Securing AI Systems · Topic 4 of 7
Encryption and Data Safety Controls for AI
Protect AI data with encryption in transit, at rest and in use, plus anonymization, classification labels, redaction, masking and data minimization.
- 5 min
- In transit means TLS, at rest means AES with managed keys, in use means confidential computing in a TEE.
- Anonymization is irreversible; pseudonymization and tokenization can be reversed with a protected key.
- Redaction removes the value; masking hides it while keeping the format.
What it is
Artificial intelligence (AI) systems move large amounts of data: training sets, retrieved documents, prompts, responses and logs. Data security controls protect that data with encryption and reduce what is exposed with data safety techniques.
The two work together. Encryption stops outsiders reading data, and data safety controls make sure that even authorised systems, including the model, see only what they need.
How it works
Encryption requirements
| State | Where it applies in AI | Typical control |
|---|---|---|
| In transit | Prompts to the gateway, calls to model services, data moving into training clusters, agent tool calls | Transport Layer Security (TLS) 1.2 or later, mutual TLS between services |
| At rest | Training data stores, model weights, vector stores, prompt and response logs, backups | Advanced Encryption Standard (AES) 256 with keys in a key management service (KMS) or hardware security module (HSM) |
| In use | Data and model weights in memory while training or answering | Confidential computing in a trusted execution environment (TEE) |
Encryption in use is the newest of the three. A TEE is a hardware-isolated area of the processor that keeps data and code encrypted or isolated in memory, even from the host administrator, which matters when a model runs on shared cloud hardware.
Homomorphic encryption, which computes on data while it stays encrypted, is another in-use technique. It is far slower than normal processing, so it suits narrow tasks rather than running large models.
Data safety techniques
| Technique | What it does | Reversible? | Example |
|---|---|---|---|
| Data anonymization | Removes or transforms identifiers so a person cannot be identified, even with other data | No | Replacing names and exact ages with age bands before training |
| Data classification labels | Tags data by sensitivity, such as public, internal, confidential or restricted | Not applicable | Only data labelled public or internal may be sent to an external model |
| Data redaction | Removes sensitive content entirely, often replacing it with a marker | No | "Call [REDACTED] about the invoice" |
| Data masking | Hides part or all of a value with substitute characters while keeping its format | Static masking no; dynamic masking shows the real value to authorised users | Card number shown as ****-****-****-4821 |
| Data minimization | Collects, keeps and sends only the data the purpose needs | Not applicable | The support bot receives an order number, not the customer's full profile |
Pseudonymization and tokenization are related. They replace identifiers with a consistent substitute that can be mapped back with a separately protected key or vault, so they are reversible and the data is still personal data under most privacy laws.
Where to apply them in an AI system
- Before training or fine-tuning: minimise and anonymise. A model can memorise and repeat what it was trained on, and you cannot easily remove it later.
- Before indexing for retrieval-augmented generation (RAG): classify documents and carry the labels into the vector store.
- In the prompt path: redact or mask sensitive values before they leave for an external model.
- In the response path: redact sensitive data the model may have retrieved or generated.
- In logs: mask or redact secrets and personal data before storing prompts and responses.
A redaction step in pseudo-config
# illustrative, not a real product syntax
prompt_filter:
detect: [email_address, phone_number, payment_card, national_id]
action:
payment_card: mask_keep_last_4
national_id: redact
email_address: redact
block_if_label: [restricted]A worked example
An insurer wants to fine-tune a model on claim notes to speed up assessments. The notes contain names, addresses, medical details and bank accounts.
The team classifies the notes, minimises the data set to the fields the task needs, anonymises names and addresses, and redacts bank details. The prepared set is stored encrypted at rest with keys in the KMS, moved to the training cluster over TLS, and training runs in confidential computing instances.
How the exam asks about this
- "A company must stop the cloud host operator from reading model weights and data while inference is running. Which of the following meets this requirement?" Encryption in use through confidential computing in a trusted execution environment.
- "Support agents must see only the last four digits of a customer's card number in AI-generated summaries. Which of the following techniques should be used?" Data masking.
- "A team wants to train a model only on the fields required for its task and discard the rest. Which of the following principles is this?" Data minimization.
What to remember for the exam
- In transit means TLS, at rest means AES with managed keys, in use means confidential computing in a TEE.
- Anonymization is irreversible; pseudonymization and tokenization can be reversed with a protected key.
- Redaction removes the value; masking hides it while keeping the format.
- Classification labels decide which data may reach which model, especially external ones.
- Minimise and anonymise before training, because a model can memorise and repeat its training data.
Data that reaches a model's training set is very hard to take back out. Apply minimization, anonymization and redaction before training, not after a leak.
Common mistakes
Calling tokenized data anonymous. Tokenization can be reversed by whoever holds the vault, so the data remains personal data.
Encrypting storage but logging prompts in clear text. Prompt and response logs often hold the most sensitive data in the system. Sanitise and encrypt them too.
Confusing masking with redaction. Masking leaves a partial or formatted value, such as the last four digits; redaction removes it completely.
Check yourself
Which encryption state does confidential computing protect?
Data in use, while it is in memory being processed, using a trusted execution environment.
What is the difference between anonymization and pseudonymization?
Anonymization cannot be reversed, while pseudonymization replaces identifiers with substitutes that can be mapped back using a protected key.
Why should data be minimised before fine-tuning a model?
The model may memorise and later reveal training data, so leaving out unneeded sensitive fields removes that risk.
Topic 4 of 7 in Securing AI Systems
Test yourself on Securing AI Systems
The full CompTIA SecAI+ CY0-001 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.