使用 Amazon Nova 自动脱敏图像中的个人身份信息（PII）

跨团队内部共享数据、对外与合作伙伴共享，或将其用于机器学习（ML）模型训练等工作负载，是现代业务运营的基础。然而，当这些数据包含个人身份信息（PII）时，企业将面临《通用数据保护条例》（GDPR）和支付卡行业数据安全标准（PCI DSS）等法规所规定的重大法律和合规义务。如果在共享或处理数据前未正确脱敏 PII，可能导致监管处罚、声誉损害和客户信任的丧失。

对真实世界图像数据集中的 PII 进行脱敏尤其具有挑战性。与结构化文本不同，图像中的 PII 可能以意想不到的位置和形式出现：画面边缘捕捉到的半张人脸、汽车抛光表面上的人脸倒影、结合其他视觉线索后可识别的部分可见路牌，或广角照片中桌上放着的文件，其中泄露了姓名、地址或身份证号。这些边缘情况常常让单一用途的掩蔽工具束手无策。

Amazon Nova 是一系列具备先进视觉理解能力的基础模型，使其成为复杂图像分析工作流中智能协调者的有力候选。Nova 能够整体解读图像内容，结合上下文推理某些内容是否构成 PII，包括前述细微和不寻常的情况，并从头到尾指导整个脱敏管道。通过理解 PII 的“什么”，Nova 协调专用工具，在脱敏过程中实现像素级精度，同时保留图像的整体价值。

在本文中，我们展示一个由 Amazon Nova 指导的多步骤管道，它利用上下文视觉推理来协调互补工具，包括 Meta 的开源 Segment Anything Model (SAM 3) 部署在 Amazon SageMaker AI 上进行像素级分割，以及 Amazon Textract 进行光学字符识别（OCR）。此管道旨在为指纹、身份证或任意方向的车牌等具有挑战性的边缘情况提供全面、合规的 PII 脱敏。

解决方案概述

本解决方案使用以下关键服务实现全面的 PII 脱敏：

Nova 2 Lite

Amazon Nova 2 Lite 是一种快速、经济高效的多模态基础模型，可处理文本、图像、视频和文档。该模型在 Amazon Bedrock 中可用，具有出色的性价比，可帮助企业和开发者构建功能强大、可靠且高效的应用程序。它充当本解决方案的核心协调者，协调整个 PII 检测和脱敏工作流，在每个阶段做出决策，并协调专用服务以实现全面结果。

Segment Anything Model (SAM 3)

SAM 3 是一个开源分割模型，可根据文本和视觉提示检测、分割和跟踪图像中的对象。在本解决方案中，SAM 3 作为由 Nova 指导的精密仪器。当 Nova 识别出视觉 PII 元素时，会将分割任务委托给 SAM 3，以生成用于脱敏的精确边界。

在模型演示场 (https://ai.meta.com/research/sam3/) 中，以单词 'flower' 提示时，SAM 3 分割掩码叠加在原始图像上。

Amazon Textract 是一项 ML 服务，可自动从 PDF、图像、表格和表单等格式中提取文本、手写内容、布局元素和数据。在此管道中，Amazon Textract 充当 Nova 的 OCR 能力。当 Nova 判断图像包含文本 PII 时，它将指示 Amazon Textract 提取所有文本内容及其坐标，然后 Nova 结合整个图像的上下文评估这些内容，以确定哪些构成敏感信息。

PII 检测

图像中常见的 PII 项目包括但不限于：

• 姓名。
• 识别号码，如驾照号码。
• 地址。
• 电话号码。
• 资产信息，如介质访问控制（MAC）地址。
• 财产识别号，如车辆识别号码（VIN）。
• 个人特征，如人脸图像。
• 生物识别数据，如指纹。

这些项目可分为两种模态：文本类（姓名、识别号码、地址、电话、资产信息和财产识别号）和视觉类（个人特征和生物识别数据）。

Nova 指导一个工作流，该工作流可访问两个子流程，分别识别文本或视觉 PII 项目的像素坐标。Nova 首先对图像进行初始评估，以确定存在哪些类型的 PII，然后智能地将图像路由到适当的子流程。随后，一个 AWS Lambda 函数根据 Nova 的指示，在识别出的坐标处遮盖内容。

此解决方案非常适合需要高脱敏准确度的一次性或批量图像预处理场景。Nova 2 Lite 出色的性价比、低延迟和先进的多模态推理能力使其非常适合协调此工作流，从而提供准确的 PII 脱敏，无需您的组织具备深厚的机器学习专业知识或微调专用模型。

