ScrubLocally local · no upload

The placeholder round trip: keeping an AI answer usable after redaction

Published 2026-07-29

The reason people stop redacting prompts is not principle, it is friction. You scrub a document, paste it, get a useful answer back — and then spend five minutes retyping real names into the model’s reply. Do that twice and you quietly go back to pasting the raw text.

The round trip removes that friction. Scrub, ask, paste the answer back, get every real value restored in one click. Here is how to make it work reliably.

Step 1: pick a replacement style that fits the task

Four styles, two of them reversible.

Numbered tokens ([NAME_1], [CARD_2]) are the default and the best choice for analysis, classification, summarising and debugging. They are visually obvious, so you can confirm at a glance that nothing real remains, and they are trivially reversible.

Realistic fake values (“Jordan Blake”, person1@example.com, (555) 555-0102) are better when the model has to write something. Ask for a letter about [NAME_1] and you may get a letter addressed to “[NAME_1]”; ask for a letter about Jordan Blake and you get natural prose you can restore afterwards. The fake phone numbers come from the 555-0100 to 555-0199 block that NANPA reserves for fictitious use, so a stand-in can never ring a real person.

Blocks and delete are one-way. Use them when the output is going to a human, not a model.

Step 2: keep the tab open

The mapping between placeholders and real values lives in the page. Close the tab and it is gone — which is the security property you are paying for, and also the thing that will bite you if you scrub in the morning and paste the answer back in the afternoon.

If you need to restore later, use Save key file before you close. That file is the mapping in plain JSON: it undoes the entire redaction, so treat it exactly like a password. Store it where you would store a credential, and delete it when the task is done.

Step 3: tell the model about the placeholders

One sentence at the top of your prompt prevents most problems:

The text below has been redacted. Values in square brackets like [NAME_1] are placeholders for real data. Keep them exactly as written in your answer, and do not invent replacements for them.

This does three things. It stops the model helpfully “filling in” a plausible name. It stops it asking you what [NAME_1] means. And it makes the placeholders survive into the answer, which is what the restore step needs.

Step 4: what models actually do to placeholders

In practice, models handle bracketed tokens well — but they reformat them. Expect all of these:

The restore step here is tolerant of all of them: it matches the token body case-insensitively, with or without brackets, and with a space or hyphen where the underscore was. Possessives are untouched, so [NAME_1]'s correctly becomes Sarah Chen's.

What it cannot fix is a placeholder the model deleted or paraphrased away (“the customer” instead of [NAME_1]). When that happens the restore step tells you which placeholders never appeared, so you know to re-read that paragraph rather than assuming it came back complete.

Step 5: restore, then read

Paste the model’s answer into step 3 of the tool and every placeholder becomes the value it stood for. The status line tells you how many were restored and which, if any, were missing.

Then read it. Not because the substitution is unreliable — it is exact string replacement — but because this is your last look at the text before it goes to a client, a patient or a colleague, and the model may have said something that was fine about [NAME_1] and is not fine about a named person.

Things that make the round trip work better

Scrub once, ask several times. The mapping is stable while the tab is open, so you can run four follow-up prompts against the same redacted document and restore each answer with the same mapping.

Keep the values the model genuinely needs. Your own company name, a product name, a public statute — put them on the never-redact list. Over-redaction produces vague answers, and vague answers are why people abandon the workflow.

Add what the detectors cannot know. Codenames, unusual surnames, internal system names go in custom terms. This is where most of the real coverage comes from on documents that matter.

Choose fake values for drafting, tokens for analysis. The single highest-value habit here.

Do not paste the key file into the chat. It sounds absurd, but the failure mode exists: someone asks the model to “use this mapping to make the answer readable”. That hands over everything you just protected.

A worked example

Original:

Sarah Chen at Northwind Trading Ltd wants a refund on card 4111 1111 1111 1111. Reach her at s.chen@example.com or (415) 555-2671.

Scrubbed with tokens:

[NAME_1] at [COMPANY_1] wants a refund on card [CARD_1]. Reach her at [EMAIL_1] or [PHONE_1].

Ask a model to draft a reply and it will write about [NAME_1] at [COMPANY_1] without hesitation. Paste the reply back and you get a letter addressed to Sarah Chen at Northwind Trading Ltd, with the real contact details in place — and the model never saw any of them.

That is the whole workflow. It takes about fifteen seconds once, and roughly two after that. Try it on the main tool.

Use the tool