Traditional data protection has a clear mental model. Sensitive data lives in a database. You encrypt it, control who can access it, and audit who did. The data stays where you put it, and protecting it means controlling access to that location. This model works well for conventional software. It breaks down for AI.
The problem is that AI systems don't just process data — they learn from it. When a model trains on a dataset that includes sensitive information, that information doesn't stay in the dataset. It gets absorbed into the model's parameters in ways that are difficult to predict, audit, or reverse. Researchers have demonstrated repeatedly that language models can be prompted to reproduce fragments of their training data, including personal information, private communications, and proprietary content. The data is no longer in a database you can lock. It is encoded, in some form, in a model that may be deployed widely and queried by many users.
This is a privacy risk that encryption doesn't address. LLM Data Encryption and Data Security protect data in transit and at rest, and they are necessary. But they don't prevent a model from memorizing what it was trained on, and they don't prevent that memorized content from surfacing in a response to a user who was never supposed to see it.
The inference layer creates a second risk. Every prompt sent to an AI system is a potential log entry. Model Security covers the controls around the model itself, but the logging and retention practices around inference are a separate concern. Users often share sensitive information in prompts without realizing it is being stored, and organizations often log inference traffic for quality and debugging purposes without fully thinking through the privacy implications of what those logs contain.
PII Protection addresses the most immediate version of this problem: identifying and handling personally identifiable information before it enters the model or after it appears in outputs. But PII protection is a mitigation, not a solution to the underlying tension. The fundamental challenge is that AI systems are most useful when they have access to rich, detailed data, and that same richness is what creates privacy risk.
The articles in this section cover the core data protection practices that every AI deployment handling sensitive data needs. The next section covers the more advanced techniques that address the deeper problem: how to let AI learn from sensitive data without directly exposing it.
