# SovereignBench — Semantic Leakage Benchmark, Methodology v1

**Status:** design spec (supersedes the v0 spike, `semantic_leakage_corpus_v0.jsonl`).
**Goal:** a benchmark on *sensitive-data egress that survives pattern/span redaction*
that survives hostile peer review and can be owned by a **neutral steward**
(MLCommons / OWASP GenAI) with AI-Z as a founding *contributor*, not the grader.

The v0 spike proved the *effect* exists (0 % detector vs high judge). v1 exists to
make that claim **defensible, reproducible, and hard**. Design principle throughout:
**we must be able to lose.** A benchmark everyone — including BRANE — aces is dead.

---

## 0. What v0 got wrong (and v1 fixes)

| v0 weakness | Why a reviewer kills it | v1 fix |
|---|---|---|
| Fully synthetic, vendor-authored | "Built so BRANE wins" | Multi-provenance sourcing incl. real cases; external co-authors; **held-out private split** |
| N = 37 | No statistical power, no CIs | N ≥ 1,000 public + ≥ 500 private, power-analysed |
| 27/27 & 0/27 (perfect) | Perfect separation reads as tuned | Difficulty gradient incl. a **hard tier every system fails**; report the gradient |
| Graded by BRANE's own judge | Circular ground truth | **Independent human annotation**, ≥3 raters, adjudication, report Fleiss' κ |
| 1 detector + 1 LLM baseline | Not a baseline field | 8–12 systems, blind, one harness (DLP, guardrails, cloud-LLM-redactors, BRANE) |
| Binary protect/leak | Hides utility cost | Dual metric: leak-prevention **and** over-block (FPR); report the frontier |
| No provenance per case | Uncheckable | Every case carries a `source` + license + labeler IDs (Datasheet) |

---

## 1. Construct & threat model (what we measure — precisely)

**Definition.** A *semantic leak* is sensitive information that a competent reader
(or model) can recover from a text, but which **no surface-form detector can locate**
because the sensitive token does not appear literally — it exists only after
*decoding, inference, or aggregation*.

Grounded in **OWASP LLM02:2025 Sensitive Information Disclosure** (now the #2 LLM
risk) and GDPR Art. 9/10 (special categories). We measure the outbound-governance
question: *if this message is sent to an external model, does confidential content
leave the perimeter?* — regardless of whether it is literally spelled out.

**In scope:** encoding smuggling, mosaic/aggregation, keyword-free special-category
context, business-confidential inference, fragmented/cross-message identifiers,
cross-lingual transliteration, cloaking/fiction framing, indirect reference
("the CEO's condition"), unit/format obfuscation.
**Out of scope (separate benchmarks):** literal PII (REDACT-DE covers that),
training-data contamination (the *other* "leakage"), jailbreak-to-harmful-content
(AILuminate covers that), multi-agent tool leakage (AgentLeak covers that).
Explicit scoping is itself a defensibility move — we are not re-labeling an
existing benchmark.

---

## 2. Taxonomy (leak modes) — externally anchored

Nine top-level modes, each mapped to an external reference so the taxonomy isn't
ours alone:

| # | Mode | External anchor |
|---|---|---|
| 1 | Encoding / transformation smuggling | OWASP LLM02; obfuscation literature |
| 2 | Mosaic / aggregation (k-anonymity break) | Statistical disclosure control (Dalenius) |
| 3 | Special-category context w/o keywords | GDPR Art. 9/10 |
| 4 | Business-confidential inference | Trade-secret / ISO 27001 A.5 |
| 5 | Fragmented / cross-message identifiers | Re-identification literature (Sweeney) |
| 6 | Cross-lingual / transliteration | — |
| 7 | Cloaking / fiction / role framing | Prompt-injection taxonomies |
| 8 | Indirect reference / definite description | Coreference / pragmatics |
| 9 | Format / unit obfuscation | — |

Each case is tagged with mode × language × domain (health/finance/legal/HR/gov/
corporate) × **difficulty tier (T1 obvious → T4 expert-adversarial)**.

---

## 3. Sourcing — "echte Fälle", multi-provenance (the credibility core)

No single provenance is trusted. Five streams, each case labeled with its origin:

1. **Real incident-derived (anonymized).** Structure taken from public breach/DPA
   records — ICO & EU DPA enforcement decisions, US HHS "Wall of Shame" breach
   portal, VERIS/VCDB — re-instantiated with synthetic-but-realistic values. The
   *scenario* is real; the *PII* is fabricated (so we ship no real PII). Cite the
   source decision per case.
2. **Real document templates.** Actual public forms (arztbrief, Kontoauszug, HR
   record, court filing) populated with fabricated PII — real structure, real
   phrasing, fake people. Credible because the *language* is authentic.
3. **Expert red-team.** Security/privacy professionals author adversarial cases
   (encoding, mosaic) under a written protocol — attributed, not anonymous.
4. **Crowd-sourced adversarial.** A public "break-it" call (like AILuminate's) —
   external contributors submit leaks; diversity + neutrality signal.
5. **Naturalistic (stretch).** Consented, anonymized enterprise chat logs sampled
   for genuine leak patterns — the hardest to obtain, the most convincing. Gated
   on DPA/consent; may land in v2.

