Recognises a derivation rule leaving data identifying
A rule allowing a lower level whose method leaves the data identifying.
Can AI do this?
Not settled yet The benchmark tested this, but the models' answers do not settle yet whether they master it. 0 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 71% | Not shown |
| gemini-3.5-flash-lite | Low cost | 39% | Not shown |
| gpt-6-luna | Low cost | 74% | Not shown |
| claude-haiku-5-5 | Low cost | 74% | Not shown |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The rule and the method the standard allows
How it is assessed: Flags the deficient case and passes the acceptable one. Deficient: DR-002 "PAN masked to first 6 and last 6 digits" -> confidential Acceptable: First 6 and last 4 at most (PCI DSS 3.4.1)
Also known as: Derivation rule that does not de-identify
Related knobits
Builds on
- S-252 Explains classification of derived data
- S-154 Explains PCI DSS requirements on stored card data
All 16 knobits of Classify data.
Source: Review checklist 02-classification, row 9 (PCI 3.4.1)