Researchers from AI Librarium and Tohoku University presented a two-stage method at CSS2026 for detecting and masking personally identifiable information in internal documents entirely within an in-house environment. The paper reports improved detection accuracy and processing speed by combining regular expressions, dictionaries and Japanese NER with a local LLM.
AI Librarium and Tohoku University researchers presented a paper at the Information Processing Society of Japan's CSS2026 conference on detecting and masking personally identifiable information contained in internal documents entirely within an in-house environment when using generative AI. Titled "A Lightweight Pre-Detection Method Using Regular-Expression Rules and a Local LLM to Protect Personally Identifiable Information," the paper's authors include Asahina Mutsuro (朝比奈睦郎) of Ehime University and others, Nishikawa Tomoaki (西川智章) of AI Librarium and others, and Kuribayashi Minoru (栗林稔) and others from Tohoku University's Center for Data-Driven Science and AI Education and Research.
The method uses regular expressions, dictionaries and Japanese NER such as GiNZA to extract candidates, while definitively identifying clearly formatted email addresses and telephone numbers without passing them through an LLM. Only candidates that are difficult to classify are then assessed and corrected by a local LLM (gpt-oss:20b), creating a two-stage process that improves accuracy while limiting processing time. All processing is completed in-house, with no external transmission.
The evaluation covered 500 Japanese documents from the publicly available OpenPII 1.5M dataset that were not used for development. With candidate extraction followed by correction using a local LLM, the proposed method achieved detection accuracy of 0.790 and an average processing time of approximately 11.97 seconds per document, making it faster than a method that processes the full text with an LLM. Detection accuracy also improved for email addresses and names.
Going forward, the researchers plan to apply the results to enterprise governance support services, including AI Governance X, while improving the coverage of candidate extraction, expanding the types of information detected, such as age and driver's license numbers, and conducting validation using practical business documents.