Split-value leak evidence archive: streaming privacy gateway conformance specifications, reports, and reproduction records

Supporting data for the article "Testing LLM Privacy Gateways on the Wire: Fragmentation-Induced Detection Evasion" (Ninad Phalak, submitted to IEEE Software, special issue "Building Trustworthy Software in the Time of AI", 2026). This is the open-access mirror of the IEEE DataPort dataset 10.21227/1kjn-0436; the two archives are byte-identical (see SHA256SUMS.txt inside).

Every number in the article's text, Table I and Table II is computed from a JSON report in this archive, and the README maps each statement in the article to its file. The archive holds the frozen evidence (specifications v1.0.0, v2.0.0 and v2.1.0; 168 schema reports and ten aggregates produced by a deterministic conformance harness from real HTTP traffic against five gateway configurations and three library wrappers; the harness source at the revision that produced them), the reproduction kit and CI workflow that an independent third party ran on 2026-10-03 with the artifact of that run, the reviewer supplement, and the scripts and raw results of an Azure OpenAI default-streaming measurement with the vendor case outcome. All corpus values are synthetic and generated from a seed; no real personal data, live credential or customer traffic appears anywhere. Nothing in the archive was produced by an AI system.

How to use: unzip and open README.md first. To verify, run sha256sum -c SHA256SUMS.txt; then re-run the reference controls with the reproduction kit (CPython 3.11 to 3.14, no network, about two minutes: lay reproduction-kit/ over evidence-round-8/, pip install ./pii-leak-benchmark, python benchmarks/reproduce_fragmentation.py --out reproduction; the Presidio track needs Docker and --policies presidio-chunk-local,presidio-retention). Every report carries instrument.inspector_sha256 = 94262e29a492ab6a; a report with a different inspector digest was scored by different code and is not comparable. Source mirror: Git tag v2-evidence-round-8 at https://github.com/ninadphalak/LLM-Shield-Proxy.

Version 2 (2026-10-12) adds incidence-2026-10/, a production-incidence measurement made on 2026-10-11 and 12: 100 synthetic values of each of the eight corpus types tokenized with seven public tokenizers, and 3,000 raw SSE streams from five live models (DeepSeek, Claude Haiku, two Gemini models and gpt-5.4-mini, each with the value at the start of the answer and again mid-passage) asked to repeat a value, with every event's character and byte offsets. Its README.md explains the captures, and the tables re-derive from them with python scripts/layer2_analyse.py layer2 raw/*.jsonl, with no API key. Every version-1 file is byte-identical (the version-1 zip's MD5 was 50cd229819cd77da156da6110f8be0b1).

Version 3 (2026-10-25) adds cloud-rerun-2026-10-25/: the two Google Cloud detector rows of the article's one-cut-versus-every-cut figure (Cloud DLP and Model Armor, each in a chunk-local and a retention wrapper) re-measured at the same 12 seeds as the Presidio study, under both cut rules, with every value kind requested. Every seed reproduced the published single-seed numbers. The README also records that the article names the failure the "split-value leak"; the specification and the reports in this archive call the same thing fragmentation-induced detection evasion. Every version-2 file is byte-identical; only README.md and SHA256SUMS.txt changed among the existing files.

Title until 2026-10-26: "FIDE evidence archive: streaming privacy gateway conformance specifications, reports, and reproduction records". Same record, same DOIs; the article now calls the failure the split-value leak. GitHub tag split-value-leak-evidence marks the same commit (6cbfee3) as v2-evidence-round-8.