Caveman.PrivacyGuard
1.5.0
dotnet add package Caveman.PrivacyGuard --version 1.5.0
NuGet\Install-Package Caveman.PrivacyGuard -Version 1.5.0
<PackageReference Include="Caveman.PrivacyGuard" Version="1.5.0" />
<PackageVersion Include="Caveman.PrivacyGuard" Version="1.5.0" />
<PackageReference Include="Caveman.PrivacyGuard" />
paket add Caveman.PrivacyGuard --version 1.5.0
#r "nuget: Caveman.PrivacyGuard, 1.5.0"
#:package Caveman.PrivacyGuard@1.5.0
#addin nuget:?package=Caveman.PrivacyGuard&version=1.5.0
#tool nuget:?package=Caveman.PrivacyGuard&version=1.5.0
Caveman.PrivacyGuard
PII and privacy analyzer for AI and LLM workflows. It detects, scores and masks personal data before text reaches a model, with checksum validators for national identifiers of 32 countries (27 EU members, UK, Switzerland, China, Russia, Ukraine), compliance flags (GDPR, AI Act, NIS2, PCI-DSS, NIST 800-53) and rules driven by YAML. It is thread-safe, has no required external service and ships its rules inside the package.
Version 1.5.0 targets .NET 10 and netstandard2.0.
Install
dotnet add package Caveman.PrivacyGuard
Quick start
using Caveman.PrivacyGuard;
var analyzer = new PrivacyAnalyzer { EnableAutoMasking = true };
var session = new PrivacySession();
var result = analyzer.Analyze("Il mio CF e RSSMRA80A01H501U, chiamami al cellulare 3389123456", "it", session);
Console.WriteLine(result.MaskedText); // placeholders such as [PG_1]
Console.WriteLine(result.RiskLevel);
string restored = PrivacyAnalyzer.RestoreText(modelAnswer, session); // put the real values back in the reply
What it detects
| Group | Examples |
|---|---|
| Identifiers | National IDs and tax codes with checksum (Italian CF and VAT, German Steuer-ID, French NIR, Spanish NIF, Polish PESEL, Dutch BSN...) |
| Finance | IBAN, credit card (Luhn), monetary amounts |
| Contact | E-mail, phone numbers, URLs |
| Network | IP addresses, CIDR and ranges |
| Credentials | JWT, passwords and secrets |
| Other | Dates of birth, document protocol numbers, vehicle plates, GPS coordinates, case numbers |
A value that fails its checksum is never detected or masked. A bare number needs a context keyword nearby ("tel", "cellulare", "iban"...).
New in 1.5.0
Anti-triggers: fewer false positives
A keyword such as "numero" confirms a phone number, but a label of another kind can be closer to the digits: in "numero fattura 3389123456" the number is an invoice. Words such as invoice, order, article code, protocol, serial, SKU, tracking, reference, batch and year (Italian, English, French, German, Spanish, Portuguese, Dutch, Polish) now mark a nearby number as a non-personal identifier. The words before the number decide first, and a keyword of the rule wins a tie. A number prefixed with plus is never vetoed.
| Text | Result |
|---|---|
| Per problemi chiamami al cellulare 3389123456 | masked as a phone |
| Il mio numero di telefono e 3389123456, anno 2024 | masked as a phone |
| Il codice articolo del prodotto e 3389123456 | kept |
| numero fattura 3389123456 | kept |
analyzer.UseNegativeContext = true; // default
analyzer.AddNegativeKeywords("pratica interna", "badge"); // your own labels
Rules can carry their own words: negative_keywords on a rule, global_negative_keywords on a rules document.
New and corrected detections
| Category | What is detected |
|---|---|
| IBAN, printed form | Groups separated by space, dot or dash; the match has exactly the length of the country, mod-97 decides |
| Credit card | Also with dots as separators |
| Phone | Landlines starting with 0 are masked whole; more keywords (cellulare, whatsapp, chiamami, handy, movil, celular...) |
| IP Address | IPv4, CIDR and ranges; a network keyword is required, so a version number is not an address |
| URL | Scheme, www and bare domains with a known TLD; trailing punctuation excluded |
| Monetary Amount | Prefix or suffix currency, grouped or decimal amounts |
| Date of Birth | Numeric date next to a birth keyword |
| Document Protocol Number | Prot., Rep., protocollo with or without the number sign |
| Italian VAT Number | Checksum weights corrected: valid numbers were rejected before |
Use RemoveRule with a category name (for example URL) when your use case does not treat it as sensitive.
Main API
| Member | Purpose |
|---|---|
| Analyze, AnalyzeAsync, AnalyzeBatch | Score and detect |
| EnableAutoMasking, MaskedText | Placeholder masking |
| PrivacySession, PrivacySessionManager | Reversible masking, one session per conversation |
| RestoreText | Put real values back in a model answer |
| PrivacyStreamMasker, DocumentMasker | Streaming and file masking (txt, Markdown, CSV) |
| PromptInjectionGuard | Screens untrusted text for injection attempts |
| AddToWhitelist, LoadCustomYaml, LoadCustomJson | Customize rules at runtime |
| UseNegativeContext, AddNegativeKeywords | Anti-trigger control |
| MlDetector | Optional learned confirmation tier |
Disclaimer
This library is a technical aid. It does not replace a Data Protection Impact Assessment or the advice of a Data Protection Officer.
