AndrewAndrewsen commited on
Commit
ee6b360
Β·
verified Β·
1 Parent(s): f943796

Upload README.md with huggingface_hub

Browse files
Files changed (1) hide show
  1. README.md +335 -331
README.md CHANGED
@@ -1,331 +1,335 @@
1
- ---
2
- language:
3
- - en
4
- license: apache-2.0
5
- tags:
6
- - secret-detection
7
- - token-classification
8
- - ner
9
- - security
10
- - api-keys
11
- - credentials
12
- - distilbert
13
- library_name: transformers
14
- pipeline_tag: token-classification
15
- datasets:
16
- - custom
17
- metrics:
18
- - f1
19
- - precision
20
- - recall
21
- model-index:
22
- - name: distilbert-secret-masker
23
- results:
24
- - task:
25
- type: token-classification
26
- name: Secret Detection
27
- dataset:
28
- name: SecretMask v2 (600 test examples)
29
- type: custom
30
- metrics:
31
- - type: f1
32
- value: 0.52
33
- name: F1 Score
34
- verified: true
35
- - type: precision
36
- value: 0.82
37
- name: Precision
38
- verified: true
39
- - type: recall
40
- value: 0.38
41
- name: Recall
42
- verified: true
43
- base_model: distilbert-base-uncased
44
- ---
45
-
46
- # DistilBERT Secret Masker (Fast Expert)
47
-
48
- [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
49
- [![Model Size](https://img.shields.io/badge/Size-265MB-green.svg)](https://huggingface.co/AndrewAndrewsen/distilbert-secret-masker)
50
- [![Inference Speed](https://img.shields.io/badge/Latency-6ms-brightgreen.svg)](https://huggingface.co/AndrewAndrewsen/distilbert-secret-masker)
51
-
52
- **Fast Expert** model for SecMask MoE system - specialized for rapid secret detection in short to medium-length texts (≀512 tokens).
53
-
54
- ---
55
-
56
- ## 🎯 Overview
57
-
58
- Fine-tuned DistilBERT model for detecting and classifying secrets (API keys, tokens, credentials) in text using Named Entity Recognition (NER). Serves as the **Fast Expert** in the [SecMask Mixture of Experts architecture](https://github.com/AndrewAndrewsen/secmask), handling **92.7%** of inference requests with ~6ms latency.
59
-
60
- ### Key Features
61
-
62
- βœ… **High Speed**: ~6ms average latency
63
- βœ… **High Precision**: 82% (low false positives)
64
- βœ… **Production Ready**: Handles 92.7% of real-world cases
65
- βœ… **Lightweight**: 265MB (66M parameters)
66
- βœ… **Multi-Secret Types**: AWS keys, GitHub tokens, JWTs, API keys, PEM blocks, K8s secrets
67
-
68
- > **Note**: Combines NER model (82% precision, 38% recall) with deterministic post-filters for PEM blocks and K8s secrets to achieve production-grade coverage.
69
-
70
- ### Detected Secret Types
71
-
72
- | Secret Type | Example Pattern | F1 Score |
73
- | ----------------------------- | --------------------------------- | -------- |
74
- | **AWS Access Keys** | `AKIA...` | 0.92 |
75
- | **GitHub Personal Tokens** | `ghp_...`, `gho_...` | 0.88 |
76
- | **JWT Tokens** | `eyJ0eXAiOiJKV1QiLCJhbGc...` | 0.85 |
77
- | **Generic API Keys** | `sk-proj-...`, `api_key=...` | 0.79 |
78
- | **PEM Certificate Blocks** | `-----BEGIN PRIVATE KEY-----` | 0.95 |
79
- | **Kubernetes Secrets (data)** | `kind: Secret` β†’ `data:` values | 0.81 |
80
- | **Database Credentials** | Connection strings with passwords | 0.74 |
81
-
82
- ---
83
-
84
- ## πŸš€ Quick Start
85
-
86
- ### Installation
87
-
88
- ```bash
89
- pip install transformers torch
90
- ```
91
-
92
- ### Basic Usage
93
-
94
- **Standalone (Direct):**
95
-
96
- ```python
97
- from transformers import pipeline
98
-
99
- # Load model
100
- classifier = pipeline(
101
- "token-classification",
102
- model="AndrewAndrewsen/distilbert-secret-masker",
103
- aggregation_strategy="simple"
104
- )
105
-
106
- # Detect secrets
107
- text = "My API key is sk-proj-1234567890abcdefghijklmnopqrstuvwxyz"
108
- results = classifier(text)
109
-
110
- print(results)
111
- # [{'entity_group': 'SECRET', 'score': 0.95, 'word': 'sk-proj-1234567890abcdefghijklmnopqrstuvwxyz', ...}]
112
- ```
113
-
114
- **Recommended (via SecMask MoE):**
115
-
116
- ```python
117
- # Clone SecMask repo
118
- # git clone https://github.com/AndrewAndrewsen/secmask.git
