Adversarial lexical probe
The paper's clearest methodological point: a corpus built from a rule set's own vocabulary cannot detect a matcher defect — only adversarial construction can. The earlier matcher used unrestricted substring containment, returned the first matching rule, and consulted the description only when the name matched nothing. On the 200-column synthetic corpus it scored 100%. Here are the 19 cases that separate it from the corrected, boundary-aware matcher — computed live by both engines as you read this.
| Kind | Field | Expectation | Corrected matcher | Pre-correction matcher |
|---|
Why the two failure modes are different
False positives are the obvious one: pan fires inside "company", "japan" and "panorama";
race inside "trace"; sect inside "section"; salt inside "saltwater" — ordinary
banking columns silently labelled Secret, and ungated, because the colliding rules carry high assurance.
Multi-token patterns fail differently: card_no can straddle "card notification" even after every
single-word pattern is token-aligned, which is the defect that survived the first fix.
Silent under-classification is the one the headline safety claim denies. aml_alert_balance,
described as "suspicious activity investigation account balance", matched the low-level balance rule by
name, so its AML description was never read: Secret evidence, a Restricted label, no gate. The corrected engine
searches both fields always, collects every rule that fires, and lets the most protective level win.
Nineteen cases characterise the two failure modes found, not the full lexical risk of a 243-pattern field-name vocabulary (plus 33 description-only patterns). The paper names the systematic expansion still required before the matcher can be called adversarially validated — see Section IV-D.
Try your own collision
Collision-prone patterns
Every pattern of at most five characters with no separator — the ones that, under substring matching, fire inside ordinary words. Under the corrected matcher each must equal a whole token.