ALLSmartArt9-10
Finds and masks special categories of personal data (Art. 9 GDPR: health, ethnic origin, political opinion, religion, trade union membership, genetic and biometric data, sex life and sexual orientation) and criminal offences (Art. 10 GDPR) in German and English text, before a prompt leaves the house.
Name recognisers do not help here: "Frau Berger ist seit der Chemo im Krankenstand" contains a name, but the sensitive part is the chemotherapy. ALLSmartArt9-10 decides whether a section touches such a category and marks the passage that does, so it can be replaced while the rest of the request stays usable.
ALLSmartArt9-10 is one of three privacy models of ALLSmartLLM, where it runs in the privacy layer of the gateway on our own hardware in Austria. See also ALLSmartArt4 (names, organisations, addresses) and ALLSmartArt4i (people identifiable without a name).
klassifikator/ |
4.2B, sequence classification on Qwen3.5-4B (text only). Per section of up to 60 words: besonders (any special category or offence) and nine category scores, independent sigmoids |
stellen/ |
0.3B, token classification on mmBERT-base. Per word: probability that it belongs to the sensitive passage |
| Languages | German, English |
| Speed | GPU (NVIDIA GB10): ≈ 90 ms for a single section, ≈ 30 ms per section in batches of 16. CPU (Ryzen 7 7800X3D, 8 threads, without optimised kernels): ≈ 0.8 s for a short sensitive text, ≈ 2 s for 260 harmless words |
Categories: gesundheit (health), herkunft (racial or ethnic origin), politik (political opinion), religion
(religious or philosophical belief), gewerkschaft (trade union membership), genetik, biometrie, sexualitaet
(sex life, sexual orientation), straftat (criminal convictions and offences, Art. 10).
Frau Berger ist seit der Chemo im Krankenstand, bitte die Übergabe an Tom. Das Meeting ist um 10 Uhr.
Frau Berger ist <<PRIVACY_1>> die Übergabe an Tom. Das Meeting ist um 10 Uhr. [gesundheit]
Our new colleague in Leeds is a member of Unite and attends the mosque on Fridays, so please avoid scheduling meetings then.
Our new colleague in Leeds is <<PRIVACY_1>>, so please avoid scheduling meetings then. [religion]
Bitte das Angebot für die Schulung bis Freitag an Frau Huber schicken.
(unchanged)
The placeholder is neutral on purpose: <<GESUNDHEIT_1>> would reveal the category itself. Names are left to a
name recogniser such as ALLSmartArt4.
Usage
beispiel.py in this repository contains the complete chain used in production:
from beispiel import maskiere, Gesperrt
text, befund = maskiere("Frau Berger ist seit der Chemo im Krankenstand, bitte die Übergabe an Tom.")
- Split the text into sections of at most 60 words at sentence boundaries (the classifier was trained on these).
- Classify every section;
besonders≥ 0.5 counts as sensitive. - Sensitive sections: the span model marks the passage, it is replaced.
- Check again. If the section is still sensitive, the frame around the passage still carries the category ("diagnosed with <>"); then the sensitive sentences are replaced as a whole.
- Still sensitive after that:
Gesperrtis raised. Fail closed, do not send the text on.
On CPU, transformers uses a slow reference implementation for the linear-attention layers of Qwen3.5. If
flash-linear-attention is installed but no GPU is used, its Triton kernels fail; uninstall it for CPU use.
When loading the classifier, transformers reports the model.visual.* weights as MISSING. That is expected: the
vision tower of the base model was removed, the classifier only reads text and never uses it.
Evaluation
Test sets created and annotated independently of the training data, never used for training or model selection. Threshold 0.5 throughout.
Classifier, sensitive texts found / harmless texts flagged / precision:
| found | false alarms | precision | |
|---|---|---|---|
| Blind set 5: 300 texts, 151 sensitive (65 only indirectly), 149 harmless (112 hard counterparts) | 144 / 151 (95.4 %) | 14 / 149 | 91.1 % |
| Blind set 3: 300 texts, 140 sensitive, 160 harmless | 134 / 140 (95.7 %) | 7 / 160 | 95.0 % |
"Hard counterparts" are harmless texts that look sensitive: general statements about health or politics without a specific person, disease names in product or room names, a priest as a job title.
Whole chain (classifier, span model, check, sentence fallback):
| passages hit (≥ 80 % replaced) | sensitive after masking | harmless texts changed | |
|---|---|---|---|
| Blind set 5 (160 passages) | 135 (84 %) | 7 / 151 | 14 / 149 |
| Blind set 3 (162 passages) | 149 (92 %) | 6 / 140 | 7 / 160 |
| Blind set 2 (360 texts, 222 passages) | 196 (88 %) | 10 / 169 | 8 / 191 |
"Sensitive after masking" are texts in which the classifier still fires after span replacement; in the chain they go to the sentence fallback, not out unmasked.
Long documents (40 documents of 700 to 2,800 words, minutes, mail threads, reports; 70 annotated passages): 49 of 70 passages found in 37 documents, 3 documents blocked as a whole, 17 masked passages in paragraphs without a sensitive passage.
Limitations
- Masking removes the which, not always the whether. "I've been diagnosed with <>" still says that the person has a diagnosis, which under Art. 9 is already health data. The check in step 4 catches this for most texts by replacing the whole sentence; keep it in your pipeline.
- References across sections ("for the reasons discussed under item 2") are not sensitive on their own; the classifier sees one section at a time.
- Indirect cases are harder than explicit ones, especially same-sex partnerships mentioned in passing ("my wife and I" from a woman).
- The category scores are a hint,
besondersis the decision. In the second example above the trade union is masked but not listed as a category. - Trained and measured on German and English only. Invented test texts, no measurement on real customer data.
Training data
Only invented texts in German and English, created for this purpose, including long documents split into sections. No customer data and no real personal data were used.
License
Apache 2.0. Base models Qwen3.5-4B (Apache 2.0) and mmBERT-base (MIT).
Deutsch: ALLSmartArt9-10 erkennt besondere Kategorien personenbezogener Daten nach Art. 9 DSGVO (Gesundheit, Herkunft, politische Meinung, Religion, Gewerkschaft, Genetik, Biometrie, Sexualleben) und Straftaten nach Art. 10 und ersetzt die heikle Stelle, bevor ein Prompt das Haus verlässt. Es läuft in der Privacy-Schicht von ALLSmartLLM: Abschnitt prüfen, Stelle ersetzen, nachprüfen, im Zweifel den Satz ersetzen oder sperren.