119
-
120
- from infer_moe import mask_text_moe
121
-
122
- masked = mask_text_moe(
123
- "My GitHub token is ghp_1234567890abcdefghijklmnopqrstuvwxyz",
124
- fast_model_dir="AndrewAndrewsen/distilbert-secret-masker",
125
- tau=0.80,
126
- routing_mode="heuristic"
127
- )
128
-
129
- print(masked)
130
- # "My GitHub token is [SECRET]"
131
- ```
132
-
133
- ### Command Line (via SecMask)
134
-
135
- ```bash
136
- # Clone repo
137
- git clone https://github.com/AndrewAndrewsen/secmask.git
138
- cd secmask
139
-
140
- # Mask secrets
141
- python infer_moe.py \
142
- --text "AWS key: AKIAIOSFODNN7EXAMPLE" \
143
- --fast-model AndrewAndrewsen/distilbert-secret-masker \
144
- --routing-mode heuristic \
145
- --tau 0.80
146
-
147
- # Output: AWS key: [SECRET]
148
- ```
149
-
150
- ---
151
-
152
- ## πŸ“Š Performance
153
-
154
- ### Secret Detection Metrics
155
-
156
- | Metric | Value |
157
- | --------------- | ------ |
158
- | **F1 Score** | 0.52 |
159
- | **Precision** | 0.82 |
160
- | **Recall** | 0.38 |
161
- | **Avg Latency** | 6ms |
162
- | **P99 Latency** | 57.4ms |
163
-
164
- > **Note**: Evaluated at Ο„=0.80 threshold with post-filtering (PEM blocks, K8s secrets). The model prioritizes precision (low false positives) over recall. For higher recall, lower the threshold or combine with deterministic filters.
165
-
166
- ### When This Model Is Used (MoE Routing)
167
-
168
- The router selects this **Fast Expert** when:
169
-
170
- - Token count ≀ 512
171
- - No multi-line structures (PEM blocks, K8s YAML)
172
- - Simple text patterns
173
- - **Coverage: 92.7%** of real-world requests
174
-
175
- For longer or more complex texts, the MoE router automatically switches to the [Longformer Secret Masker](https://huggingface.co/AndrewAndrewsen/longformer-secret-masker).
176
-
177
- ---
178
-
179
- ## πŸ—οΈ Model Details
180
-
181
- ### Architecture
182
-
183
- - **Base Model**: [`distilbert-base-uncased`](https://huggingface.co/distilbert-base-uncased) (66M params, Apache 2.0)
184
- - **Task**: Token Classification (NER)
185
- - **Max Sequence Length**: 512 tokens
186
- - **Label**: `B-SECRET`, `I-SECRET`, `O` (BIO tagging)
187
-
188
- ### Training Details
189
-
190
- - **Dataset**: Custom SecretMask v2 (6,000 training examples)
191
- - **Optimizer**: AdamW (lr=5e-5)
192
- - **Epochs**: 3
193
- - **Batch Size**: 16
194
- - **Hardware**: GPU (NVIDIA A100 or equivalent)
195
- - **Training Time**: ~30 minutes
196
-
197
- ### Evaluation
198
-
199
- Evaluated on 600 held-out examples from SecretMask v2 test set:
200
-
201
- ```
202
- Precision: 0.82
203
- Recall: 0.38
204
- F1: 0.52
205
- Support: 1,021 secret tokens
206
- ```
207
-
208
- **Key Insights**:
209
-
210
- - **High Precision (82%)**: Very low false positive rate - safe for production
211
- - **Lower Recall (38%)**: Misses some secrets when used standalone
212
- - **Production Strategy**: Combine with deterministic filters (see `filters.py`) for PEM blocks, K8s secrets, and AWS patterns to achieve >90% coverage
213
- - **Threshold Tuning**: Lower Ο„ from 0.80 to 0.50 for higher recall (trade-off: more false positives)
214
-
215
- ---
216
-
217
- ## πŸ’‘ Use Cases
218
-
219
- ### Production Applications
220
-
221
- 1. **Pre-Commit Hooks** - Prevent secrets in git commits
222
- 2. **CI/CD Pipelines** - Scan code before deployment
223
- 3. **Log Sanitization** - Remove secrets from application logs
224
- 4. **API Response Filtering** - Mask secrets in debug output
225
- 5. **Documentation Cleanup** - Sanitize before open-sourcing
226
- 6. **Security Audits** - Scan codebases for exposed credentials
227
-
228
- ### Example: Pre-Commit Hook
229
-
230
- ```python
231
- # .git/hooks/pre-commit
232
- from transformers import pipeline
233
-
234
- classifier = pipeline("token-classification", model="AndrewAndrewsen/distilbert-secret-masker")
235
-
236
- for file in staged_files:
237
- content = read_file(file)
238
- secrets = classifier(content)
239
- if secrets:
240
- print(f"❌ Secret detected in {file}!")
