BiVelio Shield: Architecture, Deployment Boundaries, and Reproducible Detection Benchmarks

Abstract

BiVelio Shield combines a browser extension and a self-hosted gateway to reduce data exposure through deterministic detection, credential handling, optional contextual NLP, policy-based transformation, and reversible pseudonymization. This revision corrects the earlier presentation: the browser and gateway do not share one universal pipeline, and guarantees depend on the route, configuration, and failure under consideration.

The frozen catalogue contains 339 entries, including 204 credential types classified as secrets; it is not an official GDPR personal-data taxonomy. Its 15 art9-labelled entries represent eight general Article 9(1) classes plus seven health-related identifiers, not fifteen legal categories. The NLP benchmark evaluates PERSON and LOCATION, not those Article 9 classes.

Keywords: large language models; data minimization; pseudonymization; data loss prevention; contextual PII; reproducible benchmarks; GDPR.

Architecture and actual boundaries

The three configurations have different flows and dependencies. Whenever an external provider is used, it receives a sanitized prompt; this means neither that no prompt leaves nor that the text has become anonymous.

The Team order is material: raw text in the browser → Falkenstein names plane → entity spans → local substitution/redaction → sanitized prompt → external LLM. It is therefore inaccurate to claim that all redaction occurs before any sensitive text leaves the device.

• Failures and degradation: fail-closed closure is limited to modelled gateway routes and failures. On some browser paths, names-plane errors, timeouts, over-length text, or partial responses continue with deterministic-only detection and a warning.
• Vault and restoration: in the browser, restoration writes values into a DOM controlled by the provider page; a hostile page retains a residual oracle. In the gateway, both operations belong to gateway infrastructure.
• Coverage: it varies by route, transport, mode, and attachment. Voice, real-time, images, scans, and unintercepted routes have specific limits; consent to send without protection is not an automatic safety property.

Published results

Cooperative deterministic benchmark

The synthetic corpus has 1,000 documents, seed 1234, and 4,522 entities: 2,689 across nine structured types and 1,833 across six credential types. With overlap matching, precision, recall, and F1 are 1.000; residual verbatim leakage is 0/4,522 and pseudonymization round-trip is 2,689/2,689. These are corpus-specific observations, not coverage of all 339 entries or a universal consequence of MOD-97 or Luhn.

Adversarial track

Perturbations include fullwidth and Arabic-Indic digits, zero-width splits, and combining marks. Observed zeros are not probability-zero guarantees; no confidence intervals or independent adversarial dataset are reported.

Contextual NLP: Presidio and GLiNER

This separate benchmark uses 400 synthetic documents and 800 PERSON/LOCATION gold entities, seed 2026. Presidio runs as a local component; it is not inherently a cloud API.

Published cooperative throughput is 381,110 characters/s on the reference run; the report also documents machine- and load-dependent variation. The timer covers only Python-core detection and scoring: transformation, vault operations, network I/O, model inference, document extraction, browser work, and restoration are excluded. It is not end-to-end redaction throughput.

Limitations and reproducibility

• The corpora are synthetic, and additional seeds do not create external validity. Performance on real professional text, complete detection, and effectiveness on Article 9 classes are not demonstrated.
• Overlap matching does not require exact entity boundaries and may not penalize all additional prose consumed by a span.
• No benchmark measures answer quality, reasoning, translation, extraction, or user effort. Utility preservation is a hypothesis, not a result.
• No superiority over local Presidio, GLiNER, another gateway, or a no-redaction condition is established; nor is end-to-end p50/p95/p99 latency.
• Reproduction requires recording revision, dependencies, models, licence context, hardware, load, command, size, seed, and track. Some NLP commands require licensed components and models.
• Pseudonymization reduces verbatim disclosure of detected values, but context can reveal attributes. GDPR alignment is an engineering analysis, not a legal determination.

Declarations

Conflict of interest: BiVelio develops and distributes the system and has a commercial interest in it. This is a company-authored internal evaluation; no independent validation or absence of bias is claimed.

Authorship and AI assistance: authorship is attributed at team level because no verified individual author list was supplied. AI-assisted language editing and document generation were used; technical claims and figures were checked against the cited repository evidence, and no AI system is designated as an author.

Data and funding: all published benchmark corpora are synthetic; no new personal-data dataset was collected. The work is presented as internal engineering documentation, with no external funding claimed.

Download and cite

Download the revised technical report (19 pages, 109 KB; 111,534 bytes; in English, with a Spanish summary).

How to cite it:

BiVelio Privacy Research Team (2026). BiVelio Shield: Architecture, Deployment Boundaries, and Reproducible Detection Benchmarks. Revised company technical report, not peer reviewed, repository revision cafd425c, BiVelio, 25 October 2026. https://bivelio.com/en/research/papers/bivelio-shield