Presidio - Automated identification and anonymization of PII data at scale

thanks Marty hi everyone I'm Emily I'm a data scientist at Microsoft and I also lead the procedure project which I'll describe in a moment but first let's start with a story about how the NSA identified Satoshi Nakamoto anyone here doesn't know who Satoshi Nakamoto is okay he's the guy who invented Bitcoin he's also one of the world's most rich people and he's anonymous nobody knows who is so how did the NSA identify him they used telemetry telemetry is the way of comparing writing styles of different authors and they compared his writing style because he published blog posts and and things like that where the trillions of other writing samples more technically they use terms frequencies features principal components analysis to reduce dimensionality and come up with a distance metric between satoshis writings and others they are the NSA they have access to literally every piece of data like Google's face books and Amazon's data centers so coming up with candidates wasn't really a problem they around this process for a month compared his writings to 1 billion people and collected one positive match now I have two things I'd like to talk about regarding this story first I have no idea if it's correct or not maybe it's fake news you know the NSA don't really write blog posts about methods they use you can ask Edward Snowden about this and the second thing is that even after running this gigantic process but one of the world's most powerful organizations how do you know that you actually got the guy so maybe they got somebody else maybe Satoshi Nakamoto is actually a group of people so Satoshi Nakamoto didn't reveal any identifying attribute about himself but in many data sets and I assume that maybe the data sets that you have in your organization you do have these identifiers like maybe names or locations or IP addresses or credit cards emails so let's think together what you can do in order to not camuto's or anonymize your data so we'll talk about presidio which is an open-source package to do this which is completely free and you just try it we'll talk about some scenarios we have identified in which such tool is necessary then we'll go a little more technical about how to use NLP to do data the identification and finally how you can use it yourself if you're interested so what is presidio procedure is a production ready so it's not just a Python package it's a full service that you could deploy locally on premises in any cloud anywhere you'd like a context aware and customizable data protection then PII and an imitation service mainly for text also for images PII stands for personal identifiable information essentially all the private data of users or people that you have it has two main components one is identification that's the part that we go through text and we look for different entities PII entities and the second phase of an animation in which we take everything we found in the identification phase and do something about it we could either encrypt it redact hash it or anything we'd like off the shelf it already supports things like detecting credit card numbers names locations financial data but it's very easy to extend this to your own PII entity or two so for something we don't currently support and as I said it's completely open-source completely completely free it doesn't rely on any anything commercial and you could just go to this repo and check it out so what are the scenarios in which you might need such tool so a lot of us are data scientists and we're working in a product team but we don't have access to the production data because the production data has users data and it has PII data we're not allowed to touch it because we're not allowed to be exposed to personal data so what we can do is we can deliberate something like presidio to take the production data strip out all the PII entities and then we get a PII free version that we can use to train our models to and analyze our data to build dashboards maybe and not worry too much about all the privacy in the data a second scenario is around monitoring production systems so production systems that are already deployed the put a lot of logs and these logs often contain PII data themselves because users interact with big systems and often different regulations don't let us allow us to touch this data so we could have maybe some scheduled tasks to take this lot take these logs clean the PII data and then we could we could work with them and a third scenario is about taking our data maybe from the on-premise environment to the cloud or maybe collaborating with a third party around this data and in this case we could use such tool to clean out a PII maybe we won't be able to clean everything but a lot of people around the world are working on manual scrubbing and manual removal of PII data in these scenarios and we could at least automate this process to some extent which is also something that reduces a lot of manual labor so these are the main scenarios obviously there there are some more next where I'm going to show some demo this is a screenshot but you could you could just go to the URL on top and try it on whatever you'd like so on the left hand side you can see just unstructured data it might seem like it have some structure but the tool is not aware of the structure in this data and the data contains all kinds of different PII entities and on this side on the around the right side you could see how the data looks like on the other side so we have identified things like credit card it used to be a 16 digit number and now it is replaced with with a token and saying goes for all the other different entities in the original text and in addition we get the confidence that prestigious things about every prediction that it had made so for the credit card version for example the score is 1 because of various factors that I already scribe in a minute I'm going into one example it a little more deeper so let's say I'm writing something like my phone number is this and that I don't try calling me on the other side you see what a proceed you're identified and on the bottom side you see that the score is 0. 