“Use homomorphic encryption to enable secure data analysis and privacy-preserving machine learning. This ensures data remains confidential while being processed by the model.”

“Implement tokenization to preprocess and sanitize sensitive information. Techniques like pattern matching can detect and redact confidential content before processing.”

The poem attack (Slide 13) extracted raw, plaintext training data — names, emails, phone numbers — because none of it had been tokenized or redacted before training. Pattern-matching redaction at ingestion would have replaced that PII with placeholders the model could never regurgitate verbatim.

→ Use pattern-matching redaction (regex, NER-based PII detectors) to strip or tokenize sensitive fields before any text enters a training or fine-tuning pipeline
→ Reserve homomorphic encryption for the highest-sensitivity use cases — it's computationally expensive, so apply it where the data justifies the cost
→ Treat tokenization as reversible-by-design only for authorized systems; the model itself should never see the detokenized value

Search your training or fine-tuning dataset for patterns that look like emails, phone numbers, or SSNs before training starts — not after a researcher proves the model memorized them.