feat(model_armor): continue with de-identified text when only SDP matched - #7370

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: Add support for de-identification / sanitization in ModelArmorPlugin #7369

Problem:

ModelArmorPlugin blocks every MATCH_FOUND. That includes a Sensitive Data Protection (SDP) match where the template's SDP advanced config has a de-identify template and Model Armor has already returned the text with the sensitive data transformed, in sdp_filter_result.deidentify_result.data.text. A user who types an email address or phone number gets the blocked message instead of an answer.

Solution:

• New ModelArmorConfig.deidentify_sensitive_data: bool = False. Off by default, so current behavior is unchanged.
• When it is on, and SDP is the only filter that matched, and the SDP result is a de-identify result with text:
  • input: before_model_callback replaces the text parts of the latest user turn in the request with the de-identified text (non-text and thought parts are kept) and lets the call proceed;
  • output: after_model_callback returns a copy of the response with its text, or its live transcription, replaced, marked with custom_metadata={"model_armor_deidentified": True}.
• Everything else still blocks:
  • any other filter that does not report NO_MATCH_FOUND. Model Armor returns de-identified text even when another filter matched (for example a jailbreak attempt that also contains an email address), so the other filters are checked first, and a filter type the code does not know also blocks;
  • an SDP match without de-identified text (a basic SDP config, or an advanced config without a de-identify template).
• The Model Armor guide documents the option and replaces the limitation that said redaction was not supported with one that says the de-identified input is not written back to the session.

The two questions in my comment on #7369 are still open: the shape of the setting (one boolean or one per direction), and whether the text stored in the session should be de-identified too. This PR keeps to the model request as the issue describes; happy to adjust either.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

8 new tests in tests/unittests/integrations/model_armor/: input and output (content and live transcription) continue with the de-identified text, text parts are merged while image and thought parts are kept, another filter match still blocks, a filter without a definite verdict still blocks, an SDP match without de-identified text still blocks, the option is off by default and blocks then. 7 of them fail on main.

pytest tests/unittests/integrations/model_armor
41 passed

pytest tests/unittests -n auto --ignore=tests/unittests/integrations/livekit
2 failed, 16923 passed, 86 skipped, 25 xfailed, 2 xpassed

The 2 failures are not from this change: test_import_loading.py::test_entry_point_loads_only_allowlisted_packages[agent] fails the same way on main in my environment, and test_mcp_session_manager.py::TestMCPSessionManager::test_is_session_disconnected_without_streams is a timing test that passes on its own. integrations/livekit hangs in my environment on main too.

pre-commit run on the changed files is clean, and mypy reports no new errors (the two it reports in _plugin.py are on main too).

Manual End-to-End (E2E) Tests:

Against a real Model Armor template in us-central1: SDP advanced config with a Sensitive Data Protection inspect template (EMAIL_ADDRESS, PHONE_NUMBER) and a de-identify template (replaceWithInfoTypeConfig), plus the prompt injection and jailbreak filter. google-cloud-modelarmor 0.7.1.

With a basic SDP config, a card number and SSN came back as an inspect_result match with no text, which is why that case still blocks.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.