Personal Information Detection System

Abstract

We provide a personal information detection system that enables the detection of PII (Personally Identifiable Information) while considering the context of the text. [Solution] Based on request data that includes a specified text, the PII entities to be detected, and instructions regarding the text context to be considered, a generating AI to which a predetermined trained model 3 is applied is made to detect the PII contained in the text, and the detection result is output based on the response data from the generating AI.

Description

Technical Field

[0005] ,

[0001] The present invention relates to security technology, and particularly to a technology effective for application to a personal information detection system that detects PII (Personally Identifiable Information).

Background Art

[0002] In an environment where the need for personal information protection is increasing, in order to prevent the situation where personal information is leaked when using emails, SNS (Social Networking Service), web applications, etc., many technologies and solutions for detecting whether PII is included in the data exchanged in information processing systems and networks have been studied and provided.

[0003] For example, Japanese Unexamined Patent Application Publication No. 2023-18360 (Patent Document 1) describes an information processing system having a storage unit that stores the conversation content between a first terminal device and the information processing system, a personal information detection unit that detects personal information from the conversation content, and a communication unit that transmits a list of conversation content with whether personal information is included in the conversation content set to a second terminal device when a list of conversation content is requested from the second terminal device. Here, it is further described that in response to a request to anonymize personal information from the second terminal device, the same character string as the personal information associated with the conversation content is specified from the conversation content to anonymize the personal information in the conversation content.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] Many conventional PII detection technologies, tools, and solutions are made overseas and have shortcomings, such as being strong at detecting English PII but having weak support for Japanese, or being dictionary-based PII signatures lacking comprehensiveness and being unable to handle input variations, making them impractical in many cases. On the other hand, there are services like PrivateAI from PrivateAI Inc. (https: / / www.private-ai.com / ) that have extremely high capabilities in detecting Japanese PII (supporting many entities specified in the Personal Information Protection Act), and have detection functions that utilize AI (Artificial Intelligence) in addition to dictionary-based signatures, making them highly comprehensive and able to handle input variations.

[0006] Many of these conventional technologies automatically detect any string that may be PII (Personally Identifiable Information) in a text without considering the context in which it is included. For example, a postal code may be included in a text in a way that relates to a specific individual, or it may be included as general information completely unrelated to personal information. Detecting the latter case as PII can lead to excessive detection.

[0007] Therefore, an object of the present invention is to provide a personal information detection system that enables the detection of PII (Personal Information Inclusion) while taking into account the context of the text. The aforementioned and other objects and novel features of the present invention will become apparent from the description herein and the accompanying drawings. [Means for solving the problem]

[0008] A brief overview of some of the representative inventions disclosed in this application is as follows:

[0009] A representative embodiment of the present invention is a personal information detection system that detects PII contained in a document, and based on request data including a specified document, the entities of the PII to be detected, and instructions regarding the context of the document to be considered, it causes a generating AI to detect the PII contained in the document by applying a predetermined trained model, and outputs a detection result based on response data from the generating AI. [Effects of the Invention]

[0010] The effects obtained by some of the representative inventions disclosed in this application can be briefly explained as follows:

[0011] In other words, according to a typical embodiment of the present invention, it becomes possible to detect PII while taking into account the context of the text. [Brief explanation of the drawing]

[0012] [Figure 1] This figure outlines an example configuration of a personal information detection system, which is one embodiment of the present invention. [Figure 2] This figure outlines an example of the PII detection process flow in one embodiment of the present invention. [Figure 3] This diagram outlines an example of PII detection processing that does not consider context. [Figure 4] This figure outlines an example of PII detection processing in one embodiment of the present invention. [Figure 5] This diagram outlines another example of PII detection processing that does not consider context. [Figure 6] This figure outlines another example of the PII detection process in one embodiment of the present invention. [Figure 7] This figure outlines another example of the PII detection process in one embodiment of the present invention. [Figure 8]This figure outlines another example of the PII detection process in one embodiment of the present invention. [Modes for carrying out the invention]

[0013] Embodiments of the present invention will be described in detail below with reference to the drawings. In principle, the same parts will be denoted by the same reference numerals in all the drawings used to describe the embodiments, and repeated descriptions will be omitted. On the other hand, a part that is denoted by a reference numeral and described in one drawing may be referred to again in the description of another drawing, although it will not be shown again.

[0014] <Overview> One embodiment of the present invention is a personal information detection system that detects PII contained in text. For example, it uses a generating AI to detect whether or not PII is contained in text or sentences input by a user. If PII is found, the system identifies its position in the text and has the function of replacing the string detected as PII with a predetermined string to conceal it before outputting it.

[0015] As mentioned above, PrivateAI, as a service for detecting PII, has extremely high detection capabilities for Japanese PII, possessing detection functions that utilize not only dictionary-based signatures but also machine learning, offering high comprehensiveness and the ability to handle input variations. In contrast, the personal information detection system of this embodiment constructs and fine-tunes a proprietary model related to generative AI (for example, using OpenAI®'s GPT®-4o mini, etc.) to enable the detection of entities equivalent to those of general PII detection solutions, and further uses a model that has been further trained and fine-tuned to enable PII detection that takes into account the context of the text. This makes it possible to detect PII based on instructions given by the user regarding the context to be considered.

