip emails and phone numbers, ships it, and calls it done.
Regex is good at fixed-shape PII like card numbers or emails, but it cannot catch context-dependent PII, something like “the patient in room 4B”, where the sensitive part is a relationship between tokens, not a pattern.
This can be fixed by classic named entity recognition. An NER model classifies a span using surrounding context, so it can flag “Alice” as a PERSON even without a trigger pattern. But NER alone misses domain-specific identifiers, like an internal employee ID format unique to your company.
What actually works is layered -
- structural detectors for fixed-shape data
- NER for free-text entities, and
- domain-specific rule layer for your own schema.