Rizzo-AI-Academy/rizzo-pii

rizzo-pii Local, reversible PII anonymization for Italian legal text Use frontier models without giving up your data. 📄 Read the full technical report (PDF) — model, dataset, method and experiments in detail 🪟 Windows installer · 🍎 macOS (Apple Silicon) · 🐧 Linux AppImage — all available now rizzo-pii:0.3B is a lightweight, CPU-friendly, Italian-first token-classification model (≈0.3B parameters, mmBERT / ModernBERT backbone) that detects 22 categories of personal data — including the Italian-legal identifiers ( codice fiscale , partita IVA , dati catastali ) that no other open model covers — and drives a fully reversible anonymization workflow: 🔒 anonymize locally → 🏷️ placeholder + reversible local dictionary → ☁️ frontier LLM → 🔓 restore locally It is built for law firms, accountants, notaries and anyone bound by the GDPR who wants to keep using ChatGPT / Claude / Gemini on sensitive documents without ever sending the real data out . ≈0.3B ~0.5 GB 22 0.989 parameters (mmBERT-base) RAM footprint, CPU PII categories micro-F1 (real IT validation) The hedgehog mascot does one job: it grabs your document, blacks out every identifier, and stays inside the EU while doing it. The problem: convenience is leaking your data People summarize contracts, draft replies and ask legal questions simply by pasting the document in . It is fast and useful — and it quietly moves enormous amounts of personal and confidential data off the user's device. Names, addresses, tax codes, IBANs, health details, unsigned-contract clauses: all of it crosses the network to servers the user does not control, where it may be logged, cached, retained or exposed in a breach. For a law firm or a hospital this is not hypothetical; under the GDPR it can be a direct compliance failure. The intuitive fix is to stop sending data out and run an open model locally — but a frontier-grade open model is large and expensive to serve (€9,000–€10,000 of hardware), and the small models that fit a normal laptop are not in the same league on the hard tasks (legal reasoning, dense contracts, long official documents) — exactly where Italian professionals need the most help. The trade-off we actually want: keep the frontier model and remove the data from the equation . Anonymize the document locally on a CPU, send only placeholders to the cloud, and restore the real values locally from the answer. The sensitive content never leaves the machine. rizzo-pii in one picture The workflow has three local steps and one remote step. Locally, rizzo-pii tags every span of personal data and replaces each one with a stable, type-aware placeholder ( [FULLNAME_1] , [IBAN_1] , [CF_1] ), recording the mapping placeholder → real value in a dictionary that stays on disk . Identical values share the same placeholder, so the frontier model still sees a coherent text and can reason about it. The anonymized text is sent to ChatGPT / Claude / Gemini; when the answer comes back, a local pass swaps the placeholders for the true values. The cloud provider never receives a single real name, code or number. Everything except the frontier query happens on the user's CPU; only placeholder text crosses the boundary, and the answer is re-identified locally. Why this is different: privacy that is actually private This is not "yet another PII detector". It is an architecture for using powerful models without surrendering data , built so the privacy guarantee is structural rather than a promise: The data never leaves the device. Detection and re-identification run locally on a CPU. No API key, no telemetry, no upload. What the cloud receives is already stripped of identifiers. GDPR by design. The workflow implements data minimization (Art. 5) almost literally: the third-party processor only ever sees pseudonymized text, so the most common reason a cloud LLM call is unlawful (transferring identifiable data to a third party without a basis) is removed at the source. Aligned with the EU AI Act. Keeping personal data under local control and out of third-party model pipelines supports the Act's emphasis on data governance. Accessible to everyone. The model is ≈0.3B parameters and runs on a CPU in well under 1 GB of RAM — the privacy layer costs nothing extra in hardware. A normal laptop is enough. Reversible, not destructive. Classic redaction throws information away. rizzo-pii pseudonymizes : the answer from the frontier model is reconstructed with the real values, so the tool is useful in real work, not just compliance theater. How it compares Property rizzo-pii:0.3B OpenAI Privacy Filter MS Presidio Type Dense encoder (mmBERT / ModernBERT) Sparse MoE encoder NER + rules pipeline Parameters ≈0.3B dense (all active) 1.5B total / ≈50M active spaCy model + rules Memory to load 0.5–1.2 GB 1.5B params resident Varies (spaCy) Runs on CPU, under 1 GB RAM On-device CPU Categories 22 (incl. IT-legal) 8 generic Configurable; EN defaults Italian CF / PIVA / catasto Yes No Not by default Primary language Italian (+7 more) English English Checksum validation Yes (IBAN/CF/PIVA/card) No Some recognizers Reversible mapping Yes (local dict) Masking Anonymization The differentiators are Italian-legal coverage , a smaller memory footprint , and a checksum-backed safety net (mod-97 for IBAN, Luhn for cards, the official CF/PIVA algorithms) that the larger generic models do not provide. Concrete example. Take "Il Sig. Mario Rossi, C.F. RSSMRA85H12F205Y, P.IVA 12345678903, è titolare dell'immobile al Foglio 12, particella 345, sub. 6." rizzo-pii tags FULLNAME , CF , PIVA and CATASTO and rewrites it as "Il Sig. [FULLNAME_1], C.F. [CF_1], P.IVA [PIVA_1], è titolare dell'immobile al [CATASTO_1]." A generic English-first model has no label for the fiscal code, the VAT number or the cadastral reference — the three most sensitive identifiers in the sentence — and would leave them in the clear. The taxonomy: 22 tags, and why rizzo-pii predicts 22 entity types in BIO format (a B- / I- label per tag, plus O ). The raw datasets are left untouched; the mapping to these 22 tags is applied at load time through a single TAG_MAP in train_pii.py , so the taxonomy can be changed in one place without re-annotating anything. Details in docs/TASSONOMIA_TAG.md . Tag Meaning Example Source FULLNAME Person name (incl. legal roles: judge, lawyer, parties, witness) Mario Rossi real+synth AGE Age 45 anni real GENDER Sex / gender Femmina real DATE Calendar date 12/06/1985 real+synth TIME Time of day ore 15:30 real STREET Street / square Via Garibaldi real+synth BUILDINGNUM Street number 24 real+synth ZIPCODE Postal code (CAP) 00185 real+synth CITY City Milano real+synth PROVINCE Province abbreviation MI synth EMAIL E-mail (incl. PEC) m.rossi@studio.it real+synth TELEPHONENUM Phone number +39 333 1234567 real+synth CF Codice fiscale (personal tax code) RSSMRA85H12F205Y synth PIVA Partita IVA (VAT number) 12345678903 real+synth ID_DOC ID / passport / licence / social number CA12345AB real+synth IBAN IBAN / bank account IT60X05428… synth CREDITCARDNUMBER Credit-card number 4111 1111 1111 1111 real AMOUNT Money amount € 12.500,00 synth TARGA Vehicle plate AB 123 CD synth ORG Private company / firm / bank Edilnord S.r.l. synth DOCID Act identifier (RG, protocol, repertory, ruling) 1234/2024 synth CATASTO Cadastral data (sheet, parcel, sub.) Foglio 12, part. 345 synth Two design decisions stand out. First, legal roles collapse into FULLNAME — whether "Mario Rossi" is the judge, the lawyer or a witness is not a property of the string; the role, if needed, is recovered downstream as metadata. Second, raw types that mean the same thing are merged : names + surnames → FULLNAME ; PEC → EMAIL ; TAXNUM → PIVA ; ID card / passport / licence / social number → ID_DOC ; account number → IBAN . Honorifics ( Dott. , Avv. ) and the name of the court itself are dropped to O because they are not identifiers to mask.