red

confide:red — residual re-identification risk check

A defensive audit of YOUR OWN already-redacted output. It does not score against ground truth and is not a benchmark. It surfaces, qualitatively, what an attacker could still do — mapped to GDPR Art-29: singling-out, linkability, inference.

GUARDRAILS — read before running

• Run only on the user's own redacted output. If asked to de-anonymize or re-identify third-party / non-consented data, refuse.
• Report risk categories and counts only — never produce a step-by-step re-identification recipe or guess the hidden values.
• Local attacker by default. Enable the cloud/LLM inference probe (--inference) only on synthetic or explicitly consented data.
• Absence of a finding ≠ safety. A weak local detector/attacker is a FLOOR, not a ceiling. Always tell the user human review is still required.
• This pairs with confide:anon — run red after redacting, on the redacted file.

What it checks

1. Singling-out (deterministic, offline — the load-bearing signal): re-run detect_regex (+ detect_natasha if available) on the redacted text. Anything they still find is a surviving identifier the redaction missed. Counts by type.
2. Linkability (multi-file): given a folder, compare every file pair for shared surviving quasi-identifiers and flag potentially linkable pairs (count + types only).
3. Inference (LLM, optional, opt-in): prompt the local attacker model (cfg.red_attacker_model) for the attribute categories it could still infer (profession, location type, age band, …). Degrades gracefully if no model. WARN the user it under-reports (floor, not ceiling).

Risk tier rule

• HIGH — any DIRECT identifier survives (EMAIL, PHONE, URL, ID, PERSON).
• MEDIUM — only QUASI identifiers survive (LOCATION, ORG, DATE, AGE, PROFESSION, MEDICATION), or linkable pairs exist across files.
• LOW — no surviving identifiers found (still NOT a guarantee).