cbx-pii-extractor-17M

Finds personal information (PII) in English text and returns the exact position of each value with one of 18 labels. 17M parameters, about 6 ms per 1,000 tokens on a GPU and 37 ms on a CPU.

This is the fastest size, and the one to use on CPU. Fine-tuned from jhu-clsp/ettin-encoder-17m. Current version: v0.2 (use --revision v0.2 to pin it). Also available in 68M and 32M sizes.

What's new in v0.2

• 18 labels instead of 12. Account numbers, government IDs and other IDs are split into specific types (table below).
• More accurate on chat and business documents:
  • lowercase and first-name-only names;
  • Slack mentions such as <@U02NORA>;
  • verification codes;
  • policy, member and account references;
  • employee IDs in tables.
• The same speed as v0.1.

Upgrading from v0.1. The label names changed. Pin --revision v0.1 to keep the old ones, or map the new labels back like this:

V01 = {"DATE_OF_BIRTH": "DATE", "BANK_ACCOUNT": "ACCOUNT_NUMBER", "PAYMENT_CARD": "ACCOUNT_NUMBER",
       "CUSTOMER_ID": "ACCOUNT_NUMBER", "NATIONAL_ID": "GOV_ID", "PASSPORT": "GOV_ID", "TAX_ID": "GOV_ID",
       "DRIVERS_LICENSE": "GOV_ID", "EMPLOYEE_ID": "OTHER_ID", "PATIENT_ID": "OTHER_ID"}
spans = [dict(s, label=V01.get(s["label"], s["label"])) for s in pii.extract(text)]

Labels

How to use

1. Download and install

pip install -U huggingface_hub
hf download CobuildX-AI/cbx-pii-extractor-17M --revision v0.2 --local-dir cbx-pii-extractor-17M
cd cbx-pii-extractor-17M
pip install -r requirements.txt

2. Use it in your code

PIIExtractor (in pii.py, part of this repo) loads the model once:

from pii import PIIExtractor

pii = PIIExtractor()                 # uses a GPU if one is available
pii.extract("Hi team, I'm Priya Raman (priya.raman@northwind.com).")
# [{'label': 'PERSON', 'text': 'Priya Raman', 'start': 13, 'end': 24},
#  {'label': 'EMAIL', 'text': 'priya.raman@northwind.com', 'start': 26, 'end': 51}]

pii.redact("Hi team, I'm Priya Raman (priya.raman@northwind.com).")
# "Hi team, I'm [PERSON] ([EMAIL])."

pii.extract(text, labels=["PERSON", "EMAIL"])   # keep only some labels

• The model finds the PII. redact() replaces each value it found with its label, or with your own template.
• Context length is 7,999 tokens, read in a single pass. Longer texts are split automatically.

3. Optional: check your setup

python example.py runs four sample texts and prints what it finds.

Results

Exact-match span F1 on three public benchmarks never used for training. A value counts only if its start, end and label are all correct.

• Privacy-Bench docs: 656 human-annotated pages of business documents.
• Privacy-Bench messages: 5,198 chat messages.
• PII-TRACE: 500 conversations. It is PII-Tracer's own benchmark. Most of our remaining gap there is dates other than dates of birth, which we deliberately don't label. Without dates, this model scores 96.0% against 91.9% for PII-Tracer.

On text with no PII at all, this model flags 0.08 false values per 1,000 characters, against 1.6–3.6 for the other models.

How we evaluated

• Same runs for every model. We ran every model ourselves, on the same texts, with the same scoring.

• Benchmark sizes:

  Benchmark	Contents	Annotated values in the scored types
  Privacy-Bench docs	656 pages of Word and PDF business documents	8,700
  Privacy-Bench messages	5,198 chat messages	6,594
  PII-TRACE	500 multi-turn conversations (public subset)	2,442

• No overlap with training data. No training text shares a 13-word sequence with any benchmark.

• How the benchmarks were used. Half of each benchmark was used to study errors while we designed the training data. Scores on the other half are within 0.6 points of the full-set numbers above.

A prediction counts as correct only when its start, end and type all match the annotation. Each benchmark's types were mapped to ours as below. Every model was scored on the types that both the benchmark and the model support.

Government IDs, IP addresses and patient IDs are not annotated in either benchmark, so this evaluation does not cover them.

Speed. Latency is the median over 50 texts of 1,000 tokens, processed one at a time, end to end (text in, spans out). It was measured on an NVIDIA TITAN RTX GPU (fp16) and an Intel i7-10700 CPU (8 threads), with all models on the same machine. The v0.1 card used a Tesla T4, so its timings are not directly comparable.

Limitations

• English only.
• Sensitive attributes such as health, religion or ethnicity are not detected.
• Account and reference numbers inside long documents, and usernames in documents, are found less reliably than names, emails and phones.
• Addresses are always labelled in full. Benchmarks that mark only the street will count them as boundary errors.
• A detection aid, not a guarantee: keep human review where redaction must be complete.

Licence

Apache-2.0. Trained on NVIDIA Nemotron-PII (CC-BY-4.0), Gretel PII masking EN v1 and Gretel synthetic PII finance (Apache-2.0), Wismut nym-pii (MIT), Kiji PII training data (Apache-2.0) and data we generated. Base model: Ettin (MIT, arXiv:2507.11412).