Use Cases and Requirements for Redaction in VCON

2.1. Redaction Properties

There are several different properties of redaction systems. These properties largely define what information still remains after the redaction has ocurred.¶

3.1. Full Dialog Object Removal

The simplest way to redact audiovisual information in a VCON is to remove the dialog object containing that information entirely from the VCON. In this approach, there is no trace whatsoever that this dialog existed in the VCON. This removal changes the index for any other dialogs in the VCON, which might require updating of references to that dialog from other objects, such as an analysis or participant.¶

Full object removal only makes sense if the VCON was structured as a sequence of dialogs, each representing a temporal segment of the conversation. For example, if each turn of a conversation was represented in a singular dialog. If a user spoke their social security number in a specific turn, the dialog representing that turn could be removed from the VCON.¶

Full object removal may result in a "hole" in the sequence of dialogs where no audiovisual information is present, making it potentially detectable. Whether it is detectable or not depends on how the dialogs were structured and on the nature of the conversation being captured. If the VCON had a set of dialogs, each representing a one-minute interval of audio mixed from all participants, then removing of one of the dialogs results in a VCON in which redaction is easily detectable - there will be a notable silence in the audio. However, if the VCON had a series of dialogs, each representing the audio contribution of a single speaker for a one-minute portion of time (or perhaps a single turn), then it might be detectable, or might not. If it was a conversation between a user and an AI agent, and the user's utterance is removed, the conversation would clearly sound like it was missing something. For example -¶

AI Agent: What is your social security number?
AI Agent: Got it, thanks

A user listening to this audio sequence would know something was missing, making the redaction detectable.¶

However, in a less structured meeting, where it is possible there was no direct response to a user's utterance of redacted information, it may not be detectable.¶

Full dialog object removal does not have positional or participant indications, making this approach problematic for cases where positional and participant indications are desirable.¶

3.2. Dialog Object Content Removal

In this approach, the content of the Dialog object - present either in the body element or the url and content_hash - is removed from the VCON, but the Dialog object itself and its meta-data (including parties, start and duration), remain. We call this a Dialog object "shell".¶

Like full dialog object removal, this approach makes sense of the VCON was structured as a sequence of dialogs, each representing a temporal segment of the conversation. For example, if each turn of a conversation was represented in a singular dialog. If a user spoke their social security number in a specific turn, the dialog representing that turn could be converted to just a shell.¶

Unlike full dialog object removal, there is no change in the index of the dialog that was redacted, eliminating the need to potentially update references elsewhere in the VCON.¶

Also unlike full dialog object removal, content removal can be accompanied by positional indicators (if the start and duration elements are preserved) and participant indicators (if the parties element is preserved). This makes this approach useful for many applications. However, it has a hard requirement that the VCON be structured in a way facilitating removal of content from a single dialog. For calls between a consumer and an AI agent, it would require per speaker, per-turn dialog elements. Even then, redaction of an entire turn might cause loss of information which is desirable for downstream troubleshooting and management purposes. Consider this conversation -¶

AI Agent: How can I help you today?
User: Yeah, so my name is Jonathan Rosenberg and my account number
is 12345. I ordered a widget 2000 like a month back and it still
hasn't shown up. The website is showing it shipped but it has
said that for a while and there is no Fedex tracking number.
What's going on?

In this case, the user turn contains PII information (the user's name and account number), but it also contains critical information - the intent of the caller and context of the removal. If the dialog content is removed, the audio is lost. Now, this might be acceptable if there was an accompanying transcript in an analysis object. The entire audio turn could be redacted, and then just the two PII elements from the transcript. The alternative is to perform content substitution, noted below.¶

3.3. Dialog Object Content Substitution

In this approach, the content of the dialog object is replaced with something else. For audio, this might be a "beep" sound. For video, it might be a recorded video of a black screen. More interestingly, the content can be substituted for one in which the "beep" or video overlay only occur in a portion of the content. For example, consider a Dialog containing recorded audio covering 20 minutes of a call. At timestamp 3:41 the user said their social security number and it took 3 seconds to speak it. During the interval 3:41 to 3:44, the audio is replaced by an audible "beep".¶

Content substitution is detectable. However, in the current VCON specification, there is no explicit indication that the substitution has happened. There is no positional or participant indicators either.¶

This is a gap in the specification.¶

4.1. Well-Known Character Substitution

The simplest technique is to just substitute the sensitive information with some kind of alternative well-known characters - "XXX" being quite common. Sometimes, the word "REDACTED" is used as well.¶

Well Known Character substitution is effective and easy to implement. It is detectable.¶

It's main drawback is that, as a positional indicator, it can lead to false positives. Consider the following interesting conversation -¶

AI Agent: What is your three letter confirmation code?
User: Yes, it is XXX.
AI Agent: Thanks, let me look it up.

