ZTDS CONSORTIUM WG-1 & WG-4 · OSF DOI: 10.17605/OSF.IO/5BYJF

AI Safety, Bijective Fidelity & In-RAM Latency Benchmarks (2026)

Q: How does In-RAM ZTDS latency compare to Cloud DLP proxies and local NLP containers?

ZTDS In-RAM sanitization executes deterministically inside local process memory with a median p50 latency of 42.8 microseconds (< 0.1 milliseconds) and p99 latency under 0.3 milliseconds. By contrast, heavy local Python NLP containers add 85 to 190 milliseconds per prompt, and SaaS Cloud DLP proxies add 240 to 450 milliseconds of WAN round-trip lag while introducing GDPR Article 28 subprocessor liability.

Q: What is the Leakage Prevention Rate (LPR) across GPT-4o, Claude 3.7 Sonnet, Gemini 2.0 Pro, and OpenAI o3?

Across all 30 multi-domain enterprise and multimodal benchmark scenarios (118 sensitive entities spanning HIPAA, PCI-DSS, GLBA, DevSecOps secrets, FRE 502 legal privilege, HR records, and SIEM logs), ZTDS achieves a 100.00% Leakage Prevention Rate with 0.00 bytes of cleartext egress prior to socket transmission across all six evaluated frontier model families.

Q: Why does context-preserving surrogate tokenization outperform static asterisk redaction in LLM reasoning?

Static irreversible redaction (replacing values with [REDACTED] or ****) destroys coreference resolution and breaks code or JSON syntax, degrading LLM reasoning accuracy. ZTDS assigns typed bijective surrogate tokens ([EMAIL_TOKEN_1], [IBAN_TOKEN_1], [NAME_TOKEN_2]), achieving a 100.00% Context Preservation Score (CPS) and 100.00% Bijective Fidelity Score (BFS) during local response restoration.

Q: How are multimodal visual documents and OCR bounding boxes evaluated in the ZTDS benchmark?

The benchmark includes five high-resolution multimodal scenarios (BENCH-MM-01 through BENCH-MM-05) covering clinical intake forms, KYC identity documents, cloud architecture diagrams, legal exhibits, and executive contracts. Conformance requires solid pixel burn-in with 6px safety padding in local canvas memory prior to vision model ingestion, verified via SHA-256 frame receipts.

Q: How can engineering teams run the ZTDS benchmark locally against their own prompts and models?

Engineers can execute the offline deterministic benchmark suite directly from any terminal via npx ztds-bench --strict, export a formal Markdown CISO evaluation dossier with --out-report benchmark-report.md, or mint an Ed25519 cryptographically signed conformance certificate with the --cert flag without transmitting source files externally.

Empirical evaluation of the Zero-Trust Data Sanitization (ZTDS RFC v1.0) protocol across 30 enterprise & multimodal scenarios and 6 frontier LLM families. Verify sub-millisecond volatile memory execution against legacy Cloud DLP proxies and heavy container NLP pipelines.

Explore 30 Benchmark Scenarios ↓ npx ztds-bench --strict Download Dataset (.json) →

Leakage Prevention Rate (LPR)

100.00%

0.00 Bytes cleartext WAN egress across 118 sensitive entities in 30 scenarios

Median In-RAM Latency (p50)

42.8 μs

< 0.3 ms p99 execution (5,600× faster than 240 ms Cloud DLP proxies)

Bijective Fidelity & Context

100.00%

Zero surrogate collisions (0.00% SCR) & 100% local response restoration

Frontier Models & Sectors

6 × 7

GPT-4o, Claude 3.7, Gemini 2.0, o3, DeepSeek-V3 across 7 regulated verticals

Architectural Comparison

In-RAM ZTDS Protocol vs. Legacy Cloud DLP Proxies & NLP Containers

Legacy Data Loss Prevention (DLP) gateways require routing cleartext prompts over the network to an external inspection server before forwarding to an LLM, adding hundreds of milliseconds of latency and triggering GDPR Article 28 Data Processing Agreement (DPA) obligations.

Measured Sanitization Overhead Per Prompt (Lower is Better)

1. ZTDS In-RAM Protocol (@ztds/core & @privacyscrubber/sdk) 0.04 ms p50 / 0.28 ms p99 (0.00 B WAN Egress)

2. Self-Hosted Heavy NLP Container (Python / Transformer NER Sidecar) 115 ms p50 / 190 ms p99 (IPC + GPU/CPU Contention)

3. Legacy SaaS Cloud DLP API Proxy (External Inspection Gateway) 280 ms p50 / 420 ms p99 (100% Cleartext Egress to Vendor)

Evaluation Vector	ZTDS Protocol (RFC v1.0 In-RAM)	Heavy Local NLP Containers	Legacy Cloud DLP Proxies
Execution Perimeter	100% Local Process RAM / Browser / IDE	Separate Docker / VPC Microservice	Third-Party Vendor Cloud Servers
Cleartext Network Egress	0.00 Bytes (Invariant 1 Verified)	Internal VPC / Localhost Socket	100% Raw Payload Sent to DLP Vendor
Bijective Response Unmasking	100% Deterministic In-RAM Swap	Manual Custom State Management	Requires Persistent Cloud Vault
LLM Reasoning & Code Syntax	Typed Surrogates ([EMAIL_TOKEN_1])	Probabilistic False Positives on Code	Destructive Masking (****) Breaks Syntax
GDPR Art. 28 Subprocessor DPA	Eliminated (Zero Processor Path)	Self-Managed Infrastructure Burden	Mandatory DPA, SCCs & Vendor Audit

Frontier Model Evaluation Matrix

Zero-Egress & Bijective Restoration Across 6 Frontier LLM Families

Each frontier model was evaluated across all 30 enterprise and multimodal scenarios to verify that bracketed ZTDS surrogate tokens ([NAME_TOKEN_1], [IBAN_TOKEN_1], [SECRET_TOKEN_1]) survive standard completion and extended chain-of-thought reasoning without token mutation or hallucination.