241
- exit(1)
242
- ```
243
-
244
- See [SecMask Examples](https://github.com/AndrewAndrewsen/secmask/blob/main/EXAMPLES.md) for more.
245
-
246
- ---
247
-
248
- ## ⚠️ Limitations
249
-
250
- ### Known Issues
251
-
252
- 1. **Token Limit**: Cannot handle texts >512 tokens (use Longformer expert)
253
- 2. **English Only**: Trained on English text
254
- 3. **False Negatives**: ~25% recall means some secrets may be missed
255
- 4. **Context Sensitivity**: May struggle with unusual formatting
256
- 5. **Novel Patterns**: May miss new secret types not in training data
257
-
258
- ### Not Suitable For
259
-
260
- ❌ Non-English text
261
- ❌ Binary data or encrypted content
262
- ❌ Images/PDFs (extract text first)
263
- ❌ Very long documents (use [longformer-secret-masker](https://huggingface.co/AndrewAndrewsen/longformer-secret-masker))
264
- ❌ Real-time streaming (consider batching)
265
-
266
- ### Recommended Mitigations
267
-
268
- - **Combine with filters**: Use deterministic filters for PEM blocks, K8s secrets (see [SecMask filters](https://github.com/AndrewAndrewsen/secmask/blob/main/filters.py))
269
- - **Adjust threshold**: Lower `tau` for higher recall (more false positives)
270
- - **Use MoE system**: Automatic routing to appropriate expert
271
- - **Add regex patterns**: Supplement with custom patterns for your use case
272
-
273
- ---
274
-
275
- ## πŸ“œ License & Attribution
276
-
277
- ### Model License
278
-
279
- **Apache 2.0** (inherited from `distilbert-base-uncased`)
280
-
281
- ### Base Model Attribution
282
-
283
- This model is fine-tuned from:
284
-
285
- - **Model**: [`distilbert-base-uncased`](https://huggingface.co/distilbert-base-uncased)
286
- - **Authors**: Hugging Face
287
- - **License**: Apache 2.0
288
- - **Citation**:
289
- ```
290
- @inproceedings{sanh2019distilbert,
291
- title={DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter},
292
- author={Sanh, Victor and Debut, Lysandre and Chaumond, Julien and Wolf, Thomas},
293
- booktitle={NeurIPS EMC^2 Workshop},
294
- year={2019}
295
- }
296
- ```
297
-
298
- ### SecMask Code License
299
-
300
- The SecMask inference code and training scripts are licensed under **MIT**. See [GitHub repo](https://github.com/AndrewAndrewsen/secmask/blob/main/LICENSE).
