da-pii-mini-preview-21m

A small (about 20.7M parameters, 21.8 MB as int8 ONNX) token classifier that flags candidate personal data in Danish and English text for review. It is the NER component of the PromptSkjold browser extension, which checks text locally before it is sent to an AI chatbot. It is a PromptSkjold fine-tune of BardsAI's bardsai/eu-pii-multi-mini-preview (mMiniLMv2-L6-H384, distilled from XLM-RoBERTa Large), with the vocabulary pruned to Danish and English (about 25.7k tokens) and int8 quantization for the ONNX file.

Try it in your browser: the demo runs the model locally and nothing you type is sent anywhere, but please don't enter real sensitive data in a demo.

Preview. Use it to flag text for a human to review, not as the only safeguard. It misses things and flags harmless things. In our own challenge tests it missed spoken (dictated) phone numbers and addresses, phonetic or heavily misspelled names, some lowercase multi-part names, and long job titles. It flagged public figures, names used as brands, pets or dishes, and ordinary words in name positions. Sensitive subject matter (health, religion, politics) is not flagged. Only Latin-script text is supported well. A span the model does not flag cannot be recovered by reviewing flagged spans.

What it detects

The output head is the base model's label set (69 token labels including O and B-/I- forms, unchanged). The extension maps the labels it uses to these types (it accepts some aliases, so not every name below need be an emitted class):

For fixed-format identifiers (Danish CPR numbers, IBAN, card numbers, email, IP, secrets, phone) the extension relies primarily on separate pattern and context rules, with checksums where they exist; the model can also emit overlapping types. The raw head still contains PERSON_IDENTIFIER, but the extension does not use it, and the model-only evaluation below is not a CPR detector. Reproducing the figures below needs more than the ONNX file: per-type confidence thresholds, visibility filtering, byte-offset span grouping and 480-token windows with 64-token overlap (application windowing, not a built-in long-document capability). Plain argmax decoding gives more low-confidence spans.

How it was made

1. Base: bardsai/eu-pii-multi-mini-preview.
2. Fine-tuned over several rounds on synthetic and LLM-written Danish and English text (chat prompts, HR and case notes, CVs, logs, long documents, multi-origin names, hard negatives such as prices, SKUs and greetings), cut into 480-token windows with 64-token overlap to match inference. This release is "round 6, variant a" (5 epochs, rare-label weight 0.25, 13,215 training rows). A seventh round did not meet the pre-registered acceptance rule and was not used.
3. Vocabulary pruned to Danish and English, then int8 quantization (model_int8mm_embq.onnx).

Results

Test prompts written after the model was frozen, scored on the model alone (no extension rules). "Fully covered" means every character of an identifier is inside a flagged span.

Kiji (Danish test split, full extension pipeline, not the model alone): 95% of core identifiers found, 96% adjusted precision. The labels in this dataset are incomplete, so raw precision is lower.

PIIMB (Danish rows, model alone): F2 0.75 on ai4privacy and 0.16 on MAPA legal text, against 0.94 and 0.46 for the base model. R6a scores lower by design: the benchmark masks every date, age, gender, city and occupation, while R6a flags those only where they identify a person. On names, email, phone and payment cards it matches the base.

Speed (browser, WASM, one thread, laptop): about 90 ms for 128 tokens and about 400 ms for a 480-token window.

Intended use and out-of-scope

Intended: local pre-send checking of text, with a person approving what is replaced. Out of scope: automated, unattended anonymisation for legal or regulatory purposes, and re-identification risk assessment.

Licence and credits

Released under Apache-2.0. Base model: bardsai/eu-pii-multi-mini-preview by BardsAI (used and modified with their agreement). It is fine-tuned from nreimers/mMiniLMv2-L6-H384-distilled-from-XLMR-Large, a MiniLM-style distillation (Microsoft MiniLM method, MIT) of XLM-RoBERTa Large (Meta, MIT). The BardsAI base model and the mMiniLMv2 distillation do not declare a licence on their Hugging Face pages. The Microsoft MIT text is reproduced below; XLM-RoBERTa (Meta) is distributed under the MIT licence with the notice "Copyright (c) Facebook, Inc. and its affiliates". The Apache-2.0 declaration covers PromptSkjold's own contributions (fine-tuning, pruning, quantization); the upstream weights carry the terms and notices above. This model is a modified version of that base (further fine-tuning, vocabulary pruning, quantization). Our additional fine-tuning data (13,215 rows) is template-generated or written by AI assistants; we did not intentionally include real people's data or any public NER dataset. This does not describe or audit the pretraining data of the base models. Names in our data are drawn from name lists, so a combination may coincide with a real person by chance.

The MIT License (MIT)

Copyright (c) Microsoft Corporation

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Part of the PromptSkjold project (a Danish fork of the DFKI pii-guardrail extension, Apache-2.0).