nobody-pii-de

German-first multilingual PII detection for the nobody redaction pipeline. This repository contains the GLiNER model layer. The production pipeline also runs deterministic detectors for structured identifiers; that code is in the source repository.

Release identity

The binary model files were verified at Hub revision 311329838bba75d974be36b042af7836f99b30fa. The card and attribution metadata may receive later commits; pin that revision when the exact binary artifact is required.

file	SHA-256
model.safetensors	84cb4207ec386a2467894328bccd83127ac62ee771779c0c909047ea3cc54d06
gliner_config.json	16adf9e94687869a82af3234fce29550096df7ccfeb0438e957cf89d358337ec
tokenizer.json	c5b8041501fcdee792b9b112dd592861f04391a24633a73fd9f05aaaf6e8eff1
tokenizer_config.json	d5fc9ee06444205f6d6e9cc1b0ba05855ca740246d4c4dbabbd15bfc1e0170b7

The starting checkpoint was urchade/gliner_multi_pii-v1 at Hub revision 1fcf13e85f4eef5394e1fcd406cf2ca9ea82351d.

Intended use

Use this model to identify potentially sensitive entities in German, English, and Dutch business-style text before applying a redaction or review policy. It is a decision-support component, not a legal, compliance, or anonymization guarantee. Review outputs on representative documents before deployment.

The model predicts these labels:

• person
• address
• date of birth
• organization

The companion pipeline additionally detects structured labels such as email, phone number, IBAN, credit card, national ID, and license plate with syntax/checksum-aware rules.

Usage

from gliner import GLiNER

model = GLiNER.from_pretrained("naeyn/nobody-pii-de")
text = "Kontakt: Anna Müller, geboren am 5. Juni 1984."
entities = model.predict_entities(
    text,
    ["person", "address", "date of birth", "organization"],
    threshold=0.5,
)
print(entities)

For the complete production pipeline:

git clone https://github.com/naeyn/nobody.git
cd nobody
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python redact.py --model naeyn/nobody-pii-de \
  --text "Kontakt: Anna Müller, anna@example.de"

The default production policy favors recall. Its per-label thresholds are person=0.50, address=0.05, date of birth=0.50, and organization=0.50. The deterministic layer runs independently of model confidence.

Training recipe

The released checkpoint was fine-tuned from the pinned GLiNER base model with a mixed training set of 38,581 document instances:

• 25,909 German rows from ai4privacy/pii-masking-openpii-1m, selected from the German training source and excluding every row whose raw labels contained DATE. The publisher states that OpenPII 1M is synthetic; its generating model is not disclosed.
• 12,672 instances from the companion synthetic corpus: all 9,450 training documents plus one additional copy of each of its 3,222 documents containing at least one date of birth span. This is a 2x oversample of birth-date-bearing documents, not a second independently generated split.

The mixed file was concatenated and shuffled with seed 42; the trainer also used seed 42. The generated corpus's own generation seed is documented on the dataset card as not retained in the published snapshot, so this training seed must not be mistaken for a dataset-generation seed.

Training settings:

setting	value
epochs	1
selected global step	800
per-device batch size	4
gradient accumulation	4 (effective batch size 16)
GLiNER learning rate	1.23465e-05
other-parameter learning rate	7.48573e-05
weight decay	0.01 for both parameter groups
scheduler	linear
warmup	10% of training steps
training seed	42
checkpoint interval	400 steps

The released step-800 checkpoint was selected on a separate German development stream before the canonical evaluation. The real benchmark and the synthetic test split below were not used for checkpoint selection.

Only inference artifacts are published here: weights, tokenizer, model configuration, license, notice, and this card. Optimizer state, training logs, private orchestration, and restricted benchmark documents are not part of the model repository.

Evaluation

Results below were measured through the same production pipeline: deterministic detectors, model predictions, span merging, and the released policy. Leakage is the share of gold PII tokens missed; lower is better. Gate decisions use point estimates; the intervals are doc-level bootstrap 95% confidence intervals with 10,000 resamples.

