Source-linked AI summary
Redakto - The Incognito Tab for LLMs
Saurav Kumar Saha, Tom Röhr, Felix Bießmann
TL;DR
PII exposure remains a barrier to safe LLM use, especially for confidential legal and medical text. Redakto provides anonymization through a web application, REST APIs, and MCP hooks, and evaluations show anonymized texts retain substantial downstream utility in most cases.
Problem
PII exposure limits the safe use of LLMs for processing confidential text in domains such as healthcare and legal studies.
Method
Redakto detects and redacts PII using multiple strategies, exposes the functionality through web, REST, and MCP interfaces, and evaluates privacy and downstream utility across legal, medical, and email data.
Results
Redakto reaches macro F1 ≈0.95 for PII detection on data-rich domains, while anonymized texts show no substantial utility loss in most evaluated cases.
Takeaways & Limitations
Redakto offers a practical open-source route for privacy-oriented text anonymization in LLM workflows without substantially reducing utility for the evaluated tasks.
Abstract
from arXiv · showhide
Large Language Models (LLMs) are being increasingly used in everyday applications. A major challenge in the context of LLMs or Artificial Intelligence (AI) in general is to ensure privacy when using them, meaning that personally identifiable information (PII) is removed from any text that enters an LLM. These challenges have become more urgent with novel EU legislation. Uncertainty around LLM usage with respect to privacy concerns in EU countries can be a major blocker for the speed of innovation and transfer from research to applications. Here we present \textbf{Redakto}, a tool that can be used for anonymizing text prior to feeding it to an LLM or other downstream text processing. We provide state-of-the-art functionalities for both redaction of PII but also when used for pseudonymization. These functionalities are exposed such that they can easily be used by end-users, through the Redakto web application, and by developers and researchers, via REST APIs and model context protocol (MCP) hooks. The implementation is fully open source, requires modest compute resources, and can be readily deployed on local hardware. In contrast to prior work and in order to better assess the quality of the anonymized texts, we conduct extensive empirical evaluations on textual data from legal and medical domain with respect to both privacy and utility of the redacted texts. Our empirical results demonstrate that the texts anonymized with different redaction strategies achieve utility scores on par with the original texts, suggesting that anonymization with Redakto can be used for LLM tasks without substantial negative impact for the tasks we explored.
1 Introduction
Redakto addresses the privacy risks that hinder safe LLM use by automatically detecting and redacting personally identifiable information from sensitive text. The demonstrator supports privacy-conscious sharing with LLM chatbots and other downstream applications, alongside REST/MCP access and evaluations of privacy and utility.
- Motivation: PII exposure remains a significant barrier to the safe and ethical use of LLMs for text processing and analysis.The challenge is especially acute where confidential documents are routinely analyzed.
- Contribution: Redakto automatically detects and redacts PII from confidential text before it is shared with LLM-based chatbots or downstream applications.The demonstrator targets privacy-sensitive domains including public administration, healthcare, and legal studies.
- Contribution: The project provides a Redakto web application, REST and MCP APIs, and evaluations of model privacy and redacted-text utility in downstream tasks.These components are presented as extensions of prior work on practical implementation.
2 Redakto web application and APIs
Redakto exposes its models through a web application, REST APIs, and an MCP server for end users, developers, and researchers. The components are containerized for self-hosting, while the APIs and MCP server support structured privacy-aware text processing.
- Deployment and access: Redakto provides a web application, REST APIs, and an MCP server hosted on institutional computing infrastructure for end users, developers, and researchers.All components are containerized and can be self-hosted, including on Kubernetes clusters.
- Deployment and access: A publicly accessible Redakto web application is available, alongside a Docker container image and deployment documentation for installation.The public instance is available at https://redakto.demo.calgo-lab.de.
- REST APIs: The REST API exposes endpoints for entity recognition and pseudonymized text generation, with both coarse- and fine-grained entity labeling.The endpoints are documented through Swagger UI within the web application.
- MCP integration: The npm-distributed MCP server exposes schema-defined tools for entity detection and pseudonymization in LLM assistants and agent frameworks.This enables privacy-aware text transformation to be integrated programmatically into agentic workflows and developer tooling.
3 Privacy Evaluation
Redakto’s privacy evaluation measures PII-detection performance across German email, clinical, and legal datasets. Transformer models reach macro F1 ≈0.95 when trained on domains with abundant annotated data.
- Evaluation scope: The evaluation covers three distinct domains: CodE Alltag emails, GraSCCo clinical texts, and LER legal documents.This design assesses robustness and domain generalization across email, clinical, and legal text.
- Overall performance: Macro F1 ≈0.95 is achieved for PII detection when transformer models are trained on domains with abundant annotated data.The result summarizes the transformer models optimized for the Redakto demonstrator.
- CodE Alltag: On CodE Alltag, three transformer models are compared for detecting 14 PII categories in German email text using five-fold cross-validation.Performance is reported as macro-averaged means and standard deviations across the test sets.
