Presidio and LiteLLM Hide Personal Data From External LLMs: Testing Three Configurations on 20 Texts

A familiar situation: a company wants to run customer requests through GPT or Claude, but those requests contain surnames, phone numbers, email addresses and street addresses. Lawyers wince, and security teams ask for "something to be done." The simplest solution is not to send personal data at all: replace it with placeholders, wait for the response and substitute the values back. This is exactly the scheme that a Habr article walks through using Presidio and LiteLLM.

An important caveat: we only have the announcement of the article, not its full text. So below is what the author states directly, plus the general mechanics of the tools as known from their documentation.

How it works in a simple example

Presidio is an open-source Microsoft library for detecting and anonymizing personal data. It consists of two parts. The Analyzer finds entities in text: names, phone numbers, emails, card numbers. The Anonymizer replaces what was found according to a chosen rule: it deletes, masks or inserts a placeholder.

Imagine the request: "Ivan Petrov asks to call back at +7 900 123-45-67." What goes to the model is "<PERSON_1> asks to call back at <PHONE_1>." The model replies using the same placeholders, and the proxy substitutes the real values back. The external provider never sees the real data, and the user gets a coherent answer.

LiteLLM plays the role of a proxy between your application and the model providers. It has a Presidio integration in the form of a guardrail: masking and reverse substitution are built into a single point, so you don't need to rewrite the code of every service.

Where Russian makes things difficult

Out of the box, Presidio is geared toward English. For Russian you need to connect a suitable language model, for example from spaCy, and check that it can find names across grammatical cases at all. "Ivanu Petrovu," "u Ivana Petrova" and "Petrova I. A." are different tasks for the model.

Next you need custom rules. Presidio lets you add your own recognizers based on regular expressions, context words and lists. For Russian realities these are contract numbers, INN (taxpayer ID), SNILS (pension insurance number) and internal customer identifiers. There is most likely no ready-made recognizer for such data, and you will have to write one yourself. The author covers this setup separately.

What the test showed

The author compared three configurations on 20 fictional texts. The announcement gives no detailed figures, but one conclusion is stated outright: in some cases part of the address remains exposed.

The cause is typical for addresses. An address is a composite entity made up of city, street, building and apartment. The model confidently tags the city or region, but skips the street with the building number or cuts it in the middle. A fragment is enough for a leak: "ul. Lesnaya, 12" combined with other data already points to a specific person.

What to do in practice

• Don't treat masking as "turn it on and forget it." Build your own test set of Russian texts with the data typical for you, and measure the miss rate before going to production.

• Cover addresses, document numbers and internal identifiers with separate rules. A standard NER model is not enough for them.

• Decide what matters more: missing something or masking too much. For customer data it is better to tolerate false positives than leaks.

• Store the mapping between placeholders and values only on the proxy side and only for the duration of the request.

Limitations

A sample of 20 fictional texts is too small to judge real accuracy on a live stream. Real emails are longer, with typos, abbreviations and mixed languages. Placeholders in the text can affect the model's answer: it loses context such as gender or nationality, and quality on some tasks drops.

The bottom line: the Presidio and LiteLLM combination is a working and inexpensive way to reduce risk when using external LLMs. But it is not a guarantee until you have checked it on your own data and closed gaps like partially exposed addresses. For teams that already send customer texts to cloud models, this is worth reading in the original and repeating on your own dataset.