A city tree-removal permit desk replaces real owner names and parcel IDs with tokens before asking an LLM for boundary-related test data. Which mitigation strategy is being applied?
Select an answer to reveal the explanation.
Short Explanation
Swapping “Maria Lopez / Parcel 44-A” for tokens is like putting alias tags on museum pieces. The boundary data stays useful for testing, but real people are not exposed. That is anonymization and pseudonymization—not model comparison or energy thrift.
Full Explanation
Tree-removal permit desks that replace owner names and parcel IDs with tokens before asking an LLM for boundary-related test data are applying data anonymization and pseudonymization of identifiers in test inputs. Boundary geometry remains useful; real people are not exposed.
Comparing outputs across two LLMs fails by concept: that is a detection/mitigation for output quality, not identifier protection. Limiting model interactions for energy savings fails because energy practice is a different control family. Installing the LLM on municipal infrastructure for custody fails because hosting location alone is not anonymization of the identifiers in the prompt.
Exam caveat: pseudonymization reduces identification risk but may remain personal data under some regimes if re-identification is feasible—still far better than raw names in public prompts.
Operational check: maintain a secure token map offline from the LLM; feed only tokens into generation; verify that outputs do not reverse-identify owners; rotate tokens for public demos of the tree-permit pack. Tree-removal token maps must remain offline from the model vendor, with periodic checks that generated boundary cases never echo real owner names or raw parcel IDs.