Masker
masker is a multilingual token classifier for personally identifiable information (PII), covering 23 European languages. It is the neural half of a two-part redaction system: this model tags contextual PII: names, addresses, ages, dates.
A separate, dependency-free rules layer handles structured PII (IBANs, cards, national IDs) with real checksum validation.
On any span where both fire, the checksum-validated rule takes precedence; everywhere else the model decides. This repository is the neural half, and the full-accuracy reference model of the family.
📱 Need something small enough to run on a phone or in a web-browser? See masker-mini. A 6-layer distillation shipped as ONNX and 4-bit Core ML, down to ~17 MB.
Model type & training
Masker is a DeBERTa-v3 token classifier fine-tuned from
microsoft/mdeberta-v3-base
on ai4privacy/pii-masking-openpii-1m.
It is trained with boundary-first BIOES supervision.
After fine-tuning, the model's vocabulary was pruned from mDeBERTa's 250K SentencePiece pieces to the 136,671 tokens actually present in the training corpus. Because every used token is retained (byte-fallback covers the rest), the prune is lossless on in-distribution text; it shrinks the embedding table by ~45% (278M → 190M parameters). Weights are stored in bfloat16.
The head predicts 12 entity types (48 BIOES labels + O):
GIVEN_NAME, SURNAME, CITY, STREET_NAME, BUILDING_NUMBER, ZIP_CODE,
PHONE, EMAIL, CREDIT_CARD, DATE, AGE, GOVERNMENT_ID.
GOVERNMENT_ID collapses passport / national-ID / SSN / tax / driver-license
numbers, which the rules layer disambiguates by checksum and format. Other
structured types (IBAN, IP, URL, etc.) are owned entirely by the rules layer and
are not part of this head.
Usage
from transformers import AutoTokenizer, AutoModelForTokenClassification
import torch
tok = AutoTokenizer.from_pretrained("amsintelligence/masker")
model = AutoModelForTokenClassification.from_pretrained("amsintelligence/masker").eval()
text = "Kundin Beatrix Möller, geb. 04.07.1979, Rosenweg 8, 50667 Köln."
enc = tok(text, return_tensors="pt", return_offsets_mapping=True)
offsets = enc.pop("offset_mapping")[0]
with torch.no_grad():
labels = model(**enc).logits.argmax(-1)[0]
for (a, b), lab in zip(offsets.tolist(), labels.tolist()):
if b > a and model.config.id2label[lab] != "O":
print(text[a:b], "->", model.config.id2label[lab])
The raw output is per-token BIOES labels; turning those into character spans and
merging them with the rules layer is handled by the companion mask package.
Evaluation
Measured on the openpii-1m validation split (span-level, boundary-exact).
Overall
| metric | value |
|---|---|
| Strict span F1 | 0.982 |
| Typed F1 | 0.995 |
| Typed precision | 0.994 |
| Typed recall | 0.996 |
| Leak-safe recall | 0.9996 |
Per-type strict F1
| entity | F1 |
|---|---|
| 1.000 | |
| DATE | 1.000 |
| PHONE | 0.999 |
| GOVERNMENT_ID | 0.999 |
| CREDIT_CARD | 0.999 |
| ZIP_CODE | 0.997 |
| CITY | 0.996 |
| STREET_NAME | 0.992 |
| BUILDING_NUMBER | 0.992 |
| AGE | 0.985 |
| GIVEN_NAME | 0.940 |
| SURNAME | 0.935 |
Person names are the hardest category; every other type is ≥ 0.985.
Limitations & biases
- In-distribution evaluation. openpii-1m is synthetic / templated. These numbers are an upper bound on a friendly distribution and may be lower on real-world, out-of-distribution text. Validate on your own data before relying on it.
- Not a substitute for review in high-stakes settings. No detector is perfect; design for residual leakage.
Credits & attribution
This model is a derivative work and would not exist without:
- Backbone:
microsoft/mdeberta-v3-baseby Microsoft — MIT License. DeBERTaV3: He, Gao & Chen, 2021 (arXiv:2111.09543). - Training data:
ai4privacy/pii-masking-openpii-1mby Ai4Privacy — CC-BY-4.0. Attribution required; please retain this credit in downstream use.
License
Licensed under the Offchain Studio Source License, Version 1.0, a source-available license. Full terms: https://ai.basement.dev/license.
Commercial-license requests: licensing@basement.dev.
See the accompanying NOTICE file; its Required
Notice line MASKER © 2026 Offchain Studio must be retained in
redistribution.
The underlying components keep their own (attribution-only) terms, retained in Credits above: the mDeBERTa lineage is MIT and the openpii training data is CC-BY-4.0.
Citation
@software{masker,
title = {masker: multilingual PII detection for 23 European languages},
year = {2026},
note = {DeBERTa-v3 token classifier, boundary-first BIOES supervision},
url = {https://huggingface.co/amsintelligence/masker}
}