先决条件

要跟随使用本解决方案，您应具备：

• 一个 AWS 账户。
• 熟悉 Amazon Bedrock、Amazon SageMaker AI、Amazon Simple Storage Service (Amazon S3)、AWS Lambda、AWS Step Functions、Amazon EventBridge 和 Amazon Textract。
• 在您的 AWS 区域中通过 Amazon Bedrock 访问 Nova 2 Lite。
• 在 SageMaker AI 上 部署 SAM 3。
• 具备 AWS 软件开发工具包（SDK）基础知识。
• 基本了解计算机视觉概念和图像处理。
• 熟悉基础模型和提示工程技巧。

请注意，此解决方案将产生 AWS 费用，包括：S3 存储、Lambda 调用、Step Functions 状态转换、SageMaker AI 端点托管、Amazon Bedrock API 调用和 Amazon Textract API 调用。在创建相应资源之前，请确保您了解所在 AWS 区域这些服务的定价。

解决方案架构

本节描述一个架构指南，其中 Nova 驱动图像处理工作流，并指导并行的文本和视觉分析以识别和脱敏敏感信息。

1. 文档上传与工作流触发

当您将图像上传到 S3 input/ 文件夹时，S3 事件通知会触发一条 EventBridge 规则，该规则将启动 AWS Step Functions 工作流。

2. 文件验证与初始 PII 筛查

工作流首先验证您上传的文件类型是否与 Amazon Bedrock 支持的图像格式兼容。验证后，Nova 2 Lite 对图像进行初始评估，充当第一道智能防线，判断是否存在 PII。如果 Nova 确定不存在 PII，工作流将提前退出，图像立即被移至 S3 noPII/ 文件夹，可供下游直接使用而无需进一步处理。大多数业务图像不包含 PII。Nova 做出的这一提前退出决策，在第一步也是最经济的一步就排除了大量图像。它通过避免不必要地调用下游服务（如 Amazon Textract 和 SageMaker AI 上的 SAM 3），显著降低了整体管道成本。

3. 并行 PII 检测：视觉流程

当 Nova 2 Lite 识别出潜在的 PII 时，它会按类型（文本、视觉或两者皆有）对检测到的 PII 进行分类，并为下游处理做出路由决策。根据 Nova 的分类，Step Functions 工作流选择性地调用一个或两个专门流程：如果 Nova 检测到文本 PII，则调用文本流程；如果 Nova 检测到视觉 PII，则调用视觉流程；如果 Nova 识别出两种类型，则并行调用两个流程。

视觉流程侧重于检测图像中的视觉 PII 元素，如人脸和车牌。在 Nova 的指导下，部署在 SageMaker AI 上的 SAM 3 被提示定位视觉 PII 元素并生成像素级分割掩码。分割掩码是一种像素级轮廓，在图像中勾勒出对象的精确形状。它将每个像素标记为属于该对象或不属于，类似于一个精准的数字模板。与简单的边界框（对象周围的粗略矩形）不同，分割掩码遵循检测项的真实轮廓，从而允许仅脱敏敏感像素，而不遮盖周围内容。这种由 Nova 初始 PII 分类引导的精细方法，有助于在仅移除敏感区域的同时保持图像价值。例如，在大型图像数据集上训练 ML 模型时，此方法有助于防止 PII 传递给模型，同时保留您的数据集规模和非敏感视觉信息。

4. 并行 PII 检测：文本流程

文本流程借助 Amazon Textract，利用 Nova 的多模态推理来分析嵌入图像中的文本。首先，Amazon Textract 识别图像中文本的像素级位置并提取其内容。它为每个检测到的文本元素提供轴对齐的边界框坐标和多边形坐标，您可以选择最适合脱敏需求的坐标类型。然后，Nova 2 Lite 结合原始图像评估每个提取的文本元素，以确定哪些包含 PII，如姓名、地址或身份证号。这正是 Nova 上下文智能的关键所在：某些文本元素在单独考虑时可能不像是 PII，但 Nova 能够结合图像中的周围视觉上下文进行推理，识别其敏感性质。例如，一个街道名称和一个街道号码分处两处，单独来看并不构成 PII，但因为它们出现在同一图像中，完整地址是可见的，应作为 PII 进行遮盖。作为多模态模型，Nova 能同时处理文本和图像，做出这些细微的 PII 判定。最后，Amazon Textract 返回 Nova 识别为 PII 的文本坐标，供下一步使用。

5. PII 脱敏与最终验证

在 Nova 的指导下完成子流程分析后，它们的坐标输出被传递到下一阶段进行脱敏。回顾一下，视觉流程的输出是来自 SAM 3 的分割掩码坐标，而文本流程的输出是来自 Amazon Textract 的边界框或多边形坐标。

