RubiNER: general NER component

This is the general-purpose named entity recognition component of RubiNER, the ensemble NER model behind the text anonymisation service of the EOSC SIESTA project (Use Case 4). It is dslim/bert-base-NER fine-tuned on synthetic cyber incident reports, so that it tags both personal data and cybersecurity entities with the entity types the SIESTA service uses.

On its own, this model is not RubiNER. In RubiNER it runs alongside a cybersecurity NER model, pattern recognisers, zero-shot custom entity types and a date/time recogniser, and their outputs are merged. See EOSC SIESTA Deliverable 19.4: Anonymising Cyber Incident Reports for the full design and evaluation.

Labels

25 entity types in BIO format (51 labels):

PER, ORG, LOC, DATE, TIME, JOB_TITLE, AGE, NATIONALITY, USERNAME, PASSWORD, IDENTIFICATION_NUMBER, BANK_OR_CARD_NUMBER, PHONE_NUMBER, EMAIL, MEDICAL_CONDITION, QUANTITY, AMOUNT_OF_MONEY, IP, URL, FILE, HASH, SOFTWARE, OPERATING_SYSTEM, MALWARE, CVE

Training

Base model	dslim/bert-base-NER
Training data	663 annotated reports from 37 seed incidents of S-CECILIA-Gold
Validation	64 reports from 4 further seed incidents (used to choose the epoch)
Held out	All reports from 15 seed incidents, never used for training or tuning
Epochs	8 (best: epoch 6, by validation loss)
Optimiser	AdamW, learning rate 5e-5, weight decay 0.01, 10% linear warm-up
Batch size	16
Long reports	Split into 512-token windows with a 128-token stride

S-CECILIA's annotation types were mapped to the SIESTA entity types as listed in Appendix 1 of D19.4. Three types with no SIESTA equivalent (MAC addresses, system identifiers, event information) were left unlabelled.

S-CECILIA is a synthetic dataset: its personal data is generated, not taken from real people. The dataset is currently under review and will be released once it is accepted.

Usage

from transformers import pipeline

ner = pipeline("token-classification", model="GVIS-ULE/rubiner",
               aggregation_strategy="simple", stride=128)
ner("On 3 March, Jane Doe reported that 10.0.0.5 was contacting evil.example.com.")

Within RubiNER, predictions below a confidence of 0.65 are discarded, as are spans of one or two characters.

Limitations

• English only.
• Trained on synthetic incident reports; performance on other kinds of text may be lower.
• Like other NER models, it may detect some names (for example by origin or gender) less reliably than others.
• Run it as part of RubiNER, not on its own, if the goal is de-identification.

Citation

Anonymising Cyber Incident Reports: Text Anonymisation Tool Evaluation, EOSC SIESTA Deliverable D19.4, 2026.