feat(probes): add propile_sensitive probe for sensitive PII extraction

[frangelbarrera]

Summary

Following up on my comment on #219 (July 8) — no response there, but since the issue is tagged good first issue and has been dormant for 10 months, I'm opening this PR directly. Happy to address any scope concerns here.

This PR adds garak/probes/propile_sensitive.py, extending the ProPILE methodology (Kim et al. 2023, arXiv:2307.01881) to cover sensitive PII types that the base module's Ethics section explicitly excludes: SSN (US), IBAN, passport number, date of birth, and driver's license (US).

What does this PR do?

• Adds garak/probes/propile_sensitive.py with two probe classes:
  • PIILeakSensitiveTwin: twin elicitation (name → 1 sensitive PII type)
  • PIILeakSensitiveTriplet: triplet elicitation (name + auxiliary email/phone → 1 sensitive PII type)
• Adds garak/data/propile_sensitive/ with synthetic data (20 records, 5 sensitive PII types per record) and 25 prompt templates (15 twin + 10 triplet)
• Adds tests/probes/test_probes_propile_sensitive.py (20 tests, all passing)
• Adds docs/source/probes/propile_sensitive.rst + toctree entry in docs/source/index_probes.rst

Both probe classes:

• Subclass PIILeakProbeMixin + Probe (reuse existing template/data loading and the probe() guard)
• Reuse the existing garak.detectors.propile.PIILeak detector — its _generic_partial_match Jaro-Winkler fallback (threshold 0.7) already handles arbitrary PII types, so no new detector is needed
• Ship active=False (consistent with the base ProPILE classes)
• Use synthetic data only: SSN 000-00-NNNN (area/group reserved invalid), IBAN XX00BANK… (XX is not a valid ISO 13616 country code), passport X00000000, driver license X0000000, fictional DOBs. No real victim PII is shipped
• Document a DOB-coverage limitation in the module docstring: Jaro-Winkler similarity falls below the 0.7 threshold for some reformatted dates (e.g., "January 1, 1990" vs canonical "1990-01-01"); verbatim matches are reliably detected

Related issue

Closes #219 (partial — covers sensitive PII types not in original ProPILE)

Non-overlap with existing work

• PR chore: add optional pre-commit hook for garak-report #1594 (ProPILE base module) — extends rather than modifies; new module file, new data directory, no edits to propile.py or its data files
• Draft PR feat(probes): add PII leakage probe #1407 (generic pii.ContainsPII detector + personal.PII probe, dormant since 2025-10-20) — different module path, different detector surface, different scope (ProPILE twin/triplet recipe for specific sensitive types vs generic PII detection). This PR also addresses the review feedback @jmartin-tech left on feat(probes): add PII leakage probe #1407: prompts and detector criteria are separate, PII samples are clearly-invalid synthetic placeholders, matching uses Jaro-Winkler similarity rather than full-string equality, and tests do not reuse the data file as detection criteria
• Issue probe: credit cards #88 / PR feat: add credit card PII probe and detectors #1748 (credit cards) — explicitly out of scope for this module

Type of change

• New probe module
• Bug fix
• Detector addition
• Documentation improvement
• Test addition

Testing

All validation run locally with pip install -e .[tests,lint]:

pytest tests/probes/test_probes_propile_sensitive.py — 20/20 pass
pytest tests/probes/test_probes_propile.py — 24/24 pass (no regression)
pytest tests/detectors/test_detectors_propile.py — 12/12 pass (no regression)
pytest tests/test_docs.py — 671/671 pass (docstring + RST validation)
black --config pyproject.toml --check — clean

No API keys required for the test suite (uses MagicMock config + direct-Attempt pattern from tests/detectors/test_detectors_propile.py:23-31).

AI assistance disclosure

This PR was developed with assistance from Claude (Anthropic), in compliance with AGENTS.md. Claude was used to draft initial module scaffolding, suggest test fixtures consistent with existing garak probe tests, and verify docstring/RST format against tests/test_docs.py. Every changed line was reviewed, understood, and accepted by the human submitter, who wrote the design, the prompt templates, and the test assertions. The commit carries a Co-authored-by: Claude trailer; the human is the sole signatory of the DCO Signed-off-by: trailer.

Checklist

• DCO signed (Signed-off-by: in commit)
• AI assistance disclosed (Co-authored-by: Claude in commit + statement above)
• Conventional Commits format (feat(probes): ...)
• black --check clean
• Tests pass (20 new + 36 existing propile tests + 671 docs tests = 727 total)
• No regression in existing tests
• Documentation added (RST stub + toctree entry)
• Module docstring follows garak conventions (RST, ≥2 paragraphs, Ethics + Limitations sections)
• No real PII in data files (all synthetic with clearly-invalid placeholders)
• No new dependencies added (reuses existing nltk for Jaro-Winkler via propile.PIILeak detector)
• Issue referenced (probe: extraction of personal info from llms #219)
• Non-overlap with existing PRs documented