{
  "bundle_id": "governed-memory-vector-sanitization-v2",
  "bundle_type": "governed_memory_sanitization_evidence",
  "published_at": "2026-09-23T00:00:00Z",
  "system": "CAIN governed agent memory -- prompt-injection screening",
  "status": "MEASURED",
  "what_it_is": "Deterministic pattern layer (NFKC + invisible-char stripping + homoglyph folding + base64/hex/%-decoding, English/German injection families). One layer, not a guarantee.",
  "benchmark": {
    "dataset": {
      "dataset": "deepset/prompt-injections",
      "revision": "4f61ecb038e9c3fb77e21034b22511b523772cdd",
      "license": "apache-2.0"
    },
    "dataset_sha256": {
      "train": "4294fcbd0ce2b543675076e8d42707f129992929a6bec91d961f2e96b0d5ceb7",
      "test": "de0996d15cabd838d50a4925a8493062ba70c29f845601cd6a17412236614486"
    },
    "split_reported": "test (held out; patterns designed on train only)",
    "measured_at": "2026-09-23T19:56:47.068996+00:00",
    "results_file_sha256": "62144b5f1363dfd2af42d89d7a9d6eb7d9f36b6bce11c1baec00bf50323a6e4c",
    "reproduce": "python3 benchmarks/memory_sanitizer/fetch_deepset.py && python3 benchmarks/memory_sanitizer/run_bench.py",
    "after_2026_09_23": {
      "vector_sanitizer": {
        "recall": 0.3333,
        "precision": 1.0,
        "false_positive_rate": 0.0,
        "tp": 20,
        "fn": 40,
        "fp": 0,
        "tn": 56,
        "latency_ms": {
          "p50": 0.1345,
          "p95": 0.8657,
          "p99": 2.4124,
          "mean": 0.4538
        },
        "obfuscation_still_flagged_rate": {
          "zero_width_interleaved": 1.0,
          "word_joiner_interleaved": 1.0,
          "cyrillic_homoglyphs": 1.0,
          "base64_wrapped": 0.9915,
          "hex_wrapped": 0.9915
        }
      },
      "governed_memory_check_security": {
        "recall": 0.3333,
        "precision": 1.0,
        "false_positive_rate": 0.0,
        "tp": 20,
        "fn": 40,
        "fp": 0,
        "tn": 56,
        "latency_ms": {
          "p50": 0.1209,
          "p95": 0.5326,
          "p99": 0.9382,
          "mean": 0.2175
        },
        "obfuscation_still_flagged_rate": {
          "zero_width_interleaved": 0.9915,
          "word_joiner_interleaved": 0.9915,
          "cyrillic_homoglyphs": 0.9915,
          "base64_wrapped": 0.9915,
          "hex_wrapped": 0.9915
        }
      }
    },
    "before_2026_09_23": {
      "vector_sanitizer": {
        "recall": 0.0,
        "precision": 0.0,
        "false_positive_rate": 0.0,
        "tp": 0,
        "fn": 60,
        "fp": 0,
        "tn": 56,
        "latency_ms": {
          "p50": 0.0262,
          "p95": 0.101,
          "p99": 0.3109,
          "mean": 0.0415
        },
        "obfuscation_still_flagged_rate": {
          "zero_width_interleaved": 1.0,
          "word_joiner_interleaved": 0.3333,
          "cyrillic_homoglyphs": 0.3333,
          "base64_wrapped": 0.6667,
          "hex_wrapped": 0.0
        }
      },
      "governed_memory_check_security": {
        "recall": 0.0833,
        "precision": 1.0,
        "false_positive_rate": 0.0,
        "tp": 5,
        "fn": 55,
        "fp": 0,
        "tn": 56,
        "latency_ms": {
          "p50": 0.047,
          "p95": 0.2494,
          "p99": 0.3281,
          "mean": 0.0929
        },
        "obfuscation_still_flagged_rate": {
          "zero_width_interleaved": 0.0,
          "word_joiner_interleaved": 0.0,
          "cyrillic_homoglyphs": 0.0968,
          "base64_wrapped": 0.0,
          "hex_wrapped": 0.0
        }
      }
    }
  },
  "limitations": [
    "Held-out recall is about one third: paraphrased, role-play and non-override injections are missed.",
    "116-sample test split; confidence intervals are wide.",
    "No semantic/model-based detection is used."
  ],
  "supersedes": {
    "sha256": "3be54103763895ddd59c4342311ac7708b8f87dcaaaa741b7a918c24e7d3dc7f",
    "previous_status": "PRODUCTION_OPERATIONAL",
    "reason": "The previous version claimed 100% detection and 0.04% false positives over 25,000 audited vectors, block_rate 1.0, and ACTIVE homoglyph normalization and hex shellcode scanning. No benchmark source existed; measured held-out recall was 0% (vector sanitizer) and 8.3% (governed memory), and homoglyph/hex normalization did not exist."
  },
  "source_modules": [
    "cain/memory.py",
    "platform-gateway/cain_memory_api.py"
  ]
}