Hager290/gliner2_FT

glliner2_FT: fine-tuned GLiNER2 PII detector (Tier 2 of the DOPPEL AI Privacy Gateway)

glliner2_FT is a fine-tune of fastino/gliner2-privacy-filter-PII-multi (encoder: microsoft/mdeberta-v3-base). It is the semantic detector (Tier 2) of the DOPPEL AI Privacy Gateway: it finds names, addresses, dates, usernames, passwords and similar items that fixed rules cannot recognise by shape.

What fine-tuning changed: the original model flagged about 77% of harmless prompts (git, UUIDs, ISBNs, ordinary dates, environment variables). This model flags about 11% on the same test, while keeping coverage at the original level. It was tuned to be quiet on harmless text, not to find more.

Use it with the rule-based Tier 1. On its own it is weak on ssh user@host usernames and does not label long seed phrases as secrets (see Limitations). The numbers below are on synthetic data; they are not a guarantee on real prompts.

Quick start

from gliner2 import GLiNER2

model = GLiNER2.from_pretrained("Hager290/glliner2_FT")   # private repo: run `hf auth login` or set HF_TOKEN first

text = "John Doe (username: johndoe_99) works as an engineer at OpenAI."
labels = ["person", "username", "organization"]

result = model.extract_entities(text, labels, threshold=0.3, include_confidence=True, include_spans=True)
print(result)

In the DOPPEL repository the engine does this for you, with chunking, label mapping and offsets:

DLP_TIER2_MODEL=Hager290/glliner2_FT
DLP_TIER2_EXTRA_LABELS=organization
HF_TOKEN=<token>          # only while this repository is private

(These variables are read by Tier2Config once the "model and extra labels from environment variables" change is merged.)

Recommended settings

Setting	Value	Why
Threshold	0.3	Low on purpose: a missed secret is a leak. Raising it lost recall without removing many false alarms in our tests.
Labels	the 20 default labels plus organization	organization is not in the default list; the original model flagged tool names as organizations, this one does not (precision 1.00 on our test).
Chunking	384 tokens, 64 overlap	Pipeline default for long text.
Span limit	8 words	The model cannot mark a span longer than 8 words (max_width: 8).

Labels

Label sent to the model	Pipeline label	Fine-tuned?
person	PERSON	yes
full_name, first_name, middle_name, last_name	PERSON	no (inherited from the base model)
date_of_birth	DATE_OF_BIRTH	yes
sensitive_date	SENSITIVE_DATE	yes
address	ADDRESS	yes
street_address	ADDRESS	no (inherited)
city, state_or_region, postal_code, country	LOCATION	yes
username	USERNAME	yes
password	PASSWORD	yes
secret	SECRET	yes
government_id	GOVERNMENT_ID	yes
national_id_number	GOVERNMENT_ID	no (inherited)
passport_number	PASSPORT_NUMBER	yes
drivers_license_number	DRIVERS_LICENSE_NUMBER	yes
organization (extra)	ORGANIZATION	yes

phone_number also appears in the training data, but it is not recommended: Tier 1 already covers phone numbers that have a cue word, and this model's own phone precision was poor (0.21 on a very small sample).

Training

• Method: fine-tuning (LoRA) of the base model. 3 epochs, encoder learning rate 5e-6, task-head learning rate 5e-5, batch size 8 with 2 gradient-accumulation steps, other settings the GLiNER2 trainer defaults. A free Colab GPU. Gentle settings were deliberate: a version trained with 4x larger learning rates forgot dates and addresses.
• Data: 6,500 synthetic examples (95% train, 5% validation) generated from templates; no real people or real prompts. Names, streets and cities come from multi-regional pools; text includes English plus Arabic, Spanish, French and German phrasing.
• Hard negatives (about a quarter of the data): git/docker/vault words, UUIDs, ISBNs, hashes, environment variable names, timestamps, product and order references, ordinary dates, placeholders such as password: ********.
• Long labels: any label longer than 8 words is split into consecutive pieces of at most 6 words, because the model cannot learn longer spans.
• No test leakage: no training text appears in the test sets, and no hold-out organization name is in the data.

Evaluation

Test: 1,498 cases (the team's 298-case synthetic hold-out plus 1,200 synthetic cases with held-out names, streets and templates); 303 of them contain nothing sensitive. Threshold 0.3.

Metric	Base model	v1	v3	v5
Tier 2 alone: leak recall	0.9473	0.9195	0.8599	0.9454
Tier 2 alone: fully missed spans	44	73	114	56
Tier 2 alone: strict P / R / F1	0.394 / 0.875 / 0.543	0.604 / 0.935 / 0.734	0.736 / 0.888 / 0.805	0.589 / 0.933 / 0.722
Combined: leak recall	0.9706	0.9497	0.9036	0.9697
Combined: fully missed spans	14	40	82	23
Combined: strict P / R / F1	0.627 / 0.859 / 0.725	0.910 / 0.909 / 0.909	0.855 / 0.862 / 0.858	0.894 / 0.917 / 0.905
Harmless texts flagged (of 303)	233	30	25	38

"Recall" is leak recall (any overlapping detection counts). "Precision" ignores boundary differences and nested spans. Tier 2 alone: harmless texts flagged 233/303 (original) against 33/303 (glliner2_FT).

Limitations

• SECRET and USERNAME are weak on their own (recall 0.68 and 0.60, and lower than the original model's 0.77 and 0.66). Seed and recovery phrases of 12 to 24 words are not labelled as secrets, and the username inside user@host.tld cannot be marked, because GLiNER2 reads an e-mail-shaped string as one word. The DOPPEL Tier 1 rules (regex) cover both; keep them.
• Spans are limited to 8 words.
• Plain dates can still be flagged as sensitive_date (precision 0.92), for example 2026-12-31 in a meeting note.
• Synthetic evaluation only. The test data comes from templates and is probably easier than real prompts. No real user data was used for training or testing.
• Languages: mostly English, with some Arabic, Spanish, French and German phrasing. Other languages are untested.
• Not a compliance tool. It reduces leaks; it does not guarantee that none occur. Keep a fail-closed policy and a second check after masking.
• Policy effects: in the gateway an ORGANIZATION is replaced by a fake name, so a false alarm on a tool name could rewrite a user's text. Enable organization deliberately.

Version history

Version	Notes
v1	First fine-tune: harmless texts flagged 233 to 30 of 303, but lost recall on secrets and usernames
v3	Stronger training; forgot dates and addresses (not published)
v5 (this model)	Gentle settings, long labels split into pieces; best overall

License and credits

Apache-2.0, the same license as the base model fastino/gliner2-privacy-filter-PII-multi (itself built on microsoft/mdeberta-v3-base, MIT). Evaluation tools, data generator and full report: the eval/detection_ft folder of the repository (once merged).