LLM Judge Privacy

The Separate Exposure Surface

An LLM judge is a language model used to grade another system’s output. In Al Chen’s example, the judge returns a score and an explanation. If it reads raw traces, its generated explanation can repeat personally identifiable information (PII) or material nonpublic information (MNPI), even when the main user interface appears redacted (10:07-11:40). This is re-exposure from sensitive context, not demonstrated recovery of information that was irreversibly removed. Source: Shipping AI Into Banks

This makes evaluation outputs part of LLM Observability and AI Security, not an automatically safe monitoring layer. Include the judge’s input, generated explanation, persistence, and viewer permissions in Threat Modeling; this is a synthesis of the example, not a reported audit checklist. Source: Shipping AI Into Banks

Proposed Controls And Limits

Control In The Talk	Intended Benefit	Limit
Keep the score without persisting the explanation	Preserve evaluation results with less sensitive output	All storage and telemetry behavior is not specified
Conditionally suppress explanations when sensitive data is present	Reduce exposure in the UI	Hiding output is not equivalent to preventing storage
Use a second judge with redacted input	Provide a displayable explanation	Redaction accuracy and agreement with the raw-input judge are not established

Chen describes these options at 11:41-12:48. The explanation here means generated evaluator text, not access to hidden model reasoning. The talk provides no measured leakage rate or proof that the controls eliminate exposure. Source: Shipping AI Into Banks

Cost And Sovereignty

The second judge adds another LLM call to the evaluation flow; the talk provides no monetary or latency measurement (12:50-13:02). It does not establish hosting location, so redaction alone is not evidence of data sovereignty. In Enterprise AI Deployment, treat privacy, cost, and residency as related but distinct review questions. Source: Shipping AI Into Banks