fix(truthbench): match digit-only canaries within one numeric run

[kevincostner17]

Summary

The TruthBench PII scanner checks each canary in several normalized forms. For the digit-only form it compared the canary's digits with all digits of the scanned leaf joined together. In a long prose or HTML leaf, that joined stream mixes digits from unrelated tokens, so a 7-digit canary could match by chance and report a leak that no value in the sink contains. For example, "token 3fa555b01c23" projects to ...5550123.... Because the digits come from whatever else is in the leaf, this showed up as an occasional, non-reproducible raw_pii_leakage failure.

Change

• Digit-only patterns of _MIN_DIGIT_ONLY_LENGTH (6) digits or more now match only inside a single numeric run: digit groups joined by at most three whitespace, ., -, / or parenthesis characters.
• Runs are read from the literal, HTML-unescaped, URL-decoded, NFKC and zero-width-removed forms of the leaf, so non-breaking spaces, zero-width characters and HTML entities between digit groups still join.
• Shorter digit-only patterns keep their existing exact, letter-free rule. The other normalized forms (literal, casefold, whitespace- and punctuation-stripped, URL, HTML, Unicode, JSON and byte forms) are unchanged.

Reformatted numbers are still detected: 555-0123, 5550123, 555 0123, (555) 0123, 555.0123, 555/0123, a non-breaking or zero-width space between groups, and contiguous digits inside a longer token. One case is newly detected: 555 0123 was missed before, because the entity's own digits (32) were joined into the stream.

Tests

New cases in tests/truthbench/test_privacy.py put each value in the middle of a long prose leaf that contains other numbers:

• 10 reformatted numbers that must be reported
• 5 values whose digits come from separate tokens and must not be reported: letter-split, separate HTML cells, CSS values, a long separator run

Against the previous privacy.py, 6 of these fail: the 5 separate-token cases and 555 0123.

Verification

• tests/truthbench: 265 passed on Python 3.9 / pandas 1.5.3 and Python 3.12 / pandas 2.3.3
• ruff check and mypy --python-version 3.9 benchmarks/truthbench/privacy.py: clean
• make truthbench-pr (release profile, pandas/polars/duckdb, 2 repeats, regression check): overall PASS; cleaning:raw_pii_leakage and parity:raw_pii_leakage pass with 0 failures; no gate-level changes vs baseline

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: bc919ae6-eb3a-4b0c-83bb-4d8ea149a5d7

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

FreshData benchmark report — performance

• freshdata: ?
• python: ?
• platform: ?

fixture	n_rows	n_cols	p50 s	p95 s	peak MB	repair %	false-repair %	preserve %	trust	monotonic	export %

Authored-code reduction (Metric 6)