Protecting data before an AI prompt costs output quality — but how much depends entirely on the method. Censoring/redaction retains only ~37% of baseline AI writing quality and random substitution/tokenization ~32%, because they remove the context the model reasons from. Meaning-preserving cloaks retain far more: sequential cloaking 91–93% and semantic cloaking 94–98% (Tremblay & Harricharan, 2026). The principle isn't the cost — the method is.
The question nobody answers
Every "how to use AI safely" article ends the same way: de-identify the data before you prompt. It's good advice. But it quietly assumes the cost is zero — and it isn't. Removing information from a prompt changes what the model can do with it, and how much it changes depends on how you remove it. That cost has rarely been measured. This is the measurement.
The numbers
A controlled benchmark compared four ways of protecting confidential values before an AI writes, scoring the writing quality retained against an uncensored baseline:
| Method | What the model receives | Retained AI writing quality |
|---|---|---|
| Censoring / redaction | [REDACTED] or blanks — information removed | ~37% of baseline |
| Substitution / crypto-tokens | Opaque tokens (x7Qk) — no meaning | ~32% of baseline |
| Sequential cloaking (SLC) | Position-aware markers the model can reference | 91–93% of baseline |
| Semantic cloaking (SSA) | Markers encoding each value's meaning + position | 94–98% of baseline |
Meaning-preserving cloaks retain roughly 95% of AI writing quality; removing or opaquely replacing information keeps only about a third (≈32–37%).
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access: Censorship, Substitution, and Sequential and Semantic Cloaking,” Zenodo, doi:10.5281/zenodo.21343321. Composite writing-quality index, 30 tests per technique, rebalanced out of a 97% baseline.
The gap is not marginal — it is the difference between an AI that drafts a usable value dossier and one that stalls or hallucinates. Protect the data the wrong way and you keep the compliance but lose almost two-thirds of the productivity you adopted AI for.
Why the method decides the cost
A language model reasons from context. When you redact — "[REDACTED] undercuts [REDACTED] by [REDACTED]" — you delete the very context it reasons from, so it stalls or invents. Opaque tokenization is no better: the model treats x7Qk as a real word and writes nonsense around it. Both protect the value by destroying the meaning.
Cloaking protects the value and keeps the meaning. A name becomes a stable identifier the model can track; a price becomes a semantic flag conveying its strategic role; a response rate becomes a sequential flag the model references in context — all without the real values ever being transmitted. The model reasons fluently; the secrets never leave the user's device. (See Semantic Cloaking, Explained for the mechanism.)
How it was measured
- A composite writing-quality index scoring AI-generated HEOR and market-access text.
- 30 tests per technique, across censoring, substitution, and sequential/semantic cloaking.
- Scores rebalanced out of a 97% baseline (uncensored text is not itself perfect).
- Full method and results: Tremblay & Harricharan (2026), Zenodo, doi:10.5281/zenodo.21343321.
What this means for you
"De-identify before you prompt" is only half an instruction. The half that matters is which method — because censoring and tokenizing hand back a fraction of the AI's ability, while meaning-preserving cloaking keeps almost all of it. If a tool protects your data by blanking or scrambling it, expect to lose most of the output quality. If it cloaks while preserving meaning, you keep both the protection and the work.
Frequently asked questions
How much AI output quality do you lose when you de-identify data before a prompt?
It depends entirely on the method. Removing or opaquely replacing information — censoring/redaction and random substitution/tokenization — collapses quality to roughly a third of baseline (about 37% and 32% respectively). Methods that hide the value but keep its meaning — sequential and semantic cloaking — retain 91–98% of baseline writing quality (Tremblay & Harricharan, 2026).
Why does redaction hurt AI output so much?
Because a language model reasons from context, and redaction removes the context. Replacing values with [REDACTED] or opaque tokens (x7Qk) leaves the model with nothing to reason about, so it stalls, hedges, or invents — and the writing quality drops by roughly two-thirds.
Does any de-identification method keep AI quality high?
Yes: cloaking that preserves meaning. Sequential cloaking (SLC) retained 91–93% of baseline quality and semantic cloaking (SSA) 94–98% in a controlled benchmark, because the cloaks encode each value's role and position so the model can still reason — while the real value is never transmitted.
Is the ~95% figure published?
Yes. It comes from Tremblay & Harricharan (2026), a preprint on Zenodo (doi:10.5281/zenodo.21343321) comparing censorship, substitution, and sequential/semantic cloaking on AI writing quality in HEOR and market access, using a composite writing-quality index across 30 tests per technique.
Work with AI on data you can't share with it.
Untraceable cloaks confidential values on your computer before any AI model sees the text — the model never receives the secret at all.