301
-
302
- ---
303
-
304
- ## πŸ”— Related Models
305
-
306
- | Model | Size | Max Tokens | Latency | Use Case |
307
- | ------------------------------------------------------------------------------------------------------------ | ----- | ---------- | ------- | ------------------------- |
308
- | **[distilbert-secret-masker](https://huggingface.co/AndrewAndrewsen/distilbert-secret-masker)** (this model) | 265MB | 512 | 6ms | Short texts, fast routing |
309
- | **[longformer-secret-masker](https://huggingface.co/AndrewAndrewsen/longformer-secret-masker)** | 592MB | 2048 | 12ms | Long documents, configs |
310
- | **[secretmask-gate](https://huggingface.co/AndrewAndrewsen/secretmask-gate)** | 12KB | N/A | +0.2ms | Learned MoE routing |
311
-
312
- ---
313
-
314
- ## πŸ“š Resources
315
-
316
- - **GitHub Repository**: [AndrewAndrewsen/secmask](https://github.com/AndrewAndrewsen/secmask)
317
- - **Documentation**: [README](https://github.com/AndrewAndrewsen/secmask/blob/main/README.md)
318
- - **Benchmarks**: [BENCHMARKS.md](https://github.com/AndrewAndrewsen/secmask/blob/main/BENCHMARKS.md)
319
- - **Examples**: [EXAMPLES.md](https://github.com/AndrewAndrewsen/secmask/blob/main/EXAMPLES.md)
320
- - **Deployment**: [DEPLOYMENT.md](https://github.com/AndrewAndrewsen/secmask/blob/main/DEPLOYMENT.md)
321
-
322
- ---
323
-
324
- ## 🀝 Contributing
325
-
326
- Issues and contributions welcome! See [CONTRIBUTING.md](https://github.com/AndrewAndrewsen/secmask/blob/main/CONTRIBUTING.md).
327
-
328
- ---
329
-
330
- **Developed by**: Anders Andersson ([@AndrewAndrewsen](https://huggingface.co/AndrewAndrewsen))
331
- **Part of**: [SecMask MoE System](https://github.com/AndrewAndrewsen/secmask)
 
 
 
 
 
1
+ ---
2
+ language:
3
+ - en
4
+ license: apache-2.0
5
+ tags:
6
+ - secret-detection
7
+ - token-classification
8
+ - ner
9
+ - security
10
+ - api-keys
11
+ - credentials
12
+ - distilbert
13
+ library_name: transformers
14
+ pipeline_tag: token-classification
15
+ datasets:
16
+ - custom
17
+ metrics:
18
+ - f1
19
+ - precision
20
+ - recall
21
+ model-index:
22
+ - name: distilbert-secret-masker
23
+ results:
24
+ - task:
25
+ type: token-classification
26
+ name: Secret Detection
27
+ dataset:
28
+ name: SecretMask v2 (600 test examples)
29
+ type: custom
30
+ metrics:
31
+ - type: f1
32
+ value: 0.52
33
+ name: F1 Score
34
+ verified: true
35
+ - type: precision
36
+ value: 0.82
37
+ name: Precision
38
+ verified: true
39
+ - type: recall
40
+ value: 0.38
41
+ name: Recall
42
+ verified: true
43
+ base_model: distilbert-base-uncased
44
+ ---
45
+
46
+ # DistilBERT Secret Masker (Fast Expert)
47
+
48
+ [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
49
+ [![Model Size](https://img.shields.io/badge/Size-265MB-green.svg)](https://huggingface.co/AndrewAndrewsen/distilbert-secret-masker)
50
+ [![Inference Speed](https://img.shields.io/badge/Latency-6ms-brightgreen.svg)](https://huggingface.co/AndrewAndrewsen/distilbert-secret-masker)
51
+
52
+ **Fast Expert** model for SecMask MoE system - specialized for rapid secret detection in short to medium-length texts (≀512 tokens).
53
+
54
+ ---
55
+
56
+ ## 🎯 Overview
57
+
58
+ Fine-tuned DistilBERT model for detecting and classifying secrets (API keys, tokens, credentials) in text using Named Entity Recognition (NER). Serves as the **Fast Expert** in the [SecMask Mixture of Experts architecture](https://github.com/AndrewAndrewsen/secmask), handling **92.7%** of inference requests with ~6ms latency.
59
+
60
+ ### Key Features
61
+
62
+ βœ… **High Speed**: 11ms P50 latency on CPU
63
+ βœ… **High Precision**: 82% (NER-only), **92.3% with filters**
64
+ βœ… **Production Ready**: Handles 92.7% of real-world cases
65
+ βœ… **Lightweight**: 265MB (66M parameters)
66
+ βœ… **Multi-Secret Types**: AWS keys, GitHub tokens, JWTs, API keys, PEM blocks, K8s secrets
67
+
68
+ > **Production Performance**: When combined with post-processing filters (PEM blocks, K8s secrets, pattern matching), achieves **92.3% precision, 80% recall, F1: 0.857**. The NER model alone achieves 82% precision and 38% recall. See [comprehensive benchmarks](https://github.com/AndrewAndrewsen/secmask/blob/main/BENCHMARK_RESULTS.md) for details.
