language: en
license: apache-2.0
base_model: distilbert/distilbert-base-cased
datasets:
- nvidia/Nemotron-PII
pipeline_tag: token-classification
library_name: transformers
tags:
- pii
- privacy
- onnx
- experimental
- datafog
DataFog PII v0.1.0
Experimental English PII token classifier trained by DataFog. This is the September 25, 2026 DistilBERT model used by datafog-mcp PR #32. GLiNER is a separate CI comparison and is neither the backbone nor an artifact in this release.
Checkpoint and training
Release checkpoint: epoch 2, selected by lowest validation token cross entropy under the predeclared two-epoch recipe. Epoch 1: 0.003570595682300194; epoch 2: 0.0018816228932983772. The safetensors bytes equal training/epoch-2/model/model.safetensors; the frozen ONNX, tokenizer, calibration and native macOS bundle are copied unchanged. No final-test tuning or retraining occurred for release.
Backbone: distilbert/distilbert-base-cased at 6ea81172465e8b0ad3fddeed32b986cdcdcffcf0. NVIDIA Nemotron-PII at b70ffaf5ff39e079776134c5bf4381f00a9fd1ed. Seed 42, float32 MPS, batch 16, learning rate 2e-5, weight decay 0.01, two epochs (8,102 seconds). Prepared partitions: train 89,307; validation 514; calibration-fit 501; calibration-select 532; test 90,018 documents. Grouping by UID, exact text and normalized annotated templates prevents evidenced family overlap; semantic annotation noise remains. See provenance/docs/data.md and provenance/artifacts/data-manifest.json for filtering, immutable source hashes and split provenance.
Labels and inference contract
Seven labels in this exact order: first_name, last_name, email, phone_number, street_address, customer_id, account_number. Class 0 is O; each label has B then I, for 15 classes. Both mappings are preserved in root config.json and label-mappings.json. Root configuration is the Transformers checkpoint configuration; bundle/config.json is the frozen native inference configuration. Do not interchange them.
The released JSONL runtime tokenizes the entire input, constructs 512-token windows (510 content tokens), and overlaps 42 content tokens. Minimum predicted-class token probability forms the raw span score. Boundary-fragment suppression precedes greedy overlap resolution. Half-open offsets count UTF-8 bytes, not Python characters. Pooled isotonic calibration uses clipped linear interpolation; the experimental threshold is 0.6486486486486487 (the exact value in bundle/calibration.json is authoritative). Calibration fit and threshold selection use separate partitions. Preserve tokenizer, config and calibration together with weights. The runtime returns {findings, contains_pii, redacted}; invalid requests and unsupported full-window entities return explicit errors.
Transformers can load the root safetensors using AutoModelForTokenClassification.from_pretrained(path, local_files_only=True). A generic token-classification pipeline does not reproduce native windowing, calibrated confidence, thresholding, offsets or redaction. Use the bundle for MCP qualification; reproduction/pii/core.py preserves the Python reference.
Evaluation
Frozen held-out synthetic evaluation: exact typed-span precision 0.9901, recall 0.9763, F1 0.9832; TP 242,853, FP 2,424, FN 5,886. UTF-8 byte redaction F1 0.9876. Hand-authored support fixtures recovered 14/18 entities (F1 0.8485). These are agreement with synthetic annotations, not verified accuracy on private customer tickets. Full metrics, calibration reliability, limitations and original audit are in provenance/REPORT.md and provenance/artifacts/evaluation/.
MCP integration and platform distribution
PR #32 at c2c45ec62728d85b7472131a3df9ccb67afd4a02 launches <bundle>/datafog-pii <bundle> locally. It maps first_name/last_name to PERSON and street_address to STREET_ADDRESS; it ignores other model categories in favor of Core detectors. No downloads occur during MCP inference. Configure [model].bundle_directory after installing the bundle. See DOWNLOAD.md.
Only macOS ARM64 has a qualified executable in this release. The preserved binary uses the bundled ONNX Runtime 1.30.0 dylib, API 27, CPU execution. Require macOS 14.0+ for the packaged dylib (Mach-O LC_BUILD_VERSION minos 14.0). The model and tokenizer are platform-neutral; the native executable/library are not. PLATFORMS.md documents candidate builds for macOS Intel, Linux x86_64/AArch64 and Windows x86_64, including Windows adapter requirements. None is advertised as qualified before a native build and actual MCP fixture test. Do not copy the ARM dylib to another platform.
The adapter previously timed out on a 100 MB input at a 120-second model deadline. This release does not establish the 100 MB complete-model-scan target, production throughput or real-world privacy guarantees. Finite window overlap cannot cover arbitrary entity lengths; 16 training spans had boundaries the tokenizer cannot express exactly. A clean result only concerns seven supported labels and accepted predictions.
License and attribution
DataFog additions, trained weights and runtime source: Apache License 2.0; LICENSE. DistilBERT backbone and tokenizer: Apache-2.0, retained backbone card. Training dataset: CC-BY-4.0, attribution in NOTICE and preserved dataset card. ONNX Runtime: MIT with complete upstream ThirdPartyNotices. Rust dependencies retain their own licenses in licenses/cargo/; licenses/cargo-inventory.json records all 98 locked packages across targets, a conservative superset rather than a claim that all are linked. See LICENSING.md for redistribution details.
Reproduction and versioning
release.json identifies the version, selection, revisions and weights. manifest.json contains SHA-256 and size for every distributed file except itself. archives/datafog-pii-v0.1.0-macos-arm64.tar.gz preserves executable mode and includes original bundle checksums. Pin a Hub commit SHA rather than main for downloads; tag v0.1.0 is a convenient release alias after publication. reproduction/ includes the original scripts and uv.lock; run those from a restored workspace layout following provenance/README.md. Original training optimizer states, raw datasets, obsolete caches and diagnostic probe weights are intentionally omitted. Exact inference artifacts are reproducible by checksum; bitwise repeatability of MPS training is not promised.