**Splits.** ~60 % **public** (open corpus, on GitHub + HF) / ~40 % **held-out
private** (never published; run by the steward). Private split is the anti-gaming
core — you cannot tune to what you cannot see (AILuminate model).
**Canary strings** seeded in the corpus to later detect if it leaked into any
model's training data (contamination control).

---

## 4. Ground truth — independent, not our judge

- Each case labeled by **≥3 trained annotators** against a written **codebook**
  (leak? / mode / severity / recoverability). Disagreements adjudicated by a
  senior annotator. **BRANE's judge never labels.**
- Report **inter-annotator agreement (Fleiss' κ)**; target κ ≥ 0.7; cases below
  threshold are revised or dropped.
- Annotation is **blind to system output** — labels are the *gold*, produced
  before any system runs.
- Codebook + rater instructions published (reproducibility).

---

## 5. Baselines — a real field, blind, one harness

Every system runs through **one adapter interface** on the **same inputs**, outputs
scored blind (grader doesn't know which system produced which output):

- **Pattern/DLP:** Microsoft Presidio, MS Purview, Google Cloud DLP, AWS Comprehend
  PII, Nightfall, Protecto.
- **Guardrail models:** Llama Guard, NeMo Guardrails, ProtectAI/others.
- **Cloud-LLM-as-redactor:** GPT-x, Claude, Gemini asked to redact before egress.
- **Semantic (us + peers):** a semantic-reasoning system, plus any other
  reasoning-based redactor.

Apples-to-apples: same corpus, same prompt template per system class, same scorer.

---

## 6. Metrics — beyond binary, report the frontier

- **Leak-Prevention Recall** = fraction of protect cases where the system keeps the
  payload off-perimeter (LOCAL / redacted / blocked).
- **Over-Block Rate (FPR)** = fraction of benign controls wrongly restricted
  (utility cost). Large control set (≥ 40 % of N) makes this meaningful.
- **Primary score = the Prevention/Utility frontier** (PR-style curve) + a single
  **F-metric** at a fixed operating point. A system that "protects everything" by
  blocking everything scores badly — as it should.
- **Per-mode and per-difficulty breakdown** (where does each system fail?).
- **Statistics:** bootstrap 95 % CIs on every number; **McNemar** for paired
  system comparisons; pre-registered **power analysis** justifying N.
- **Report the gradient, not a headline 100 %.** If BRANE hits 100 %, we add T4
  cases until it doesn't — a benchmark with no headroom has no future signal.

---

## 7. Threats to validity (state them ourselves)

- **Construct:** "leak" is judgment-laden → mitigated by codebook + κ.
- **Internal (gaming):** authored-to-win → held-out private split, external
  co-authors, pre-registration, blind scoring.
- **External:** synthetic PII ≠ real distribution → real-incident *structure* +
  real document templates + naturalistic stretch goal.
- **Contamination:** corpus leaks into training → canaries + private split +
  versioned re-release.
- **Grader bias:** LLM-graded circularity → human gold; if an LLM assists scoring
  it is a *third-party* model, never a system under test, and validated against
  human labels (report agreement).

---

## 8. Governance & reproducibility

- **Neutral steward** owns scoring + leaderboard (MLCommons/OWASP); AI-Z =
  founding contributor. We supply methodology + public corpus; **we do not grade.**
- **Datasheet for Datasets** (Gebru et al.) + **Croissant** metadata; per-case
  license + provenance. Public corpus CC BY-SA; code Apache-2.0.
- **Versioned** (v1.0, v1.1 …); leaderboard pinned to a corpus version; private
  split rotated on contamination signal.
- **Companion arXiv paper** co-authored with academia (HPI/KIT/Fraunhofer) = the
  citable anchor and the neutrality shield.

---

## 9. Build plan v0 → v1

1. Freeze taxonomy + codebook; pre-register design (OSF) **before** authoring.
2. Author/collect ~1,500 cases across 5 provenance streams; 60/40 public/private.
3. Recruit ≥3 annotators; label; compute κ; adjudicate; drop low-κ.
4. Build the system-adapter harness; run the 8–12 baselines blind.
5. Score; bootstrap CIs; per-mode/difficulty; write the paper + Datasheet.
6. Hand scoring + leaderboard to the neutral steward; publish public split +
   leaderboard on sovereignbench.org; keep private split with the steward.

**Success = not that BRANE wins, but that the benchmark is one a competitor would
grudgingly accept as fair — and still shows the semantic layer opening a gap no
pattern/DLP system closes.**