8 e5 now I'm going to change the sentence a little bit instead of phone number it's going to say my pool card number and you see that it's still identified as a phone number but the confidence is lower and that is because we leverage the context of every entity so surrounding words if the word phone for example exists then it it could it brings or it increases the likelihood of this actually being a phone number and if it doesn't then it might still think that way because of the structure of the number but the confidence is actually lower so how does data flow within within the system let's take an example of HTTP request this is just one example of interacting with with the service so we send some text into presidio it goes into the PII analyser phase which orchestrates different PII recognizers so every recognizer is in charge of detecting one PII entity for example so we call all the different recognizers we have the built-in ones that you get off the shelf but you could also create your own custom pattern may be using regular expression or something else or your own custom model and train your own machine learning model and deploy it within the service to detect your own PII entities and every recognizer uses all kinds of tools that we'll talk later about like regular expressions check some named entity recognition and context which is the surrounding words so we run all these built-in and custom recognizers we collect all the results we transfer them to the anonymization phase where we could have one entity being redacted and the other being hashed for example so we have a lot of flexibility there and eventually we get an request or a response that contains the original text without all the identified PII entities in it so more technically how do we identify PII entities in text so how do we identify this private data the more basic stuff I guess is using black lists or regular expressions and checksum then we could maybe do something a little more complex yielding some rule-based logic and eventually we could train models to unprovided and then have service during runtime to detect these PII entities during runtime so blacklist may it may be simple but it's it could be very efficient in some cases so essentially I'm I'm providing the tool with a list of words that that once it sees it automatically defines its PII think about titles for example mr. mrs.

doctor professor there is a finite list probably of titles and I don't have to build a full-blown machine learning model just to detect titles and another thing I could think of is to have this tool connected to my to my database for example and query my employee list and every time an employee name appears in some text I could redact it because it's in some some sequel database this is an example of how to provide video with a blacklist the word in this case it's just five different companies but you could customize it and build your own blacklist if you're interested regular expressions so not very sexy but very efficient so we essentially build some regular expression pattern and proceed you just sift through the code and look for candidates that agree to this pattern once it had identified these entities I could also add validation code that is for example check sound so entities like credit cards and the Israeli ap for Israeli ID number for example they don't only follow some pattern they also should have some logic of which numbers are in this in this pattern so if we see that of the sixteen digits for example agree to being a valid credit card it increases the likelihood this being a credit card and not just arbitrary sixteen digit numbers so we could use this as well as well as the surrounding words rule based is essentially a way of defining our own custom rules to detect PII entities and we could use all kinds of tools to do this so we talked about blacklist we could also do whitelist so all the words in the dictionary are a whitelist and every word that is not in the dictionary may be suspect to be to be a PII data we could also use parallel speech and dependencies regular expressions and these are things we get for free so we don't have to to run our spacey pipeline or some other pipeline to extract part of speech we get this out of the system we could also look at the previous and next tokens and I will show an example of recognizers that we've built using these this technique last but not least we could obviously trained on named entity recognition models on on per open private data and then have it served during production and we could either use off-the-shelf models because some of them already know how to handle things like person names locations organizations or we could train our own so two example recognizers one for address detection and the other of how we try to improve personal organization and location detection using deep learning so address detection is pretty high it's a pretty hard problem the example here is I moved from Market Street to 23 olive road last week so the the task is to identify where in adverse starts and where it ends in order to i2d identify it on the later phase and you might have heard of address parsing which is a model that you put in a free-form address into and then you get for example what is the street number what is the zip code and things like that so identified different parts in in an address and this is not the same problem because here we have a very large body of text that might contain or not contain an address and just put everything into an address parser would not give any meaningful results so what you could think about solutions to this problem so we could train a model like a named entity recognition model some things to consider is that entities you are relatively long so if a person name is usually one two maybe three tokens long an address could be ten tokens long and I'm not sure that the current models that people use for names for example would work in this case and second is that we usually don't have very big they're very big label data sets of free text that contains human written addresses so this is something that pretty hard to find what we try to do is is something a little different more rule-based approach using token lookup so essentially what we did is we talked we took some geospatial data set from OpenStreetMap it essentially contains a lot of addresses of places points of interest locations and things like that we took all the tokens from there and put them into a try at Eri it's a data structure that essentially allows you to