Model-Based Detection and Verification

Models complement rules - they do not replace them

A named-entity recognition model can identify contextual entities such as person names and postal addresses that regex handles poorly. This is often called model-based PII detection. It adds latency, memory use, model-version drift, and false positives, so high-confidence deterministic patterns should still run first.

A practical pipeline is: normalize text, apply credential and structured-PII regexes, optionally run a local entity model on the remaining text, merge overlapping spans, redact before output, then emit only safe counts and categories to telemetry. Never send sensitive text to a remote detection model without an approved data-processing agreement.

Analogy: Regex is a barcode scanner: excellent for known shapes. A model is a trained clerk: better with context, but slower and capable of judgment errors. Sensitive workflows often use both.

Test every supported form plus near-misses. Assert that canaries disappear, typed markers appear, ordinary identifiers remain, and multiline or chunked input is handled. Measure precision - how many masks were correct - and recall - how many real sensitive items were found.

Goal: Repair the output-stream filter so email aliases, phone variants, and API-key shapes are masked while the harmless order number remains unchanged. The lab uses regex because it is lightweight and directly testable on the shared host.