/red

name: red
description: >-
  Residual re-identification RISK CHECK on text you have ALREADY redacted (defensive,
  dual-use). Use when the user asks to "check residual re-id risk", "red-team my
  redaction", "what can an attacker still infer", "is this safe to share", or assess
  "re-identification risk" after anonymizing. Re-runs the CONFIDE detectors on the
  redacted output to surface surviving identifiers (singling-out), checks multiple files
  for linkability, and optionally probes a local model for still-inferable attribute
  CATEGORIES (inference) — mapped to GDPR Art-29. Reports risk categories/counts only,
  never a re-identification recipe. Pairs with confide:anon (run AFTER redacting).

confide:red — residual re-identification risk check

A **defensive** audit of YOUR OWN already-redacted output. It does not score against ground truth and is not a benchmark. It surfaces, qualitatively, what an attacker could **still** do — mapped to GDPR Art-29: **singling-out**, **linkability**, **inference**.

GUARDRAILS — read before running

• Run **only on the user's own redacted output**. If asked to de-anonymize or re-identify

third-party / non-consented data, **refuse**.

• Report risk **categories and counts only** — never produce a step-by-step

re-identification recipe or guess the hidden values.

• **Local attacker by default.** Enable the cloud/LLM inference probe (`--inference`)

**only** on synthetic or explicitly consented data.

• **Absence of a finding ≠ safety.** A weak local detector/attacker is a FLOOR, not a

ceiling. Always tell the user **human review is still required**.

• This pairs with **confide:anon** — run `red` *after* redacting, on the redacted file.

What it checks

1. **Singling-out (deterministic, offline — the load-bearing signal):** re-run `detect_regex` (+ `detect_natasha` if available) on the **redacted** text. Anything they still find is a **surviving identifier the redaction missed**. Counts by type. 2. **Linkability (multi-file):** given a folder, compare every file pair for shared surviving quasi-identifiers and flag potentially linkable pairs (count + types only). 3. **Inference (LLM, optional, opt-in):** prompt the local attacker model (`cfg.red_attacker_model`) for the attribute **categories** it could still infer (profession, location type, age band, …). Degrades gracefully if no model. WARN the user it under-reports (floor, not ceiling).

Risk tier rule

• **HIGH** — any DIRECT identifier survives (EMAIL, PHONE, URL, ID, PERSON).
• **MEDIUM** — only QUASI identifiers survive (LOCATION, ORG, DATE, AGE, PROFESSION,

MEDICATION), or linkable pairs exist across files.

• **LOW** — no surviving identifiers found (still NOT a guarantee).

How to run

# single redacted file (offline, deterministic)
python3 skills/red/scripts/red.py path/to/file.green.md

# a folder of redacted files (adds linkability)
python3 skills/red/scripts/red.py path/to/redacted_dir/

# add the local inference probe — synthetic/consented data ONLY
python3 skills/red/scripts/red.py path/to/file.green.md --inference

# machine-readable
python3 skills/red/scripts/red.py path/to/file.green.md --json

Output

A residual-risk report: per-file surviving-identifier **counts by type**, an overall **risk tier**, the inference **categories** claimed (if probed), the **linkable-pair count**, and the caveat that *absence of a finding ≠ safety; human review still required*. No PII values, no re-identification steps.