Explains data masking and its limits
Masking hides values from roles that need less, and holds only if no key, copy or filter in reach recovers them (ISO/IEC 27002:2022 8.11).
Can AI do this?
AI does this well Most of the tested AI models master this. 3 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 99% | Mastered |
| gemini-3.5-flash-lite | Low cost | 80% | Not shown |
| gpt-6-luna | Low cost | 99% | Mastered |
| claude-haiku-5-5 | Low cost | 99% | Mastered |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: Masking hides values from roles that need less, and holds only if no key, copy or filter in reach recovers them (ISO/IEC 27002:2022 8.11).
How it is assessed: Answers a written question on the data masking correctly
Related knobits
Builds on
Needed for
- S-304 Recognises masking a join can undo
- S-310 Recognises masking applied to one copy only
- S-332 Closes the clear-text paths around a masked column
All 20 knobits of Design access control.
Source: Practice the stage 3 reference and review checklist rest on