一个 Lambda 函数将从各流程返回的坐标合并为图像上统一的 PII 位置集。然后，RedactPII Lambda 函数使用 Python 的 Pillow (PIL) 库遮盖原始图像中识别出的区域，并将脱敏后的图像存储在 S3 redacted/ 文件夹中。

作为最终的质量保证步骤，Nova 2 Lite 对脱敏后的图像进行全面审查，以判断是否已移除所有检测到的 PII。此最终验证利用 Nova 的整体视觉理解来发现任何残留的敏感内容。如果 Nova 判定图像是干净的，图像将被移至 S3 noPII/ 文件夹供下游使用。如果 Nova 仍然检测到 PII，图像将被移至隔离文件夹进行人工审核，旨在帮助防止 PII 遗漏。

6. 测试解决方案

要验证解决方案是否正确运行，请按照以下步骤

Sharing data internally across teams, externally with partners, or using it for workloads such as machine learning (ML) model training is fundamental to modern business operations. However, when that data contains Personally Identifiable Information (PII), organizations face significant legal and compliance obligations under regulations such as the General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCI DSS). If PII isn’t properly redacted before sharing or processing data, the result can be regulatory penalties, reputational damage, and erosion of customer trust.

PII redaction in real-world image datasets is particularly challenging. Unlike structured text, PII in images can appear in unexpected places and forms: a partial face captured at the edge of a frame, a face reflected on the polished surface of a car, a partially visible street sign that, combined with other visual cues, becomes identifiable, or a document lying on a desk in a wide-angle photo that reveals names, addresses, or ID numbers. These edge cases routinely defeat single-purpose masking tools.

Amazon Nova is a family of foundation models with advanced vision understanding capabilities, making it a strong candidate to serve as the intelligent coordinator for complex image analysis workflows. Nova interprets image content holistically, reasons about whether something constitutes PII in context, including the subtle and unusual cases described earlier, and directs the entire redaction pipeline from start to finish. By understanding the “what” of PII, Nova coordinates specialized tools to achieve pixel-level precision in redaction while preserving the overall value of the image.

In this post, we present a multi-step pipeline directed by Amazon Nova, which uses its contextual vision reasoning to coordinate complementary tools, including Meta’s open-source Segment Anything Model (SAM 3) deployed on Amazon SageMaker AI for pixel-level segmentation, and Amazon Textract for optical character recognition (OCR). This pipeline is designed to provide comprehensive and compliant PII redaction even for challenging edge cases such as fingerprints, ID cards, or license plates in arbitrary orientations.

Solution overview

This solution uses the following key services to achieve comprehensive PII redaction:

Nova 2 Lite

Amazon Nova 2 Lite is a fast, cost-effective multimodal foundation model that processes text, images, videos, and documents. Available in Amazon Bedrock, the model offers strong price-performance and helps enterprises and developers build capable, reliable, and efficient applications. It serves as the central coordinator of this solution, coordinating the entire PII detection and redaction workflow, making decisions at every stage, and coordinating specialized services to achieve comprehensive results.

Segment Anything Model (SAM 3)

SAM 3 is an open-source segmentation model that detects, segments, and tracks objects in images from text and visual prompts. In this solution, SAM 3 acts as a precision instrument directed by Nova. When Nova identifies visual PII elements, it delegates the segmentation task to SAM 3 to produce exact boundaries for redaction.

SAM 3 segmentation masks overlaid on the original image when prompted with the word ‘flower’ on model playground (https://ai.meta.com/research/sam3/)

Amazon Textract is an ML service that automatically extracts text, handwriting, layout elements, and data from formats such as PDFs, images, tables, and forms. In this pipeline, Amazon Textract serves as Nova’s OCR capability. When Nova determines that an image contains textual PII, it directs Amazon Textract to extract all text content along with their coordinates, which Nova then evaluates to determine what constitutes sensitive information, taking into account context of the entire image.

PII detection

Common PII items found in images include, but are not limited to:

• Name.
• Identification number, such as driver’s license number.
• Address.
• Telephone number.
• Asset information, such as Media Access Control (MAC) address.
• Property identification number, such as a vehicle identification number (VIN).
• Personal characteristic, such as facial images.
• Biometric data, such as fingerprints.

These items can be divided into 2 modalities: textual (name, identification number, address, telephone number, asset information, and property identification number) and visual (personal characteristics and biometric data).

Nova directs a workflow with access to two sub-processes, each identifying either the pixel coordinates of the textual or the visual PII items. Nova first performs an initial assessment of the image to determine what types of PII are present, then intelligently routes the image to the appropriate sub-processes. An AWS Lambda function subsequently obscures the contents at the coordinates identified under Nova’s direction.