[0016] <System Configuration> FIG. 1 is a diagram showing an overview of a configuration example of a personal information detection system according to an embodiment of the present invention. The personal information detection system 1 is constituted by, for example, a virtual server constructed on a server device or a cloud computing service, and by a CPU (Central Processing Unit) not shown, from a recording device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive), an OS (Operating System), a DBMS (DataBase Management System), middleware such as a Web server program, and software operating thereon are deployed on a memory and executed to realize various functions related to PII detection.

[0017] The personal information detection system 1 has, for example, each part such as an interface part 11, a pre / post processing part 12, and a model call part 13 implemented as software.

[0018] The interface part 11 has a function of providing an interface to a client 2 (an information processing terminal, an application, etc. used by a user) that uses the PII detection function according to the present embodiment. The interface part 11 receives instructions / requests related to PII detection from the user (client 2) via the interface, and responds to the user (client 2) with the detection result.

[0019] For example, it may be configured to provide an interface in the form of an API (Application Programming Interface) and be called from an application or program not shown on the client 2, or to provide a user interface by a screen and be accessed from a Web browser not shown on the client 2. In the present embodiment, an explanation will be given assuming that an interface is provided in the form of an API. Note that the instruction content related to PII detection specified as an API parameter includes, for example, the text of the detection target, the entity of the detection target, and the instruction content about the context to be considered.

[0020] The pre- and post-processing unit 12 has the function of performing pre-processing and post-processing for the PII detection process performed by the model calling unit 13, which will be described later. Specifically, based on the instructions related to PII detection from the user received by the interface unit 11, it creates a request related to PII detection as pre-processing, for example, in the form of data in JSON (JavaScript Object Notation) format. Furthermore, as post-processing, it processes and formats the JSON data obtained as a response from the PII detection process by the model calling unit 13 into a format suitable for output by the interface unit 11.

[0021] The PII detection process by the model calling unit 13 is performed by the generating AI. However, due to the characteristics of the generating AI, its output is not definitive and is subject to fluctuations. For example, the index indicating the position of the string detected as PII in the text, or the string that conceals it, may not be accurate, or the original string may be modified before PII is detected and concealed. In such cases, the system also has a function to detect and correct PII using a definitive approach, such as correcting it using general text processing based on a comparison with the original input string.

[0022] The model calling unit 13 has the function of detecting PII using the trained model 3 based on the PII detection request (JSON data) passed from the pre / post / processing unit 12 (in other words, having the generating AI to which the trained model 3 is applied perform the PII detection process), and outputting a response (JSON data) to the pre / post / processing unit 12. As described above, the trained model 3 of this embodiment is a model that can detect entities equivalent to those of a general PII detection solution, and has been further trained and fine-tuned to enable PII detection that takes context into consideration. For this training and fine-tuning, for example, the text to be detected for PII, the instructions regarding the context to be considered (described later), and the PII detection results based on those instructions are used as training data.

[0023] <Processing flow> FIG. 2 is a diagram showing an outline of an example of the flow of PII detection processing in an embodiment of the present invention. First, an API provided by the personal information detection system 1 as a PII detection service is called from an application or program on the client 2 (S01), and the interface unit 11 of the personal information detection system 1 receives the API call (S11). The API parameters include, for example, the text to be detected and the text related to the instructions for the context to be considered.

[0024] Thereafter, in the personal information detection system 1, the pre-post processing unit 12 creates request data in JSON format as a pre-process based on the API parameters input by the user (S12). Then, the created JSON format request is input to the generative AI to which the learned model 3 is applied by the model call unit 13 to instruct PII detection, and JSON format data of the response is obtained (S13).

[0025] Thereafter, the pre-post processing unit 12 performs post-processing to process and format the JSON format data of the response into a format or format for output by the interface unit 11 as needed (S14), and responds to the client 2 as the API output (S15).

[0026] At the client 2, when the API response is obtained (S02), subsequent processing is performed based on the content (S03). The content of the subsequent processing is unique processing depending on the specifications and content of the client 2. For example, when PII is detected, the processing can be regarded as an error, or a warning can be output and the processing can be continued. It is also conceivable to interrupt the processing and request the user to take measures or respond.

[0027] <PII Detection> Figure 3 is an overview of an example of PII detection processing that does not consider context. Here, for example, the upper part shows an example of request data in a typical PII detection solution using conventional machine learning technology, and the lower part shows an example of response data to it. Both are in JSON format, and the request data in the upper part indicates that the text to be detected for PII ("Please tell me the address of postal code 230-0056.") and the entities to be detected ("Name", "Postal Code", "IP Address", "Organization") are specified.

[0028] In contrast, the response data in the lower section shows that the entity detected as PII ("postal code"), the detected string ("230-0056"), the string with the PII hidden ("postal code_1"), and the position of these strings within the text (number of characters from the beginning) are set. Furthermore, it shows that the entire original text has been replaced with the string with the PII detected string hidden ("Please tell me the address for postal code [postal code_1].").

