Adversarial PHI red-team corpus¶

OpenMed ships a synthetic adversarial-PHI corpus and an offline harness that measures whether protected identifiers survive the de-identification pipeline. It turns the abuse cases in the redactor threat model into a repeatable, leakage-first evaluation gate.

The corpus is eval/redteam/corpus/adversarial_phi.jsonl. Every row is explicitly marked synthetic: true; contains a stable abuse_case_id, an attack type, and one or more expected_protected assertions; and uses documentation-only identifiers. Restricted clinical datasets and real PHI must never be added.

Run offline¶

The default runner calls openmed.deidentify with OpenMedConfig(local_only=True) and the deterministic safety sweep enabled. This blocks network fallback. The selected model must already be cached, or --model-name must point to a local model directory. A model-loading or pipeline error is scored as a bypass rather than skipped.

OPENMED_OFFLINE=1 .venv/bin/python -m openmed.eval.redteam \
  --max-bypass-rate 0 \
  --output artifacts/redteam-report.json

Use a different cached model or local directory when needed:

.venv/bin/python -m openmed.eval.redteam \
  --model-name /path/to/local/pii-model \
  --max-bypass-rate 0.01 \
  --output artifacts/redteam-report.json

The threshold is inclusive and applies to the overall rate, every attack-type rate, and every mapped abuse-case rate. All of those rates must be at or below the configured maximum; otherwise the harness exits with status 1. CI can set the same optional gate without changing the command:

export OPENMED_REDTEAM_MAX_BYPASS_RATE=0
.venv/bin/python -m openmed.eval.redteam \
  --output artifacts/redteam-report.json

Without the CLI flag or environment variable, the harness still emits the report with decision MEASURED but does not enforce a rate.

Scoring and report safety¶

Each assertion declares a protected surface and its comparison strategy:

{
  "label": "email",
  "value": "synthetic.patient@example.com",
  "match": "normalized"
}

Supported matching modes are:

• exact: literal substring comparison.
• casefold: case-insensitive Unicode comparison.
• normalized: the same adversarial-Unicode folding used by PII detection.
• alnum: normalized comparison with separators removed, suitable for structured identifiers.

A case is a bypass if any expected-protected assertion survives or if the pipeline fails to return de-identified text. The overall bypass rate is bypassed cases / total cases; the report also groups the same rate by attack type and abuse-case id so a fully bypassed attack family cannot be hidden by unrelated passing cases.

Reports never include input text, de-identified output, protected values, or exception messages. Case results contain only ids, counts, exception types, and SHA-256 hashes of leaked synthetic assertions.

Corpus coverage¶

The committed pack covers:

AC-02 remains a documented known gap. Do not publish an actionable reproducer for an unmitigated bypass in this corpus; report it privately through SECURITY.md and add the regression case with its fix.

Add a case¶

Every new JSONL row must:

1. contain a unique id, a catalogued AC-xx id, and a stable attack_type;
2. set synthetic to the JSON boolean true;
3. include at least one expected_protected assertion whose value appears in the case text; and
4. use only generated, documentation-only fixtures with no real PHI.

The loader rejects missing assertions, unknown abuse-case-id shapes, duplicate ids or JSON keys, unsupported fields, malformed or non-UTF-8 JSON, and any row not explicitly marked synthetic. It also bounds corpus bytes, case count, case text, assertions per case, and de-identified output size; repeated assertions and comparison values that normalize to an empty string are rejected.