nym-pii-multilingual-small

Compact multilingual PII token-classification model for the nym anonymization CLI — a 16-layer depth-pruned, vocabulary-pruned student of Wismut/nym-pii-multilingual (mmBERT architecture). 69 MB int8 / 274 MB fp32, 17× smaller than the teacher — and it outperforms the teacher on real-world text.

40 entity types / 81 BIO labels across ~23 languages and 6 scripts (Latin, Cyrillic, CJK, Korean, Arabic, Devanagari), trained with ~20% OCR-style corruption for robustness to scanned/mangled text.

Files

File	Use
model.onnx	fp32 ONNX, 274 MB — nym's default (accuracy-first)
int8/	dynamic-int8 variant (70 MB, per_channel+reduce_range — plain dynamic int8 collapses this architecture). Measured cost vs fp32: in-dist −0.3 F1, non-Latin −1.6, ai4privacy −4.2. Use via token_model = "Wismut/nym-pii-multilingual-small/int8"
tokenizer.json	vocabulary-pruned tokenizer (106,372 of 256,000 tokens; byte-fallback keeps any input representable)

Benchmarks

Span-level, label-agnostic F1 via the nym eval harness:

Benchmark	this model (69 MB)	teacher (1.2 GB)	Rampart (15 MB)
Synthetic held-out (in-distribution)	97.9	96.3	48.5
ai4privacy pii-masking-300k (OOD)	47.4	51.3	57.9*
WikiANN real text, 8 non-Latin languages (char-F1)	59.2	50.9	6.5
WikiANN Latin reference (de/es)	70.6	61.5	58.6

* ai4privacy is Rampart's training distribution and Latin-only. On real multilingual text — the reason this model exists — Rampart's English WordPiece tokenizer cannot represent non-Latin scripts at all (0.0 char-F1 on Arabic), while this model beats its own 1.2 GB teacher (Arabic 56.3 vs 41.4, Hindi 54.9 vs 41.5, Japanese 55.2 vs 43.0).

How it was trained

1. Init: jhu-clsp/mmBERT-small depth-pruned 22→16 layers (evenly spaced, per-layer attention types preserved).
2. Data: 724k exactly-labeled synthetic examples (Wismut/nym-pii-multilingual-data v2) + 161k real Wikipedia passages (22 languages) auto-labeled by the teacher and filtered to high precision.
3. Weak-label handling (the step that matters): for teacher-labeled real text, O tokens are masked from the loss — only verified entity spans supervise — because entities the teacher missed would otherwise train as false negatives. 25% of PII-free real passages are kept with full O supervision to preserve precision. This recipe is why the student beats its teacher on real text.
4. Vocabulary pruning: embedding rows restricted to the 106k tokens the corpora use (+ BPE merge-closure + byte tokens); verified lossless.
5. int8 quantization: plain dynamic int8 collapses this architecture (~15% token agreement); per_channel=True, reduce_range=True recovers it to 99.6% agreement with the benchmark deltas quoted above. Always re-benchmark quantized variants — token-level spot checks can mislead.

Training pipeline: scripts/ in the nym repo (datagen/, prune/, train_ner.py).

Use with nym

[ner]
enabled = true
backend = "tokens"
token_model = "Wismut/nym-pii-multilingual-small"        # fp32, accuracy-first
# token_model = "Wismut/nym-pii-multilingual-small/int8" # 70 MB, small accuracy cost
threshold = 0.5

Limitations

• The pruned tokenizer + ONNX layout targets nym / onnxruntime; for transformers fine-tuning use the teacher repo.
• Trained partly on teacher-labeled Wikipedia text (CC-BY-SA source text; not redistributed here). Labels for real text are machine-generated: precision- filtered, recall-imperfect.
• Higher recall / lower precision than the teacher on messy Latin-script forms data (see ai4privacy row) — it flags more aggressively, which for anonymization is usually the safer direction.
• No claim of HIPAA/GDPR compliance by itself; it is a detection component.

License

MIT (inherited from mmBERT-small). The synthetic training data contains no real personal information; the real-text training corpus is not distributed with this model.