PII and Secret Leak Audit for LLM Chat Logs and Traces with Retention Rules
LLM apps log everything: prompts, retrieved chunks, tool results and answers. Those logs quietly fill up with phone numbers, CNIC numbers, addresses, API keys and other users' data. Build an auditor that scans existing LLM traces, finds personal data and secrets in English, Urdu and Roman Urdu, shows where each leak entered the pipeline, and enforces retention and masking rules going forward.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 students
7 to ship
3 optional extrasSuggested stack
What you should ship
- Importers for LLM traces from a self-hosted Langfuse instance and from OpenTelemetry GenAI spans
- Detectors for personal data common in Pakistan and South Asia (CNIC, local phone formats, IBAN, addresses) plus emails, card numbers and API keys, with custom Presidio recognisers
- A leak map that shows which pipeline stage introduced each item: user prompt, retrieved chunk, tool result or model answer
- A detector for cross-user leaks, where one user's data appears in another user's answer
- Retention and masking policies (for example: mask CNIC everywhere, delete raw prompts after 30 days) enforced by a scheduled job with an audit trail
- A synthetic test dataset with planted leaks and an evaluation of precision and recall per data type
- A dashboard for a privacy owner: leaks over time, worst sources, and what was masked or deleted
If you have time left
- A real-time masking processor that sits in the OpenTelemetry collector so new traces are cleaned before storage
- Bangla and Hindi recognisers
- A data subject lookup: find every trace mentioning one email address and export or delete it
The problem: observability turned into a data store nobody governs
To debug an LLM app you need traces: the prompt, the retrieved context, each tool call and the answer. Tools like Langfuse, LangSmith and OpenTelemetry make this easy, and teams switch them on in week one. Six months later the trace store holds thousands of conversations with customers' phone numbers, national ID numbers, addresses, order details and sometimes API keys that a tool returned by mistake.
The OWASP Top 10 for LLM Applications (2025) lists sensitive information disclosure as the second risk. Data protection law in many places, including the GDPR's storage limitation principle, expects personal data to be kept no longer than needed. Yet the trace store usually has no retention rule at all, and nobody has looked inside it.
What already exists and the gap
- Microsoft Presidio is an open source framework for detecting and anonymising personal data in text, with pluggable recognisers.
- Langfuse supports masking functions you write yourself on the client side.
- Cloud data loss prevention services scan storage buckets for personal data.
None of them understands an LLM trace as a pipeline. The gap is an auditor that knows a trace has stages, points to the stage where a leak entered (a badly scoped retrieval, a tool returning a whole customer record), handles South Asian identifiers and Roman Urdu, and turns findings into retention rules.
Inspiration
Research on training-data extraction (Carlini and colleagues, "Extracting Training Data from Large Language Models", USENIX Security 2021) made the industry take memorised personal data seriously. Your project looks at the more ordinary, more common leak: data the app itself copies into its own logs.
What you build
- An importer that pulls traces and normalises them into stages.
- Detectors built on Presidio with custom recognisers and checksum validation where an identifier has one.
- A leak map for each finding: the trace, the stage, the user and the rule it breaks.
- Policies and a cleaner that mask or delete according to rules and record what changed.
The technically interesting part
- Roman Urdu and mixed scripts. Phone numbers written as words, addresses half in Urdu, names that are also common nouns. Precision matters, or the privacy owner stops trusting the tool.
- Cross-user leaks. Detect when an entity that belongs to user A appears in a trace for user B. That is a real incident, not just untidy logging.
- Masking without breaking debugging. Replace values with consistent pseudonyms so engineers can still follow a conversation.
How you will evaluate it
- Precision and recall per data type on a synthetic dataset with planted leaks.
- The number of traces where you correctly identify the stage that introduced the leak.
- Time to scan 100,000 trace spans on a laptop.
Path to a product
Every company with an LLM feature has this problem and few have noticed it yet. A self-hostable auditor with retention enforcement, sold as a plug-in for popular observability tools or as a compliance add-on, is a credible small business, especially for teams serving customers in regulated sectors.
Scope warning
Use synthetic data you generate, never real users' conversations. Build on Presidio rather than writing a new entity recogniser from scratch. One trace source done well beats five done badly.
Learn what you need on Sefism
- AI security roadmap: sensitive data disclosure and how LLM apps leak.
- AI governance roadmap: retention, data minimisation and who owns AI risk.
- Langfuse documentation: the trace format you will import.
- OpenTelemetry documentation: spans, collectors and processors.
- EU GDPR rules for business: storage limitation and data subject rights in plain language.
- OWASP Top 10 for LLM Applications: the sensitive information disclosure risk.
- What does an AI governance job involve?: the governance work that depends on clean logs.
Get help with this idea
The risk is a detector so noisy nobody acts on it. Tauseef can help you decide which identifiers matter, build a fair synthetic dataset and shape the dashboard around real decisions. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.