External German benchmark

The evaluation used 3,000 documents from the German validation stream of ai4privacy/pii-masking-400k. That dataset is synthetic (machine-generated by its publisher) and evaluation-only: it is not redistributed here and was not used to train the released weights. It is external to nobody's training distribution.

model	F1	leakage
nobody v0.2.0	0.791 [0.776–0.805]	1.63% [1.17–2.17]
Piiranha-v1	0.853	0.95%
gliner_multi_pii-v1 zero-shot	0.610 [0.591–0.628]	3.10% [2.23–4.04]

Per-label results for nobody on this stream: person F1 0.876 / 0.62% leakage; email F1 0.987 / 0.00% leakage; phone F1 0.925 / 1.49% leakage; date-of-birth recall 1.000 / 0.00% leakage with precision 0.306; address F1 0.550 / 15.85% leakage.

Synthetic regression set

On the held-out test split of naeyn/nobody-pii-synth-de, covering German, English, and Dutch:

model	F1	leakage
nobody v0.2.0	0.927	0.51%
Piiranha-v1	0.677	24.09%
gliner_multi_pii-v1 zero-shot	0.826	6.60%

This is regression evidence on a procedurally generated, template-based set, not independent real-world evidence. Piiranha is evaluated here outside its training distribution. The external German stream is closer to Piiranha's home distribution, so the two comparisons should not be conflated; neither evaluation uses real-world documents. The GLiNER synthetic row was recomputed with the shipped production policy; no synthetic confidence interval is reported for this comparison.

The upper bound of the German leakage interval is 2.17%, so the interval still crosses a 2% gate despite the point estimate being below 2%.

Contamination checks

The German validation extension used for the canonical evaluation was checked against the training candidates before the final run. The audit covered 2,500 extension documents, including 1,068 PII-bearing documents, and compared exact text hashes plus 5-gram Jaccard similarity with a threshold of >0.8 against:

• the 38,581-instance mixed training set;
• the 9,450-document generated training split; and
• the full 96,179-row German OpenPII source used as the provenance pool.

The result was zero PII-bearing exact duplicates and zero PII-bearing near-duplicates for every comparison; no exclusions were needed. Planted exact and near-duplicate controls were detected before the real audit.

Training data and provenance

The model has two training sources:

1. naeyn/nobody-pii-synth-de, using its 9,450-document training split. All documents in this dataset are procedurally generated and labeled by construction.
2. 25,909 German rows from ai4privacy/pii-masking-openpii-1m, used under CC-BY-4.0. Rows whose raw labels contained DATE were excluded before training because that source taxonomy does not distinguish ordinary dates from dates of birth.

The evaluation-only ai4privacy/pii-masking-400k stream was not included in released weights. No real personal records are intentionally included in the published synthetic dataset or in this model's training inputs. The OpenPII publisher describes its data as synthetic, but does not disclose its generator.

Limitations and safety

• Address is the weakest class. Bare house numbers and context-free street fragments can be missed.
• Recall-first date rules can over-redact invoice, delivery, or contract dates.
• Synthetic-test performance can overstate generalization because templates and generation distributions are narrower than real documents.
• Benchmark numbers are proxies. Annotate and measure a representative sample of your own documents.
• Redaction is pseudonymization, not necessarily anonymization; surrounding context can still permit re-identification.
• Do not send sensitive documents to external services without an appropriate data-processing and security review.

Reproducibility status

Inference is reproducible from the pinned Hub revision, the checksums above, and the public source code. The complete private training orchestration and the restricted benchmark records are not published, so the aggregate real-benchmark figures are not independently rerunnable from the public repositories alone. The public synthetic test remains regression evidence, not a substitute for a representative evaluation of your own documents.

License and attribution

The released weights are licensed under Apache-2.0. The base model urchade/gliner_multi_pii-v1 is Apache-2.0.

The OpenPII 1M portion of the training mix is used under CC-BY-4.0. Required attribution: Ai4Privacy / Ai Suisse SA. See the CC-BY-4.0 license and the OpenPII 1M dataset card. The publisher describes that source as synthetic and does not disclose its generating model.

The companion synthetic dataset is released under Apache-2.0. Its values were created with Faker locale providers; Faker is MIT-licensed. See the dataset card for details.

Citation

@software{nobody_pii_de,
  title = {nobody-pii-de: German-first PII redaction model},
  author = {naeyn},
  year = {2026},
  url = {https://huggingface.co/naeyn/nobody-pii-de},
  license = {Apache-2.0}
}