Urdu and English Personal Data Redaction Before Prompts Reach Cloud AI Tools
Build a local redaction layer that finds names, CNIC numbers, phone numbers, bank account numbers and addresses in Urdu, Roman Urdu and English text, replaces them with consistent placeholders before the text goes to a cloud AI tool, and puts the real values back into the reply. Staff at clinics, law chambers and HR teams paste customer data into chat assistants every day. Existing open source tools cover English and a few European languages well but not Pakistani identifiers or Urdu names.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 to 3 students
7 to ship
4 optional extrasSuggested stack
What you should ship
- Rule-based recognisers with checks for CNIC numbers, Pakistani mobile and landline numbers, IBANs and common address patterns
- A named entity model fine-tuned to find person names and places in Urdu script, Roman Urdu and English
- Reversible pseudonymisation: consistent placeholders inside a conversation, with real values restored in the reply on the user's machine
- A local proxy or browser extension that applies redaction before text is sent to a chosen AI tool
- A labelled evaluation set of synthetic but realistic messages, letters and case notes in the three scripts
- Recall and precision per entity type, and a check of how much redaction harms the usefulness of the AI's answer
- A short privacy note explaining what is and is not protected
If you have time left
- Detecting indirect identifiers, such as a rare job title plus a small town
- Redaction for uploaded PDFs and images through OCR
- An admin policy file that sets which entity types to remove for each team
- A small model that runs fully in the browser
The problem: customer data pasted into chat assistants
A receptionist summarises a patient's complaint. A lawyer's clerk asks an AI tool to draft a letter from case notes. An HR officer pastes a CV and a salary. Across Pakistan, staff at small organisations now use cloud AI tools for daily writing, and the text they paste often contains names, CNIC numbers, phone numbers, account details and addresses. Most of these organisations have no data protection officer and no approved tool list.
Banning the tools does not work; people use them on their phones. A better answer is to strip personal data out before it leaves the machine, while keeping the text useful.
What already exists and the gap
- Microsoft Presidio is an open source framework for finding and anonymising personal data, with recognisers for common entities, support for English and some other languages, and a way to add custom recognisers.
- Enterprise data loss prevention tools block or mask sensitive data, usually priced and configured for large companies.
- AI gateways can call Presidio as a guardrail.
What is missing is coverage for the data that actually appears in Pakistani text: CNIC numbers in their usual formats, local phone numbers, IBANs, Urdu-script names and the same names spelt many ways in Roman Urdu. The gap is a tested, local redaction layer for these, with placeholders that can be reversed so the answer still makes sense to the user.
Inspiration
"The Text Anonymization Benchmark (TAB): A Dedicated Corpus and Evaluation Framework for Text Anonymization" by Ildikó Pilán, Pierre Lison and colleagues, published in Computational Linguistics in 2022, argued that anonymisation must be judged by whether a person can still be identified, not only by whether named entities were tagged, and proposed evaluation metrics to match. Your project borrows that view of evaluation for Urdu and Roman Urdu text.
What you build
- Office staff use their usual AI tool; names become placeholders such as PERSON_1 before sending, and come back as real names in the reply on their screen.
- Owners and managers set which data types are always removed.
- Developers can call the same redaction service from their own applications.
Before anything is sent, the user sees the redacted text with placeholders highlighted and can add or remove a redaction with a click. That review step matters: it catches misses, teaches users what the tool does and gives you real feedback on where the model fails. The tool should run without an internet connection of its own, since sending the text to yet another server for checking would defeat the purpose.
The technically interesting part
- Three scripts, one person. "Muhammad Ali", "محمد علی" and "M. Ali" in one email are the same person and should get the same placeholder. Linking them is a real entity resolution problem.
- Rules plus learning. CNICs, phones and IBANs suit pattern rules with checks. Names and places need a learned model. Combining them without double counting is fiddly.
- Reversibility, safely. The mapping from placeholders to real values must stay on the user's machine and expire, or you have built a new leak.
- Utility. Over-redaction makes answers useless. Measure both sides: how much personal data still leaks, and how much the AI's answer degrades.
How to evaluate it
- Recall per entity type, especially for names in Roman Urdu, where misses are most likely.
- Precision, so ordinary words are not replaced.
- Re-identification test: give redacted texts to teammates who did not write them and record whether they can identify the person.
- Answer quality: compare AI answers on original and redacted prompts with a simple rubric.
- Latency added per request.
Suggested plan
- Weeks 1 to 3: read the TAB paper, install Presidio, write synthetic test messages.
- Weeks 4 to 7: rule recognisers and the fine-tuned name model.
- Weeks 8 to 10: placeholder linking, reversibility and the proxy or extension.
- Weeks 11 to 13: evaluation and a short pilot in one office.
- Weeks 14 to 15: report and demo.
Path to a product
Data protection expectations are rising, and every organisation using AI tools has this problem. A local tool for small offices, with a paid policy dashboard, is realistic; so is contributing the recognisers back to Presidio. The project builds skills that privacy, security and AI engineering teams value.
Scope warning
Never use real customer data for training or testing; write synthetic data. Do not claim the tool makes data anonymous; it reduces exposure. Start with text only. Keep the placeholder mapping on the device and say clearly what happens if the user pastes data somewhere the tool does not cover.
Learn what you need on Sefism
- AI engineering roadmap: guardrails and the request path to model APIs.
- Cybersecurity roadmap: data protection basics and threat thinking.
- OWASP Top 10 for LLM Applications: sensitive data disclosure and related risks.
- Hugging Face Transformers Documentation: fine-tuning the name model.
- spaCy Documentation: NER pipelines that Presidio can use.
Get help with this idea
The risk is weak recall on Roman Urdu names, which is exactly where leaks happen. Tauseef can help you design the synthetic data, the evaluation and the pilot. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.