TL;DR
A model that strips personal data from text behaves like a tourist with a phrasebook: it knows the standard phrases (names, dates, addresses) but doesn't get the local slang. Researchers showed that if you explicitly list local designations in the prompt (organization abbreviations, building names, internal codes) and give examples of what not to touch, the model finds almost everything it used to miss in a single pass.
The core pain: an LLM is good at scrubbing "classic" personal data but misses anything outside the standard list — the hospital abbreviation "TCH," the building name "Mark Wallace Tower," internal pager numbers. That isn't a limitation of the model — it simply was never asked to. When the prompt told it to remove only "the 18 HIPAA categories," it faithfully removed only 18 categories.
The fix isn't a fancy architecture but clarifying the task in two layers: first tell the model which additional local terms count as identifying, then give "Wrong → Right" pairs so it doesn't start deleting everything out of paranoia. Both layers go into the same prompt, with no extra passes.
Want this for your own case? Apply this study to your task: AI adapts its method to what you are working on and writes the prompt.
Method Blueprint
STEP 1: Normal run — ask it to remove the standard categories of personal data → a first scrubbed version of the text
STEP 2: Look at what's still recognizable (abbreviations, codes, your organization's names) → a list of "blind spots"
STEP 3: One final prompt: standard categories + an explicit list of local categories + "don't remove this" examples → the finished result in a single request
All three steps fit in one chat: run it, look, add to the prompt, run it again with the clarifications.
Example in Action
Task: A startup is preparing internal correspondence and an incident report to hand to outside counsel before a deal (due diligence). Names and dates need to go — but so does internal slang: the meeting room "Caribbean Room," the department abbreviation "SLS" (sales), project codenames like "Project Mongoose," internal Jira ticket numbers.
Prompt:
You are an expert in anonymizing documents before they are shared with a third party.
In the text below, replace all identifying data with placeholders of the form [TYPE]:
Standard categories: people's names, dates, phone numbers, email, addresses, contract numbers.
Also replace designations specific to our company:
- Names of internal spaces and meeting rooms (e.g., "Caribbean Room")
- Department abbreviations ("SLS", "MKT", "ENG")
- Project codenames ("Project Mongoose")
- Internal ticket and task numbers (formats like PROJ-1234)
Do NOT remove the following — it doesn't identify the company or people:
- WRONG: "meeting at 2:00 PM" → RIGHT: keep it, this is not an identifier
- WRONG: "discussed the department's KPIs" → RIGHT: keep it, a generic term not tied to a specific person
If in doubt, remove it rather than leave something potentially recognizable.
Text:
{paste document}
Result: The model returns the text with placeholders instead of names, dates and local designations. Generic business terms (KPIs, reporting, meeting times) stay untouched. On a first run without the list of local categories, some internal slang ("Caribbean Room," "Project Mongoose") will most likely slip through — that's exactly why you need the second step with an explicit list.
Why It Works
The model can't guess that at your company "SLS" means "sales department" — it has never seen your internal dictionary. Without explicit instructions it faithfully follows the general rules and misses contextual details, because to it these are just ordinary words, not identifiers.
But the model is excellent at doing what it's explicitly told to do. Name a category once — "department abbreviations" — and the model applies that rule consistently across the whole text, even if the abbreviation shows up 20 times in different forms.
The method uses this strength directly: instead of hoping the model "figures out the context on its own," you point out specific categories plus examples of what not to touch. One request solves both problems — misses and over-deletion.
Control knobs: - The list of local categories — expand or narrow it for your document (legal, HR, financial) - "Wrong → Right" pairs — add your own specific cases of over-deletion - The doubt threshold ("if unsure, remove") — flip it if keeping the text readable matters more than maximum anonymity
Prompt Template
You are an expert in document anonymization.
Replace all personal and identifying data in the text below with placeholders of the form [DATA_TYPE].
Standard categories: people's names, dates, addresses, phone numbers, email, document numbers.
Also replace identifiers specific to {context: my company/organization/industry}:
- {category 1: e.g., abbreviations of the company and department names}
- {category 2: e.g., names of rooms, buildings, offices}
- {category 3: e.g., internal project codes, office numbers, internal designations}
Do NOT remove the following — it is not identifying information:
- {example 1: WRONG — ..., RIGHT — keep it}
- {example 2: WRONG — ..., RIGHT — keep it}
If in doubt, err on the side of removing too much rather than leaving something potentially identifying.
Text:
{document}
Put the type of organization or document into {context}, your local designations into {category} (you'll find them by running the document once and seeing what's still recognizable), and real cases where the model might over-delete into the "Wrong/Right" examples.
🚀 Quick start — paste into the chat:
Here is a template for anonymizing documents. Adapt it to my task: {your task}.
Ask me questions to fill in the fields.
[paste the template above]
The LLM will ask which local abbreviations, names and codes you have — because without that list it can't know what exactly in your document counts as a "local" identifier.
Limitations
⚠️ A preliminary step is required: the method doesn't work "out of the box" on the first prompt — first you have to run the document and manually find what's still recognizable, and only then write the final prompt with the list.
⚠️ The category list doesn't transfer automatically: one company's (or hospital's) local designations don't fit another. You need to build the list from scratch for each specific document.
⚠️ The method recovers most, not all: even with a refined prompt some misses remain — the model catches about 4 out of 5 cases, not all of them.
⚠️ Different models react differently: adding clarifying categories improves detection accuracy for some models and throws off the balance for others (they start missing more). Test it on your own model.
How They Studied It
The researchers took 100 clinical notes from pediatric oncology patients at a Texas hospital (5,322 annotated spans of personal data) and ran them through 8 different LLMs (Claude, GPT-oss, GLM, DeepSeek and others), as well as two specialized tools for removing personal data from medical texts. They compared three prompt variants: a baseline (per the HIPAA standard), one with added local categories, and one with added "what not to touch" examples.
The LLMs beat the specialized systems, and the gap was especially visible where context mattered rather than template-based recognition. Simply adding a list of local terms recovered almost 80% of the missed identifiers.
Separately, they tested 14 variants of multi-agent setups — where several LLMs work in a chain, checking each other (one "scrubs," another "verifies"). Not a single complex setup beat a simple prompt with good instructions. That's the key takeaway: the problem wasn't the architecture, it was how the task was worded.
The biggest surprise: when the researchers checked what exactly the LLMs found "above the bar" (things the human annotators hadn't marked), experts confirmed it was real personal data too — the humans had simply missed it during annotation. So a model with a good prompt found errors in the human-made gold-standard annotation.
Resources
Palacios D., Neeley M.B., et al. Institution-Specific LLM Prompting Recovers PHI That De-identification Systems and Their Gold Standards Both Miss. Baylor College of Medicine, Texas Children's Hospital.