February 22, 2026
Tamga's core scanner is a deterministic finite automaton (DFA) built on Aho-Corasick. It's fast — typically sub-millisecond for payloads under 512 tokens — and it never hallucinates. But determinism has limits.
A DFA matches patterns. It can tell you that "4242 4242 4242 4242" looks like a credit card number. It can run Luhn and BIN validation to increase confidence. But it can't answer:
These questions require contextual understanding that only ML models can provide.
The key insight: ML inference is too slow for the hot path. Piiranha (a transformer-based PII detection model) takes 50-200ms per inference. You cannot add 200ms to every LLM API call.
Instead, Tamga runs Piiranha as a **shadow sidecar**:
This gives you the best of both worlds: wire-speed detection for known patterns, and ML-powered analysis for ambiguous cases, without adding latency to the user experience.
Out-of-the-box Piiranha (and most PII detection models) are trained primarily on English and a handful of European languages. They struggle with:
We fine-tuned Piiranha on a curated dataset of ~15,000 Turkish PII examples (synthetic + red-team, no real user data) and saw a 12-percentage-point improvement in recall on the TR-specific categories.
The benchmark data and fine-tuning methodology are in the public repo. Clone and run `make redteam-report` to compare DFA-only vs. DFA+Shadow ML numbers.