[0029] For example, postal codes do not necessarily qualify as PII (Personally Identifiable Information) in all cases. As seen in the example in Figure 3, postal codes appearing in the detected text may be used in a way that does not associate them with any particular individual. Conventional PII detection mechanisms that do not consider the context of the text may indiscriminately detect even such unrelated information as PII simply because it is a postal code.

[0030] Figure 4 is a diagram illustrating an example of PII detection processing in one embodiment of the present invention. In this embodiment, as described above, the PII detection request includes user instructions regarding the context to be considered. That is, in the example in Figure 4, the key "Special Instructions" in the request data indicates that instructions ("Detect only if you can identify an individual.") are given to the generating AI (trained model 3). As a result, for sentences similar to the request data in the example in Figure 3, since the postal code is included in a way that does not identify an individual, no PII was detected in the response data below. In other words, considering the context, the postal code was not detected as PII and was left as is.

[0031] Figure 5 outlines another example of PII detection processing that does not consider context. Here, the postal code appearing in the PII-detected sentence ("The postal code for Taro Nomura's address is 230-0056.") in the request data at the top indicates that it is associated with a specific individual ("Taro Nomura"). As a result, the response data at the bottom shows that the strings of the individual's name ("Taro Nomura") and postal code ("230-0056") were detected as PII and concealed.

[0032] Figure 6 is a diagram illustrating another example of PII detection processing in one embodiment of the present invention. For a sentence similar to the request data in the example in Figure 5, the example in Figure 6 shows that the context to be considered is indicated as "Special Instructions" which state "Detect only if it is possible to link it to a specific organization." As a result, for a sentence similar to the request data in the example in Figure 5, the postal code is included in a way that links it to a specific individual, but not in a way that links it to a specific organization. Considering the context, the response data in the lower section shows that no PII was detected.

[0033] Figures 7 and 8 illustrate another example of PII detection processing in one embodiment of the present invention. In the example in Figure 7, the upper request data shows that for the sentence targeted for PII detection ("Taro Nomura works for NRI."), the "Special Instructions" state "Please extract only information unrelated to Nomura Research Institute," indicating the context to be considered. In this sentence targeted for detection, "NRI" is an abbreviation for "Nomura Research Institute," and "Taro Nomura" works for "NRI." Therefore, there is no information unrelated to Nomura Research Institute, and as a result of considering the context, the lower response data shows that no PII was detected.

[0034] On the other hand, in the example in Figure 8, if the text targeted for PII detection was "Taro Nomura works at NASA," in response to the same "special instructions" as in the example in Figure 7, both "NASA" and "Taro Nomura," who works there, would be considered "information unrelated to Nomura Research Institute." Considering the context, the response data in the lower section indicates that these were detected as PII and concealed.

[0035] As described above, according to the personal information detection system 1, which is one embodiment of the present invention, PII can be detected in a text subject to PII detection based on instructions given by the user regarding the context to be considered, its location can be identified, and the detected string can be replaced with a predetermined string to conceal it and output, thus enabling PII detection that takes into account the context of the text.

[0036] The present inventors have described the invention in detail based on embodiments above, but it goes without saying that the present invention is not limited to the above embodiments and can be modified in various ways without departing from its essence. Furthermore, the above embodiments are described in detail for the purpose of explaining the present invention in an easy-to-understand manner and are not necessarily limited to those having all the configurations described. In addition, it is possible to add, delete, or replace some of the configurations of the above embodiments with other configurations.

[0037] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, in whole or in part, for example, by designing them as integrated circuits. Alternatively, each of the above configurations, functions, and means may be implemented in software by having the processor interpret and execute programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in memory, hard disks, SSDs, or other recording devices, or in recording media such as IC cards, SD cards, or DVDs.

[0038] Furthermore, in the diagrams above, the control lines and information lines shown are those deemed necessary for explanation and do not necessarily represent all control lines and information lines that would be present in the actual implementation. In reality, it can be assumed that almost all components are interconnected. [Industrial applicability]

[0039] This invention can be used in personal information detection systems that detect PII (Personally Identifiable Information). [Explanation of Symbols]

[0040] 1…Personal information detection system, 2…Client, 3…Trained model 11…Interface unit, 12…Pre- and post-processing unit, 13…Model recall unit

Claims

1. A personal information detection system that detects personally identifiable information (hereinafter referred to as "PII") contained in a text, A personal information detection system that, based on request data including a specified text, the entity of PII to be detected, and instructions regarding the context of the text to be considered, causes a generating AI to detect PII contained in the text by applying a predetermined trained model, and outputs a detection result based on response data from the generating AI.

2. In the personal information detection system described in claim 1, The aforementioned trained model is a personal information detection system that has been trained using as training data information the text to be detected, instructions regarding the context of the text to be considered, and the detection results of PII contained in the text when the instructions are taken into account.

3. In the personal information detection system described in claim 1, A personal information detection system that performs a predetermined correction on the response data when outputting a detection result based on the response data.

Images