--- license: other license_name: offchain-studio-source-license-1.0 license_link: https://ai.basement.dev/license library_name: transformers pipeline_tag: token-classification base_model: microsoft/mdeberta-v3-base base_model_relation: finetune datasets: - ai4privacy/pii-masking-openpii-1m language: - bg - cs - da - de - el - en - es - et - fi - fr - hr - hu - it - lt - lv - nl - pl - pt - ro - sk - sl - sr - sv tags: - token-classification - pii - pii-detection - pii-masking - redaction - privacy - deberta-v3 metrics: - f1 model-index: - name: masker results: - task: type: token-classification name: PII span detection dataset: name: pii-masking-openpii-1m (validation) type: ai4privacy/pii-masking-openpii-1m metrics: - type: f1 name: Strict span F1 value: 0.982 - type: f1 name: Typed F1 value: 0.995 - type: recall name: Leak-safe recall value: 0.9996 --- # Masker **masker** is a multilingual token classifier for personally identifiable information (PII), covering **23 European languages**. It is the neural half of a two-part redaction system: this model tags _contextual_ PII: names, addresses, ages, dates. A separate, dependency-free rules layer handles _structured_ PII (IBANs, cards, national IDs) with real checksum validation. On any span where both fire, the checksum-validated rule takes precedence; everywhere else the model decides. This repository is the neural half, and the **full-accuracy reference model** of the family. 📱 Need something small enough to run on a phone or in a web-browser? See [**masker-mini**](https://huggingface.co/amsintelligence/masker-mini). A 6-layer distillation shipped as ONNX and 4-bit Core ML, down to ~17 MB. ## Model type & training Masker is a **DeBERTa-v3 token classifier** fine-tuned from [`microsoft/mdeberta-v3-base`](https://huggingface.co/microsoft/mdeberta-v3-base) on [`ai4privacy/pii-masking-openpii-1m`](https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1m). It is trained with **boundary-first BIOES supervision**. After fine-tuning, the model's **vocabulary was pruned** from mDeBERTa's 250K SentencePiece pieces to the **136,671** tokens actually present in the training corpus. Because every used token is retained (byte-fallback covers the rest), the prune is lossless on in-distribution text; it shrinks the embedding table by ~45% (278M → 190M parameters). Weights are stored in **bfloat16**. The head predicts **12 entity types** (48 BIOES labels + `O`): `GIVEN_NAME`, `SURNAME`, `CITY`, `STREET_NAME`, `BUILDING_NUMBER`, `ZIP_CODE`, `PHONE`, `EMAIL`, `CREDIT_CARD`, `DATE`, `AGE`, `GOVERNMENT_ID`. `GOVERNMENT_ID` collapses passport / national-ID / SSN / tax / driver-license numbers, which the rules layer disambiguates by checksum and format. Other structured types (IBAN, IP, URL, etc.) are owned entirely by the rules layer and are not part of this head. ## Usage ```python from transformers import AutoTokenizer, AutoModelForTokenClassification import torch tok = AutoTokenizer.from_pretrained("amsintelligence/masker") model = AutoModelForTokenClassification.from_pretrained("amsintelligence/masker").eval() text = "Kundin Beatrix Möller, geb. 04.07.1979, Rosenweg 8, 50667 Köln." enc = tok(text, return_tensors="pt", return_offsets_mapping=True) offsets = enc.pop("offset_mapping")[0] with torch.no_grad(): labels = model(**enc).logits.argmax(-1)[0] for (a, b), lab in zip(offsets.tolist(), labels.tolist()): if b > a and model.config.id2label[lab] != "O": print(text[a:b], "->", model.config.id2label[lab]) ``` The raw output is per-token BIOES labels; turning those into character spans and merging them with the rules layer is handled by the companion `mask` package. ## Evaluation Measured on the openpii-1m validation split (span-level, boundary-exact). **Overall** | metric | value | | ---------------- | --------- | | Strict span F1 | **0.982** | | Typed F1 | 0.995 | | Typed precision | 0.994 | | Typed recall | 0.996 | | Leak-safe recall | 0.9996 | **Per-type strict F1** | entity | F1 | | --------------- | ----- | | EMAIL | 1.000 | | DATE | 1.000 | | PHONE | 0.999 | | GOVERNMENT_ID | 0.999 | | CREDIT_CARD | 0.999 | | ZIP_CODE | 0.997 | | CITY | 0.996 | | STREET_NAME | 0.992 | | BUILDING_NUMBER | 0.992 | | AGE | 0.985 | | GIVEN_NAME | 0.940 | | SURNAME | 0.935 | Person names are the hardest category; every other type is ≥ 0.985. ## Limitations & biases - **In-distribution evaluation.** openpii-1m is synthetic / templated. These numbers are an upper bound on a friendly distribution and may be lower on real-world, out-of-distribution text. Validate on your own data before relying on it. - Not a substitute for review in high-stakes settings. No detector is perfect; design for residual leakage. ## Credits & attribution This model is a derivative work and would not exist without: - **Backbone:** [`microsoft/mdeberta-v3-base`](https://huggingface.co/microsoft/mdeberta-v3-base) by Microsoft — **MIT License**. DeBERTaV3: He, Gao & Chen, 2021 ([arXiv:2111.09543](https://arxiv.org/abs/2111.09543)). - **Training data:** [`ai4privacy/pii-masking-openpii-1m`](https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1m) by **Ai4Privacy** — **CC-BY-4.0**. Attribution required; please retain this credit in downstream use. ## License Licensed under the **Offchain Studio Source License, Version 1.0**, a source-available license. Full terms: . Commercial-license requests: `licensing@basement.dev`. See the accompanying **`NOTICE`** file; its Required Notice line _MASKER © 2026 Offchain Studio_ must be retained in redistribution. The underlying components keep their own (attribution-only) terms, retained in Credits above: the mDeBERTa lineage is **MIT** and the openpii training data is **CC-BY-4.0**. ## Citation ```bibtex @software{masker, title = {masker: multilingual PII detection for 23 European languages}, year = {2026}, note = {DeBERTa-v3 token classifier, boundary-first BIOES supervision}, url = {https://huggingface.co/amsintelligence/masker} } ```