When to Use
- Frame privacy research questions for safeguard and moderation stacks
- Design PII detection/redaction benchmarks — precision/recall, re-identification risk
- Evaluate de-identification techniques (mask, tokenize, synthetic replace) on realistic prompts
- Study memorization and extraction — can models or logs leak user content?
- Curate privacy-sensitive datasets — synthetic data, consent boundaries, labeling rules
- Run ablations on detector architecture, threshold, or post-processing
- Define logging minimization — what safety systems may store vs must discard
- Write research memos with privacy–utility trade-offs and production recommendations
- Specify promotion criteria for privacy mitigations before prod rollout
When NOT to Use
- Audit evidence pipelines for GDPR/SOC 2 attestations →
compliance-engineer - Legal DPIA, acceptable-use policy, regulatory mapping →
ai-risk-governance - Harm categories, jailbreak benchmarks, toxic classifiers →
ml-research-engineer-safeguards - Deploy gateways, canaries, safety-path SLOs →
ml-infrastructure-engineer-safeguards - Red-team attack campaigns →
ai-redteam - Enterprise data governance architecture →
data-architect - Human-data platform product ethics (contributor labor) →
product-management-human-data-platform - General literature review unrelated to privacy in ML →
ai-researcher
Related skills
| Need | Skill |
|---|---|
| Safety classifier research | ml-research-engineer-safeguards |
| Safeguard production infra | ml-infrastructure-engineer-safeguards |
| AI governance and DPIA framing | ai-risk-governance |
| Compliance controls and evidence | compliance-engineer |
| Data classification and lineage | data-architect |
| Adversarial extraction testing | ai-redteam |
| General research methods | ai-researcher |
| Human-data platform privacy | product-management-human-data-platform |
| Release and incident ops | ai-lead-ops |
Core Workflows
1. Privacy research framing
Threat model, metrics, baselines.
See references/privacy_research_framing.md.
2. PII detection and redaction research
Detectors, redaction quality, evals.
See references/pii_detection_redaction_research.md.
3. Memorization and extraction
Leakage studies, attack surfaces.
See references/memorization_and_extraction.md.
4. Privacy benchmarks and datasets
Corpora, labeling, versioning.
See references/privacy_benchmarks_datasets.md.
5. Logging and retention minimization
Safety observability without over-collection.
See references/logging_retention_minimization.md.
6. Handoff to production
Promotion bar, monitoring hooks.
See references/privacy_to_production_handoff.md.
Outputs
- Threat model — assets, adversaries, failure modes for privacy in safeguards
- Benchmark spec — PII types, locales, adversarial variants
- Results table — detection/redaction metrics by slice (language, format)
- Leakage study report — methodology, findings, confidence
- Logging policy draft — fields allowed, TTL, access controls (engineering input to legal)
- Promotion recommendation — go/no-go with privacy–utility summary
Principles
- Minimize data — collect and retain only what eval and ops truly need
- Separate privacy from safety metrics — low PII leak rate is not interchangeable with low toxicity FN
- Locale and format matter — email in one language ≠ global PII detector
- Synthetic ≠ risk-free — synthetic PII can still encode patterns; document limits
- Legal review for human data — research plans involving real user content need governance sign-off