From secret scanning to semantic privacy

The argument

Regex, token grammars, entropy and provider-specific prefixes catch a great deal, quickly, and they matter. But a delivered artifact can still carry local identity, absolute workstation paths, network layout, session state or organization relations — or information split across constants and files — without a single literal match.

Anonymous case A showed the split-string form directly: the excluded value was stored as separate constants, a contiguous-string search reported PASS, and simple concatenation recovered it. The paper grades recoverability in five steps, from R0 not recoverable to R4 literally present, and treats metadata, paths and multi-file composition as content.

It refuses the opposite mistake as firmly. A semantic AI detector is not a new oracle; it can hallucinate, miss, over-classify and leak through its own explanations. The architecture it proposes fuses pattern evidence, semantic evidence, policy context and independent falsification — and keeps UNKNOWN as an answer.