69
+
70
+ > **Recommended Configuration**: Fast Expert + Filters (this model with post-processing) is the recommended production setup, outperforming Full MoE configurations. See [Configuration Guide](https://github.com/AndrewAndrewsen/secmask/blob/main/CONFIGURATION_GUIDE.md) for usage recommendations.
71
+
72
+ ### Detected Secret Types
73
+
74
+ | Secret Type | Example Pattern | F1 Score |
75
+ | ----------------------------- | --------------------------------- | -------- |
76
+ | **AWS Access Keys** | `AKIA...` | 0.92 |
77
+ | **GitHub Personal Tokens** | `ghp_...`, `gho_...` | 0.88 |
78
+ | **JWT Tokens** | `eyJ0eXAiOiJKV1QiLCJhbGc...` | 0.85 |
79
+ | **Generic API Keys** | `sk-proj-...`, `api_key=...` | 0.79 |
80
+ | **PEM Certificate Blocks** | `-----BEGIN PRIVATE KEY-----` | 0.95 |
81
+ | **Kubernetes Secrets (data)** | `kind: Secret` β†’ `data:` values | 0.81 |
82
+ | **Database Credentials** | Connection strings with passwords | 0.74 |
83
+
84
+ ---
85
+
86
+ ## πŸš€ Quick Start
87
+
88
+ ### Installation
89
+
90
+ ```bash
91
+ pip install transformers torch
92
+ ```
93
+
94
+ ### Basic Usage
95
+
96
+ **Standalone (Direct):**
97
+
98
+ ```python
99
+ from transformers import pipeline
100
+
101
+ # Load model
102
+ classifier = pipeline(
103
+ "token-classification",
104
+ model="AndrewAndrewsen/distilbert-secret-masker",
105
+ aggregation_strategy="simple"
106
+ )
107
+
108
+ # Detect secrets
109
+ text = "My API key is sk-proj-1234567890abcdefghijklmnopqrstuvwxyz"
110
+ results = classifier(text)
111
+
112
+ print(results)
113
+ # [{'entity_group': 'SECRET', 'score': 0.95, 'word': 'sk-proj-1234567890abcdefghijklmnopqrstuvwxyz', ...}]
114
+ ```
115
+
116
+ **Recommended (via SecMask MoE):**
117
+
118
+ ```python
119
+ # Clone SecMask repo
120
+ # git clone https://github.com/AndrewAndrewsen/secmask.git
121
+
122
+ from infer_moe import mask_text_moe
123
+
124
+ masked = mask_text_moe(
125
+ "My GitHub token is ghp_1234567890abcdefghijklmnopqrstuvwxyz",
126
+ fast_model_dir="AndrewAndrewsen/distilbert-secret-masker",
127
+ tau=0.80,
128
+ routing_mode="heuristic"
129
+ )
130
+
131
+ print(masked)
132
+ # "My GitHub token is [SECRET]"
133
+ ```
134
+
135
+ ### Command Line (via SecMask)
136
+
137
+ ```bash
138
+ # Clone repo
139
+ git clone https://github.com/AndrewAndrewsen/secmask.git
140
+ cd secmask
141
+
142
+ # Mask secrets
143
+ python infer_moe.py \
144
+ --text "AWS key: AKIAIOSFODNN7EXAMPLE" \
145
+ --fast-model AndrewAndrewsen/distilbert-secret-masker \
146
+ --routing-mode heuristic \
147
+ --tau 0.80
148
+
149
+ # Output: AWS key: [SECRET]
150
+ ```
151
+
152
+ ---
153
+
154
+ ## πŸ“Š Performance
155
+
156
+ ### Secret Detection Metrics
157
+
158
+ | Metric | NER Only | With Filters (Recommended) |
159
+ | --------------- | -------- | -------------------------- |
160
+ | **F1 Score** | 0.52 | **0.857** |
161
+ | **Precision** | 82% | **92.3%** |
162
+ | **Recall** | 38% | **80.0%** |
163
+ | **P50 Latency** | 11ms | 11ms |
164
+ | **P90 Latency** | 14ms | 14ms |
165
+ | **P99 Latency** | 17ms | 17ms |
166
+ | **Throughput** | 84 req/s | 84 req/s (CPU) |
167
+
168
+ > **Note**: NER-only metrics measured at Ο„=0.80. Production systems combine NER with post-processing filters (PEM blocks, K8s secrets, pattern matching) to achieve 92.3% precision and 80% recall. Post-processing adds no latency overhead. See [BENCHMARK_RESULTS.md](https://github.com/AndrewAndrewsen/secmask/blob/main/BENCHMARK_RESULTS.md) for comprehensive benchmarks.
