Protegrity-PII

Protegrity-PII detects personally identifiable information (PII) in text, labeling each span with one of 69 entity types covering names and contact details, financial and government IDs, health data and other sensitive categories. It supports English, Spanish, Portuguese, German, French, Italian and Dutch.

Developed by	Protegrity
Model type	Token classification
Base model	XLM-RoBERTa
Version	1.0.0 (released 2026-10-27)
Paper	Protegrity-PII Technical Report
Contact	hardeep.bassi@protegrity.com, ave.gatton@protegrity.com

Entity types

All 69 entity types

ACCESS_SECURITY_CODE, ACCOUNT_BALANCE, ACCOUNTNAME, ACCOUNTNUMBER, AGE, AMOUNT,
BIC, BUILDING, CARD_EXPIRATION_DATE, CARD_SERVICE_CODE, CARD_TRACK_DATA, CCN,
CITY, COMPANYNAME, COUNTRY, COUNTY, CREDIT_SCORE, CREDITCARDCVV,
CRIMINAL_RECORD, CRYPTO_ADDRESS, CURRENCY, DATE, DEVICE_IDENTIFIER, DRIVERLICENSE,
EMAIL, FAX_NUMBER, FINGERPRINT_DATA, GENDER, GENETIC_DATA, GEOCOORD,
HEALTH_CONDITION, HEALTH_PLAN_BENEFICIARY_NUMBER, IBAN, IDCARD, IMMIGRATION_STATUS, INCOME,
IP, LOGIN_CREDENTIAL, MAC, MEDICAL_RECORD_NUMBER, MOTHERS_MAIDEN_NAME, NAME,
NEURAL_DATA, PASSPORT, PASSWORD, PHONE, PIN, PLACE_OF_BIRTH,
POLITICAL_OPINION, PROFESSIONAL_LICENSE_NUMBER, RACE_ETHNICITY, RELIGIOUS_BELIEF, RETINA_SCAN_DATA, SECADDRESS,
SEX_LIFE_DATA, SEXUAL_ORIENTATION, SSN, STATE, STREET, TIME,
TITLE, TRACKING_IDENTIFIER, TRADE_UNION_MEMBERSHIP, TRANSACTION_HISTORY, URL, USERNAME,
VEHICLE_IDENTIFICATION_NUMBER, VEHICLE_REGISTRATION, ZIPCODE

Training data

The model was trained entirely on synthetic text from Protegrity's LLM-based data generation pipeline; no real personal data was used. About 61% of examples are English, with the remainder split across the other six languages. Most examples are unstructured text.

Evaluation

The model is evaluated on PII-SCOPE, a set of 8,030 synthetic examples spanning HR, finance, healthcare, legal, retail, insurance and IT scenarios, plus four public PII benchmarks. Results use exact span matching: typed metrics require the correct entity type, untyped metrics only the correct span. Each benchmark's labels were mapped to the 69-type taxonomy (see the paper, Appendix B).

Dataset	Typed P	Typed R	Typed F1	Untyped P	Untyped R	Untyped F1
PII-SCOPE	0.902	0.910	0.906	0.905	0.913	0.909
AI4Privacy	0.652	0.696	0.674	0.746	0.797	0.771
Nemotron-PII	0.790	0.691	0.737	0.893	0.781	0.834
Gretel	0.470	0.500	0.484	0.680	0.725	0.702
SPY	0.317	0.887	0.467	0.339	0.948	0.499

Lower precision on some datasets partly reflects real PII left unlabeled in those benchmarks (paper, Section 3.4).

Limitations

• Recall is highest for English and Spanish and lower for French, German, Italian and Dutch (paper, Appendix A). Portuguese is supported but was not evaluated. Other languages are not supported.
• Free-form entities such as names and passwords are harder to detect than structured ones.
• The model does not flag quasi-identifiers that could re-identify someone in combination, and may miss deliberately obfuscated PII.
• Performance on structured and semi-structured text may benefit from domain-specific fine-tuning.

How to use

The repository includes the weights, tokenizer, inference.py and requirements.txt.

hf download Protegrity/protegrity-pii --local-dir protegrity-pii
cd protegrity-pii
pip install -r requirements.txt   # Python 3.10+

python inference.py --text "Contact Jane Doe at jane.doe@example.com or +1 415-555-0134."
python inference.py --input texts.jsonl --output spans.jsonl   # one {"text": ...} per line

From Python:

from inference import load, detect

model, tokenizer = load(".")
spans = detect(model, tokenizer, "Contact Jane Doe at jane.doe@example.com")

The script uses a GPU when available (--device cpu to override) and handles long documents with overlapping 512-token windows.

Tips:

• Tune the threshold. Spans below --threshold (or detect(..., threshold=...)) are dropped. Lower it where a missed span costs more than a false positive, and calibrate on labeled data from your own domain.
• Add validators for structured entities, such as Luhn checks for card numbers or IBAN and national-ID check digits.
• Normalize input with Unicode NFKC and strip zero-width characters before inference.

No training code is released, but the model can be fine-tuned with your own setup.

License and citation

Protegrity-PII is licensed under LICENSE.md for research and non-commercial use. It is derived from XLM-RoBERTa (MIT License).

Please report issues, evasion techniques or harmful failures to the contacts above. If you use this model, please cite the technical report.