Byrne-Anon
85M PII detector / anonymizer. BIOES tag per token, then redact the spans. SpikeWhale (Byrne) backbone plus a small token-classification head (hidden 640 → 33 BIOES labels).
Eight categories:
private_person, private_email, private_phone, private_address, private_url,
private_date, account_number, and secret (API keys, passwords, tokens, PINs).
Benchmark vs. openai/privacy-filter
I ran this against the 1.4B openai/privacy-filter token-classifier on
200 samples, per-token PII labels. ~1/16 the params, tagging tracks
closely. Full 200-sample dump:
eval_samples_200.jsonl.
| Metric | Result |
|---|---|
| Per-token agreement (all tokens) | 96.27% |
| Entity agreement (PII tokens only) | 90.52% |
| Macro-F1 over PII classes | 89.10 |
Per-category token-level scores:
| Category | Precision | Recall | F1 |
|---|---|---|---|
| private_email | 94.6 | 99.6 | 97.1 |
| private_url | 95.0 | 99.3 | 97.1 |
| account_number | 86.7 | 94.0 | 90.2 |
| private_address | 85.3 | 95.7 | 90.2 |
| private_date | 94.3 | 84.7 | 89.2 |
| private_person | 90.9 | 78.5 | 84.2 |
| secret | 79.8 | 87.8 | 83.6 |
| private_phone | 98.2 | 69.1 | 81.2 |
Usage
from byrne_anon import ByrneAnon
anon = ByrneAnon(".")
anon.detect("Email me at sarah.j@example.com or call 415-555-0182.")
# [{'type': 'private_email', 'text': 'sarah.j@example.com', 'start': 11, 'end': 31},
# {'type': 'private_phone', 'text': '415-555-0182', 'start': 39, 'end': 52}]
anon.redact("Ship to 1600 Pennsylvania Avenue NW, Washington DC 20500.")
# 'Ship to [PRIVATE_ADDRESS], [PRIVATE_ADDRESS].'
detect() returns entities with byte offsets. redact() replaces them with
[TYPE] placeholders.
Files
| File | Purpose |
|---|---|
model.safetensors, config.json | SpikeWhale backbone weights + config |
pii_head.pt | token-classification head (640 → 33 BIOES) |
pii_labels.json | id → BIOES label map |
tokenizer.json, tokenizer_config.json | byte-level SpikeTokenizer |
byrne_anon.py | self-contained detect() / redact() API |
model_v2.py, config.py, spike_tokenizer.py | SpikeWhale architecture + tokenizer |
Limitations
- English-centric evaluation.
- Strongest on emails, URLs, accounts, addresses. Weaker:
private_phonerecall andsecretprecision. Unusual emails (+tags, very short, very long local parts) may be only partially tagged. - Span boundaries can include a leading space or clip by a token. Treat detections as approximate spans for redaction, not exact character forensics.
- Custom architecture: load via the bundled
byrne_anon.py(local modeling code, no remote code execution).
Citation
@misc{byrne2026byrneanon,
title = {Byrne-Anon: A Compact 85M PII Detector and Text Anonymizer},
author = {Byrne, Dean},
year = {2026},
howpublished = {\url{https://huggingface.co/Quazim0t0/Byrne-Anon}},
}
License
Apache-2.0.