This solution is ideal for one-off or batch image pre-processing scenarios where high redaction accuracy is required. Nova 2 Lite’s strong price-performance, low latency, and advanced multimodal reasoning make it well-suited to coordinate this workflow, delivering accurate PII redaction without requiring your organization to have deep machine learning expertise or to fine-tune purpose-built models.

Prerequisites

To follow along with this solution, you should have:

• An AWS account.
• Familiarity with Amazon Bedrock, Amazon SageMaker AI, Amazon Simple Storage Service (Amazon S3), AWS Lambda, AWS Step Functions, Amazon EventBridge, and Amazon Textract.
• Access to Nova 2 Lite via Amazon Bedrock in your AWS Region.
• Deploy SAM 3 on SageMaker AI.
• Basic knowledge of AWS Software Development Kits (SDK).
• Basic understanding of computer vision concepts and image processing.
• Familiarity with foundation models and prompt engineering techniques.

Please be aware that this solution will incur AWS charges including: S3 storage, Lambda invocations, Step Functions state transitions, SageMaker AI endpoint hosting, Amazon Bedrock API calls, and Amazon Textract API calls. Make sure you understand the pricing for these services in your AWS Region before you create the corresponding resources.

Solution architecture

This section describes an architectural guidance where Nova drives the image processing workflow and directs parallel textual and visual analysis to identify and redact sensitive information.

1. Document upload and workflow trigger

When you upload an image to the S3 input/ folder, an S3 event notification triggers an EventBridge rule, which initiates the AWS Step Functions workflow.

2. File validation and initial PII screening

The workflow first validates that your uploaded file type is compatible with Amazon Bedrock supported image formats. After validation, Nova 2 Lite performs its initial assessment of the image, acting as the first line of intelligence to determine whether PII is present. If Nova determines that no PII exists, the workflow exits early and the image is immediately moved to the S3 noPII/ folder, ready for downstream use without further processing. Most business images contain no PII. This early-exit decision by Nova routes away a large number of images at the first and least expensive step. It significantly reduces overall pipeline cost by avoiding unnecessary invocations of downstream services such as Amazon Textract and SAM 3 on SageMaker AI.

3. Parallel PII detection: Visual process

When Nova 2 Lite identifies potential PII, it classifies the detected PII by type, textual, visual, or both, and makes the routing decision for downstream processing. Based on Nova’s classification, the Step Functions workflow selectively invokes one or both specialized processes: the textual process if Nova detected textual PII, the visual process if Nova detected visual PII, or both processes in parallel if Nova identified both types.

The visual process focuses on detecting visual PII elements such as faces and license plates within your image. Under Nova’s direction, SAM 3, deployed on SageMaker AI, is prompted to locate visual PII elements and produce pixel-by-pixel segmentation masks. A segmentation mask is a pixel-level outline that traces the exact shape of an object in an image. It labels each pixel as either belonging to that object or not, similar to a precise digital stencil. Unlike a simple bounding box (a rough rectangle around an object), a segmentation mask follows the true contours of the detected item, allowing redaction of only the sensitive pixels without obscuring surrounding content. This precision approach, guided by Nova’s initial PII classification, helps maintain the image’s value while removing only the sensitive regions. For example, when training ML models on large image datasets, this method helps prevent PII from being passed to the model while preserving your dataset size and non-sensitive visual information.

4. Parallel PII detection: Textual process

The textual process uses Nova’s multimodal reasoning to analyze text embedded within your image with the help of Amazon Textract. First, Amazon Textract identifies pixel-level location of text in images and extracts its content. It provides both axis-aligned bounding box and polygon coordinates for each detected text element, and you can choose which coordinate type best suits your redaction needs. Nova 2 Lite then evaluates each extracted text element, alongside the raw image, to determine which ones contain PII such as names, addresses, or identification numbers. This is where Nova’s contextual intelligence is critical: some text elements, when considered in isolation, might not appear to be PII, but Nova can reason about the surrounding visual context in the image to recognize their sensitive nature. For example, a street name and a street number broken into 2 locations do not constitute PII separately by themselves, but because they both appear in the same image, the full address is visible and should be obscured as PII. As a multimodal model, Nova can process text and image simultaneously to make these nuanced PII determinations. Finally, Amazon Textract returns the coordinates of the text that Nova identified as PII for use in the next step.

5. PII redaction and final verification

After the sub-process(es) complete their analysis under Nova’s direction, their coordinate outputs are passed to the next stage for redaction. Recall that the output from the visual process is segmentation mask coordinates from SAM 3, while the output from the textual process is bounding box or polygon coordinates from Amazon Textract.

