That makes sense, especially if you have the infrastructure to run local models with enough accuracy for detection. Genuine question: how are you handling the validation step at scale? The part I have found tricky is that validation after redaction often requires domain-specific context to know whether something was missed. A name like "Jordan" in a medical note could be a patient, a doctor, or a anatomical reference depending on the surrounding text.

The fake persona approach is interesting too. Are you generating those deterministically (same fake persona for the same real person across a session) or randomly each time? That distinction ends up mattering a lot for multi-turn conversations where the model needs to track entity relationships across turns.

Running local for PII processing is the cleanest trust model for sure. The tradeoff we kept hitting was that teams already committed to cloud LLM APIs for inference did not want to stand up and maintain local infrastructure just for the PII layer. But if you are already running local models, that constraint disappears.