Skip to main content

Reversible Masking

Redact PII and secrets on the way in. Restore them on the way out. The model provider never sees the plaintext, and every masking decision is signed and auditable.

What it is​

Reversible Masking is a token-level transform that runs in the Trinitite data plane. Before a prompt reaches the upstream model, sensitive spans (SSNs, card numbers, API keys, patient identifiers, customer names) are replaced with stable, reversible tokens. After the model responds, the tokens are restored to the original plaintext — but only on your side. The mapping is held in a KMS-backed vault, scoped to the request, and every masking/unmasking decision is written to the Glass Box Ledger.

Why it matters​

  • The provider never sees the plaintext. Your data-minimization obligation (GDPR Art. 25, HIPAA §164.312) is satisfied at the transport layer, not by contract.
  • Reversible, not destructive. Unlike blanket redaction, the user-facing response preserves the original information — "Customer SSN: 123-45-6789" comes back correct, while the model only ever saw Customer SSN: [MASK::ssn_1].
  • Auditable. Every masked span and every restoration is a signed ledger entry. You can prove, per request, what was hidden and what was restored.
  • Deterministic tokens. The same plaintext yields the same token within a request, so the model's reasoning over the masked input is stable and replayable.

How it works​

  1. Detect. The masker identifies sensitive spans against configured classifiers (PII, PCI, secrets, custom).
  2. Tokenize. Each span is replaced with a stable reversible token; the plaintext→token mapping is stored in a KMS-backed vault scoped to the request.
  3. Forward. The masked prompt goes to the upstream model.
  4. Restore. Tokens in the response are mapped back to plaintext on your side.
  5. Attest. Each mask and restore is a signed ledger entry.

Get started​

  • Configure masking classifiers and vault settings per tenant.
  • Apply masking on the Proxy or Chat path.
  • Drive the masking surface programmatically via the Masking API.

→ Masking API — classifiers, vault, mask/restore operations. → LLM Proxy — where masking runs in the data plane. → Evidence & Verification — every mask is a signed entry.

Last updated on