Not just redacted — redacted under attack

The question that matters

Can an identifier survive redaction when the document is trying to make it?

The Redacta benchmark measures the engine in scope, under cooperative conditions: 300 synthetic notes, every targeted identifier caught, zero false positives, stable across ten seeds. That number is real and reproducible — but it is measured on text that isn't fighting back.

The Gauntlet exists to make that 100% earn its asterisks. Its metric is asymmetric on purpose. A false negative — one identifier that slips through — is a privacy breach, so recall under adversarial conditions comes first. Over-redaction is tracked as the cost axis: a redactor that deletes the whole document scores perfect recall and is useless, so the two numbers are only meaningful together. This is the same discipline behind the RefCheckr eval — gold cases in, scorers out, a baseline that gates every commit — pointed at a different failure: leaked identity instead of unsupported claims.

Threat model

The attacker's goal is one identifier surviving redaction. A design fact shapes everything below: the deterministic engine does not interpret the document — it applies pattern passes and keyword-anchored rules, so it cannot "follow instructions" embedded in text. Prompt injection against this layer should fail by construction; the Gauntlet measures it anyway, because "should" is not a measurement. The genuinely injectable surface is any downstream model consuming Redacta's output — named as a gap, and the target of v1.

What the Gauntlet found v0 · measured

The point of an adversarial set is the failures. Run against the shipping engine (@pharmatools/redacta@1.2.0, cross-checked token-for-token against the live MCP server), v0 holds the line where the engine is designed to be strong and breaks — informatively — where it isn't.

Four findings are worth naming — this is the eval doing its job, turning a limitation into a number rather than a surprise:

• A dual failure in prose. Given "…transferred to the RJ1-2209841 record after a merge. Hospital number confirmed at desk," the keyword-anchored MRN pass latched onto the word "confirmed" — it followed "Hospital number" — and tokenised that as the MRN, while the real identifier RJ1-2209841 survived in the clear. A miss and a spurious redaction in one sentence. Reproduced identically by the offline engine and the live MCP.
• NHS number grouping. 9234 4578 54 (4-4-2) is missed; standard 923 445 7854 (3-3-4) is caught. Notably, the MCP's self_check net does flag the missed string as a "long number" for human review — a miss at the redaction layer, caught at the review layer.
• DOB keyword distance. 07/22/1955 is missed when the "DOB" keyword is separated from the number by intervening prose; the name and postcode in the same note are caught.
• Untitled name. Sarah Trevino, written without a salutation and set off in dashes next to a clinician of the same first name, is missed; Mrs Sarah Trevino is caught — the documented free-text-name limitation, made concrete.

Results by attack surface v0 · expanding

Recall broken out by surface — teal where the engine is designed to win, grey where a case is out of deterministic scope by design. The shape is the story: the engine is near-perfect against injection and near-misses, strong in prose, and falls off exactly where an LLM-assisted layer is needed.

The edge and leakage figures are dominated by reasoning-scope cases — partial postcodes, initials, DOB-as-age, and pure quasi-identifiers — that the deterministic engine is not claimed to catch. Split by scope, recall is 91.5% on in-scope (deterministic) identifiers and 0% on reasoning-scope identifiers. Reporting them together would flatter the engine; reporting them apart is the point.

v0 gold set is 28 synthetic cases (56 labelled identifiers, 17 preserve distractors). All data is synthetic — no real patient information. The set will grow across formats and surfaces; as it does, these figures move, which is why the scorecard is versioned and every run is stamped with the code SHA it ran against.

How it works

Same architecture as the RefCheckr harness — gold cases in, metrics out, a baseline to compare against, one command to run.

Honest by construction

• The set includes cases it expects to fail. An eval that only contains winnable cases is marketing. Reasoning-scope cases score 0% and are reported as such — flagged expected_miss, never averaged into the headline. known gap
• Recall comes before convenience. A false negative is a breach; a false positive is a cost. The two are scored separately so neither can hide the other, and both over-redaction and precision have their own gates — so recall can't be bought by shredding the record, and a spurious grab fails CI even when recall holds.
• Offline and online agree. The deterministic scorecard is cross-checked token-for-token against the live MCP server — including the prose-04 dual failure — so the fast, network-free suite is a faithful stand-in for the shipping service.
• Reproducible. Every scorecard records the engine version and code SHA it ran against, so a result can always be traced to a specific state of the system.

Known gaps & what's next

• No reasoning layer yet. Indirect leakage, partial postcodes, initials and DOB-as-age need the LLM-assisted layer. They're in the gold set now, scoring 0%, so the day that layer lands its gain is measured, not asserted. v1 target
• Injection is only tested against the deterministic engine. The genuinely injectable surface is any downstream model consuming Redacta's output. The same injection cases are staged to point there next. v1 target
• Precision now scores every removal, not just baited distractors. A precision metric treats any non-gold token the engine removes as a candidate false positive, so spurious grabs like prose-04's "confirmed" land in the headline (97.7% precision) and fail CI on any new occurrence — no longer only a case note. shipped · v1
• Synthetic only, permanently. Realism is bounded by policy — no real patient data, ever. That's a deliberate ceiling, named here so it isn't mistaken for an oversight.

The triad, completed

Redacta now carries three measurements that answer three different questions. The benchmark asks does the engine do what it targets, reliably? — 100% recall, zero false positives, ten seeds. The Gauntlet asks what happens outside the target, when the document is hostile? And the harness's cost-and-latency axis asks what does correctness cost at manuscript scale? Read together, they turn "trust us" into numbers anyone can re-run.