---
title: PII Detection
emoji: 🕵️
colorFrom: purple
colorTo: blue
sdk: docker
app_port: 7860
header: mini
pinned: false
private: true
short_description: Multilingual PII detection with LFM2.5, server-side CPU
---

# PII Detection

Server-side PII detection powered by [`LiquidAI/LFM2.5-Encoder-350M-PII-Detector`](https://huggingface.co/LiquidAI/LFM2.5-Encoder-350M-PII-Detector): a bidirectional LFM2.5 encoder (354M) with a token-classification head, covering 40 PII types across 16 languages. It runs on the Space's CPU; the browser only sends text to `/api/detect` and highlights the returned spans, so nothing is downloaded to the visitor.

## How it works

- `pii.py` — loads the model via its custom modeling code (`trust_remote_code`) and runs the model's own inference-time **hybrid regex decode** (`pii_hybrid_decode.py` + `context_cued.py`, fetched from the model repo): the token classifier locates PII, a validator-gated regex layer owns format-bound types (email/IBAN/credit-card/JWT/…), and cue-gated rules recover structure-less IDs. Spans are enriched with a domain (color), a pretty label, and a redaction tag.
- `app.py` — Flask server: loads the model once, serves the page, and answers `POST /api/detect {text}` with `{spans, redacted, count, ms}`.
- `index.html` / `style.css` — the UI: highlight or redacted view, a per-domain legend, and detection stats.

f32 on CPU (not fp16: x86 has no fast half path; not int8: token-classification boundaries are precision-sensitive) — the same reasoning as the spellchecker / policy-linting Spaces. Threads are matched to the container's CPU quota.

## Setup

The model repo is private, so the Space needs an **`HF_TOKEN`** secret with read access to `LiquidAI/LFM2.5-Encoder-350M-PII-Detector`.