efficiently query the number of occurrences of every string on your on your previous previously seen data so words like streets Road Avenue Boulevard will appear a lot of times in this data set but words like Omri will not appear that in the in that data structure at all and then we take our input data that we don't know if it actually contain or don't contain any any addresses and we see how many times every token appeared in this try so we see those words like street a street and road may be street names like market and olives or do appear in this in this try but words like last in week don't appear and and we already have some feeling or some understanding of where an address might be in existing in this in this sentence we still need to understand where it starts and where it ends and for that we could go back to the address parsing task and come up with different candidates for where it starts and where it ends put put the candidate substring in to address parser and see if we get something meaningful if we did get something meaningful it means that we're probably on spot on the address but if we don't we could maybe try and play a little bit with the start and ends of the sentence to see if we get anything better a future work you could might think of is to look at these counts as features and add additional features that you might find in addresses like regular expressions for ZIP codes or for States and trainer model to detect address parts in free text so this is one example and the other example is around doing more traditional named entity recognition and I'll talk about how we created the data set which models we used in some interesting results so data set creation again like the errors problem PII data are hard to come by it's not like people give you their PII data it's the last thing they would want to do and you have to come up with creative ways of generating your data so the solution we came up with is to augment publicly available label datasets so you download a label dataset from the web for example that has a sentence like thank you Tim and Tim is labeled it's a person you replace this with a token or a template saying thank you person and then you could generate new sentences using fake PII like thank you Rick thank you a full name Amanda marks or a lowercase thank you Yoda for example and then you could see how your model behaves on much more data than originally was in this label dataset that you started with so this is actually a little easier said than done and we we thought it would be easy but it wasn't that easy so some some examples there is a difference between location which was the label that was given and nationality so if the original sentence was the North Koreans knows what's in the agreement know what's in the agreement and we replaced the North Koreans with Germany then we get something like the German you know who what's in the agreement and that's not remotely correct and we had to fix this by adding a new nationality label for example same goes with gender so maybe the original sentence were talking about a female and we injected a male name and sometimes person names are inside institutions so the Obama administration will replace with maybe the Gaga administration and then you have to think if you want this or don't want this in your data set and some funny sentences or a lot of these labels data sets talk about take take data from the news and obviously Israel is all over the news in many places so this was originally a sentence about Israel and Palestine and once we replace everything we get something like Dutch gunman at the London refugee camp in the southern part of Budapest rip opened fire on the Australian forces and again you could think if you'd like this or don't like to have it in your in your data set and we've also encountered a lot of wrong labels in these these are these data sets and these are the data sets the tea used to two-note state-of-the-art results for example so one of the data says has a lot of sentences from the Bible but they are not labeled so because they are holy or something nobody labels Jesus or Judas or Paul and then the model itself needs to have some divine understanding I guess in order to get this right so actually our data set is a little more clean than the original data set that we started with so we took 8,000 templates and we generated 80,000 samples and we did all kinds of approaches we trying to train a deep Learning Network from scratch we used pre trained embeddings or we try to fine tune so continual training and already trained model and the factors that we cared about obviously the accuracy the performance also because presidio is currently very fast and we don't want to to get lower performance and what we had before and interpretability was also something that we had in mind the metric we optimize on is f2 because recall is more important than precision we don't want false negatives or false PII to slip through the process and reach the final data set so evaluate in various space see models and flare models software if you are not familiar with it it's an NLP library that is built on top of pi torch it has all kinds of tweaks that actually bring state-of-the-art results on many tasks specifically there is the flair embeddings which is a fair way of calculating embeddings and another nice feature is that you could tack embeddings from different sources so you could have Bert and Elmo together or things like that we use Bert on one model and we use the stacking of glove and slurring bearings on the other we also use conditional random fields as just a baseline approach which is a little more interpretable I guess than the others so regarding results it's a little too much so I'll go over it step by step let's start on the bottom the black bar is the f2 score for what was pai detected or not so we're less interested in whether it got a location as person or organization as location we were more interested in whether we got the PII right or not so this is the metric we were we cared about and you see that CRF actually gets pretty good results around 80% we tested various space versions when we started this experiment space he had 2. 1 2. 0 and it didn't recognize anything that was lowercase and that's one of the reasons why we've decided to do this ourselves while we were in the process they released a new version 2.