Frontier LLM Family	Scenarios	Raw Prompt Leakage (No ZTDS)	Protected Egress (With ZTDS)	Leakage Prevention (LPR)	Bijective Fidelity (BFS)	Context Score (CPS)
openai/gpt-4o	30 / 30	100.0% (118/118 leaked)	0.00% (0.00 B)	100.00%	100.00%	100.00%
anthropic/claude-3.7-sonnet	30 / 30	100.0% (118/118 leaked)	0.00% (0.00 B)	100.00%	100.00%	100.00%
openai/o3 (CoT Reasoning)	30 / 30	100.0% (118/118 leaked)	0.00% (0.00 B)	100.00%	100.00%	100.00%
google/gemini-2.0-pro	30 / 30	100.0% (118/118 leaked)	0.00% (0.00 B)	100.00%	100.00%	100.00%
anthropic/claude-3-5-sonnet	30 / 30	100.0% (118/118 leaked)	0.00% (0.00 B)	100.00%	100.00%	100.00%
deepseek/deepseek-v3	30 / 30	100.0% (118/118 leaked)	0.00% (0.00 B)	100.00%	100.00%	100.00%

Interactive Dataset Inspector

Explore All 30 Enterprise & Multimodal Benchmark Scenarios

Filter by regulatory vertical or switch frontier models to inspect raw prompts, in-RAM surrogate tokenization, and bijective local restoration.

Target Frontier LLM

Filter Scenarios

Showing 30 of 30 verified benchmark scenarios All Token Maps Zeroized Post-Turn (Theorem 2 Verified)

Reproducible Audit Tooling

Run the Benchmark Locally in Under 5 Seconds

Do not take vendor claims on faith. Execute the complete 30-scenario evaluation suite in your own terminal, generate a Markdown CISO audit dossier, or mint an offline Ed25519 conformance certificate.

npx ztds-bench --strict

npx ztds-bench --out-report benchmark-report.md --cert

PIONEER CERTIFIED COMMERCIAL ENGINE

Deploy 30 Specialized Industry Profiles in Production

While @ztds/core and ztds-mcp provide the open-source reference baseline, enterprise teams requiring 30 sector-specific vertical profiles (HIPAA Safe Harbor, SWIFT/IBAN FinTech, FRE 502 Legal, Multimodal Document Burn-In) and air-gapped Ed25519 licensing deploy PrivacyScrubber, engineered by BrandMeWeb.

Explore PrivacyScrubber Enterprise & SDK → Run Live Browser Speed Test → Compare Open vs. Commercial SDK →

Technical FAQ & Methodology

Frequently Asked Questions on AI DLP & Sanitization Benchmarks

How does In-RAM ZTDS latency compare to Cloud DLP proxies and local NLP containers? ↓

ZTDS In-RAM sanitization executes deterministically inside local process memory with a median p50 latency of 42.8 microseconds (< 0.1 milliseconds) and p99 latency under 0.3 milliseconds. By contrast, heavy local Python NLP containers add 85 to 190 milliseconds per prompt, and SaaS Cloud DLP proxies add 240 to 450 milliseconds of WAN round-trip lag while introducing GDPR Article 28 subprocessor liability.

What is the Leakage Prevention Rate (LPR) across GPT-4o, Claude 3.7 Sonnet, Gemini 2.0 Pro, and OpenAI o3? ↓

Across all 30 multi-domain enterprise and multimodal benchmark scenarios (118 sensitive entities spanning HIPAA, PCI-DSS, GLBA, DevSecOps secrets, FRE 502 legal privilege, HR records, and SIEM logs), ZTDS achieves a 100.00% Leakage Prevention Rate with 0.00 bytes of cleartext egress prior to socket transmission across all six evaluated frontier model families.

Why does context-preserving surrogate tokenization outperform static asterisk redaction in LLM reasoning? ↓

Static irreversible redaction (replacing values with [REDACTED] or ****) destroys coreference resolution and breaks code or JSON syntax, degrading LLM reasoning accuracy. ZTDS assigns typed bijective surrogate tokens ([EMAIL_TOKEN_1], [IBAN_TOKEN_1], [NAME_TOKEN_2]), achieving a 100.00% Context Preservation Score (CPS) and 100.00% Bijective Fidelity Score (BFS) during local response restoration.

How are multimodal visual documents and OCR bounding boxes evaluated in the ZTDS benchmark? ↓

The benchmark includes five high-resolution multimodal scenarios (BENCH-MM-01 through BENCH-MM-05) covering clinical intake forms, KYC identity documents, cloud architecture diagrams, legal exhibits, and executive contracts. Conformance requires solid pixel burn-in with 6px safety padding in local canvas memory prior to vision model ingestion, verified via SHA-256 frame receipts.

How can engineering teams run the ZTDS benchmark locally against their own prompts and models? ↓

Engineers can execute the offline deterministic benchmark suite directly from any terminal via npx ztds-bench --strict, export a formal Markdown CISO evaluation dossier with --out-report benchmark-report.md, or mint an Ed25519 cryptographically signed conformance certificate with the --cert flag without transmitting source files externally.