Masker

masker is a multilingual token classifier for personally identifiable information (PII), covering 23 European languages. It is the neural half of a two-part redaction system: this model tags contextual PII: names, addresses, ages, dates.

A separate, dependency-free rules layer handles structured PII (IBANs, cards, national IDs) with real checksum validation.

On any span where both fire, the checksum-validated rule takes precedence; everywhere else the model decides. This repository is the neural half, and the full-accuracy reference model of the family.

📱 Need something small enough to run on a phone or in a web-browser? See masker-mini. A 6-layer distillation shipped as ONNX and 4-bit Core ML, down to ~17 MB.

Model type & training

Masker is a DeBERTa-v3 token classifier fine-tuned from microsoft/mdeberta-v3-base on ai4privacy/pii-masking-openpii-1m. It is trained with boundary-first BIOES supervision.

After fine-tuning, the model's vocabulary was pruned from mDeBERTa's 250K SentencePiece pieces to the 136,671 tokens actually present in the training corpus. Because every used token is retained (byte-fallback covers the rest), the prune is lossless on in-distribution text; it shrinks the embedding table by ~45% (278M → 190M parameters). Weights are stored in bfloat16.

The head predicts 12 entity types (48 BIOES labels + O):

GIVEN_NAME, SURNAME, CITY, STREET_NAME, BUILDING_NUMBER, ZIP_CODE, PHONE, EMAIL, CREDIT_CARD, DATE, AGE, GOVERNMENT_ID.

GOVERNMENT_ID collapses passport / national-ID / SSN / tax / driver-license numbers, which the rules layer disambiguates by checksum and format. Other structured types (IBAN, IP, URL, etc.) are owned entirely by the rules layer and are not part of this head.

Usage

from transformers import AutoTokenizer, AutoModelForTokenClassification
import torch

tok = AutoTokenizer.from_pretrained("amsintelligence/masker")
model = AutoModelForTokenClassification.from_pretrained("amsintelligence/masker").eval()

text = "Kundin Beatrix Möller, geb. 04.07.1979, Rosenweg 8, 50667 Köln."
enc = tok(text, return_tensors="pt", return_offsets_mapping=True)
offsets = enc.pop("offset_mapping")[0]
with torch.no_grad():
    labels = model(**enc).logits.argmax(-1)[0]
for (a, b), lab in zip(offsets.tolist(), labels.tolist()):
    if b > a and model.config.id2label[lab] != "O":
        print(text[a:b], "->", model.config.id2label[lab])

The raw output is per-token BIOES labels; turning those into character spans and merging them with the rules layer is handled by the companion mask package.

Evaluation

Measured on the openpii-1m validation split (span-level, boundary-exact).

Overall

metric	value
Strict span F1	0.982
Typed F1	0.995
Typed precision	0.994
Typed recall	0.996
Leak-safe recall	0.9996

Per-type strict F1

entity	F1
EMAIL	1.000
DATE	1.000
PHONE	0.999
GOVERNMENT_ID	0.999
CREDIT_CARD	0.999
ZIP_CODE	0.997
CITY	0.996
STREET_NAME	0.992
BUILDING_NUMBER	0.992
AGE	0.985
GIVEN_NAME	0.940
SURNAME	0.935

Person names are the hardest category; every other type is ≥ 0.985.

Limitations & biases

In-distribution evaluation. openpii-1m is synthetic / templated. These numbers are an upper bound on a friendly distribution and may be lower on real-world, out-of-distribution text. Validate on your own data before relying on it.
Not a substitute for review in high-stakes settings. No detector is perfect; design for residual leakage.

Credits & attribution

This model is a derivative work and would not exist without:

Backbone: microsoft/mdeberta-v3-base by Microsoft — MIT License. DeBERTaV3: He, Gao & Chen, 2021 (arXiv:2111.09543).
Training data: ai4privacy/pii-masking-openpii-1m by Ai4Privacy — CC-BY-4.0. Attribution required; please retain this credit in downstream use.

License

Licensed under the Offchain Studio Source License, Version 1.0, a source-available license. Full terms: https://ai.basement.dev/license.

Commercial-license requests: licensing@basement.dev.

The underlying components keep their own (attribution-only) terms, retained in Credits above: the mDeBERTa lineage is MIT and the openpii training data is CC-BY-4.0.

Citation

@software{masker,
  title  = {masker: multilingual PII detection for 23 European languages},
  year   = {2026},
  note   = {DeBERTa-v3 token classifier, boundary-first BIOES supervision},
  url    = {https://huggingface.co/amsintelligence/masker}
}