Here is the interesting question - was the user's confirmation code actually XXX, or was it something else, and there was a redaction operation which substituted the real confirmation code?¶

This perhaps seems contrived, but it is even more complex in cases where the redaction occurred over text that was the result of speech recognition. Consider this example -¶

AI Agent: What is your three letter confirmation code?
User: Hang on, umm, OK. Its XXX, then YKZ.
AI Agent: Thanks, let me look it up.

In this case, is the user's confirmation code XXXYKZ, or has some kind of partial redaction taken place? There is no way to know.¶

This is perhaps improved by using a word like REDACTED, but again can lead to confusion if the participants in a conversation actually use that word! Consider this conversation -¶

User 1: Did you try reading the document?
User 2: Yes I did, but the account number was redacted.

In this conversation - did user 2 speak the account number, but then it was subsequently redacted? Or did they say the word "redacted"?¶

There is another problem that the word "redacted" is in English, making it difficult to parse in VCON represented conversations in a different language.¶

All of these problems stem from the fact that character substitution is not actually part of the schema of the VCON at all - its a hint. As a hint, is ambiguous in some cases. If we want software to be able to know that redaction has ocurred, we want to do better.¶

4.2. Information Substitution

An alternative solution is to replace a piece of information - like a social security number or name - with an alternative that is incorrect, but plausible. For example, using the name "John Smith" or a social security number like "183-13-3948". To perform this substitution, software requires knowlede about the type of information element, and needs some kind of algorithm to perform substitution.¶

This approach is similar to well-known character substitution. However, when done well, it can produce redaction which is undetectable. In some use cases, that is highly desirable. In others, it may be very bad. Using a contact center call as an example, consider a user that chats with a contact center agent to get a refund. The account number is recorded into the VCON for the call at the end, and then replaced using information substitution. The user calls back the next day. A human contact center agent reviews the transcript of the prior chat session, and observes the account number in the prior transcript. Not knowing that this is actually NOT the correct account number, the agent uses the wrong account number and applies the refund to the wrong account.¶

5.1. Explicit Positional and Participant Redaction Indicators

In cases where audiovisual dialog content has undergone substitution (e.g., the "beep" sound in an audio track), it would be desireable to have a property within the dialog object that explicity indicates the points in time (start and duration) that contain these beeps. That would address the limitation that, without this, there is no clear positional or participant indicators. THose indicators are highly useful for troubleshooting purposes.¶

5.2. Explicit Text Redaction Element

Instead of using XXX or the word REDACTED or similar, it would be good to standardize a way for any text string - present anywhere in the body of the VCON - to have a standardized way of indicating that some kind of redaction has ocurred. A good way to do this is by adding the idea of a redaction manifest, which allows a string anywhere in the document to be replaced by a reference to a standardized object which supports a mix of text and redacted information. Consider a simple VCON showing a single event - a tool call - which closes an account (using the event concept defined in [RESTRUCTURE]).¶

{
  "events" : [
    {
      "type" : "tool-call",
      "tool_name" : "close_account_by_id",
      "input-params" : [
        {
          "input-name" : "account_id",
          "input-value" : "293827344"
        }
      ]
    }
  ]
}

You can see that this contains a sensitive account ID. Here is a version that is now redacted.¶

{
  "events" : [
    {
      "type" : "tool-call",
      "tool_name" : "close_account_by_id",
      "input-params" : [
        {
          "input-name" : "account_id",
          "input-value" : "__REDACTED_REF_001"
        }
      ]
    }
  ],
  "redactions" : [
    "name" : "__REDACTED_REF_001",
    "type" : "account_number"
  ]
}

You can see that, we've added a redactions element into the JSON which contains the list of redacted fields, including specification of their types.¶

5.3. Explicit Information Identication Element

There is no way in VCOn to take a piece of information - like a first name or social security number - and then explicitly tag it as a piece of sensitive information, without removing it from the document per se.¶

This can be done along much the same lines as the text redaction element noted above.¶