License
MIT. See the LICENSE file in the package.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net5.0 was computed. net5.0-windows was computed. net6.0 was computed. net6.0-android was computed. net6.0-ios was computed. net6.0-maccatalyst was computed. net6.0-macos was computed. net6.0-tvos was computed. net6.0-windows was computed. net7.0 was computed. net7.0-android was computed. net7.0-ios was computed. net7.0-maccatalyst was computed. net7.0-macos was computed. net7.0-tvos was computed. net7.0-windows was computed. net8.0 was computed. net8.0-android was computed. net8.0-browser was computed. net8.0-ios was computed. net8.0-maccatalyst was computed. net8.0-macos was computed. net8.0-tvos was computed. net8.0-windows was computed. net9.0 was computed. net9.0-android was computed. net9.0-browser was computed. net9.0-ios was computed. net9.0-maccatalyst was computed. net9.0-macos was computed. net9.0-tvos was computed. net9.0-windows was computed. net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
| .NET Core | netcoreapp2.0 was computed. netcoreapp2.1 was computed. netcoreapp2.2 was computed. netcoreapp3.0 was computed. netcoreapp3.1 was computed. |
| .NET Standard | netstandard2.0 is compatible. netstandard2.1 was computed. |
| .NET Framework | net461 was computed. net462 was computed. net463 was computed. net47 was computed. net471 was computed. net472 was computed. net48 was computed. net481 was computed. |
| MonoAndroid | monoandroid was computed. |
| MonoMac | monomac was computed. |
| MonoTouch | monotouch was computed. |
| Tizen | tizen40 was computed. tizen60 was computed. |
| Xamarin.iOS | xamarinios was computed. |
| Xamarin.Mac | xamarinmac was computed. |
| Xamarin.TVOS | xamarintvos was computed. |
| Xamarin.WatchOS | xamarinwatchos was computed. |
-
.NETStandard 2.0
- Microsoft.Bcl.AsyncInterfaces (>= 8.0.0)
- Microsoft.Extensions.Logging.Abstractions (>= 8.0.2)
- System.Text.Json (>= 8.0.5)
- System.Threading.Tasks.Extensions (>= 4.5.4)
- YamlDotNet (>= 15.1.6)
-
net10.0
- Microsoft.Extensions.Logging.Abstractions (>= 8.0.2)
- YamlDotNet (>= 15.1.6)
NuGet packages (2)
Showing the top 2 NuGet packages that depend on Caveman.PrivacyGuard:
| Package | Downloads |
|---|---|
|
Caveman.Compliance
AI compliance engine for LLM gateways: one rule registry (risk, action, scope) over PII, secrets, prompt-injection, agent-policy, toxicity, PHI, data-residency and code-vulnerability controls; a traceability matrix to EU AI Act / GDPR / NIS 2 / ISO 42001 articles; a hash-chained audit trail (Art. 12); and technical file, DPIA, FRIA and executive report generated as JSON and as PDF through Stilo. |
|
|
CavemanML
The optional ML tier of the Caveman family, in pure C# (no torch, no onnxruntime, no native code): SynthelionML, a learned per-token prompt compressor (39 languages, 70% target), and PrivacyGuardML, a learned PII confirmation model for Caveman.PrivacyGuard. Models from Hugging Face (digitalsolutionsai), fully offline at inference. |
GitHub repositories
This package is not used by any popular GitHub repositories.
1.5.0: targets .NET 10 (and netstandard2.0). Anti-triggers (negative context): a number next to invoice, order, article code, protocol... is no longer read as a phone number (UseNegativeContext, AddNegativeKeywords, negative_keywords, global_negative_keywords). Wider detection: printed IBAN, IP addresses (CIDR, ranges), URLs, monetary amounts, dates of birth, document protocol numbers, dotted card numbers, landlines starting with 0, more phone keywords. Fixed the Italian VAT checksum. 1.4.0: optional ML confirmation tier - IMlEntityDetector / PrivacyAnalyzer.MlDetector / MlSpan (the learned PrivacyGuardML model ships in the CavemanML package); a failed checksum still vetoes. 1.3.1: False-positive hardening ported from Synthelion 1.2.5 - a failed checksum is never detected or masked, bare numeric formats are gated by requires_context + nearby keyword, short keywords match as whole words, Maltese ID tightened, spaced phone/card numbers. 1.3.0: Streaming & document masking (ported from Synthelion 1.2.5 privacy_stream.py / document_extractor.py). PrivacyStreamMasker: boundary-safe chunked/streaming PII masking with a configurable overlap window (default 512 chars) so patterns spanning a chunk boundary are caught; Feed()/Flush() API for incremental streams and a MaskStream() convenience helper for chunked iterables. PrivacySession.Summary(): redacted placeholder+category view (never the original value) safe to log/display/return over APIs, unlike GetAll()/ToJson() which carry cleartext PII (their XML docs now warn about this). DocumentMasker: streaming masking of plain text, Markdown and CSV files into a "name.masked.ext" copy next to the source (the original is never overwritten) — files are processed in chunks, never loaded whole; CSV rows are read with a minimal RFC-4180-aware reader so quoted multi-line cells survive. Added 12 new regression tests. 1.2.2: NuGet icon restored (caveman-icon.png now packed and referenced via PackageIcon).