There is a tempting architecture that keeps getting rebuilt: put a PII scrubber in front of the LLM API, swap the names for tokens, and now you can send anything. The tooling for it is genuinely good. Microsoft’s Presidio detects entities with confidence scores, open-source wrappers add a restore map so the model’s answer comes back with the real names re-inserted, and the whole reversible-tokenization proxy pattern is now a standard tutorial genre. If the problem were identifiers, it would be solved.
But for the class of documents this architecture usually gets built for — strategy papers, analyses, working drafts — the problem is rarely the identifiers. There are real domains where the identifier is exactly the sensitive element, medical records and HR files among them, and there the scrubber earns its keep. In a confidential work document, though, the sensitive part is usually the substance — the strategy, the internal structures, the unreleased plan — and that survives every name swap intact. A masking layer gives you a green check on the wrong property. It answers “did I remove the PII” when the question that actually governs the decision is “is this content mine to send to this processor at all.” Those are different questions, and passing the first one loudly makes it easier to stop asking the second.
Two further things break the disguise idea. Re-identification works on structure, not just names: distinctive vocabulary, process shapes, and the particular combination of constraints in a document can narrow “a large organisation in a regulated sector” down to one candidate, and a determined reader doesn’t need the label to make the match. And even where the disguise holds, non-attribution doesn’t discharge the obligation. Confidentiality duties are about the content leaving to an unapproved processor, not about whether the recipient can tell whose it is. Sending it in a costume is the same act.
Watch how practitioners discuss this in the open — legal-tech forums debating client data, the documentation of the redaction tools themselves — and the same three lanes keep recurring, while semantic disguise is conspicuously absent from what anyone defends. They rely on the contract: enterprise or API terms with a data processing agreement and a no-training commitment, read rather than assumed, because the paper terms vary more than the marketing does. They keep it local: on-machine models are now credible reviewers for document work. Or they use tokenization for what it’s actually for — identifier hygiene on top of one of the first two lanes, not a declassifier that unlocks a third.
There is a fourth move, but it isn’t a lane and it resists becoming a layer: extraction. Instead of disguising the instance, pull the generic problem out of it. “How should a document like this be structured” carries none of the substance that made the original confidential, and the test is simple — would this prompt be fine as a public blog post? What makes extraction work is the same thing that makes it hard to delegate to infrastructure: it’s a fresh judgment about what the substance is, made per payload. You could put a model in front of it and have the judgment made automatically — but the moment you trust that as a standing filter and stop making the call yourself, you’ve rebuilt the masking architecture with a smarter scrubber, and you’re back to a green check on a property you no longer examine.