Detect free-form PII with AI matching

This guide adds a model-backed AI Matching detector to a surface’s Prompt Guard, alongside any regex rules it already has, so free-form personal data reaches a trusted detection model before it reaches the main provider. For the concept behind this detector, see PII protection and NER IDs →.

Pattern matching only catches well-shaped values, such as emails, social security numbers, and credit card numbers. It cannot express free-form PII such as a person’s name, a street address, an organisation, or a date of birth. Without an AI detector, this class of PII reaches the provider unmasked no matter how many regex rules a surface carries.

Use this guide when:

• Prompts contain unstructured personal data, such as names, addresses, or dates of birth, that a regex cannot reliably express.
• Your surface handles free-form conversational text, such as customer support or case-handling, rather than only structured fields.
• You need detection that works across languages without maintaining word lists.

You do not need this if your surface’s PII exposure is confined to well-shaped patterns like emails or card numbers; regex-based Prompt Guard patterns alone are sufficient and cheaper.

Prerequisites

• An active LLM Surface with a Prompt Guard element on the request seam.
• A trusted, ideally self-hosted, OpenAI-compatible detection endpoint and model. The request text is sent to this endpoint, so treat its trust level the same as you would the main provider’s.
• A secret storing the detection endpoint’s API key, if it requires one. See Create your first LLM Surface for how to store a secret, if you have not created one yet.

Steps

Add an AI Matching entry to the request-side Prompt Guard

Under SURFACES in the dashboard sidebar, select LLM, open your surface, and select the Prompt Guard element on the request seam. Add a new entry and choose AI Matching as its detection type. AI Matching entries are request-only; the response side offers Regular Expression matching only.

Point the detector at a trusted endpoint

Set Provider, then select an Endpoint from that provider’s known endpoints, and enter the Model name. Set API Key Secret to the secret you created in the prerequisites, if the endpoint requires one.

Choose which entity types to detect

Under Entity types to detect, keep or adjust the default pills: PERSON, ORGANIZATION, LOCATION, ADDRESS, EMAIL_ADDRESS, PHONE_NUMBER. Remove any type that is not relevant to your surface to reduce false positives.

Set the match action

In the When detected dropdown, choose how a match is handled: Use a NER ID to preserve context (pseudonymize, the default) keeps values distinguishable, Redact the text that matches the pattern replaces every match with the same placeholder, and Reject the call completely blocks the call outright.

Decide what happens if the detector is unavailable

In If PII detection is unavailable, choose Reject if PII detection is unavailable (the default, fail-closed) to block the call when the detector errors or times out, or Continue with regex masking only to fail open and rely on pattern matching alone for that request.

Optional: restore in response and link coreferences

Turn on Restore in response to swap detected values back to their real form before the answer reaches the caller. Turn on Link coreferences only if you need aliases like “Bob” and “Robert Smith” collapsed to one NER ID; this forces detection to whole-prompt granularity, so every turn of a growing conversation is re-scanned instead of only the newest message.

Save the surface

Select the save icon in the toolbar. The change applies immediately; no restart is required.

Confirm

Replace <YOUR_APPLIANCE_HOST> and <YOUR_SURFACE_ROUTE> with your surface’s values.

Test 1: a name and address with no regex-matchable pattern still returns 200

curl -k -X POST "https://<YOUR_APPLIANCE_HOST><YOUR_SURFACE_ROUTE>/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [
      { "role": "user", "content": "My name is Priya Raman and I live at 42 Baker Street. Can you confirm you have my details correct?" }
    ]
  }'

The -k flag disables TLS certificate verification. Use this for local testing only. Remove it in production.

Expected: 200 OK. Neither value matches a regex pattern, so only the AI Matching detector catches them.

Test 2: the logged request shows the masked form, not the raw name

If request logging is enabled, open the surface’s Monitoring tab and scroll to Surface Logs, find the request from Test 1, and inspect the logged outbound request body. It should show a NER ID or placeholder in place of Priya Raman and 42 Baker Street, confirming the detector ran before the provider call.

Troubleshooting

Next steps

• Pseudonymize PII with NER IDs: Apply the same NER ID pseudonym scheme to regex-matched patterns.
• Block and re-review calls with Judge and Jury: Layer a pre-call and post-call safety review on top of Prompt Guard.
• PII protection and NER IDs: How pattern and AI matching combine, and how coreference linking works.

Related

• Guardrails: Where Prompt Guard sits alongside Expert Witnesses, Judge, and Jury.
• Guardrails reference: Every model-backed PII detector field.
• Security and access control: The SSRF protection applied to the detector endpoint, the same as any other operator-supplied endpoint.