169
+
170
+ ### When This Model Is Used (MoE Routing)
171
+
172
+ The router selects this **Fast Expert** when:
173
+
174
+ - Token count ≀ 512
175
+ - No multi-line structures (PEM blocks, K8s YAML)
176
+ - Simple text patterns
177
+ - **Coverage: 92.7%** of real-world requests
178
+
179
+ > **Note**: The recommended production configuration is **Fast Expert + Filters** alone (without the Long Expert). This achieves better results than Full MoE. See [Configuration Guide](https://github.com/AndrewAndrewsen/secmask/blob/main/CONFIGURATION_GUIDE.md) for details.
180
+
181
+ ---
182
+
183
+ ## πŸ—οΈ Model Details
184
+
185
+ ### Architecture
186
+
187
+ - **Base Model**: [`distilbert-base-uncased`](https://huggingface.co/distilbert-base-uncased) (66M params, Apache 2.0)
188
+ - **Task**: Token Classification (NER)
189
+ - **Max Sequence Length**: 512 tokens
190
+ - **Label**: `B-SECRET`, `I-SECRET`, `O` (BIO tagging)
191
+
192
+ ### Training Details
193
+
194
+ - **Dataset**: Custom SecretMask v2 (6,000 training examples)
195
+ - **Optimizer**: AdamW (lr=5e-5)
196
+ - **Epochs**: 3
197
+ - **Batch Size**: 16
198
+ - **Hardware**: GPU (NVIDIA A100 or equivalent)
199
+ - **Training Time**: ~30 minutes
200
+
201
+ ### Evaluation
202
+
203
+ Evaluated on 600 held-out examples from SecretMask v2 test set:
204
+
205
+ ```
206
+ Precision: 0.82
207
+ Recall: 0.38
208
+ F1: 0.52
209
+ Support: 1,021 secret tokens
210
+ ```
211
+
212
+ **Key Insights**:
213
+
214
+ - **High Precision (82%)**: Very low false positive rate - safe for production
215
+ - **Lower Recall (38%)**: Misses some secrets when used standalone
216
+ - **Production Strategy**: Combine with deterministic filters (see `filters.py`) for PEM blocks, K8s secrets, and AWS patterns to achieve >90% coverage
217
+ - **Threshold Tuning**: Lower Ο„ from 0.80 to 0.50 for higher recall (trade-off: more false positives)
218
+
219
+ ---
220
+
221
+ ## πŸ’‘ Use Cases
222
+
223
+ ### Production Applications
224
+
225
+ 1. **Pre-Commit Hooks** - Prevent secrets in git commits
226
+ 2. **CI/CD Pipelines** - Scan code before deployment
227
+ 3. **Log Sanitization** - Remove secrets from application logs
228
+ 4. **API Response Filtering** - Mask secrets in debug output
229
+ 5. **Documentation Cleanup** - Sanitize before open-sourcing
230
+ 6. **Security Audits** - Scan codebases for exposed credentials
231
+
232
+ ### Example: Pre-Commit Hook
233
+
234
+ ```python
235
+ # .git/hooks/pre-commit
236
+ from transformers import pipeline
237
+
238
+ classifier = pipeline("token-classification", model="AndrewAndrewsen/distilbert-secret-masker")
239
+
240
+ for file in staged_files:
241
+ content = read_file(file)
242
+ secrets = classifier(content)
243
+ if secrets:
244
+ print(f"❌ Secret detected in {file}!")
245
+ exit(1)
246
+ ```
247
+
248
+ See [SecMask Examples](https://github.com/AndrewAndrewsen/secmask/blob/main/EXAMPLES.md) for more.
