Systematic Detection of Exposed PII in Publicly Shared Documents
Suryakiran Valavala • Arsh Advani • Vijay Arvind Ramamoorthy
UC Santa Cruz • CSE 253: Network Security
Can we systematically detect PII exposed through public sharing links?
Using transparent, lightweight pattern matching
Emails, Phones, Names, Addresses, SSN
100% Client-side processing for safety
Improved regex patterns with false positive filtering
Pastebin (95%+) and Google Docs (60-80%)
100% client-side processing, no server needed
16 documents, 192 PII instances, ground truth
Deployed web application on GitHub Pages
Complete implementation and evaluation code
URL Parsing • Platform Detection • Content Fetching
Regex Pattern Matching • False Positive Filtering
Results Aggregation • Risk Assessment • Recommendations
Different platforms require different approaches to fetch content. Here's how we handle each:
Simple approach: Pastebin provides a special URL format that allows direct access to raw text.
Challenge: Google Docs blocks direct access from browsers (CORS restrictions). We use a two-step approach:
F1-Score: A measure of accuracy (1.000 = perfect, 0.000 = no detection). Higher is better.
Consistent format makes detection reliable
Street addresses follow predictable patterns, but some variations exist
Always formatted as XXX-XX-XXXX
Catches 94% of names, but some false positives (e.g., "Credit Card")
Handles multiple formats, but misses international numbers
Validates with Luhn algorithm, but limited test data
Tested on: 16 documents with 192 PII instances
Out of 100, 84 correct
Find 88 of 100 PII
2 types perfect
Key Takeaway: Emails and SSN are detected perfectly (100%). Addresses work excellently (92%). Names and phones work well (68-72%).
Baseline = Simple patterns (basic regex). Our approach = Enhanced patterns with careful design.
Our system is nearly twice as good as simple baseline patterns
Bottom Line: Simple patterns miss most PII. Our enhanced approach finds much more and adds new capabilities (like address detection).
Four key insights from our evaluation:
Finding: Perfect 100% F1-scores for emails, addresses, and SSN.
Why it matters: You don't always need machine learning. For data with consistent formats, simple regex is both effective and transparent.
Finding: Names: 94.1% recall (catches almost all) but 58.7% precision (some false alarms).
Why it matters: For privacy tools, it's better to alert on potential names (even if some are false) than miss real ones. This is an intentional design choice.
Finding: Everything runs in the browser, no server needed.
Why it matters: Users' documents never leave their device. Privacy is preserved, and no infrastructure costs. Processing is fast (under 500ms).
Finding: +84.3% improvement over simple baseline patterns.
Why it matters: Our careful pattern design and false positive filtering make a huge difference. You can't just use naive regex and expect good results.
Systematic PII detection in shared documents is feasible, effective, and privacy-preserving.