Recognises re-identifiable masking
Fields masked one by one while the combination still identifies a person: an unsalted consistent hash of the personal identification code, an intact IBAN.
Can AI do this?
AI does this partly Some of the tested AI models master this; others do not show it. 2 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 91% | Mastered |
| gemini-3.5-flash-lite | Low cost | 44% | Not shown |
| gpt-6-luna | Low cost | 91% | Mastered |
| claude-haiku-5-5 | Low cost | 89% | Not shown |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The defect named on the masking leaving direct identifiers or linkable keys, and its fix or the question for its owner
How it is assessed: Flags the deficient case and passes the acceptable one. Deficient: EV-003 UAT: names masked, personal ID SHA-256 without a secret, IBAN kept Acceptable: Personal ID and IBAN replaced by format-preserving tokens with a secret key held outside the environment; or synthetic
Also known as: Masking that stays re-identifiable
Related knobits
Builds on
Usually followed by
All 15 knobits of Plan environments and capacity.
Source: Review checklist 02-environments-capacity, row 2 (GDPR recital 26; 20889; 27002 8.11)