LLM Prompt Screening With NER for Enterprise Data Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large language models (LLMs) pose significant data privacy and security risks in enterprise environments, leading to inadvertent exposure of proprietary data, personal information, and violations of regulations like GDPR and CCPA, without adequate mechanisms for user consent and data subject rights.
Innovation Solution
Implementing a computing system with a runtime data security check microservice and named entity recognition (NER) modeling microservice to analyze user prompts, identify sensitive information, and enforce compliance with data security protocols, using a custom NER model trained on domain-specific data to tag entities as compliant or noncompliant.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If LLMs are integrated into enterprise environment to provide generative AI services, then productivity and user experience are improved, but data privacy and security risks increase
Solution Approach 1:
The patent introduces an intermediary system comprising a runtime data security check microservice and a NER modeling microservice that acts as a mediator between user prompts and the LLM. This intermediary analyzes prompts in real-time, identifies sensitive information using named entity recognition, and determines compliance with data security policies before allowing prompts to reach the LLM, thereby resolving the contradiction between enabling AI services and preventing data security risks
Solution Approach 2:
The system performs preliminary data security checks and named entity recognition analysis on prompts before they are submitted to the LLM. By conducting compliance verification in advance rather than after data exposure, the system prevents sensitive information from being processed by the LLM, thus maintaining productivity while eliminating security risks proactively
2Reliability
If runtime data security checks are implemented to analyze user prompts, then data security is improved, but system complexity increases
Solution Approach 1:
The patent segments the data security system into distinct modular microservices: a runtime data security check microservice that handles compliance logic and a NER modeling microservice that handles entity recognition. This segmentation allows each component to be developed, deployed, and maintained independently, reducing overall system complexity while maintaining high reliability through specialized functionality in each module
Solution Approach 2:
The NER modeling microservice is designed to be universal and reusable across different prompts and use cases. Once trained on domain-specific data, the NER model can identify various types of sensitive information (personal identifiers, financial data, proprietary information) across diverse enterprise contexts, reducing the need for multiple specialized systems and thereby managing complexity
3Measurement precision
If custom NER model is trained on domain-specific data to identify sensitive information, then measurement precision of sensitive data detection is improved, but loss of time for model training increases
Solution Approach 1:
The custom NER model is trained in advance on domain-specific data containing examples of sensitive information relevant to the enterprise's industry and data types. This preliminary training action creates a pre-configured, highly accurate model that can immediately identify sensitive entities without requiring additional training time during runtime, thus achieving high detection precision without ongoing time loss
Solution Approach 2:
The system is configured to perform self-service by using the pre-trained NER model that automatically adapts to domain-specific terminology and patterns. The model serves itself by leveraging the training data's domain characteristics to improve detection accuracy continuously without requiring manual retraining, thereby maintaining high precision while minimizing time investment
Data Source
AI summary
Certain aspects of the disclosure concern a computer-implemented method for improved data security in large language models. The method includes receiving a prompt query entered through a user interface, extracting a plurality of named entities from the prompt query and classifying the plurality of named entities into respective entity classes, tagging the plurality of named entities to be security compliant or security noncompliant based on the respective entity classes, and responsive to finding that one or more named entities are tagged to be security noncompliant, generating an alert on the user interface.