PRvL: Quantifying the Capabilities and Risks of Large Language Models
  for PII Redaction
Authors: name: Leon Garza; name: Anantaa Kotal; name: Aritran Piplai; name: Lavanya Elluri; name: Prajit Das; name: Aman Chadha
Published: 2025-08-07 16:22:49

Abstract: Redacting Personally Identifiable Information (PII) from unstructured text is
critical for ensuring data privacy in regulated domains. While earlier
approaches have relied on rule-based systems and domain-specific Named Entity
Recognition (NER) models, these methods fail to generalize across formats and
contexts. Recent advances in Large Language Models (LLMs) offer a promising
alternative, yet the effect of architectural and training choices on redaction
performance remains underexplored. LLMs have demonstrated strong performance in
tasks that require contextual language understanding, including the redaction
of PII in free-form text. Prior work suggests that with appropriate adaptation,
LLMs can become effective contextual privacy learners. However, the
consequences of architectural and training choices for PII Redaction remain
underexplored. In this work, we present a comprehensive analysis of LLMs as
privacy-preserving PII Redaction systems. We evaluate a range of LLM
architectures and training strategies for their effectiveness in PII Redaction.
Our analysis measures redaction performance, semantic preservation, and PII
leakage, and compares these outcomes against latency and computational cost.
The results provide practical guidance for configuring LLM-based redactors that
are accurate, efficient, and privacy-aware. To support reproducibility and
real-world deployment, we release PRvL, an open-source suite of fine-tuned
models, and evaluation tools for general-purpose PII Redaction. PRvL is built
entirely on open-source LLMs and supports multiple inference settings for
flexibility and compliance. It is designed to be easily customized for
different domains and fully operable within secure, self-managed environments.
This enables data owners to perform redactions without relying on third-party
services or exposing sensitive content beyond their own infrastructure.