Masker
masker is a multilingual token classifier for personally identifiable
information (PII), covering 23 European languages. It is the neural half of a
two-part redaction system: this model tags contextual PII: names, addresses,
ages, dates.
A separate, dependency-free rules layer handles structured
PII (IBANs, cards, national IDs) with real checksum validation.
On any span where both fire, the checksum-validated rule takes precedence; everywhere else the model
decides. This repository is the neural half, and the full-accuracy reference
model of the family.
📱 Need something small enough to run on a phone or in a web-browser? See
masker-mini. A 6-layer
distillation shipped as ONNX and 4-bit Core ML, down to ~17 MB.
Model type & training
Masker is a
DeBERTa-v3 token classifier fine-tuned from
microsoft/mdeberta-v3-base
on
ai4privacy/pii-masking-openpii-1m.
It is trained with
boundary-first BIOES supervision.
After fine-tuning, the model's vocabulary was pruned from mDeBERTa's 250K
SentencePiece pieces to the 136,671 tokens actually present in the training
corpus. Because every used token is retained (byte-fallback covers the rest), the
prune is lossless on in-distribution text; it shrinks the embedding table by ~45%
(278M → 190M parameters). Weights are stored in bfloat16.
The head predicts 12 entity types (48 BIOES labels + O):
GIVEN_NAME, SURNAME, CITY, STREET_NAME, BUILDING_NUMBER, ZIP_CODE,
PHONE, EMAIL, CREDIT_CARD, DATE, AGE, GOVERNMENT_ID.
GOVERNMENT_ID collapses passport / national-ID / SSN / tax / driver-license
numbers, which the rules layer disambiguates by checksum and format. Other
structured types (IBAN, IP, URL, etc.) are owned entirely by the rules layer and
are not part of this head.
Usage
1from transformers import AutoTokenizer, AutoModelForTokenClassification
2import torch
3
4tok = AutoTokenizer.from_pretrained("amsintelligence/masker")
5model = AutoModelForTokenClassification.from_pretrained("amsintelligence/masker").eval()
6
7text = "Kundin Beatrix Möller, geb. 04.07.1979, Rosenweg 8, 50667 Köln."
8enc = tok(text, return_tensors="pt", return_offsets_mapping=True)
9offsets = enc.pop("offset_mapping")[0]
10with torch.no_grad():
11 labels = model(**enc).logits.argmax(-1)[0]
12for (a, b), lab in zip(offsets.tolist(), labels.tolist()):
13 if b > a and model.config.id2label[lab] != "O":
14 print(text[a:b], "->", model.config.id2label[lab])
The raw output is per-token BIOES labels; turning those into character spans and
merging them with the rules layer is handled by the companion mask package.
Evaluation
Measured on the openpii-1m validation split (span-level, boundary-exact).
Overall
| metric | value |
|---|
| Strict span F1 | 0.982 |
| Typed F1 | 0.995 |
| Typed precision | 0.994 |
| Typed recall | 0.996 |
| Leak-safe recall | 0.9996 |
Per-type strict F1
| entity | F1 |
|---|
| EMAIL | 1.000 |
| DATE | 1.000 |
| PHONE | 0.999 |
| GOVERNMENT_ID | 0.999 |
| CREDIT_CARD | 0.999 |
| ZIP_CODE | 0.997 |
| CITY | 0.996 |
| STREET_NAME | 0.992 |
| BUILDING_NUMBER | 0.992 |
| AGE | 0.985 |
| GIVEN_NAME | 0.940 |
| SURNAME | 0.935 |
Person names are the hardest category; every other type is ≥ 0.985.
Limitations & biases
- In-distribution evaluation. openpii-1m is synthetic / templated. These
numbers are an upper bound on a friendly distribution and may be lower on
real-world, out-of-distribution text. Validate on your own data before relying
on it.
- Not a substitute for review in high-stakes settings. No detector is perfect;
design for residual leakage.
Credits & attribution
This model is a derivative work and would not exist without:
- Backbone:
microsoft/mdeberta-v3-base
by Microsoft — MIT License. DeBERTaV3: He, Gao & Chen, 2021
(arXiv:2111.09543).
- Training data:
ai4privacy/pii-masking-openpii-1m
by Ai4Privacy — CC-BY-4.0. Attribution required; please retain this
credit in downstream use.
License
Licensed under the
Offchain Studio Source License, Version 1.0, a
source-available license. Full terms:
https://ai.basement.dev/license.
Commercial-license requests: licensing@basement.dev.
See the accompanying NOTICE file; its Required
Notice line MASKER © 2026 Offchain Studio must be retained in
redistribution.
The underlying components keep their own (attribution-only) terms, retained in
Credits above: the mDeBERTa lineage is MIT and the openpii training data is
CC-BY-4.0.
Citation
1@software{masker,
2 title = {masker: multilingual PII detection for 23 European languages},
3 year = {2026},
4 note = {DeBERTa-v3 token classifier, boundary-first BIOES supervision},
5 url = {https://huggingface.co/amsintelligence/masker}
6}
