DeTars-PII-v1

On-device PII redaction that leaks less. DeTars-PII finds names, companies, addresses, phone numbers, emails, IDs and card numbers in 27 languages before your text ever reaches a cloud model. It runs locally on CPU, using about 0.8 GB of memory, with no GPU and no network calls.

It powers Auto-Privacy in DeTars, the personal AI desktop app: real names are swapped for placeholders before a request leaves your machine, and restored when the answer comes back.

Highlights

• 🏆 #1 in all 26 languages tested on both leak rate and strict F1 against the open PII models we benchmarked (table below).
• 🥇 #1 on Chinese, Japanese and Korean among the open PII models we benchmarked: Fastino GLiNER2-PII, NVIDIA GLiNER-PII, Urchade GLiNER multi-PII and OpenAI Privacy Filter.
• 🛡️ Lowest leak rate in every one of the 23 European languages tested: 1.7% of PII characters missed, against 6.0% for Fastino, 9.9% for NVIDIA and 23.4% for OpenAI Privacy Filter.
• 🎯 Highest strict F1 in all 23 European languages: 91.5 against 68.2 for the next best.
• ⚡ Built for the desktop. ONNX encoder plus NumPy heads, ~0.8 GB peak memory, ~850 characters/s on an Apple M2 CPU. A single shared encoder serves every language.

Per-language leaderboard

DeTars-PII has the lowest leak and the highest strict F1 in every language we tested. Each row compares it with the best of the other models on that language: Fastino GLiNER2-PII, NVIDIA GLiNER-PII and OpenAI Privacy Filter, plus Urchade on Chinese, Japanese and Korean.

Language	DeTars-PII leak %	Best other leak %	DeTars-PII strict F1	Best other strict F1
Chinese	3.0	13.6 (OpenAI PF)	92.1	56.2 (OpenAI PF)
Japanese	7.4	12.7 (OpenAI PF)	69.5	59.0 (OpenAI PF)
Korean	5.7	9.1 (Fastino)	62.1	60.1 (OpenAI PF)
English	0.4	5.8 (Fastino)	90.4	66.9 (Fastino)
German	0.7	4.0 (Fastino)	92.4	73.2 (OpenAI PF)
French	1.3	5.1 (Fastino)	90.1	73.8 (OpenAI PF)
Spanish	0.9	8.6 (Fastino)	93.5	76.5 (OpenAI PF)
Italian	1.5	4.8 (Fastino)	91.5	74.1 (OpenAI PF)
Dutch	1.5	4.6 (Fastino)	91.9	73.2 (OpenAI PF)
Portuguese	1.4	6.2 (Fastino)	93.8	74.1 (OpenAI PF)
Polish	1.6	7.6 (Fastino)	92.0	68.7 (OpenAI PF)
Czech	3.6	7.1 (Fastino)	90.9	68.7 (Fastino)
Slovak	2.8	4.2 (Fastino)	92.4	68.8 (Fastino)
Hungarian	1.3	5.7 (Fastino)	88.7	67.4 (Fastino)
Romanian	1.8	6.6 (Fastino)	93.9	69.8 (OpenAI PF)
Bulgarian	2.9	8.4 (Fastino)	91.1	66.4 (OpenAI PF)
Croatian	3.1	6.3 (Fastino)	92.3	70.0 (OpenAI PF)
Serbian	1.9	7.1 (Fastino)	91.7	71.2 (Fastino)
Slovenian	2.6	6.6 (Fastino)	90.2	67.6 (Fastino)
Greek	1.7	5.8 (Fastino)	92.0	71.1 (Fastino)
Swedish	1.4	5.4 (Fastino)	90.7	65.2 (Fastino)
Danish	0.6	6.6 (Fastino)	93.8	68.5 (OpenAI PF)
Finnish	0.9	3.3 (Fastino)	92.4	66.9 (Fastino)
Estonian	2.0	7.0 (Fastino)	87.9	66.4 (OpenAI PF)
Latvian	1.3	5.1 (Fastino)	89.6	66.2 (Fastino)
Lithuanian	1.7	5.4 (Fastino)	90.2	70.9 (Fastino)

Sources:

• Chinese: public wan9yu/pii-bench-zh, 300 documents.
• Japanese and Korean: 100 held-out documents each, measured on the 3.0 multilingual route.
• European languages: a 2,300-document held-out set (100 per language), frozen before training and scored once with release 3.1.

Every system runs at its frozen operating point. Full tables, including over-mask, are in EVALUATION.md.

Benchmarks

Lower is better for leak (share of PII characters left unmasked) and over-mask (non-PII characters masked per 1,000). Higher is better for strict F1 (exact span and category).

