Skip to content
JavaAgentic

Type at least two characters. Try “RAG”, “pgvector” or “tool calling”.

Federated Learning & Privacy-Preserving AI

Privacy-preserving AI techniques for engineers: federated learning, differential privacy, PII redaction, secure processing and the practical patterns for handling sensitive data with LLMs.

Expert5 min readUpdated
On this page

Handling sensitive data with AI raises real privacy obligations, and there is a spectrum of techniques from everyday practices to specialised methods. This tutorial covers both: the practical PII discipline every application team needs, and the advanced techniques — federated learning, differential privacy — for the specific situations that call for them.

Key Takeaways

  • For most teams, privacy means practical discipline: redact PII, keep it out of prompts and logs, use compliant models and regions, minimise retention.
  • Federated learning trains across distributed data without centralising it.
  • Differential privacy gives a provable guarantee that individuals cannot be identified from output.
  • The advanced techniques are for specific situations — not everyday application patterns.

Start with the practical

Before the specialised techniques, the everyday discipline that covers most application needs.

PII redaction

Remove or tokenise personal data before it reaches the model where the use case allows:

Redaction before the model
public String process(String input) {
    // Replace personal data with tokens before it enters the prompt.
    RedactionResult redacted = redactor.redact(input);   // emails, cards, names, IDs
 
    String response = chatClient.prompt().user(redacted.text()).call().content();
 
    // Restore tokens in the response if needed, mapping back locally.
    return redacted.restore(response);
}

Combine a pattern-based pass with a proper PII-detection library for regulated content. See security in AI-powered Spring applications.

Keep PII out of prompts and logs

Use compliant models and regions

For regulated data, use local models so data never leaves your infrastructure, or in-region cloud models that meet your residency requirements. Match the processing location to the data's legal constraints.

Minimise retention

Keep sensitive data — including prompts, responses and any derived memory — only as long as needed, with a clear retention policy and deletion on request. An agent memory system that silently accumulates personal data forever is a privacy liability.

Federated learning

For the specific situation of training a model across sensitive data distributed on many devices or servers — without centralising it:

Federated learning: each participant trains locally and shares only model updates, never the raw data.

Each participant trains on its own data; only the model updates — not the data — are shared and aggregated. The classic use is learning from data on users' phones (predictive text, on-device features) while the raw data never leaves the device. It is a specialised technique, most relevant when you both train models and cannot centralise the training data.

Differential privacy

A mathematical guarantee: add calibrated noise so that the presence or absence of any single individual cannot be determined from the output, while aggregate patterns survive. It is used when you need to publish or derive insights from sensitive data with a provable privacy bound — analytics on sensitive datasets, training data protection.

The key idea for an engineer: differential privacy trades a measurable amount of accuracy for a measurable privacy guarantee, and the trade is tunable. It is powerful and specialised — you reach for it when you need a provable guarantee, not merely good practice.

Secure multi-party computation and confidential computing

Two more specialised tools worth knowing exist:

  • Secure multi-party computation lets parties jointly compute over their combined data without any party seeing the others' data — for rare cases where multiple organisations must compute together on data none will share.
  • Confidential computing processes data in hardware-encrypted enclaves, so even the infrastructure operator cannot see it — for the highest-sensitivity workloads.

Both are niche; most teams will never need them, but knowing they exist helps you recognise the situation that calls for one.

Matching technique to need

NeedTechnique
Everyday sensitive data in an LLM appPII redaction, compliant models, minimise retention
Data cannot leave the deviceLocal models, or federated learning if training
Provable guarantee no individual is identifiableDifferential privacy
Multiple orgs compute without sharing dataSecure multi-party computation
Infrastructure operator must not see dataConfidential computing

Next

Frequently Asked Questions

What is federated learning?
A training approach where a model is trained across many devices or servers holding local data, without that data ever being centralised — each participant trains on its own data and only model updates, not the data, are shared and aggregated. It lets a model learn from sensitive distributed data (like data on users' phones) while the raw data stays where it is.
What is differential privacy?
A mathematical framework that adds carefully calibrated noise to data or results so that the presence or absence of any single individual cannot be determined from the output, while aggregate patterns remain useful. It gives a provable privacy guarantee, used when you need to derive insights from sensitive data without exposing any individual.
What are the practical privacy techniques for LLM applications?
For most application teams, the practical techniques are PII redaction before data reaches the model, keeping sensitive data out of prompts and logs, using local or in-region models for regulated data, scoping access strictly, and minimising data retention. Federated learning and differential privacy are specialised techniques for specific situations, not everyday application patterns.
How do I handle PII when using an LLM?
Redact or tokenise personal data before it enters a prompt where the use case allows, keep it out of logs, use models and regions that meet your compliance requirements, and minimise what you send and retain. Treat every prompt and response as potentially containing personal data, and apply the same care you would to any system processing PII.

Related tutorials