phi-redactor-qwen3-1.7b (v5)

LoRA adapter for Qwen3-1.7B that de-identifies US clinical text: it extracts every PHI span as JSON so masking can be applied deterministically in code. Runs locally — patient text never leaves the machine. Trained entirely on synthetic data from three LLM generator families (labels correct by construction; no real patient data anywhere), with deliberate over-representation of South Asian, East Asian, Hispanic, Arabic, and African names. Covers 19 identifier types derived from HIPAA Safe Harbor.

Results

• Held-out synthetic test (1,590 docs incl. adversarial informal slices; 250-doc sample): 0.991 entity recall, 0.40% char leak rate (with the project repo's regex safety net).
• Hand-written out-of-distribution set (24 adversarial docs): 3.7% char leak standard; 0.54% with the ensemble "paranoid" mode — the residue being a 5-character partial clip of one otherwise-masked address.
• Microsoft Presidio on comparable clinical text leaks 22.6% and catches 0/315 MRNs.
• Zero false positives on eponym-trap documents: Parkinson's, Foley catheter, and drug names stay unredacted.

v5 was built through five eval-driven rounds; notable lessons: single-generator synthetic data overfits on authorial style (v3), and placeholder-format drift can silently poison synthetic pipelines (caught by audit before the v5 retrain). Long documents are supported via chunked extraction in the project repo's redact.py.

Usage

import json, torch
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

SYSTEM_PROMPT = "You are a PHI de-identification engine for US clinical text. Find every personal identifier in the document. Respond with ONLY a JSON array where each item is {\"text\": \"<exact substring as it appears in the document>\", \"type\": \"<TYPE>\"}. Valid types: NAME, DATE, AGE_OVER_89, PHONE, FAX, EMAIL, SSN, MRN, HEALTH_PLAN_ID, ACCOUNT_NUMBER, LICENSE_NUMBER, DEVICE_ID, URL, IP_ADDRESS, LOCATION, HOSPITAL, VEHICLE_ID, USERNAME, PROFESSION. If the document contains no identifiers, respond with []. Never miss an identifier: when unsure whether something is PHI, include it."

tok = AutoTokenizer.from_pretrained("Qwen/Qwen3-1.7B")
model = AutoModelForCausalLM.from_pretrained("Qwen/Qwen3-1.7B", dtype=torch.bfloat16, device_map="auto")
model = PeftModel.from_pretrained(model, "t4nishq/phi-redactor-qwen3-1.7b")

text = "Pt Priya Raghunathan, MRN 4829171, seen 03/14/2026 at Northbridge Memorial."
msgs = [{"role": "system", "content": SYSTEM_PROMPT}, {"role": "user", "content": text}]
prompt = tok.apply_chat_template(msgs, add_generation_prompt=True, tokenize=False, enable_thinking=False)
ids = tok(prompt, return_tensors="pt").to(model.device)
out = model.generate(**ids, max_new_tokens=1024, do_sample=False)
entities = json.loads(tok.decode(out[0][ids.input_ids.shape[1]:], skip_special_tokens=True))
masked = text
for e in sorted(entities, key=lambda e: -len(e["text"])):
    masked = masked.replace(e["text"], f"[{e['type']}]")
print(masked)  # Pt [NAME], MRN [MRN], seen [DATE] at [HOSPITAL].

For maximum recall, use the project repo's redact.py — it adds an OCR-tolerant regex safety net, long-document chunking, PDF input, and a --paranoid ensemble mode (sampled re-runs + Presidio + verify pass).

Training

LoRA r=16/alpha=32, all-linear, bf16, 2 epochs, lr 2e-4, effective batch 16. TRL SFT on an A100 (~50 min). 12,750 synthetic training documents from 1,050 templates written by three model families (Claude Sonnet, Llama 3.3, DeepSeek V3): clinical notes, lab reports, admin documents, informal patient messages, intake forms, OCR-noised variants, and adversarial hard negatives.

Limitations & intended use

• Assistive tool, not a compliance guarantee. No automated redactor reaches 100% recall; use human review for high-stakes release. HIPAA de-identification also requires policy-level controls.
• Synthetic-set numbers are optimistic by construction; the OOD sets are small. Validate on your own documents.
• English, US identifier formats only. Known weak spots: compound ID formats (workers-comp claim numbers), long-address span boundaries.
• Not for diagnosis or clinical decision-making.