No detector I have tested catches everything a masking layer needs. Two registered experiments measured the same frozen data with two different systems, and each missed a different category by a wide margin. The numbers, not an impression, say which one and by how much.

Key takeaways

A small open PII model (GLiNER2-PII) misses most surnames, recall 0.291, while reaching near-perfect email and phone detection, 1.000 and 0.995, on the same frozen sample.

An ensemble of standard open components, pattern recognisers plus a multilingual NER model, fixes surnames, recall 0.970, but its phone recall drops to 0.400 on the same data.

Neither configuration dominates: the choice is which failure mode is cheaper for a given pipeline, not which system is better.

Detection before the prompt is not the whole surface.…