Protecting data before an AI prompt costs output quality, there is no denying that, but how much depends entirely on the method. Censoring/redaction retains, on average, only ~37% of baseline AI writing quality and random substitution/tokenization ~32%, because they remove the context the model reasons from. Meaning-preserving cloaks retain far more: rapid cloaking (sequential) 91–93% and advanced cloaking (semantic) 94–98% (Tremblay & Harricharan, 2026). The principle is not the cost. The method is.
The question nobody answers
Every "how to use AI safely" article ends the same way: de-identify the data before you prompt. It's good advice for sure, but it quietly assumes the cost is zero, and it certainly isn't. Removing information from a prompt changes what the model can do with it, and how much it changes depends on how you remove it. That cost has rarely been measured, but we know experts and professionals try to avoid traditional redaction, so there must be a reason. This is the measurement.
The numbers
A controlled benchmark compared four ways of protecting confidential values before an AI writes, scoring the writing quality retained against an uncensored baseline:
| Method | What the model receives | Retained AI writing quality |
|---|---|---|
| Censoring / redaction | [REDACTED] or blanks. The information is removed. | ~37% of baseline |
| Substitution / crypto-tokens | Opaque tokens (x7Qk). No meaning is preserved. | ~32% of baseline |
| Rapid cloaking (SLC), also called sequential | Position-aware markers the model can reference, identify the repetition of, and contextualise using occurrence and location. | 91–93% of baseline |
| Advanced cloaking (SSA), also called semantic | Markers encoding each value's meaning and position. | 94–98% of baseline |
Rapid and advanced are the product's names for the two methods. The patent documents call them sequential and semantic cloaking.
Meaning-preserving cloaks retain roughly 95% of baseline AI writing quality; removing or opaquely replacing information keeps only about a third (≈32–37%).
Source: Tremblay & Harricharan (2026), “Comparing De-identification Methods on AI Writing Quality in HEOR and Market Access: Censorship, Substitution, and Sequential and Semantic Cloaking,” Zenodo, doi:10.5281/zenodo.21343321. Composite writing-quality index, 30 tests per technique, rebalanced out of the study’s 96/100 baseline.
Where the ~37% and ~32% figures come from, and how firm they are.
The gap is not marginal, and it is the difference between an AI that drafts a usable value dossier and one that stalls or hallucinates. Protect the data the wrong way and you keep the compliance but lose almost two-thirds of the productivity you adopted AI for.
There is a second cost, and it is the one that actually hurts. A mistake in a regulated document, a dossier or an economic analysis, will cost you your client's trust and possibly a failed submission. So you end up validating and reviewing every single word, several times per project, which can eat a good part of the productivity you were trying to gain. Not being able to trust the AI is exactly like not being able to trust a colleague, and that is something we dread as consultants.
Why the method decides the cost
A language model reasons from context. When you redact, "[REDACTED] undercuts [REDACTED] by [REDACTED]", you delete the very context it reasons from, so it stalls or invents. Opaque tokenization is no better: the model treats x7Qk as a real word and writes nonsense around it. Both protect the value by destroying the meaning.
Cloaking protects the value and keeps the meaning. A name becomes a stable identifier the model can track; a price becomes a semantic flag conveying its strategic role; a response rate becomes a sequential flag the model references in context. All of this happens without the real values ever being transmitted. The model reasons fluently and the secrets never leave the user's device. (See Semantic Cloaking, Explained for the mechanism.)
How it was measured
- A composite writing-quality index scoring AI-generated HEOR and market-access text.
- 30 tests per technique, across censoring, substitution, and sequential/semantic cloaking.
- Scores rebalanced out of the study’s 96/100 baseline (uncensored text is not itself perfect).
- Full method and results: Tremblay & Harricharan (2026), Zenodo, doi:10.5281/zenodo.21343321.
What this means for you
"De-identify before you prompt" is only half an instruction. The half that matters is which method, since censoring and tokenizing hand back a fraction of the AI's ability, while meaning-preserving cloaking keeps almost all of it. If a tool protects your data by blanking or scrambling it, expect to lose most of the output quality. If it cloaks while preserving meaning, you keep both the protection and the work.
Frequently asked questions
How much AI output quality do you lose when you de-identify data before a prompt?
It depends entirely on the method. Removing or opaquely replacing information, censoring/redaction and random substitution/tokenization, collapses quality to roughly a third of baseline (about 37% and 32% respectively). Methods that hide the value but keep its meaning, rapid (sequential) and advanced (semantic) cloaking, retain 91–98% of baseline writing quality (Tremblay & Harricharan, 2026).
Why does redaction hurt AI output so much?
Because a language model reasons from context, and redaction removes the context. Replacing values with [REDACTED] or opaque tokens (x7Qk) leaves the model with nothing to reason about, so it stalls, hedges, or invents, and the writing quality will drop by roughly two-thirds.
Does any de-identification method keep AI quality high?
Yes: cloaking that preserves meaning. Rapid cloaking (SLC) retained 91–93% of baseline quality and advanced cloaking (SSA) 94–98% in a controlled benchmark, because the cloaks encode each value's role and position so the model can still reason, while the real value is never transmitted.
Is the ~95% figure published?
Yes. It comes from Tremblay & Harricharan (2026), a preprint on Zenodo (doi:10.5281/zenodo.21343321) comparing censorship, substitution, and sequential/semantic cloaking on AI writing quality in HEOR and market access, using a composite writing-quality index across 30 tests per technique.
About the author
Gabriel Tremblay, DBA, Founder & CEO, Untraceable. Gabriel holds a doctorate in business administration (DBA) specialising in decision-making, and has published health economics and outcomes research on de-identification, cloaking methods and AI writing quality. Publications and DOIs are listed on the publications page.
This guide is general information about how AI tools interact with confidentiality obligations. It is not legal advice, and it does not create any professional relationship. Confidentiality agreements vary, so review your own agreements with qualified counsel before relying on any framework described here.
Work with AI on data you can't share with it.
Untraceable cloaks confidential values on your computer before any AI model sees the text. The model never receives the secret at all.