249
+
250
+ ---
251
+
252
+ ## ⚠️ Limitations
253
+
254
+ ### Known Issues
255
+
256
+ 1. **Token Limit**: Cannot handle texts >512 tokens (use Longformer expert)
257
+ 2. **English Only**: Trained on English text
258
+ 3. **False Negatives**: ~25% recall means some secrets may be missed
259
+ 4. **Context Sensitivity**: May struggle with unusual formatting
260
+ 5. **Novel Patterns**: May miss new secret types not in training data
261
+
262
+ ### Not Suitable For
263
+
264
+ ❌ Non-English text
265
+ ❌ Binary data or encrypted content
266
+ ❌ Images/PDFs (extract text first)
267
+ ❌ Very long documents (use [longformer-secret-masker](https://huggingface.co/AndrewAndrewsen/longformer-secret-masker))
268
+ ❌ Real-time streaming (consider batching)
269
+
270
+ ### Recommended Mitigations
271
+
272
+ - **Combine with filters**: Use deterministic filters for PEM blocks, K8s secrets (see [SecMask filters](https://github.com/AndrewAndrewsen/secmask/blob/main/filters.py))
273
+ - **Adjust threshold**: Lower `tau` for higher recall (more false positives)
274
+ - **Use MoE system**: Automatic routing to appropriate expert
275
+ - **Add regex patterns**: Supplement with custom patterns for your use case
276
+
277
+ ---
278
+
279
+ ## πŸ“œ License & Attribution
280
+
281
+ ### Model License
282
+
283
+ **Apache 2.0** (inherited from `distilbert-base-uncased`)
284
+
285
+ ### Base Model Attribution
286
+
287
+ This model is fine-tuned from:
288
+
289
+ - **Model**: [`distilbert-base-uncased`](https://huggingface.co/distilbert-base-uncased)
290
+ - **Authors**: Hugging Face
291
+ - **License**: Apache 2.0
292
+ - **Citation**:
293
+ ```
294
+ @inproceedings{sanh2019distilbert,
295
+ title={DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter},
296
+ author={Sanh, Victor and Debut, Lysandre and Chaumond, Julien and Wolf, Thomas},
297
+ booktitle={NeurIPS EMC^2 Workshop},
298
+ year={2019}
299
+ }
300
+ ```
301
+
302
+ ### SecMask Code License
303
+
304
+ The SecMask inference code and training scripts are licensed under **MIT**. See [GitHub repo](https://github.com/AndrewAndrewsen/secmask/blob/main/LICENSE).
305
+
306
+ ---
307
+
308
+ ## πŸ”— Related Models
309
+
310
+ | Model | Size | Max Tokens | Latency | Use Case |
311
+ | ------------------------------------------------------------------------------------------------------------ | ----- | ---------- | ------- | ------------------------- |
312
+ | **[distilbert-secret-masker](https://huggingface.co/AndrewAndrewsen/distilbert-secret-masker)** (this model) | 265MB | 512 | 6ms | Short texts, fast routing |
313
+ | **[longformer-secret-masker](https://huggingface.co/AndrewAndrewsen/longformer-secret-masker)** | 592MB | 2048 | 12ms | Long documents, configs |
314
+ | **[secretmask-gate](https://huggingface.co/AndrewAndrewsen/secretmask-gate)** | 12KB | N/A | +0.2ms | Learned MoE routing |
315
+
316
+ ---
317
+
318
+ ## πŸ“š Resources
319
+
320
+ - **GitHub Repository**: [AndrewAndrewsen/secmask](https://github.com/AndrewAndrewsen/secmask)
321
+ - **Documentation**: [README](https://github.com/AndrewAndrewsen/secmask/blob/main/README.md)
322
+ - **Benchmarks**: [BENCHMARKS.md](https://github.com/AndrewAndrewsen/secmask/blob/main/BENCHMARKS.md)
323
+ - **Examples**: [EXAMPLES.md](https://github.com/AndrewAndrewsen/secmask/blob/main/EXAMPLES.md)
324
+ - **Deployment**: [DEPLOYMENT.md](https://github.com/AndrewAndrewsen/secmask/blob/main/DEPLOYMENT.md)
325
+
326
+ ---
327
+
328
+ ## 🀝 Contributing
329
+
330
+ Issues and contributions welcome! See [CONTRIBUTING.md](https://github.com/AndrewAndrewsen/secmask/blob/main/CONTRIBUTING.md).
331
+
332
+ ---
333
+
334
+ **Developed by**: Anders Andersson ([@AndrewAndrewsen](https://huggingface.co/AndrewAndrewsen))
335
+ **Part of**: [SecMask MoE System](https://github.com/AndrewAndrewsen/secmask)