Chinese, Japanese, Korean

	DeTars-PII	Fastino	NVIDIA	Urchade	OpenAI PF
Chinese (wan9yu/pii-bench-zh)², strict F1	92.1	46.1	18.6	28.2	56.2
Japanese, leak % / over-mask	7.4 / 25.5	34.7 / 94.9	33.0 / 100.5	33.9 / 131.9	12.7 / 39.6
Korean, leak % at matched over-mask¹	8.2	9.2	13.1	46.0	14.7

¹ Each system is placed at Fastino's own over-mask level along its operating curve (threshold or bias), so the comparison is like-for-like. The Japanese and Korean rows were measured on the 3.0 multilingual route. In the 3.1 production regression, Japanese leak fell further and Korean over-mask dropped 31%.

² Chinese runs on the dedicated Han route, which is unchanged since release 2 (measured there).

European languages (23 languages, 2,300 held-out documents)

	DeTars-PII 3.1	Fastino	NVIDIA	OpenAI PF
Leak %	1.69	5.97	9.91	23.41
Strict F1 %	91.5	68.2	55.6	67.7
Over-mask / 1k	9.5	5.5	12.0	6.8

DeTars-PII has the lowest leak and the highest strict F1 in every language: en, de, fr, es, it, nl, pt, bg, pl, cs, sv, ro, lt, et, hr, fi, lv, hu, sk, sl, da, el, sr. Per-language tables are in EVALUATION.md.

At matched over-mask (Fastino's operating point), DeTars-PII 3.1 leaks less in Spanish, Dutch, Polish, Romanian, Bulgarian, Czech, Croatian and Finnish (for example Spanish 1.3% vs 8.6%, Romanian 1.2% vs 6.6%). That covers every language where the two curves overlap.

Privacy-first by design

A redaction model can fail in two ways. It can leak, letting a real name through to the cloud, or it can over-mask, hiding a word that wasn't sensitive. Leaks cannot be undone. Over-masking only costs a little context. DeTars-PII is tuned to keep leaks as low as possible. It also treats company and organization names as private, a category that Fastino and OpenAI Privacy Filter do not have, so on some European languages it masks more conservatively than models built to a narrower definition of PII.

What it detects

Person names (full names), companies and organizations, street addresses down to the door number, phone numbers, emails, government IDs, bank cards and accounts, tax/organization IDs, dates of birth, IP addresses, API keys and other identifiers.

Text is routed by script. Chinese uses a dedicated Han route, and every other language uses the multilingual route. Both share one encoder.

Usage

This repository ships the model bundle for the DeTars rt6 runtime: an ONNX encoder, NumPy heads, a tokenizer and a routing manifest. It is not a Transformers AutoModel checkpoint. Load it with packages/privacy-detector from DeTars at a revision that understands the detars-pii-v3.1-rt6 contract.

from huggingface_hub import snapshot_download
bundle_dir = snapshot_download(
    repo_id="DeTars/DeTars-PII-v1",
    revision="121f3ecb91f7a9ced30a8b397583af5377605795",  # release 3.1
    local_dir="./detars-pii-composite-v3.1",
)

Inside the DeTars app none of this is needed: turn on Auto-Privacy and the model downloads and verifies itself.

Release 3.1

• New multilingual adapter (rank 16, threshold 0.65) trained for European languages. On 23 European languages, versus 3.0: leak 2.1% → 1.7%, over-mask −14%, strict F1 83.9 → 91.5.
• On production regression across 3,090 documents: hard-negative false triggers fall from 4/40 to 1/40, Korean over-mask drops 31%, throughput is +7%, and memory is unchanged.
• The Chinese route is byte-identical to 3.0.

Evaluation notes

• Benchmarks are self-run and reproducible; sources and SHA256s are in evaluation-sources.json. The European set was held out and frozen before training, and scored once. All peers ran locally with their published weights; every system's operating point was locked on development data before any test scoring.

• Most test sets are synthetic or public; Ai4Privacy OpenPII validation material is from the same source family as part of the training data. Results come from a single training seed.

• Known trade-offs:

  • masking is more conservative than Fastino on some European languages (see over-mask above);
  • Japanese over-mask rose slightly in 3.1 (20.5 → 23.9 per 1k);
  • English entity boundaries are still being improved.

  The full regression tables, release criteria and caveats are in EVALUATION.md.

License and attribution

Base model: Fastino AI, fastino/gliner2-privacy-filter-PII-multi (Apache-2.0). This release's weights are distributed under Apache-2.0; see LICENSE, LICENSE.md and NOTICE. Tokenizer derived from microsoft/mdeberta-v3-base (MIT, see LICENSE-MIT-Microsoft.txt).

Training data includes Ai4Privacy / Ai Suisse SA OpenPII 1.5M (revision a785eb528e28be2693c3718a27e066970de5dadb, CC-BY-4.0, https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1.5m) plus DeTars-generated synthetic data. No dataset is redistributed here. No endorsement by Fastino, Microsoft, NVIDIA, OpenAI, Urchade or Ai4Privacy is implied.