open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 4 Activity

docs(census): the two wiki corpora are measured, and the tightening is thinner than zero looked

Browse source 
0.7.0 shipped with its corpus numbers deliberately absent: the census had only
run on reference-corpus, which the 0.6.0 narrowing had already emptied of
raw-HTML drivers, so it bounded the change rather than showing it. Both wiki
corpora are now measured through the pinned instrument, in one session because
they are living populations.

Under PRESET_USER_UPLOAD, 0.6.0 as shipped -> 0.7.0, each population against its
own denominator (the two wiki corpora share content and are never summed):

  reference-corpus   389 docs   54 -> 53   ceiling 53
  vendor-harvest     187 docs   62 -> 20   ceiling 18   42 of 44 achievable
  generated-notes    552 docs   59 -> 15   ceiling 13   44 of 46 achievable

PRODUCTION matched C1 + D field for field in every population, which is the
check that the instrument and the shipped predicate have not drifted.

Two things the measurement changed rather than confirmed:

The pair is superadditive by 13 documents in BOTH wiki corpora. Alone, the split
frees 8 in each and the narrowing 21 and 23; together they free 42 and 44.
Shipping either alone would have measured as barely worth the label.

The TIGHTENS column reads 0 on both tiers in all three populations, but that zero
is empirical and thin: the split measured ALONE tightens 13 documents on the
trusted tier in vendor-harvest and 14 in generated-notes, and the narrowing
cancels each one. LIMITATIONS now says so explicitly, so nobody reads the zero as
'cannot happen' -- the escalation is still constructed and pinned by
test_split_tightens_the_trusted_tier_when_both_carriers_are_present.

generated-notes counted 552 documents, not the 550 the scratchpad probe saw.
Living corpus, measured fresh.

791 passed; coverage 129/129, 6/6 documented gaps hold.
This commit is contained in:
Kjell Tore Guttormsen 2026-08-13 20:22:18 +02:00
commit be9759b4b3
3 changed files with 71 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

31
src/llm_ingestion_guard/active_content.py
View file

@ -60,12 +60,31 @@ split never lets a document reach WARN — it converts a hard block into a human
review, which is the difference a consumer actually feels and the reason the census
reports ``fail_secure`` alongside non-WARN.
**Measured, on reference-corpus (389 documents) at one corpus state:** 54
``fail_secure`` under ``PRESET_USER_UPLOAD`` before, 53 after; the pair unblocks 1,
and tightens 0 on both trust tiers. That corpus was already emptied of raw-HTML
drivers by the 0.6.0 narrowing, so it bounds the change rather than showing its
value. **The two wiki corpora, where the volume is, are NOT yet re-measured through
the census — see ``docs/LIMITATIONS.md`` for what is and is not measured.**
**Measured through the census on three populations, each at one corpus state**
(``fail_secure`` under ``PRESET_USER_UPLOAD``, 0.6.0 as shipped -> 0.7.0; the
ceiling is the detector switched off entirely):
=================== ========= ============= ======= =========================
population documents 0.6.0 -> 0.7.0 ceiling tightens (upload/trusted)
=================== ========= ============= ======= =========================
reference-corpus 389 54 -> 53 53 0 / 0
vendor-harvest 187 62 -> 20 18 0 / 0
generated-notes 552 59 -> 15 13 0 / 0
=================== ========= ============= ======= =========================
The pair takes **42 of the 44 achievable on vendor-harvest and 44 of 46 on
generated-notes** — 95% and 96% of what switching the detector off would buy.
reference-corpus was already emptied of raw-HTML drivers by the 0.6.0 narrowing,
so it bounds the change rather than showing its value; the wiki corpora are where
the volume is.
**Neither change alone reaches half of it, and the residual is identical in both
corpora.** The split alone frees 8 documents in each; the narrowing alone frees 21
and 23. 8+21 against a measured 42, and 8+23 against a measured 44: **13 documents
per corpus are freed by the pair and by neither member** — the narrowing strips a
document's ``</a>``/``<Frame>`` and what remains is the ``<a href=...>`` the split
grades down. Shipping either alone would have measured as barely worth the label.
Method and rows: ``docs/rawhtml-census.py``.
The URL-attribute branch deliberately stays on the HIGH side of the split. A name
outside the active set has unknown rendering and ``href`` is not the only URL