Sources

All URLs accessed 11 September 2026 unless stated otherwise.

Detection accuracy

Sikkema, A. "Benchmarking Open-Source PII Detection Across Domains", June 2026. https://albertsikkema.com/python/security/privacy/2026/06/01/benchmarking-open-source-pii-detection.html Source of the cross-domain F1 table, the latency figures, the in-distribution versus out-of-distribution degradation percentages, the hybrid regex gain, and the 64% Presidio reversibility result. Methodology: five approaches, four datasets (AI4Privacy EN+NL, Gretel Finance EN+NL, Nemotron-PII, CoNLL-2002 NL), six shared entity types, ±5 character span tolerance. Caveats carried in Chapter 4: three of four datasets synthetic, AI4Privacy is Piiranha's training distribution, CoNLL-2002 covers only two of six entity types, and a paired t-test found no significant difference between the top three models.

Jha, P. "Fine-Tuning Over Architectural Complexity: Broad-Coverage PII Detection on PIIBench with DeBERTa", arXiv 2605.25816, 25 May 2026. https://arxiv.org/abs/2605.25816 82 entity types across ten source datasets. Direct fine-tuned DeBERTa F1 0.6476; source-conditioned hierarchical 0.5899; curriculum variant 0.2772; strongest published comparator 0.1723. Conclusion: diverse training data and a simple weighted cross-entropy objective outperform architectural sophistication.

GLiNER2-PII: A Multilingual Model for Personally Identifiable Information Extraction, arXiv 2605.09973. https://arxiv.org/pdf/2605.09973

Vendor-claimed F1 figures of 0.92–0.99, and the reported 0.96 to 0.18 out-of-distribution drop for one commercial privacy filter, appear in secondary reporting and are labelled as such in Chapter 4. They are used to illustrate the gap between published and achieved, not as measurements this book verified.

Volume and exposure

Cyberhaven, 2026 AI Adoption & Risk Report. https://www.cyberhaven.com/blog/sensitive-data-flowing-into-ai-tools 39.7% of enterprise AI interactions expose sensitive data; 34.8% of corporate data entering AI tools is sensitive, against 27.4% and 10.7% in the two prior years; nearly 40% of uploaded files contain PII or PCI data; 22% of pasted text contains regulated information. This is vendor endpoint telemetry, not a survey or a census, drawn from organisations that had already deployed monitoring. Chapter 1 states this caveat in the text.

77% of employees paste into GenAI prompts; 82% of those pastes come from personal accounts. https://www.esecurityplanet.com/news/shadow-ai-chatgpt-dlp/ (secondary reporting)

Presidio

Presidio documentation, Data Privacy Stack. https://presidio.dataprivacystack.org/ Source for the four components, deployment options, detection method, and the statement that Presidio is transitioning to a community-owned project. The former microsoft.github.io/presidio address redirects via data-privacy-stack.github.io/presidio to the above.

Presidio.SDK (unofficial C# client). https://www.nuget.org/packages/Presidio.SDK · https://github.com/StefH/Presidio.SDK Version 0.0.2, published 10 June 2025. ~5.6K total downloads (4.4K on current version). 14 commits on main. Targets .NET 6.0 and .NET Standard 2.1. Companion Presidio.SDK.Extensions (~970 downloads) adds a handful of locale-specific pattern recognisers.

Azure AI Language

PII detection overview, Microsoft Learn. Page dated 30 June 2026, updated 3 August 2026. https://learn.microsoft.com/en-us/azure/ai-services/language-service/personally-identifiable-information/overview Three feature types, official client libraries for C#, Java, JavaScript and Python, redactionPolicies from API version 2025-11-15-preview, confidence-scored entity categories, no model customisation on customer data.

Transparency note for PII detection. https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/language-service/transparency-note-personally-identifiable-information

Data, privacy and security for Azure Language. https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/language-service/data-privacy No storage or processing outside the customer's deployment region. All content encrypted at rest. Request data may be temporarily stored up to 48 hours for catastrophic-failure debugging, governed by the LoggingOptOut query parameter, which defaults to true on the PII and health endpoints and false on Language Detection, Key Phrase Extraction, Sentiment Analysis and NER. Page dated 1 April 2026, updated 17 August 2026. Verified 14 September 2026.