A Lambda function merges coordinates returned from the process(es) into a unified set of PII locations across your image. The RedactPII Lambda function then obscures the identified regions in the original image using the Pillow (PIL) library in Python and stores the redacted image in the S3 redacted/ folder.

As a final quality assurance step, Nova 2 Lite performs a comprehensive review of the redacted image to decide if all detected PII has been removed. This final verification uses Nova’s holistic vision understanding to catch any residual sensitive content. If Nova determines that the image is clean, it is moved to the S3 noPII/ folder for downstream use. If Nova still detects PII, the image is moved to a quarantine folder for manual review, designed to help prevent PII from slipping through.

6. Test the solution

To verify that the solution is working correctly, follow these steps:

1. Use a sample test image containing PII. You can use an AI-generated image.
2. Upload the image to the S3 originals/ bucket using the AWS Command Line Interface (AWS CLI) or the Amazon S3 console.
3. Monitor the Step Functions execution on the AWS Step Functions console to track the workflow progress.
4. Verify the redacted image appears in the S3 redacted/ or humanreview/ folder.
5. Download the output image from the S3 redacted/ or humanreview/ folder.
6. Inspect the image to check if PII has been successfully removed, or identify PII elements (for example, niche elements beyond those cited in the “PII detection” section) that require human review.

AI-generated image with textual PII (address) and visual PII (face)

PII elements redacted in the same image by pipeline using bounding box coordinates from Amazon Textract and segmentation mask coordinates from SAM 3

Clean up

Complete the following steps to clean up your resources when you no longer need this solution. Before proceeding with cleanup, make sure you have backed up any data you need to retain from the S3 buckets. The following steps will permanently delete all resources and data.

1. Back up any necessary data from the S3 buckets.
2. Delete the S3 buckets (originals/, noPII/, redacted/, and humanreview/)
3. Delete the SageMaker AI endpoint hosting the SAM 3 model.
4. Delete the Step Functions state machine.
5. Delete the Lambda functions (PII detection, redaction, and final verification).
6. Delete the EventBridge rule configured for S3 event notifications.

Conclusion

In this post, we demonstrated how Amazon Nova 2 Lite serves as the intelligent coordinator of a serverless, automated pipeline for detecting and redacting PII from images without requiring custom model training or fine-tuning. Nova’s multimodal reasoning drives every decision in the workflow: from initial PII detection and classification, through intelligent routing to specialized tools like Amazon Textract and SAM 3 on Amazon SageMaker AI, to final quality verification of the redacted output. With Nova 2 Lite’s strong price-performance and advanced vision capabilities, organizations can deploy PII redaction at scale while maintaining full compliance with data protection regulations.

This post provides architectural guidance that you can adapt to your specific compliance requirements and deploy in your own AWS account. To get started, explore Amazon Nova models in the Amazon Bedrock console, and refer to the Amazon Nova documentation, the Amazon Textract documentation, and the Amazon SageMaker AI documentation to deploy the complementary services used in this pipeline.

---

About the authors

Caroline Des Rochers

Caroline is a Montreal-based bilingual Solutions Architect at Amazon Web Services. She works closely with financial institutions to accelerate their AI and cloud transformation journeys, embrace innovation, and create new business opportunities. Outside work, she’s a passionate skier and cyclist, always ready for new outdoor adventures.

Caitlin McDonald

Caitlin is a Montreal-based bilingual Solutions Architect at AWS with a development background. Caitlin works with customers to accelerate innovation and advise them through technical challenges. An advocate for practical AI, helping organizations turn AI’s potential into meaningful business outcomes. In her spare time, she enjoys triathlons, hockey, and traveling.

Karen Lee

Karen is a Solutions Architect at Amazon Web Services, previously based in Hong Kong, now based in Montreal. She works with Independent Software Vendors who provide various technology solutions. Karen frequently travels to see her customers and the many sights of the world.

Isabelle Charette

Isabelle is a Solutions Architect at AWS, based in Montreal, where she helps customers tackle technical challenges and move faster in the cloud in both English and French. With a background in software development, she brings a builder’s mindset to every engagement. When she’s not at her desk, she’s most likely halfway up a rock face or somewhere in the mountains.

Eric Borland

Eric is a Senior Solutions Developer on the Prototyping and Customer Engineering (PACE) team within Amazon Web Services Industries (AWSI), based in Barcelona. He builds prototypes for global customers to derisk the most complex parts of their AWS workloads. Outside work, he plays and coaches sports, and enjoys building small startups.