- GraSCCo: GraSCCo contains 1,439 annotated private entities across 19 PII label types, so models pretrained on CodE Alltag are adapted through transfer learning.The task-specific classification heads are replaced for GraSCCo labels before further fine-tuning on the clinical corpus.
- LER: LER broadens the evaluation to legal text, with persons, locations, and organizations comprising 25.66% of annotated entities.The dataset is not dedicated to PII, but these entity types overlap substantially with privacy-relevant categories.
4 Utility Evaluation
The utility evaluation tests whether models trained on original text retain classification performance when evaluating anonymized text across medical and legal tasks. It compares semantic placeholders, random masks, and generic masks using transformer-based models and cross-validation.
- Evaluation design: Utility is assessed by training models on original texts and evaluating classification performance on texts anonymized with semantic placeholders, random masks, or generic masks.The comparison examines task-specific linguistic information loss and model robustness across medical intent classification and legal violation prediction.
- Medical Intent Classification: The Medical Intent Classification dataset contains 5,541 physician turns annotated with 20 fine-grained intents in a multi-label prediction task.Each sample is a single physician utterance drawn from the ACI-Bench corpus.
- Medical Intent Classification: Three transformer models are fine-tuned for medical intent classification, with performance reported for each redaction condition across five cross-validation folds.Error bars represent performance variability across the five folds.
- Binary Violation Prediction: The legal evaluation uses the ECHR dataset and restricts experiments to binary violation prediction: determining whether any Convention article was violated.The setup uses the same redaction model and strategies as the medical task.
- Binary Violation Prediction: Three transformer-based document classifiers are fine-tuned with Flair and long-sequence support to evaluate macro-averaged performance under different redaction strategies.Results for the redaction strategies are reported in Table 4.
5 Conclusion
Redakto combines accessible deployment interfaces with comprehensive evaluations of anonymization performance and utility. The results show reliable anonymization across varied domains without substantial loss of utility.
- Deployment interfaces: Redakto provides a web application, REST APIs, and MCP hooks for direct use inside an LLM.These interfaces support direct usage by end-users and integration with LLM workflows.
- Evaluation: The demonstrator combines its redaction implementation with comprehensive evaluations of redaction performance and utility.The evaluation addresses both anonymization quality and the usefulness of the resulting texts.
- Findings: Empirical evaluations show that Redakto reliably anonymizes texts across a variety of domains without substantially impacting utility.The conclusion reports both cross-domain anonymization reliability and limited utility degradation.
A Additional Experimental Results
Additional experiments on the entity-dense ECHR dataset show that performance declines as documents become longer and more complex, while redaction causes little additional degradation relative to unredacted text. The relative performance gap remains largely stable across increasing entity-density levels.
- Experimental setting: ECHR test documents average approximately 2000 tokens and 86 private entities, with the densest documents containing several hundred PII entities.This setting enables evaluation of extensive redaction under high concentrations of sensitive information.
- Entity-density analysis: Documents were ranked by detected-entity count and divided into four percentile ranges to evaluate classification performance under increasing entity density.The ranges were 0–25, 25–50, 50–75, and 75–100 percentiles, evaluated across fine-tuned binary violation prediction models and redaction strategies.
- Entity-density analysis: Higher entity-density percentiles require more document transformation, enabling assessment of utility preservation under progressively more intense redaction.Performance trends across percentile ranges help distinguish redaction effects from the inherent difficulty of processing longer documents.
- Results: As entity density increases, performance gradually declines across all models and redaction strategies because documents become substantially longer and more complex.The comparison covers xlm-roberta-large, bert-large-cased, and electra-large-discriminator results shown in Figures 3–5.
- Results: The relative performance gap versus unredacted documents remains largely stable across density levels, suggesting document complexity—not redaction—is the primary degradation driver.This pattern indicates that extensive redaction does not introduce substantial additional performance loss in the tested setting.
B Redakto System Design
Redakto uses a layered architecture combining a Streamlit interface, FastAPI backend, model-infrastructure layer, and task-specific post-processing. Its configurable pipeline supports NER and pseudonym generation, handles longer inputs, and enables containerized deployment.
- Architecture: Redakto combines a Streamlit interaction layer with a FastAPI backend for structured NER and pseudonym-generation requests.Users select the entity set, label granularity, and model through the interface.
- Prediction service: The backend validates requests with Pydantic and dispatches models that return entity spans or pseudonyms with reconstructed text variants.NER models return detected spans, while NER-PG models additionally generate pseudonyms and reconstructed pseudonymized text.
- Model infrastructure: A YAML-configured model registry and cached loaders support Flair and Transformer-based mT5 inference with tokenization, sentence boundaries, and chunking.The infrastructure layer loads model metadata, strategies, and framework paths, while adapters use SoMaJo for preprocessing longer inputs.
- Post-processing and deployment: Post-processing merges adjacent dates, optionally maps fine-grained labels to coarse-grained labels, reconstructs pseudonymized text, and supports Docker and Kubernetes deployment.Kubernetes manifests deploy both the user interface and API services.