--- language: en license: apache-2.0 base_model: distilbert/distilbert-base-cased datasets: - nvidia/Nemotron-PII pipeline_tag: token-classification library_name: transformers tags: - pii - privacy - onnx - experimental - datafog --- # DataFog PII v0.1.0 Experimental English PII token classifier trained by DataFog. This is the September 25, 2026 DistilBERT model used by datafog-mcp PR #32. GLiNER is a separate CI comparison and is neither the backbone nor an artifact in this release. ## Checkpoint and training Release checkpoint: **epoch 2**, selected by lowest validation token cross entropy under the predeclared two-epoch recipe. Epoch 1: 0.003570595682300194; epoch 2: 0.0018816228932983772. The safetensors bytes equal `training/epoch-2/model/model.safetensors`; the frozen ONNX, tokenizer, calibration and native macOS bundle are copied unchanged. No final-test tuning or retraining occurred for release. Backbone: `distilbert/distilbert-base-cased` at `6ea81172465e8b0ad3fddeed32b986cdcdcffcf0`. NVIDIA Nemotron-PII at `b70ffaf5ff39e079776134c5bf4381f00a9fd1ed`. Seed 42, float32 MPS, batch 16, learning rate 2e-5, weight decay 0.01, two epochs (8,102 seconds). Prepared partitions: train 89,307; validation 514; calibration-fit 501; calibration-select 532; test 90,018 documents. Grouping by UID, exact text and normalized annotated templates prevents evidenced family overlap; semantic annotation noise remains. See `provenance/docs/data.md` and `provenance/artifacts/data-manifest.json` for filtering, immutable source hashes and split provenance. ## Labels and inference contract Seven labels in this exact order: first_name, last_name, email, phone_number, street_address, customer_id, account_number. Class 0 is O; each label has B then I, for 15 classes. Both mappings are preserved in root `config.json` and `label-mappings.json`. Root configuration is the Transformers checkpoint configuration; `bundle/config.json` is the frozen native inference configuration. Do not interchange them. The released JSONL runtime tokenizes the entire input, constructs 512-token windows (510 content tokens), and overlaps 42 content tokens. Minimum predicted-class token probability forms the raw span score. Boundary-fragment suppression precedes greedy overlap resolution. Half-open offsets count UTF-8 **bytes**, not Python characters. Pooled isotonic calibration uses clipped linear interpolation; the experimental threshold is 0.6486486486486487 (the exact value in `bundle/calibration.json` is authoritative). Calibration fit and threshold selection use separate partitions. Preserve tokenizer, config and calibration together with weights. The runtime returns `{findings, contains_pii, redacted}`; invalid requests and unsupported full-window entities return explicit errors. Transformers can load the root safetensors using `AutoModelForTokenClassification.from_pretrained(path, local_files_only=True)`. A generic token-classification pipeline does **not** reproduce native windowing, calibrated confidence, thresholding, offsets or redaction. Use the bundle for MCP qualification; `reproduction/pii/core.py` preserves the Python reference. ## Evaluation Frozen held-out synthetic evaluation: exact typed-span precision 0.9901, recall 0.9763, F1 0.9832; TP 242,853, FP 2,424, FN 5,886. UTF-8 byte redaction F1 0.9876. Hand-authored support fixtures recovered 14/18 entities (F1 0.8485). These are agreement with synthetic annotations, not verified accuracy on private customer tickets. Full metrics, calibration reliability, limitations and original audit are in `provenance/REPORT.md` and `provenance/artifacts/evaluation/`. ## MCP integration and platform distribution PR #32 at `c2c45ec62728d85b7472131a3df9ccb67afd4a02` launches `/datafog-pii ` locally. It maps first_name/last_name to PERSON and street_address to STREET_ADDRESS; it ignores other model categories in favor of Core detectors. No downloads occur during MCP inference. Configure `[model].bundle_directory` after installing the bundle. See `DOWNLOAD.md`. Only **macOS ARM64** has a qualified executable in this release. The preserved binary uses the bundled ONNX Runtime 1.30.0 dylib, API 27, CPU execution. Require macOS 14.0+ for the packaged dylib (Mach-O LC_BUILD_VERSION minos 14.0). The model and tokenizer are platform-neutral; the native executable/library are not. `PLATFORMS.md` documents candidate builds for macOS Intel, Linux x86_64/AArch64 and Windows x86_64, including Windows adapter requirements. None is advertised as qualified before a native build and actual MCP fixture test. Do not copy the ARM dylib to another platform. The adapter previously timed out on a 100 MB input at a 120-second model deadline. This release does not establish the 100 MB complete-model-scan target, production throughput or real-world privacy guarantees. Finite window overlap cannot cover arbitrary entity lengths; 16 training spans had boundaries the tokenizer cannot express exactly. A clean result only concerns seven supported labels and accepted predictions. ## License and attribution DataFog additions, trained weights and runtime source: Apache License 2.0; `LICENSE`. DistilBERT backbone and tokenizer: Apache-2.0, retained backbone card. Training dataset: CC-BY-4.0, attribution in `NOTICE` and preserved dataset card. ONNX Runtime: MIT with complete upstream ThirdPartyNotices. Rust dependencies retain their own licenses in `licenses/cargo/`; `licenses/cargo-inventory.json` records all 98 locked packages across targets, a conservative superset rather than a claim that all are linked. See `LICENSING.md` for redistribution details. ## Reproduction and versioning `release.json` identifies the version, selection, revisions and weights. `manifest.json` contains SHA-256 and size for every distributed file except itself. `archives/datafog-pii-v0.1.0-macos-arm64.tar.gz` preserves executable mode and includes original bundle checksums. Pin a Hub commit SHA rather than `main` for downloads; tag `v0.1.0` is a convenient release alias after publication. `reproduction/` includes the original scripts and uv.lock; run those from a restored workspace layout following `provenance/README.md`. Original training optimizer states, raw datasets, obsolete caches and diagnostic probe weights are intentionally omitted. Exact inference artifacts are reproducible by checksum; bitwise repeatability of MPS training is not promised.