Putting the original values back after an AI answers
How to protect a file, get an answer from an AI assistant, and turn the stand-ins in that answer back into the real names and values on your own computer. Covers what can be restored, what cannot, and what goes wrong.
You protected a spreadsheet, sent it to an AI assistant, and received a useful answer: "PERSON_012 placed the most orders and PERSON_007 returned the most items." The answer is only useful to you if you know who PERSON_012 is. Restoring means turning the stand-ins in the answer back into the real values, on your own computer, without the assistant ever seeing them.
Key terms
- Restore
- replace the stand-ins in a text or file with the real values they stood for.
- Stand-in
- the value that replaced a real one in the protected copy, such as
PERSON_012. - Mapping
- the record of which stand-in replaced which real value. With it you can restore. Without it you cannot.
- Reversible
- a protection method whose result can be turned back into the original by someone who holds the mapping or the key.
- Key
- a secret used to encrypt values. Whoever holds the key can restore them.
How does the round trip work?
- Protect. Replace the sensitive values in your file with stand-ins that can be reversed. The mapping or key stays with you.
- Send. Share only the protected copy with the assistant.
- Receive. The assistant answers in terms of the stand-ins.
- Restore. Paste the answer, or load a file, into your restoring tool on your own computer. It swaps each stand-in for its real value.
The assistant never needs the mapping, and the mapping never needs to leave your computer.
Which protection methods can be restored?
Only the ones that keep a way back. The rest are one-way by design.
| Method | Can it be restored? | Why |
|---|---|---|
Stable pseudonym (PERSON_012) |
Yes | The mapping records each pair |
Reversible encryption (codes beginning DAENC1.) |
Yes | The key restores the original value |
| Keyed hash | No | A hash cannot be run backwards |
| Partial mask, redaction | No | The hidden part is gone from the output |
| Rounding, grouping, scaling | No | Detail was removed, and many values map to one result |
| Removal | No | The value is not in the protected copy |
So decide before you protect. If you will want real names in the answer, choose a reversible method for the name column. If you only need the assistant to count and group, a one-way method may be enough and leaves nothing to restore.
What can go wrong?
The assistant rewrites the stand-ins
Assistants often reformat text. PERSON_012 can come back as Person 012, person_012, PERSON-012, or **PERSON_012**. A restoring tool that looks for the exact text will miss the variants. Two defenses help:
- Ask the assistant in your prompt to repeat identifiers exactly as written, with no changes.
- After restoring, search the result for the pattern of your stand-ins (for example
PERSON_) to find any that remained.
The assistant invents or merges
An assistant may write about PERSON_012 and PERSON_021 as if they were one person, or make up a stand-in that is not in your file. Restoring cannot detect that. If a stand-in is not in your mapping, the restoring step leaves it alone, so check for leftovers.
The answer contains calculations on protected numbers
If you rounded or scaled amounts, the assistant's totals are totals of the changed numbers. Restoring text does not recalculate them. Treat the assistant's figures as approximate when the numbers were changed, and run the exact calculation yourself on the original.
The restored document is now sensitive
After restoring, the text contains real names and addresses again. Treat it as you treat the original file. Do not paste it back into an external tool, and store it where the original would be.
Where should the mapping or key be kept?
Restoring depends on it, and so does everyone else's ability to read your original. Two rules follow.
- Keep it away from what you share. The mapping and the protected file should not travel together. A mapping in the same email as the protected file defeats the protection.
- Keep a backup. If the mapping or the key is lost, the stand-ins cannot be turned back, and the answer you received cannot be decoded.
Lookup table or encryption: where is the secret?
With a lookup table, the secret is the table itself: a list of pairs such as PERSON_012 = Brenna Talvik. The stand-ins are arbitrary, so the file reveals nothing on its own, but you must store, protect, and back up a table that grows with your data.
With encryption, the secret is a key, and the stand-in is the encrypted value itself. There is no table to keep, and anyone holding the key can restore any value in any file made with it, including files you make later. The stand-in is longer and does not read as a name, so an assistant is less able to say anything about it. The code cannot be used in calculations.
Under the GDPR (Article 4(5)), pseudonymized data stays personal data when the additional information exists. The rule is that the information is kept separately and protected. Either way, the one place you must treat as sensitive is the mapping or the key.
Who can restore?
In the first version of DataAttendant, restoring is done by the person who protected the file, on the computer that holds the mapping or the key. A colleague who receives the assistant's answer cannot restore it unless they also hold the same mapping or key. Sharing it with a team is planned for a later version. Until then, either the person who protected the file restores the answer and passes on the result, or the key is shared by a route you decide and control.
What does DataAttendant do?
Restoring in DataAttendant follows three steps: your text or file, the matching copy, and the result. You paste the answer or load a file. DataAttendant finds the matching copy itself, among the protected copies whose keys this browser holds, and asks you to choose only if one stand-in stands for different originals in different copies. The tool restores the values that were protected with a stable pseudonym or with reversible encryption, shows the result, and marks the restored values so that you can see what changed. It can download the result as a file. Values that were hashed, masked, rounded, grouped, or removed cannot be restored, and it tells you so. The work happens in your browser, and the answer you paste is not sent to DataAttendant.
Sources
- Regulation (EU) 2016/679 (GDPR), Article 4(5): pseudonymization and the separate keeping of additional information.
- European Data Protection Board, Guidelines 01/2025 on Pseudonymisation (consultation version), on additional information and the pseudonymization domain. The EDPB website showed this consultation version on 28 October 2026.
- NIST, Special Publication 800-38G: methods for format-preserving encryption, for background on reversible encrypted values.