Pre-launch · validating with Icelandic organisationsGate 1 decision · 18.12.2026

// Open synthetic benchmark

Results, with the limits in view.

Two synthetic sets show the limits: no annotated identifier passes into allowed text on 42 selected cases, but 8 do on 18 new challenge cases. This prototype is not ready for sensitive data.

SEPARATE CHALLENGE SET

8 known misses in a synthetic test.

These 18 cases were written after the initial detector rules, and the rules were not tuned to them. The table counts annotated identifiers still present in text the prototype would allow out. It is not a representative leak rate.

Entity typeMaskedBlockedExposed
Names (demo forms)122
Addresses022
Secrets012
Phone numbers101
Email101

Exact-span recall: names 60%, addresses 50%, secrets 33%, phones 50%, emails 50%. Each type has only a handful of examples.

dmz prototype by type.

A true positive requires the right type and exact text span. FP means a false detection; FN means a missed identifier.

Entity typeTP / FP / FNPrecisionRecall
Kennitölur6 / 0 / 0100%100%
Names (demo forms)7 / 0 / 0100%100%
IS IBAN4 / 0 / 0100%100%
Payment cards3 / 0 / 0100%100%
Phone numbers4 / 0 / 0100%100%
Email6 / 0 / 0100%100%
Secrets5 / 0 / 0100%100%
Addresses1 / 0 / 0100%100%
Tenant dictionaries1 / 0 / 0100%100%

TP = true positive, FP = false positive, FN = missed entity. The dictionary test has one preconfigured synthetic term, Verkefni Gervi. The single address hits a narrow shape rule and blocks the prompt.

PROTOTYPE OUTBOUND BOUNDARY

What would still get through?

On this selected corpus, 0 annotated identifiers remain in allowed outbound text. 2 unfamiliar full names and 1 address block their prompts for review; 10 prompts are blocked overall. This is not evidence of zero leaks on real prompts.

Entity typeMaskedBlockedExposed
Kennitölur600
Names (demo forms)520
IS IBAN400
Payment cards300
Phone numbers220
Email600
Secrets050
Addresses010
Tenant dictionaries100

Counted per annotated identifier: masked, blocked with the whole prompt, or still present in allowed text. Nothing was sent to a model. Unannotated context is not assessed, and the corpus is not a representative leak-rate sample.

Comparison: plain regex.

The same 42 cases, without date, checksum, mod-97 or Luhn validation and without a name lexicon. Patterns may overlap; each wrong type counts as a false positive.

Entity typeTP / FP / FNPrecisionRecall
Kennitölur6 / 12 / 033.3%100%
Names (demo forms)6 / 0 / 1100%85.7%
IS IBAN3 / 1 / 175%75%
Payment cards3 / 7 / 030%100%
Phone numbers4 / 32 / 011.1%100%
Email6 / 1 / 085.7%100%
Secrets3 / 0 / 2100%60%
Addresses0 / 0 / 10%0%
Tenant dictionaries0 / 0 / 10%0%

Comparison: default Presidio.

Presidio Analyzer 2.2.364 with its default English en_core_web_lg 3.8.0 model. No Icelandic recognizer or custom configuration was added. The same exact spans and types are scored.

Entity typeTP / FP / FNPrecisionRecall
Kennitölur0 / 0 / 60%0%
Names (demo forms)5 / 16 / 223.8%71.4%
IS IBAN4 / 0 / 0100%100%
Payment cards3 / 0 / 0100%100%
Phone numbers0 / 8 / 40%0%
Email6 / 0 / 0100%100%
Secrets0 / 0 / 50%0%
Addresses0 / 0 / 10%0%
Tenant dictionaries0 / 0 / 10%0%

How we measured.

Every case has annotated identifiers. The Go detector returns an entity type and UTF-8 byte offsets. The scorer compares exact span and type; partial overlaps do not count.

Test kennitölur use century digit 8. Emails use reserved example domains, cards use test numbers and no customer data is included.

What is missing.

×42 hand-selected cases are not a representative sample of Icelandic work.
×Only four hand-authored full-name forms are masked; other patronymic-shaped names block for review.
×Default English Presidio does not represent a tuned Icelandic deployment.
×The detector source remains in the private product repository; independent reruns are not available yet.